ASD ISM 0565 Email security for protective markings
What it says
Email servers are configured to block, log and report emails with inappropriate protective markings.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmail servers stop and track emails with wrong markings to prevent mistakes.
This control is about making sure that emails are properly marked so that sensitive information isn't sent to the wrong person by mistake. If emails are not marked correctly, it could lead to serious privacy breaches or sensitive information getting into the wrong hands.
Free. Save your status, tasks and notes.
Why it matters
If email servers don't block, log and report incorrect protective markings, sensitive content may be misrouted or disclosed to unauthorised recipients.
How to implement
The IT team should configure the email server to automatically block emails with incorrect markings.
This can be done by setting rules that identify and stop emails that do not match the organisation's marking policies.
Managers should provide training to staff on how to correctly mark emails.
Regular workshops or online modules can help ensure everyone understands the importance of proper email markings.
The system administrator should set up notifications for when an email is blocked due to improper markings.
By configuring the server to send an alert, administrators can quickly address any issues and prevent future occurrences.
Management should establish a procedure for handling incorrectly marked emails.
This includes designating a person who will review and resolve incidents, ensuring accountability and swift correction of errors.
Human Resources should incorporate email marking awareness into new employee orientation.
This can help new staff understand the policies from day one and reduce the risk of mistakes.
Keep it running
Tune transport rules to detect mismatched protective markings; review logs and alerts regularly and investigate reported emails to correct sender behaviour.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email server configuration settings: Request a copy of the rules or policies used by the email system to handle email markings.
Look at
Whether there are clear criteria for blocking or reporting emails with wrong markings.
Good evidence
The settings should show automatic blocking and detailed logs.
- Check 2 of 5What an auditor asks for
Ask for
To see training records for staff on email marking: Request evidence of recent training sessions or modules completed by staff.
Look at
The date and attendance of the sessions.
Good evidence
Documented evidence that a majority of staff have completed marking training in the last year.
- Check 3 of 5What an auditor asks for
Ask for
Records of any email marking violations and how they were addressed.
Look at
Trends and resolution actions taken.
Good evidence
Reports show timely detection and resolution, with steps taken to prevent recurrence.
- Check 4 of 5What an auditor asks for
Ask for
Notifications or alerts that the system generates: Request samples of alerts sent when a marking issue is detected.
Look at
How informative and actionable the alerts are.
Good evidence
Alerts clearly notify the relevant staff with steps for resolution.
- Check 5 of 5What an auditor asks for
Ask for
Copies of training content provided to new employees.
Look at
Comprehensiveness and clarity.
Good evidence
Training materials include detailed guidance on email marking policies and importance.
Mappings
Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.12.
ISM-0565 requires email servers to prevent and track mislabelled emails by blocking, logging and reporting inappropriate protective markings. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems and networks, which commonly includes email DLP rules that enforce classification/marking policies and alert on violations. ISM-0565 is narrower because it focuses specifically on protective marking correctness in email, whereas Annex A 8.12 covers a wider set of exfiltration vectors and sensitive-data controls.
This control partially meets A.8.15.
ISM-0565 requires email servers to block, log and report emails that have inappropriate protective markings. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, protect and analyse logs of relevant activities and events, which includes security-relevant email gateway events such as marking violations. ISM-0565 is a specific, email-and-classification-focused logging and enforcement use case within the broader logging control of Annex A 8.15.
This control depends on A.5.12.
ISM-0565 requires email servers to block, log and report emails with inappropriate protective markings. ISO/IEC 27001:2022 Annex A 5.12 establishes the organisation's information classification policy and practices that define what markings exist and how they must be applied. ISM-0565 depends on Annex A 5.12-style classification rules being defined so the email server can reliably determine what constitutes an 'inappropriate' protective marking.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.