ASD ISM 0270 Apply protective markings to emails based on sensitivity
What it says
Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmails must be marked to show their highest confidentiality level based on content.
This control means that any email you send needs to have a label or marking telling how sensitive the information is. It's important because if an email that includes sensitive data is handled carelessly or falls into the wrong hands, it could lead to data theft, legal issues, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If emails aren't marked to the highest sensitivity of subject, body or attachments, staff may mishandle them, leading to unauthorised disclosure, reportable breaches and legal or reputational harm.
How to implement
Managers should create a simple guide to determine sensitivity levels for emails.
This guide can list different types of information (like financial data, personal details, or public news) and what marking each type should get. The guide should be clear and easy for all staff to use.
IT teams should configure email systems to allow for protective markings.
This can involve setting up automatic prompts for users to select a sensitivity level when they send an email. These systems should have clear options, like 'Confidential', 'Internal Use Only', and 'Public'.
Office managers should organise a training session for all staff on how to apply protective markings.
In this session, demonstrate the marking process step-by-step and provide examples of common email contents and their appropriate markings.
IT staff should regularly check that the email marking system works correctly and that users comply with it.
This includes ensuring that emails are not sent without a required marking and that the marking options are still clearly visible and functioning.
HR should include the proper marking of emails as part of the staff's performance reviews.
By adding this to regular appraisals, you encourage consistent compliance and enhance protection of sensitive information.
Keep it running
Configure email tools to apply protective markings by default, validate markings match the highest sensitivity in the subject/body/attachments, and routinely review samples and train users on correct marking.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The guideline document on email sensitivity levels.
Look at
Examples of different types of data and their corresponding protective markings.
Good evidence
Guideline will have clear, easy-to-read instructions and examples.
- Check 2 of 5What an auditor asks for
Good evidence
Feature will require a marking to be applied before the email can be sent.
- Check 3 of 5What an auditor asks for
Good evidence
Record shows most, if not all, relevant staff have completed training with notes that the content was relevant and understood.
- Check 4 of 5What an auditor asks for
Ask for
Them about how they decide on a sensitivity level for emails.
Good evidence
Will include reference to the organisational guidelines and examples from their experience.
- Check 5 of 5What an auditor asks for
Look at
A sample of recent sent emails for markings: Verify that emails containing different data types are correctly marked according to guidelines.
Good evidence
Sample will show consistent correct markings corresponding with the stated sensitivity level.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.12.
Annex A 5.12 requires information to be classified based on confidentiality, integrity and availability needs and related requirements. ISM-0270 operationalises classification for a specific channel by requiring emails to carry protective markings reflecting the highest sensitivity/classification of the subject, body and attachments. ISM-0270 is narrower (email marking practice), while Annex A 5.12 covers the enterprise-wide classification scheme and handling expectations across all media and systems.
This control partially meets A.5.13.
ISM-0270 requires protective markings to be applied to emails reflecting the highest sensitivity of the subject, body and attachments. ISO/IEC 27001:2022 Annex A 5.13 requires documented procedures for labelling information in accordance with the organisation's classification scheme, which directly includes applying labels/markings to communications and documents. ISM-0270 is narrower because it specifies the email-specific rule (highest sensitivity drives the marking), while Annex A 5.13 covers labelling procedures for all information assets and formats.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.