ASD Essentials IT.PRO-09.1 Inspect Outbound Content on Egress Paths to Detect Unauthorised Data Transfers
What it says
Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks what leaves the organisation, by email, web upload or other routes, to spot sensitive or high-value data sent without approval.
Data leaves the organisation every day by email, web upload, file transfer, cloud storage and partner links. Most of it is fine. The organisation checks what goes out for its most sensitive and valuable data. To meet this, every route out from the systems in scope is checked. Rules spot classified, regulated and high-value data, such as personal data, source code or password files. Alerts are looked at and acted on within set times.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems
- User devices (does not apply)
Why it matters
Attackers often sneak stolen data out over channels they control or disguised as normal traffic. Staff can also send files to the wrong place by mistake. Without inspection, the loss can go unnoticed until it is too late to stop.
How to implement
The head of security and data owners should list each classified, regulated and high-value data type, such as private keys or Privacy Act personal information.
Record each type's owner, how to recognise it, and its approved channels and recipients.
Network and security architects should list every route out in a register, including web, email, cloud, name lookups (DNS) and partner links.
Send each through an inspection point, or record an owner and a risk decision for it.
Security engineers should turn on outbound inspection at each point, such as web filters, email gateways and cloud services.
Decrypt traffic for checking where policy allows, and alert on content that cannot be inspected, such as password-protected zip files.
Security engineers and data owners should write a rule per data type, using classification labels, card and ID number patterns or matches to known documents.
Test each rule by sending made-up sample data over every route.
Security operations should check every alert and respond within set risk-based timeframes.
Escalate suspected unauthorised transfers to incident response, tell the data owner and assess reporting duties, such as the Notifiable Data Breaches scheme.
Keep it running
Security operations runs inspection as an ongoing service. Add new cloud services and partner links to the outbound route register before go-live. Watch for inspection points that are down or bypassed, or let traffic through unchecked when they fail. A silent failure looks like a quiet day. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems. Tune rules as data changes, without narrowing detection.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of classified, regulated and high-value data types and their owners.
Look at
Whether types such as passwords or intellectual property are missing, or entries lack approved channels.
Good evidence
Every classified, regulated and high-value data type is listed with an owner and approved channels.
- Check 2 of 5What an auditor asks for
Ask for
Request the outbound route register, network diagrams and outbound firewall rules for each ASD domain.
Look at
Whether any route out, such as DNS, partner links or servers' direct internet access, skips inspection.
Good evidence
Inspection covers every applicable route out, and any uninspected route has a recorded risk decision.
- Check 3 of 5What an auditor asks for
Ask for
Ask for each inspection point's settings, including decryption settings and exemption lists.
Look at
Whether encrypted traffic or uninspectable content, such as password-protected zip files, passes without a flag.
Good evidence
Each inspection point inspects or flags all outbound content, including encrypted sessions where policy allows.
- Check 4 of 5What an auditor asks for
Ask for
Request the detection rule export and the latest test results for each route.
Look at
Whether data types lack rules, rules sit off or in test mode, or test transfers raised no alert.
Good evidence
Active rules cover every listed data type, and every test transfer raised an alert.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the alert queue or case records and the set response timeframes.
Look at
Whether alerts sit unchecked, miss their timeframes, or confirmed transfers were not contained or escalated.
Good evidence
Every alert is assessed and handled within its timeframe, with the outcome and reasons recorded.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No outbound content inspection is deployed.
- NE-2Sensitive data can leave the organisation through any egress path without detection or control.
Partially effective(3)
- PE-1Outbound inspection is deployed but does not cover all applicable egress paths.
- PE-2Rules are configured but do not cover all classified, regulated or high-value data types.
- PE-3Alerts are generated but are not triaged or acted upon in a timely manner.
Fully effective(3)
- FE-1Outbound content inspection is deployed covering all applicable egress paths.
- FE-2Rules are configured to detect unauthorised transfer of classified, regulated and high-value data.
- FE-3Alerts are triaged and responded to within accepted risk timeframes defined by the organisation.
Mappings
Closest match in ISO/IEC 27001: A.8.12, Data Leakage Prevention Measures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.12.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data. This is a specific data leakage prevention measure that directly contributes to Annex A 8.12 at the network egress point. Annex A 8.12 is broader, requiring data leakage prevention measures across systems, networks and other devices that process, store or transmit sensitive information, including measures that prevent rather than only detect leakage.
This control partially meets A.8.16.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data. Detecting possible exfiltration in network traffic is a specific form of the monitoring for anomalous behaviour required by Annex A 8.16, and its alerts feed the evaluation of potential information security incidents. Annex A 8.16 is broader, covering monitoring of networks, systems and applications for all kinds of anomalous behaviour.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0659.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-0659 requires files imported or exported via gateways or cross domain solutions to undergo content filtering checks, covering outbound files there.
This control partially overlaps ISM-0963.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-0963 requires web content filtering of potentially harmful web-based content, a related capability aimed at harmful content, not outbound data.
This control partially overlaps ISM-1237.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-1237 requires web content filtering to be applied to outbound web traffic where appropriate, covering the web channel of that inspection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.