Australian Information Security Manual ISM-1862: If using a WAF, disclosing the IP addresses of web servers under an organisation's control

If using a WAF, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for gateways

ISM-0100 Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessm
ISM-0260 All web access, including that by internal servers, is conducted through web proxies.
ISM-0261 The following details are centrally logged for websites accessed via web proxies: - web ad
ISM-0263 TLS traffic communicated through gateways is decrypted and inspected.
ISM-0591 Evaluated peripheral switches are used when sharing peripherals between systems.
ISM-0597 When planning, designing, implementing or introducing additional connectivity to CDSs, ASD
ISM-0610 Users are trained on the secure use of CDSs before access is granted.
ISM-0611 System administrators for gateways are assigned the minimum privileges required to perform

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls