ASD Essentials IT.PRO-09.3 Inspect All Inbound Content Channels and Block Malicious or Unsafe Content
What it says
Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks content coming in from outside or untrusted sources, and stops anything harmful before it is delivered.
Content arrives from outside all the time, such as emails, web downloads, supplier files and uploads to the organisation's online services. The organisation checks it on arrival. Anything harmful, such as malware, booby-trapped documents or risky file types, is blocked or held. To meet this, every way in is checked, both at the internet boundary and where content enters critical services. Detection rules update on a set schedule, and every block is logged.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 1
- Boundary services
- Identity services (does not apply)
- Phase 2
- Critical processes and services
- Privileged environments (does not apply)
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
Without inspection, phishing attachments, malware and attacker tools reach staff and critical systems unchecked. Out-of-date rules or one unchecked channel give attackers the gap they look for. Without logs, nobody sees the delivery attempts already being made.
How to implement
The security architecture team should list every channel bringing in outside or untrusted content, such as email, downloads, file transfers and partner feeds.
Record where each channel is inspected, and close any way around it.
Messaging and network engineers should scan each boundary channel for malware on arrival, decrypting where needed and checking what each file really is.
Strip document macros, block files that are malicious, unneeded or cannot be checked, and hold suspicious ones.
Owners of critical systems should find content that skips boundary checks, such as supplier files, connections from other applications and data feeds.
Inspect it where it enters, using the same block and hold rules.
The team running inspection should set a regular update schedule for detection rules, automate it and alert when an update fails.
Tune the rules using current threat intelligence, such as ASD advisories.
The security operations team should log every blocked and held item with its source, channel and reason, and keep the records available for review.
Look for patterns, such as repeated attempts on one service.
Keep it running
The team running inspection checks that rule updates succeed. It works through the queue of held items, releasing each only after review, and scans the block logs for patterns. Send every new mail domain, upload feature or partner feed through inspection before it goes live. Follow ASD's priority order: internet-facing systems first, then content that reaches critical systems without crossing the boundary.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of inbound content channels and where each one is inspected.
Look at
Whether any channel, such as a second mail domain or an upload feature, skips inspection.
Good evidence
Every channel bringing in outside or untrusted content is inspected before delivery.
- Check 2 of 5What an auditor asks for
Ask for
Ask the team to send harmless test files, including an encrypted archive, through sample channels.
Look at
Whether any test file is delivered intact, or content that cannot be inspected gets through.
Good evidence
Nothing malicious gets through, files that cannot be inspected are blocked, and suspicious ones are held.
- Check 3 of 5What an auditor asks for
Ask for
Ask how content from suppliers, other applications and data feeds is checked before reaching critical services.
Look at
Whether content reaching critical services directly skips the checks used at the boundary.
Good evidence
Content entering critical services by any route is inspected before the service uses it.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the update schedule for detection rules, and recent rule changes driven by threat intelligence.
Look at
Whether any inspection point runs old rules, or vendor defaults that nobody tunes to current threats.
Good evidence
Rules update on the set schedule, and rule changes trace back to current threats.
- Check 5 of 5What an auditor asks for
Ask for
Request records of blocked and held content from each inspection point for a sample period.
Look at
Whether any point keeps no records, or records are overwritten before anyone can review them.
Good evidence
Every blocked item is logged, and the records can be found when needed for review.
ASD indicators of good practice (7)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(1)
- NE-1No inbound content inspection is deployed.
Partially effective(2)
- PE-1Inbound inspection is deployed but does not cover all applicable content channels.
- PE-2Inspection is in place but detection signatures or rules are not maintained or updated.
Fully effective(4)
- FE-1Inbound content inspection covers all applicable content channels.
- FE-2Detection signatures and rules are maintained and updated on a regular cycle defined by the organisation.
- FE-3Blocked content is logged and available for review.
- FE-4Current cyber threat intelligence is considered when implementing controls to prevent the delivery of malicious or unsafe content.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.7.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content. This is a specific preventive malware protection measure applied where content enters the organisation, directly contributing to Annex A 8.7. Annex A 8.7 is broader, covering malware protection across the environment and requiring it to be supported by user awareness.
This control partially overlaps A.8.23.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content. It shares common ground with Annex A 8.23, as inspecting web content reduces exposure to malicious content from external websites. IT.PRO-09.3 covers all inbound channels, such as email and file transfers, while Annex A 8.23 also manages which external websites can be accessed at all.
ASD Information Security Manual: 5 mappings
This control partially overlaps ISM-0651.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-0651 requires files that content filtering finds malicious, or cannot inspect, to be blocked, the enforcement step of that inspection.
This control partially overlaps ISM-0652.
IT.PRO-09.3 requires inspection of inbound content from external or untrusted sources to stop malicious or unsafe content; ISM-0652 covers what happens to suspicious results, requiring flagged files to be quarantined until reviewed and approved or not approved for release.
This control partially overlaps ISM-0659.
IT.PRO-09.3 requires inspection of inbound content from external or untrusted sources to stop malicious or unsafe content; ISM-0659 requires files imported or exported via gateways or cross domain solutions to undergo content filtering checks, covering inbound files there.
This control partially overlaps ISM-0963.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-0963 requires web content filtering of potentially harmful web-based content, applying that inspection to the web.
This control partially overlaps ISM-1234.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-1234 requires email content filtering of potentially harmful content in email bodies and attachments, applying that inspection to email.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.