ASD ISM 0271 Prevent automatic email marking by protective tools
What it says
Protective marking tools do not automatically insert protective markings into emails.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishProtective tools for emails don't automatically add security labels to your messages.
This control is about making sure that email security tools don't automatically add labels to your emails like 'Confidential' or 'Sensitive'. If such labels are added without your knowledge, it could lead to either sensitive information being shared too broadly or normal emails being overly restricted, which can cause confusion and harm communication.
Free. Save your status, tasks and notes.
Why it matters
If tools auto-insert protective markings, emails may be over- or under-marked, causing oversharing of sensitive data or unnecessary access restrictions.
How to implement
Managers should ensure that staff understand when and how to manually apply protective labels to emails.
Provide clear guidelines during training sessions using simple examples of when certain labels should be used.
The IT team should configure email tools to prevent automatic insertion of labels.
Check the settings in your email management system and disable any features that automatically add protections unless specifically set up to do so.
The HR department should include policies in the staff handbook about manually labelling sensitive emails.
Make sure the handbook is accessible online and staff are aware of how they can find it.
The Compliance Officer should review current email practices to ensure no automated labelling occurs.
Conduct regular checks of sent emails and adjust processes if automatic labelling is detected.
Trainers should run refresher courses on email security every six months.
Use these sessions to remind staff how to classify emails properly without relying on automated tools.
Keep it running
Audit email clients/add-ins to confirm no auto protective marking is applied. Disable auto-labelling features and train staff to manually select the correct marking.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training materials provided to staff on email labelling.
Look at
The examples used and the clarity of instructions regarding manual labelling.
Good evidence
Includes examples across different types of data and straightforward steps for staff to follow.
- Check 2 of 5What an auditor asks for
Good evidence
Shows that all automation features are disabled unless needed for specific, justified use cases.
- Check 3 of 5What an auditor asks for
Ask for
How they decide which labels to use and if they know how to disable automatic markings.
Good evidence
Consists of staff being able to clearly explain the procedure and confirm awareness of the policy.
- Check 4 of 5What an auditor asks for
Good evidence
Scenario shows the user applying the correct label after considering the content and audience.
- Check 5 of 5What an auditor asks for
Good evidence
Will show documented instances, recommendations, and actions taken to prevent recurrence.
Mappings
Closest match in ISO/IEC 27001: A.5.13, Labelling of information, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.13.
ISM-0271 requires that protective marking tools do not automatically insert protective markings into emails, controlling how labels are applied in an email context. Annex A 5.13 requires procedures for information labelling in accordance with the organisation's classification scheme, including rules for when and how labels are applied. They overlap because both address the application of labels/markings, but ISM-0271 is a specific constraint on automated labelling in email tools whereas Annex A 5.13 is broader and covers labelling procedures across information types and systems.
This control depends on A.5.12.
ISM-0271 requires that protective marking tools do not automatically insert protective markings into emails, preventing unintended or incorrect classification being applied without user intent. Annex A 5.12 establishes the broader organisational requirement to classify information according to business and security needs, which is typically operationalised through user-selected classifications in tools like email clients. ISM-0271 supports Annex A 5.12 by enforcing that classification is a deliberate act aligned to the classification policy, rather than an automated, potentially inaccurate tool behaviour.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.