ASD ISM 0264 Develop and maintain an email usage policy
What it says
An email usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and uphold a policy to guide the use of email communications.
An email usage policy acts as a guide for how emails should be used within an organisation. It's important because without clear rules, people might misuse emails in ways that could lead to security risks, like sharing private information accidentally or falling for scams.
Free. Save your status, tasks and notes.
Why it matters
Without a clear email usage policy, unintentional data leaks and phishing attacks can increase, compromising organisational security.
How to implement
The office manager should draft a simple email usage policy: Start by listing acceptable and unacceptable email practices such as avoiding the use of personal email accounts for work purposes, and not clicking on suspicious links.
Ensure the policy is written in plain language that all staff can understand.
HR should organise training sessions for all employees: Explain the policy, why it's important, and give examples of how to spot and handle suspicious emails.
This can be a part of a routine quarterly meeting or a mandatory online module.
The IT team should set up automatic email filters: Configure your email system to flag or block emails with suspicious attachments or links.
This helps prevent harmful emails from reaching employees, complementing the guidance in the usage policy.
Managers should lead by example in email communication: They should follow the policy guidelines and demonstrate appropriate email behaviour, such as using work email for work purposes and respecting confidentiality.
Regularly review and update the policy: The policy should be reviewed annually or after any major email security incident.
This ensures it remains relevant and effective in addressing current email threats.
Keep it running
Regularly review, update, and re-issue the email usage policy, including phishing reporting, attachments, and sensitive data handling.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest email usage policy document: Check if the document is up-to-date and accessible to all employees.
Good evidence
A clear and comprehensive document with a recent revision date.
- Check 2 of 5What an auditor asks for
Ask for
Them about key points in the email usage policy and what actions they would take upon receiving a suspicious email.
Good evidence
Is an employee clearly describing the policy and demonstrating awareness.
- Check 3 of 5What an auditor asks for
Good evidence
Incidents being promptly managed according to policy with learning points shared across the team.
- Check 4 of 5What an auditor asks for
Good evidence
Active engagement from participants and clarity in delivery.
- Check 5 of 5What an auditor asks for
Good evidence
Regular updates with records of changes and justifications.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
Annex A 5.10 requires organisations to document and implement rules for acceptable use and handling of information and assets. ISM-0264 aligns as it mandates an email usage policy, covering acceptable behaviour and handling expectations for a key communication channel. ISM-0264 is narrower (email only), while Annex A 5.10 covers acceptable use and handling across all channels and asset types.
This control partially overlaps A.5.1.
Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed to govern secure behaviour. ISM-0264 overlaps by requiring an email usage policy to be developed, implemented and maintained, which is a direct example of a topic-specific policy covered by Annex A 5.1. ISM-0264 is narrower (email usage only) and does not explicitly include the full policy governance lifecycle elements (acknowledgement, planned reviews, change-triggered reviews) required by Annex A 5.1.
This control partially overlaps A.5.4.
Annex A 5.4 requires managers to ensure personnel apply information security according to established policies and procedures. ISM-0264 mandates developing, implementing and maintaining an email usage policy, which is a topic-specific policy that management would need to require personnel to follow. ISM-0264 is narrower (email-specific), while Annex A 5.4 applies across all information security policies and procedures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.