ASD ISM 0669 Security measures for manual data export
What it says
When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck signatures and keywords when exporting data at SECRET or TOP SECRET levels.
When you're moving data manually from computer systems marked as SECRET or TOP SECRET, it's crucial to make sure that the data hasn't been tampered with and doesn't contain anything it shouldn't. This matters because mishandling such sensitive information can lead to severe security breaches, potentially exposing critical secrets that could harm national interests or your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to validate signatures or keywords can lead to data leaks or tampered information, endangering national security and damaging organisational trust.
How to implement
IT team should verify digital signatures: Before exporting any data, the IT team needs to check the digital signatures on documents to confirm authenticity.
Use digital signature verification software to ensure the data hasn't been altered.
System administrator should set up keyword filtering: The system admin should program software to scan for specific keywords before data can be exported.
This can be done by configuring data loss prevention tools to flag and block sensitive terms.
Data handlers must undergo training: All staff involved in data handling should receive training on identifying digital signatures and using keyword-checking tools.
Conduct annual workshops explaining why these processes are vital and how to effectively execute them.
Managers should enforce export protocols: Managers need to ensure there's a clear procedure for data export that includes digital and keyword checks.
Draft a protocol document, outlining steps and assign responsibility for each stage of the process.
Compliance officer should regularly review practices: A compliance officer should regularly review data export processes to ensure adherence to protocols.
Conduct quarterly audits and update processes based on new threats or technological changes.
Keep it running
Before manual exports from SECRET/TOP SECRET, validate digital signatures and run keyword checks across all text, and review/update keyword lists and signature trust stores.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Digital signature verification logs: Request logs showing the digital signatures of files exported.
Look at
Timestamps and verification statuses logged by the system.
Good evidence
Would be logs showing all files with valid signatures and no anomalies.
- Check 2 of 5What an auditor asks for
Ask for
Keyword detection reports: Request records of keyword scanning reports for exported data.
Look at
Flagged instances and corresponding actions taken.
Good evidence
Would include timely intervention in export attempts that included flagged keywords.
- Check 3 of 5What an auditor asks for
Ask for
To see the training schedule and attendance records: Get the training schedule for relevant staff and attendance sheets.
Look at
Who participated and the topics covered.
Good evidence
Result would include an up-to-date training roster with signatures or digital confirmations of attendance.
- Check 4 of 5What an auditor asks for
Ask for
The data export protocol document: Request the official document outlining the export process.
Look at
Specific steps on digital checks and keyword verification described clearly.
Good evidence
Would be a comprehensive document, reviewed and signed by senior management.
- Check 5 of 5What an auditor asks for
Ask for
Audit and review records: Request records of any internal audits or reviews conducted on data export practices.
Look at
Findings, recommendations, and actions completed.
Good evidence
Would show regular reviews, action taken on past recommendations, and an improved compliance track record.
Mappings
Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.12.
Annex A 8.12 requires organisations to apply DLP measures across systems, networks, and devices processing sensitive information. ISM-0669 relates by prescribing specific DLP checks during manual export from SECRET and TOP SECRET systems, like validating digital signatures and keyword checks. ISM-0669 is focused on a high-side manual export scenario, while Annex A 8.12 includes other channels (e.g., email, endpoints) and non-manual leakage paths.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.