ASD ISM 0565Email Security for Protective Markings
Official control statement
Email servers are configured to block, log and report emails with inappropriate protective markings.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Email servers stop and track emails with wrong markings to prevent mistakes.
What this means in practice
This control is about making sure that emails are properly marked so that sensitive information isn't sent to the wrong person by mistake. If emails are not marked correctly, it could lead to serious privacy breaches or sensitive information getting into the wrong hands.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2019
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for emailSection
Email usageTopic
Handling emails with inappropriate, invalid or missing protective markings
Why it matters
If email servers don't block, log and report incorrect protective markings, sensitive content may be misrouted or disclosed to unauthorised recipients.
Operational notes
Tune transport rules to detect mismatched protective markings; review logs and alerts regularly and investigate reported emails to correct sender behaviour.
Implementation tips
- The IT team should configure the email server to automatically block emails with incorrect markings. This can be done by setting rules that identify and stop emails that do not match the organisation's marking policies.
- Managers should provide training to staff on how to correctly mark emails. Regular workshops or online modules can help ensure everyone understands the importance of proper email markings.
- The system administrator should set up notifications for when an email is blocked due to improper markings. By configuring the server to send an alert, administrators can quickly address any issues and prevent future occurrences.
- Management should establish a procedure for handling incorrectly marked emails. This includes designating a person who will review and resolve incidents, ensuring accountability and swift correction of errors.
- Human Resources should incorporate email marking awareness into new employee orientation. This can help new staff understand the policies from day one and reduce the risk of mistakes.
Audit / evidence tips
- AskThe email server configuration settings: Request a copy of the rules or policies used by the email system to handle email markingsLook atWhether there are clear criteria for blocking or reporting emails with wrong markingsGoodThe settings should show automatic blocking and detailed logs
- AskTo see training records for staff on email marking: Request evidence of recent training sessions or modules completed by staffLook atThe date and attendance of the sessionsGoodDocumented evidence that a majority of staff have completed marking training in the last year
- AskRecords of any email marking violations and how they were addressedLook atTrends and resolution actions takenGoodReports show timely detection and resolution, with steps taken to prevent recurrence
- AskNotifications or alerts that the system generates: Request samples of alerts sent when a marking issue is detectedLook atHow informative and actionable the alerts areGoodAlerts clearly notify the relevant staff with steps for resolution
- AskCopies of training content provided to new employeesLook atComprehensiveness and clarityGoodTraining materials include detailed guidance on email marking policies and importance
Cross-framework mappings
How ISM-0565 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.12 | ISM-0565 requires email servers to prevent and track mislabelled emails by blocking, logging and reporting inappropriate protective markings | |
| Annex A 8.15 | ISM-0565 requires email servers to block, log and report emails that have inappropriate protective markings | |
extensionDepends on(1)expand_less | ||
| Annex A 5.12 | ISM-0565 requires email servers to block, log and report emails with inappropriate protective markings | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Email
See all Guidelines for email controls, or browse the full ASD ISM library.