ASD ISM 0571 Ensure secure email transmission via gateways
What it says
When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation's centralised email gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmails should be sent through secure and encrypted channels using central gateways.
This control ensures that when you're sending or receiving emails, they're going through a central system that makes sure they're both encrypted and authenticated. It matters because if emails aren't transmitted securely, sensitive information could be exposed to cybercriminals, leading to data breaches and loss of trust.
Free. Save your status, tasks and notes.
Why it matters
Without secure email gateways, intercepted emails expose sensitive data, risking breaches and damaging organisational trust.
How to implement
Email service providers should make sure all outgoing and incoming emails pass through a secured central gateway.
This can be done by setting up your email accounts and settings so all email traffic is automatically routed through this gateway.
IT managers should configure the central email gateways to enforce encryption.
They can do this by enabling Transport Layer Security (TLS) settings which scramble the email data during transmission.
Business owners should ensure their staff are using approved email services only.
They can do this by communicating to employees which email systems are authorised and spot-checking to make sure personal accounts aren't being used.
System administrators should regularly update the gateway software to protect against new vulnerabilities.
This involves checking for updates from the software vendor and applying them as soon as possible.
IT departments should implement and test the gateway's authentication systems regularly.
This means setting up a process where emails are checked for valid sending and receiving parties, and holding periodic security tests to ensure everything works correctly.
Keep it running
Regularly verify central email gateway routing and enforce authenticated, encrypted transport (e.g. TLS) for inbound and outbound mail.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email gateway configuration settings: Obtain documentation showing how email traffic is routed and encrypted.
Look at
The encryption protocols that are enabled.
Good evidence
Includes a specified encryption method like TLS and a clear routing path through the gateway.
- Check 2 of 5What an auditor asks for
Look at
Recent update activities within the last quarter.
Good evidence
Shows consistent updates aligned with vendor recommendations.
- Check 3 of 5What an auditor asks for
Ask for
A sample of email traffic logs from the gateway: Examine how email data is encrypted and authenticated during transmission.
Look at
Examples where encryption protocols are clearly applied.
Good evidence
Shows logs indicating all emails go through the gateway with encryption.
- Check 4 of 5What an auditor asks for
Look at
A record of training sessions conducted in the past year.
Good evidence
Features documented attendance and policy acknowledgment.
- Check 5 of 5What an auditor asks for
Ask for
To see the list of approved email services: Verify the list against used accounts.
Look at
Non-compliance instances.
Good evidence
Confirms only authorised services are in active use.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.14.
ISM-0571 requires emails to be sent and received via an organisation's centralised email gateways using authenticated and encrypted channels. ISO/IEC 27001:2022 Annex A 5.14 requires rules and procedures for information transfer using any transfer facilities, which includes (but is not limited to) email transfer controls like secure gateways and TLS. ISM-0571 is a specific implementation pattern for secure email transfer, whereas Annex A 5.14 covers broader transfer methods, partners, and governance arrangements beyond email.
This control partially meets A.8.24.
ISM-0571 requires emails to traverse authenticated and encrypted channels via centralised email gateways. ISO/IEC 27001:2022 Annex A 8.24 establishes rules for cryptography and key management, which underpins how email transport encryption (e.g. TLS) and any gateway-based encryption features are configured and managed. Annex A 8.24 does not mandate the use of centralised email gateways, but it strengthens ISM-0571 by ensuring encryption is correctly selected, implemented, and governed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.