ASD ISM 0572 Enable opportunistic TLS for email server encryption
What it says
Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure email servers use encryption to protect emails sent over public networks.
This control is all about making sure your emails are encrypted when they travel over the internet. By enabling a feature called Opportunistic TLS on your email servers, you're ensuring that emails aren't easily intercepted or read by others. If this isn't set up, confidential information in emails could be exposed to hackers, leading to data breaches and loss of trust.
Free. Save your status, tasks and notes.
Why it matters
Without opportunistic TLS, emails could be intercepted over public networks, exposing sensitive data and undermining organisational trust.
How to implement
Email administrators need to regularly update the email server software.
Ensure automatic updates are turned on, so security patches are applied as soon as they are available. This helps prevent vulnerabilities that could be exploited to bypass email encryption.
Managers should train staff on the importance of TLS encryption.
They can organise a short briefing session to explain how email encryption protects company data and encourage reporting of any issues with email delivery or security.
Business owners should engage with a cyber security consultant to review their email encryption settings.
Schedule an annual review where the consultant checks the configurations and recommends improvements based on the latest security trends and threats.
Procurement teams should ensure that any new email server solutions are compliant with Australian Cyber Security Centre (ACSC) guidelines.
They need to verify that vendors provide support for Opportunistic TLS and will assist with setup and configuration.
Keep it running
Ensure opportunistic TLS is enabled for inbound/outbound SMTP, use strong TLS settings, valid certificates, and monitor logs for failed TLS handshakes or downgrade attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email server configuration file: Request a copy of the server settings showing TLS is enabled.
Look at
The sections related to encryption and ensure TLS is activated.
Good evidence
Will display settings indicating TLS is applied for both incoming and outgoing emails.
- Check 2 of 5What an auditor asks for
Look at
Clauses that specify the use of TLS.
Good evidence
Includes a policy that mandates encryption for all email communications over public networks.
- Check 3 of 5What an auditor asks for
Ask for
Recent server update logs: Request the log or record showing the email server's software was recently updated.
Look at
Entries verifying new security patches related to encryption.
Good evidence
Highlights consistent updates, focusing on TLS aspects.
- Check 4 of 5What an auditor asks for
Ask for
Documentation on staff training sessions regarding email encryption.
Look at
Attendance records and content details.
Good evidence
Shows regular sessions were held and employees are aware of email security practices.
- Check 5 of 5What an auditor asks for
Ask for
Consultant reports: Request the most recent consultancy review report regarding email server settings. Check the recommendations and evidence of TLS configuration reviews.
Good evidence
Indicates professional evaluations that reaffirm the use of TLS.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0572 requires opportunistic TLS to be enabled on email servers for inbound and outbound connections over public network infrastructure to protect email in transit. Annex A 8.20 requires networks and network devices to be secured and controlled to protect information in systems and applications, which includes configuring secure transport for services such as SMTP. ISM-0572 is a specific technical configuration for one service (email transport), whereas Annex A 8.20 is broader and covers security controls across all network services and devices.
This control partially meets A.8.24.
ISM-0572 requires the use of TLS for SMTP connections to provide encryption for email traffic traversing public networks. Annex A 8.24 requires rules for effective use of cryptography and key management to be defined and implemented, which governs how TLS is selected, configured (e.g. protocol/cipher choices) and how certificates/keys are managed. ISM-0572 is a single applied use-case of cryptography, while Annex A 8.24 covers cryptographic governance and key management across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.