Skip to content
Email
ASD ISMISM-1089

ASD ISM 1089 Block downgrading protective markings on email replies and forwards

What it says

When replying to or forwarding emails, protective marking tools do not allow the selection of protective markings lower than previously used.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Email marking tools must stop users from choosing a lower protective marking than the one already on a message when they reply to it or forward it.

Every email in a government or security-conscious organisation carries a protective marking (such as OFFICIAL, OFFICIAL: Sensitive or PROTECTED) that tells systems and people how it must be handled. The content of an email thread does not become less sensitive just because someone hits Reply or Forward, and in most cases the original message is quoted underneath the new text. This control requires that the protective marking tool (the add-in or client feature that applies markings) refuses to let a user pick a marking lower than the one previously used on that email when replying or forwarding. If the incoming message was PROTECTED, the reply cannot be sent as OFFICIAL. Why it matters: a downgraded marking can let a sensitive thread pass through email gateways, be delivered to recipients or systems not approved for that classification, or be stored and handled at a lower level than it should be. People downgrade markings by accident (picking the default), by convenience (to get past a gateway block), or by not noticing what is buried in the quoted thread. Enforcing the floor in the tool removes that decision from the user and closes a common route for spills.

Why it matters

If users can downgrade markings on replies and forwards, sensitive content quoted lower in the thread can leave the organisation or reach unapproved recipients and systems, causing data spills, breaches of classification handling rules and loss of trust with partners who rely on markings to control what they receive.

How to implement

  1. The email security or messaging administrator configures the protective marking tool (client add-in or server-side marking policy) so that on Reply, Reply All and Forward it reads the existing marking and sets it as the minimum selectable marking.

  2. The security team defines the marking hierarchy in the tool's policy configuration so that the tool correctly ranks each marking and caveat combination and knows which options count as lower.

  3. The messaging administrator configures the tool to disable or hide markings below the floor in the picker, and to block send with a plain-language warning if a lower marking is detected on a reply or forward.

  4. The IT deployment team pushes the marking tool and its policy to every managed email client (desktop, web and mobile where supported) through the standard software deployment channel so the behaviour is consistent across all platforms.

  5. The security team adds reply and forward downgrade scenarios to the change and release test plan for the email client and marking tool so that each update is verified before rollout.

Keep it running

In day-to-day use the marking tool reads the protective marking on the message being replied to or forwarded and treats it as the minimum for the new message. The marking picker either hides or greys out anything lower, or blocks send with a clear message if a lower marking is somehow chosen. Users can still raise the marking if new content is more sensitive.

Administrators need to keep the marking hierarchy in the tool aligned with the organisation's classification scheme so that "lower" is evaluated correctly, including any caveats or handling instructions the scheme treats as more restrictive. Any change to the marking tool, its policy files or the email client should be regression tested against reply and forward scenarios, because upgrades and reinstalls are where this behaviour silently breaks. Where a thread genuinely warrants a lower marking, that is a separate reclassification decision made under the organisation's own rules; it is not something the reply or forward action itself allows.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the protective marking tool's policy or configuration export.

    Look at

    Look for the setting that enforces a minimum marking on reply and forward, and check the marking hierarchy it uses matches the organisation's classification scheme.

    Good evidence

    The setting is enabled for Reply, Reply All and Forward, and the hierarchy correctly ranks all markings and caveats in use.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for a live or recorded demonstration of replying to and forwarding a marked email.

    Look at

    Watch whether the marking picker offers any option lower than the original marking, and what happens if the user tries to send with a lower marking.

    Good evidence

    Lower markings are unavailable or the send is blocked with a clear message, while equal or higher markings can still be chosen.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the list of email clients and platforms in use and the deployment status of the marking tool on each.

    Look at

    Check whether the downgrade block applies on desktop, web and mobile clients, not only the primary desktop client.

    Good evidence

    The tool and its policy are deployed to all supported clients, with any unsupported platforms documented and mitigated.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for test records from the most recent email client or marking tool update.

    Look at

    Look for test cases covering reply and forward downgrade attempts and their results.

    Good evidence

    Test cases exist, were executed after the change, and show the downgrade block still works.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the user guidance or help desk knowledge article covering marking selection on replies and forwards, and any related support tickets.

    Look at

    Check that the guidance tells users the marking cannot be lowered on a reply or forward and how to raise it if needed, and whether any tickets show the floor being disabled or worked around for convenience.

    Good evidence

    Guidance matches the tool's behaviour and no records show the reply or forward floor being switched off or bypassed.

Mappings

Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.5.12Information classification policy and practicesPartially meets
  • A.5.13Labelling of informationPartially meets
  • A.8.12Data leakage prevention measuresSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.