ASD ISM 0651 Block malicious or uninspectable files
What it says
Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBlock files flagged as harmful or that cannot be scanned to prevent threats.
This control is about blocking harmful files or those that can't be checked for safety before they can get into your systems. It's important because if dangerous files make it through, they can damage your data, slow down your operations, or even harm your reputation if customer information is compromised.
Free. Save your status, tasks and notes.
Why it matters
If malicious or uninspectable files aren't blocked, malware can bypass scanning (e.g., encrypted archives) and compromise systems and data.
How to implement
IT team should set up content filtering: Use software that automatically checks and blocks files flagged as harmful.
Choose a program that regularly updates its list of threats and automatically stops any file it can't check for safety.
Office manager should create a file policy: Establish rules on what kinds of files can be received or downloaded.
Train staff to recognise suspicious files and remind them to adhere strictly to these rules.
System owner should review and update: Schedule regular checks of the content filtering settings to ensure it's up-to-date.
Make improvements based on current threat trends to ensure harmful files are effectively blocked.
HR should conduct awareness training: Educate employees on recognising and reporting suspicious files.
Use real-life examples to demonstrate the risks of unscanned or malicious files to the team.
Procurement should vet software vendors: When buying software, ensure the vendors provide solutions that meet content filtering needs.
Prioritise those who offer strong support and regular updates to their products.
Keep it running
Configure gateways to deny/quarantine files that fail inspection (encrypted/passworded archives, unknown types) and keep signatures/rules current.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The content filtering configuration report: Request documentation on how incoming files are filtered and blocked.
Look at
Specifics on the types of files that are blocked automatically.
Good evidence
A detailed report showing file types blocked, update frequency, and any exceptions.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request evidence of staff training on recognising malicious files.
Look at
Logs of training sessions with dates and attendance.
Good evidence
Records showing all staff trained and regular updates given.
- Check 3 of 5What an auditor asks for
Ask for
Incident logs: Request logs of blocked files and any incidents arising from bypassed threats.
Look at
Details on the types of files and response actions taken.
Good evidence
Clear log showing frequency and handling of blocked files.
- Check 4 of 5What an auditor asks for
Ask for
Policy documents: Request the organisation's policy on file handling and safety protocols.
Look at
Comprehensive rules about files that can be downloaded or shared.
Good evidence
A policy that explicitly lists allowed file types and staff responsibilities.
- Check 5 of 5What an auditor asks for
Ask for
Vendor contracts: Request contracts or agreements with software vendors providing filtering solutions.
Look at
The terms regarding updates and threat handling capabilities.
Good evidence
Contracts indicating regular updates and strong vendor support.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-0651 requires organisations to block files identified as malicious by content filtering checks, and to block files that cannot be inspected. ISO/IEC 27001:2022 Annex A 8.7 requires malware protection controls to be implemented and supported by user awareness, which can include scanning and blocking malicious content. Annex A 8.7 is broader (covering the full malware protection program), while ISM-0651 is a specific enforcement outcome focused on blocking malicious or uninspectable files at inspection points.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.3Inspect all inbound content channels and block malicious or unsafe contentPartially overlaps
This control partially overlaps IT.PRO-09.3.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-0651 requires files that content filtering finds malicious, or cannot inspect, to be blocked, the enforcement step of that inspection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.