ASD ISM 1024 Verify senders for email failure notifications
What it says
Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly verified senders get notified if their email cannot be delivered.
This control means that when you send an email and it can't be delivered, you'll only get a notification if your identity as the sender can be verified. This is important because it helps to combat email scams and ensures that only genuine users are notified about email issues, preventing harmful activities like spammers from getting useful information about email addresses that work.
Free. Save your status, tasks and notes.
Why it matters
If undeliverable mail notifications go to unverified senders, attackers can confirm valid addresses and refine spam/phishing campaigns, increasing fraud risk.
How to implement
The IT team should configure the email system to check the sender's identity.
This can be done by setting up the Sender Policy Framework (SPF) on the email server to verify the sender's details. They should ensure the server only sends failure notifications to those who pass this check.
The IT manager should work with an email provider that offers sender verification features.
This involves discussing with providers about how they validate sender identities using SPF or similar technologies, and ensuring it's included in their service package.
The system administrator should regularly update the list of approved senders.
This means reviewing and, if necessary, adding or removing email addresses or domains in the system's SPF record to align with current business needs.
The office manager should educate staff on how to recognise when they should or should not receive a delivery failure notice.
This can be done through a training session explaining that only verified senders will receive these notifications, reducing confusion and potential fraud.
HR should include email usage and sender verification policies in the employee handbook.
They should outline procedures on how employees can ensure their emails are recognised as legitimate by the systems in use, using plain language instructions.
Keep it running
Configure NDRs to only notify senders that pass SPF, DKIM/DMARC or other trusted checks; review mail gateway rules and update records regularly.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The email server's SPF configuration report.
Look at
The records to check if the sender verification is applied correctly. Good evidence shows SPF records that match current business domains and restrict unauthorised sending.
Good evidence
Provides clear descriptions of their verification processes, referencing SPF or similar methods.
- Check 2 of 4What an auditor asks for
Ask for
To see the list of allowed senders in the email system.
Look at
Regular updates and alignment with active employees and domains.
Good evidence
List is current, accurately reflects business operations, and excludes inactive or unauthorised accounts.
- Check 3 of 4What an auditor asks for
Look at
Agendas and attendance lists from training sessions. Good documentation shows that employees were educated about receiving failure notifications only when the sender is verified.
- Check 4 of 4What an auditor asks for
Ask for
Copies of the relevant sections in the employee handbook on email use policies.
Look at
Details about sender verification and notification handling.
Good evidence
Handbook clearly instructs staff on these processes, updated to reflect current systems and practices.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-1024 requires notifications of undeliverable emails to be sent only to senders that can be verified via SPF or other trusted means, preventing bounce messages from going to spoofed addresses. This is a specific email handling rule that stops the organisation's mail system misdirecting message content to third parties, which falls within the electronic messaging rules that Annex A 5.14 requires for transfer facilities. Annex A 5.14 covers all information transfer rules and agreements, while ISM-1024 addresses only the handling of non-delivery notifications.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.