ASD ISM 0659 Filtering content of gateway and CDS files
What it says
Files imported or exported via gateways or CDSs undergo content filtering checks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles passing through gateways or security systems are checked for unwanted or harmful content.
When files go in and out of your organisation through online systems, they need to be checked for harmful or unwanted content. This is important because if harmful files slip through, they can introduce viruses, steal information, or cause other serious damage, much like letting germs into a clean environment.
Free. Save your status, tasks and notes.
Why it matters
Without gateway/CDS content filtering, imported or exported files may carry malware or hidden data, leading to compromise, leakage, or disruption.
How to implement
IT team should establish a procedure to filter files: Define the types of harmful content (like viruses or inappropriate material) that need to be blocked.
Use software that automatically checks files against this list before they enter or leave your organisation.
The IT manager should set up and test the content filtering system: Choose software or a service that scans files and stops harmful content.
Make sure it's tested by trying to filter a file with known threats and see if it stops them effectively.
Office manager should train staff on file handling: Explain to employees why files need filtering and how to follow correct file saving and transferring procedures.
Guide them on what to do if they suspect a file is harmful.
Procurement should ensure vendors provide secure file transfers: When selecting cloud or software services, require them to have built-in file filtering systems and obtain a summary of how they protect file integrity.
HR and IT should create a reporting policy for suspicious files: Establish an easy way for staff to report any file they think might be unsafe.
Encourage them to use this system and provide feedback on how it works.
Keep it running
Apply gateway/CDS file-type allowlists and AV/sandbox scanning; tune filters for macros/archives, and investigate blocks/alerts in transfer logs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Content filtering policy: Request the document that explains the standards and procedures for filtering files at gateways.
Look at
Detailed rules on what constitutes harmful content and how it is handled.
Good evidence
Will have a comprehensive policy updated within the last year.
- Check 2 of 5What an auditor asks for
Ask for
Logs from the filtering system: Request records showing how files have been processed and any harmful content detected or stopped.
Look at
The logs to ensure they are recent and consistent.
Good evidence
Will show regular activity and a log of incidents and their resolutions.
- Check 3 of 5What an auditor asks for
Ask for
To see the training materials on content filtering: Request documentation or slides showing staff training sessions.
Look at
Content relevant to file safety and correct handling procedures.
Good evidence
Includes recent dates of training and regular updates based on new threats.
- Check 4 of 5What an auditor asks for
Ask for
Reports on the effectiveness of file filtering software: Request recent evaluations or audits of the filtering system's performance.
Look at
Metrics or incidents showing it effectively blocks threats.
Good evidence
Provides evidence of regular testing and adjustment based on feedback.
- Check 5 of 5What an auditor asks for
Ask for
A list of vendors' security credentials: Request verification documents from service providers on their content filtering practices.
Look at
Certification or compliance with Australian standards like the Essential Eight, recognised by the Australian Cyber Security Centre.
Good evidence
Show recognised and recent certifications.
Mappings
Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.12.
ISM-0659 requires content filtering of files traversing gateways or CDSs to prevent harmful or unauthorised content being imported/exported. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention (DLP) measures across systems and networks that process, store or transmit sensitive information, including inspecting content in transit. They overlap where gateway/CDS content inspection includes DLP-style checks (e.g. sensitive markers/classification) as part of filtering, but Annex A 8.12 is broader across many channels and focuses on preventing data exfiltration, whereas ISM-0659 is specifically about sanitising/validating transferred files for harmful/unwanted content in either direction.
This control partially overlaps A.8.23.
ISM-0659 requires that files imported or exported via gateways or cross domain solutions (CDSs) undergo content filtering checks to detect unwanted or harmful content. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, commonly using web filtering and content inspection technologies at network boundaries. They overlap where gateway security stacks apply URL/content inspection and malware filtering to content entering the organisation, but Annex A 8.23 is focused on web browsing destinations while ISM-0659 is specifically about file transfer through gateways/CDSs (including non-web transfer paths).
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-09.1Inspect outbound content on egress paths to detect unauthorised data transfersPartially overlaps
This control partially overlaps IT.PRO-09.1.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data; ISM-0659 requires files imported or exported via gateways or cross domain solutions to undergo content filtering checks, covering outbound files there.
- IT.PRO-09.3Inspect all inbound content channels and block malicious or unsafe contentPartially overlaps
This control partially overlaps IT.PRO-09.3.
IT.PRO-09.3 requires inspection of inbound content from external or untrusted sources to stop malicious or unsafe content; ISM-0659 requires files imported or exported via gateways or cross domain solutions to undergo content filtering checks, covering inbound files there.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.