Skip to content
Email
ASD ISMISM-0569

ASD ISM 0569 Centralise email routing via gateways

What it says

Emails are routed via centralised email gateways.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Emails are processed through central gateways for improved control and security.

Centralising email routing through gateways means directing all your emails through a specific point where they are checked for security risks before reaching your inbox. This is important because it helps catch harmful emails, like those containing viruses or phishing attempts, before they can cause damage to your business.

Why it matters

Without centralised email gateways, malicious emails can bypass defences, leading to data breaches and compromised business operations.

How to implement

  1. IT team should set up email gateways: They need to choose a trusted email gateway provider and configure the settings to route all incoming and outgoing emails through this gateway.

    This ensures that emails are scanned and filtered for threats before they reach your staff.

  2. Office manager should communicate the change: Inform all employees that their emails will be routed through a central point and explain the benefits like reduced spam and increased security.

    Use an internal memo or a team meeting to ensure everyone understands the change.

  3. IT team should integrate security protocols: Ensure that the gateway is configured to apply security measures such as virus scanning and phishing detection.

    This involves setting rules that automatically quarantine suspicious messages.

  4. System administrator should monitor gateway performance: Regularly check the email flow and logs for any disruptions or breaches.

    Use the gateway's reporting tools to ensure it is effectively filtering threats.

  5. IT team should provide training: Run a training session for staff on recognising email threats and how the gateway works to protect them.

    Use real-world examples of threats that have been caught by the gateway to illustrate its effectiveness.

Keep it running

Ensure all inbound and outbound email is forced through the centralised gateway (e.g., MX and outbound relay), and block direct SMTP routes that bypass filtering.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The email gateway configuration document: Check this document to ensure that all company email accounts are routed through the gateway.

    Look at

    Settings that enable security filtering and monitoring.

    Good evidence

    Has clear documentation showing all email accounts are covered with security parameters appropriately set.

  2. Check 2 of 5What an auditor asks for

    Look at

    Entries that show blocked or flagged emails.

    Good evidence

    Shows consistent threat detection actions over a period.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The incident response report: If a threat was detected, check how it was handled.

    Look at

    Who responded and what actions were taken.

    Good evidence

    Shows a clear, timely response process and resolution for detected threats.

  4. Check 4 of 5What an auditor asks for

    Look at

    Communications sent to staff about the centralised email routing. Verify if the information clearly explains what changes were made and why.

    Good evidence

    Includes emails or memos with dates and distributed channels.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see training attendance records: Check these records to ensure that staff received training about the email gateway and threat recognition.

    Look at

    Comprehensive coverage and engagement notes.

    Good evidence

    Is full attendance and positive feedback from staff.

Mappings

Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.20Network and network devices securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.