ISM-0109 policy ASD Information Security Manual (ISM)

Restrict Sensitive Emails in Distribution Lists

Confirm all members' nationalities before sending sensitive Australian data to email lists.

Preventative ML3 NC OS P ASD Information Security ManualGuidelines for system monitoring access control information transfer information sharing

record_voice_over

Plain language

When sending emails that include sensitive Australian Government information, it's crucial to ensure that everyone on the email list is allowed to see it. This helps prevent confidential data from accidentally reaching those who shouldn't have access, which could lead to security breaches or information leaks.

01 — Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

May 2021

Control Stack last updated

19 Mar 2026

E8 maturity levels

ML3

Guideline

Guidelines for system monitoring

Section

Event logging and monitoring

Topic

Cable Register

Official control statement

A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification - source - destination - location - seal numbers (if applicable).

policy ASD Information Security Manual (ISM) ISM-0109

priority_high

Why it matters

Failing to maintain a detailed cable register can lead to misrouting sensitive data, compromising national security and breaching legal obligations.

settings

Operational notes

Validate each cable entry includes identifier, colour, sensitivity/classification, endpoints, location and seal numbers; reconcile against physical/installed cables after changes.

02 — Implement

build

Implementation tips

The manager should create a list of email distribution groups frequently used for sensitive information. Then, ensure that HR provides details of each member’s nationality in these groups so that only appropriate recipients receive sensitive information.
The IT team should set up a system to verify and document the nationality of email list members. This can include checking IDs or using HR records to ensure recipients meet the criteria for receiving sensitive emails.
HR teams should regularly update the recipient list details, making sure the nationalities are kept current and accurate. This can be done by verifying records with employees during scheduled HR check-ins.
Managers should conduct training sessions for employees responsible for sending emails, emphasising the importance of confirming list member nationalities before sending sensitive information.
System administrators should configure email systems to flag or block sensitive emails from being sent to distribution lists that have not been verified. This could be set up by adjusting email system settings or implementing additional software checks.

03 — Audit

fact_check

Audit / evidence tips

Askthe documented process of how nationalities are verified before sending sensitive emails

Gooda detailed process document with step-by-step instructions and designated roles
Goodis a description of tools and processes, confirming they check nationalities and adjust distribution lists accordingly
Askto see a checklist or report from a recent internal training session on email distribution practices
Goodsystem will flag and prevent emails to unverified distribution lists

04 — Mappings

link

Cross-framework mappings

How ISM-0109 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layers Partially meets (1) expand_less
Annex A 5.14	ISM-0109 requires confirming all members’ nationalities before sending sensitive Australian data to email distribution lists, to prevent ...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.