ASD ISM 0269 Restrict sensitive emails to verified recipients
What it says
Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSensitive emails must not go to groups unless all recipients' nationalities are confirmed.
This control ensures that emails with sensitive Australian government data are only sent to people whose nationalities we know and trust. It matters because sending such emails to unknown or unverified recipients could lead to information ending up in the wrong hands, risking national security or privacy breaches.
Free. Save your status, tasks and notes.
Why it matters
Sending AEO/AGAO/REL data to distribution lists without confirming every member's nationality can disclose sensitive information to ineligible recipients and breach policy.
How to implement
IT team should set up guidelines for email distribution: Make sure only verified individuals are part of email groups allowed to receive sensitive information.
Use a checklist to update and confirm each recipient's nationality for these groups.
HR should coordinate with IT to maintain employee nationality records: Keep a secure database that records the nationality of all employees.
Ensure this information is up-to-date and accessible only to authorised personnel.
Managers should regularly review the composition of email distribution lists: Conduct quarterly checks to confirm all group members are verified according to company policies.
Work with IT to remove people whose nationality cannot be confirmed.
System administrators should configure email systems to flag or block sensitive emails: Use email settings to alert senders if their message includes sensitive data and is addressed to an unverified email group.
This can prevent accidental misdelivery.
Office manager should train staff on email sensitivity protocols: Organise training sessions to explain the risks of sending sensitive emails to unverified recipients.
Use real-world examples to highlight the importance of following these guidelines.
Keep it running
Regularly audit distribution list membership and maintain evidence of each member's confirmed nationality before allowing AEO/AGAO/REL emails to be sent to the list.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email distribution list policy: Request a document outlining procedures for verifying recipient nationalities.
Look at
Specific guidelines and processes.
Good evidence
Policy will clearly define steps and responsible parties.
- Check 2 of 5What an auditor asks for
Ask for
How they verify and record employee nationality.
Look at
Procedures for collecting, updating, and ensuring accuracy.
Good evidence
Includes a secure, well-maintained database and a regular audit process.
- Check 3 of 5What an auditor asks for
Look at
Documented instances of verification.
Good evidence
Instance shows thorough cross-checking with HR records.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of how the email system alerts staff sending sensitive data to unverified groups. Verify if alerts are functioning and based on current distribution lists.
- Check 5 of 5What an auditor asks for
Ask for
Employees about email training received: During interviews, ask staff about sessions on handling sensitive emails.
Look at
Understanding of the risks and procedures.
Good evidence
Comes from staff who recall key training points and understand compliance.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
Annex A 5.15 requires organisations to define and implement rules controlling access to information based on business and security requirements. ISM-0269 applies that principle to email handling by prohibiting sending AEO/AGAO/REL data to distribution lists unless all recipients' nationalities can be confirmed. ISM-0269 is a specific logical access/disclosure rule within communications, whereas Annex A 5.15 covers access control policy and procedures across the organisation more generally.
This control partially meets A.5.18.
ISM-0269 requires restricting dissemination of specific sensitive information in email by ensuring only verified-nationality recipients in distribution lists can receive it. Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights to information assets, which can include controlling membership of groups/distribution lists and who is authorised to receive sensitive information. Annex A 5.18 is broader across the access-rights lifecycle for all assets, whereas ISM-0269 is a specific rule for email distribution list use based on nationality confirmation.
This control depends on A.5.12.
ISM-0269 requires enforcing handling rules for specific sensitive classifications by preventing sending to distribution lists unless recipient nationalities are confirmed. Annex A 5.12 establishes how information is classified and what classification practices apply, which is a prerequisite to knowing which emails fall into AEO/AGAO/Releasable To categories. Without Annex A 5.12-style classification rules and labelling/handling practices, implementing ISM-0269 consistently is difficult because the organisation cannot reliably identify in-scope content.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.