ASD ISM 0490 Ensure S/MIME 3.0 or later is used
What it says
Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly use S/MIME version 3.0 or later for secure email communications.
Imagine sending an important letter through the post. You'd want to make sure only the person it's meant for can open it, right? Using the right version of S/MIME (3.0 or later) for your emails is like sealing that letter: it protects the contents so only the intended person can read it. If you use an older version, it's like sending your letter with a faulty lock, and others could read or even change your message.
Free. Save your status, tasks and notes.
Why it matters
Using S/MIME versions earlier than 3.0 can weaken email protection, enabling message interception, downgrade attacks, or tampering.
How to implement
Email administrators should check the current email system settings to ensure S/MIME is enabled and set to version 3.0 or later.
Start by reviewing the email system's encryption settings and confirm the version number in the documentation or system settings.
The IT team should conduct regular training for staff to explain how S/MIME works and why the specific version is important.
This can be done through workshops where they demonstrate how to check if an email is encrypted properly using the right S/MIME version.
Procurement should ensure that when purchasing email software or services, the products support S/MIME 3.0 or later.
This involves checking technical specifications and confirming with vendors that their product meets this requirement.
System owners should collaborate with IT to perform periodic checks on emails sent from the organisation to ensure they are encrypted with the correct version of S/MIME.
This involves using email testing tools or scripts that can check the security features of outgoing emails.
Network administrators should integrate continuous monitoring systems to alert if any email traffic does not conform to the proper S/MIME version.
Set up alerts through existing monitoring tools to flag emails that do not meet the encryption standards.
Keep it running
Configure mail clients/servers to require S/MIME v3.0+ only; disable older S/MIME options and confirm in client/server settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The configuration settings of the email system: Request documentation or screen captures that show the S/MIME setup.
Look at
The version number and options indicating encryption is enforced.
Good evidence
Is the presence of settings showing S/MIME 3.0 or later is the default.
- Check 2 of 5What an auditor asks for
Ask for
Records of email security training sessions: Request the dates and content of any training held to educate staff on S/MIME.
Look at
Attendance lists and materials covered in the session.
Good evidence
Regularly scheduled training with updated content on secure email practices.
- Check 3 of 5What an auditor asks for
Ask for
Purchase records of email software: Request documentation for software purchases related to email systems.
Look at
The specifications indicating support for S/MIME 3.0 or later.
Good evidence
Includes clear vendor confirmation on product capabilities and specifications meeting the control.
- Check 4 of 5What an auditor asks for
Ask for
Logs or reports from email security tests: Request logs showing the results of tests conducted on outgoing emails for S/MIME compliance.
Look at
The details indicating the percentage or types of emails passing the security checks.
Good evidence
Includes consistent reports showing adherence to the S/MIME version requirement.
- Check 5 of 5What an auditor asks for
Ask for
To see alerts from the network monitoring system regarding email encryption: Request a demonstration or printout of alerts related to email traffic's encryption status.
Look at
Data indicating the frequency and type of alerts for non-compliance.
Good evidence
Is a lack of recent alerts, signifying compliance with S/MIME 3.0 or later.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.14.
ISM-0490 requires organisations to prevent the use of S/MIME versions earlier than 3.0 for secure email connections. Annex A 5.14 requires organisations to establish and implement rules and procedures for information transfer, which includes selecting appropriate secure email transfer and protection mechanisms. ISM-0490 is a specific technical standard for one transfer mechanism (S/MIME), whereas Annex A 5.14 is broader and covers all transfer methods and governance arrangements.
This control partially meets A.8.24.
ISM-0490 requires organisations to only use S/MIME version 3.0 or later, preventing weak/obsolete cryptographic message protection in email. Annex A 8.24 requires rules for effective use of cryptography and cryptographic key management, under which approved protocol versions and cryptographic standards for email protection would be defined. ISM-0490 is a concrete protocol-version requirement, while Annex A 8.24 is broader and also covers key management, algorithm choices, and cryptographic governance beyond email.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.