ASD ISM 0570 Maintain backup email gateways to primary standards
What it says
Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAlternative email gateways must be kept to the same standards as the main gateway to ensure consistency.
Having backup email systems up to the same standards as your primary email system is crucial, so they can step in seamlessly if the main system goes down. Without this, you risk having weak spots that cyber threats could exploit, potentially leading to loss of important messages or data breaches.
Free. Save your status, tasks and notes.
Why it matters
If backup email gateways aren't maintained to the same standard as primary, failover may allow mail loss, misrouting or compromise, exposing sensitive data.
How to implement
IT team should regularly review backup email configurations: Compare the security settings of backup email gateways to the primary one.
Make any necessary changes to ensure they align with the latest security updates and protocols.
IT team should conduct regular security audits: Schedule audits every six months to evaluate the performance and security of all email gateways.
Use a checklist to ensure consistency with primary standards.
Training team should educate employees: Develop a training session to remind staff about the procedures if switchover to backup email systems occurs.
Ensure staff understand the importance of both systems being secure.
System owners should collaborate with IT advisors: Meet quarterly to discuss any changes in security requirements or updates in threat landscapes that could affect email gateways.
Adjust standards accordingly.
IT team should document all gateway configurations: Keep detailed documentation of the settings and security features of both primary and backup email systems.
Store them securely and review them for accuracy and up-to-date information.
Keep it running
Regularly test failover and mail flow via the backup gateway; mirror configs, patches, filtering and logging with primary to prevent drift and gaps.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Configuration documents of both primary and backup email gateways: Request the technical specifications and setup files.
Look at
The alignment of security settings between the primary and backup gateways.
Good evidence
Is consistent configurations adhering to current security protocols across both systems.
- Check 2 of 5What an auditor asks for
Ask for
Logs of security audits conducted on all gateways: Request records of recent security checks.
Look at
The audit results and recommendations applied to the backup systems.
Good evidence
Is regular audits resulting in updates or confirmations of security status.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records on email gateway procedures: Request materials or attendance records from recent training sessions.
Look at
The content relevance and frequency of such trainings.
Good evidence
Is comprehensive, regular training that reflects current protocol for using email systems.
- Check 4 of 5What an auditor asks for
Ask for
Incident response records involving email systems: Request documentation of any incident where backup systems were activated.
Look at
The timeliness and effectiveness of the switchover.
Good evidence
Shows smooth transitions with no security compromise or data loss.
- Check 5 of 5What an auditor asks for
Ask for
Meeting notes between IT and security teams: Request records of discussions on email security strategies.
Look at
The alignment in security posture recommendations for all gateways.
Good evidence
Reflects proactive and coordinated security updates.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-0570 requires that any backup or alternative email gateways are maintained to the same security and operational standard as the primary email gateway. Annex A 8.9 requires configurations (including security configurations) across hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which would explicitly include both primary and standby email gateway services. ISM-0570 is a specific parity requirement for one critical service path (email gateways), whereas Annex A 8.9 is an organisation-wide configuration management expectation that would drive that parity through baselines, change control and ongoing review.
This control supports A.5.29.
ISM-0570 requires that backup or alternative email gateways are maintained to the same standard as the primary email gateway to avoid security gaps when switching gateways during outages or maintenance. Annex A 5.29 requires organisations to plan how to maintain information security at an appropriate level during disruption, and maintaining hardened, up-to-date alternate gateways is a specific way to preserve email security controls during a disruption scenario. Annex A 5.29 is broader and planning-focused across all disruption types and services, while ISM-0570 is a targeted operational requirement that supports that planning by addressing a common disruption dependency (email gateway failover).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.