ASD ISM 0657 Scanning data for threats before manual import
What it says
When manually importing data to systems, the data is scanned for malicious and active content.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure data is checked for viruses and threats before being imported into systems.
When you're moving data into your computer systems, it's crucial to check it for any hidden viruses or harmful content first. If you skip this step, you could accidentally let in malicious software that can corrupt your system or steal sensitive information, leading to major disruptions or data breaches.
Free. Save your status, tasks and notes.
Why it matters
Failing to scan data before manual import can introduce malware or active content, causing compromise, breaches, and outages.
How to implement
The IT team should be responsible for setting up a reliable anti-virus software that automatically scans data files before they are imported.
They can choose a reputable software that updates regularly to ensure it detects the latest threats.
Managers should ensure that all staff involved in manual data imports are trained on the importance of scanning files first.
This can be done through regular training sessions and reminder alerts.
Data entry staff should manually run the scan on each batch of data before uploading.
They can use an easy step-by-step guide provided by the IT team to ensure no data is imported without a clean bill of health.
System owners should regularly review the scanning process and update procedures if new types of threats are identified.
They can meet semi-annually with the IT team to discuss any necessary changes based on emerging threats.
Procurement teams should include requirements for data scanning capabilities when selecting new software solutions.
It's important they work with IT to make sure any new tools can integrate with existing scanning solutions.
Keep it running
Before each manual import, scan files/media with current signatures and active-content detection, and block/quarantine any detections.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The records of scanned data logs: Request logs that show recent data imports have been scanned for threats.
Look at
The dates and results of these scans.
Good evidence
Logs show consistent scanning with no missed imports, and all logs are dated with results.
- Check 2 of 5What an auditor asks for
Ask for
The training records of staff responsible for data imports: Request evidence that shows these staff have been trained on data scanning procedures.
Look at
The dates and content of the training sessions.
Good evidence
Up-to-date training records showing completion dates and details of the training content.
- Check 3 of 5What an auditor asks for
Ask for
To see the anti-virus software subscription or licence: Request proof of a valid and active subscription to an anti-virus tool.
Look at
The subscription end date and software version.
Good evidence
A current and valid subscription with the software updated to the latest version.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the scanning process: Request a live demonstration of how data files are scanned before being imported.
Look at
The steps taken during the process.
Good evidence
Clear procedure that includes automatic or manual scanning with an easy-to-understand user interface.
- Check 5 of 5What an auditor asks for
Ask for
Feedback from system owners on the effectiveness of data scanning: Request any reports or assessments discussing the scanning process's effectiveness.
Look at
The conclusions and recommendations.
Good evidence
Positive feedback highlighting effectiveness with any recommendations for improvements noted and actioned.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-0657 requires that data is scanned for malicious and active content before it is manually imported into systems. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware (including supporting processes and user awareness), which commonly includes scanning of files/media prior to introduction into corporate environments. ISM-0657 is a specific preventive use case (manual import) within the broader malware protection control in Annex A 8.7.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.