ASD ISM 0652 Quarantine suspicious files for review
What it says
Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles flagged as risky are held until checked and cleared or blocked.
This control means that if a file looks suspicious, it gets set aside so someone can take a closer look before it's allowed to continue. This matters because it helps prevent harmful files, like viruses or ransomware, from getting into your computer systems and causing damage or stealing your information.
Free. Save your status, tasks and notes.
Why it matters
Without quarantining suspicious files flagged by content filtering, malware (e.g. ransomware) may be released to users, causing outages or data compromise.
How to implement
IT team should set up automatic checks: Use security software to automatically identify and set aside files that seem suspicious based on known signs of risky behaviour.
Adjust settings to match the types of files your company typically uses and encounters.
Managers should establish a review process: Design a clear process for someone knowledgeable, like an IT security specialist, to review these quarantined files regularly.
Ensure that there's a set timeline for these reviews, and document the outcome of each review.
IT team should train staff: Conduct training sessions for employees to recognise the types of files that can be suspicious, and explain what to do if they come across such files.
Use simple examples that are relevant to your organisation's work environment.
System owners should update content filtering criteria: Regularly update the rules that determine what gets flagged as suspicious based on new threats, with input from the Australian Cyber Security Centre (ACSC) guidelines and reports.
Managers should review the process: Every month, review the records of quarantined files and outcomes with the IT team to ensure the process is effective.
Make adjustments as necessary based on any new threats identified.
Keep it running
Route quarantined files to a defined reviewer queue, set SLAs for review, and only release items after approval; track backlog to avoid business delays.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of quarantined files: Request a report that lists all files that were flagged and quarantined in the past month.
Look at
The types of files and the reasons they were marked as suspicious.
Good evidence
Is seeing an accurate and comprehensive list with clear reasons for each file's status.
- Check 2 of 5What an auditor asks for
Ask for
Documentation of the file review process: Request to see the documented process of how quarantined files are reviewed.
Look at
Clear steps and responsible roles.
Good evidence
Shows a detailed process with specific responsibilities assigned and timelines adhered to.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request records of staff training sessions on recognising suspicious files.
Look at
Attendance lists and session content.
Good evidence
Includes dates, participant names, and feedback or assessments from attendees.
- Check 4 of 5What an auditor asks for
Ask for
Policy documents: Request the organisation's content filtering policy.
Look at
How current the policy is and if it aligns with up-to-date ACSC guidelines.
Good evidence
Shows a regularly updated document with clear reference to current practices.
- Check 5 of 5What an auditor asks for
Ask for
Review meeting minutes: Request records from regular review meetings between managers and IT staff regarding the content filtering process.
Look at
Action items and decisions documented.
Good evidence
Includes minutes that detail discussions and any changes made to the process.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.7.
ISM-0652 requires files flagged by content filtering as suspicious to be quarantined until they are reviewed and either approved or not approved for release. Annex A 8.7 requires the organisation to implement protection against malware (supported by user awareness), which commonly includes email/web content filtering, detonation/sandboxing, and quarantine handling of suspected malicious files. ISM-0652 is a specific quarantine-and-review mechanism, whereas Annex A 8.7 is broader and covers the full set of malware prevention, detection, and response measures beyond quarantine.
This control partially overlaps A.8.16.
ISM-0652 requires files identified as suspicious by content filtering to be quarantined pending review and release decision. Annex A 8.16 requires monitoring of networks, systems, and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which can include triggering containment actions such as isolating or quarantining suspicious artefacts. The overlap is in detection-to-action workflows (flagging suspicious content and responding), but Annex A 8.16 focuses on behavioural monitoring and incident evaluation while ISM-0652 focuses specifically on quarantining filtered files until human/automated review completes.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.3Inspect all inbound content channels and block malicious or unsafe contentPartially overlaps
This control partially overlaps IT.PRO-09.3.
IT.PRO-09.3 requires inspection of inbound content from external or untrusted sources to stop malicious or unsafe content; ISM-0652 covers what happens to suspicious results, requiring flagged files to be quarantined until reviewed and approved or not approved for release.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.