ASD ISM 1187 Check data for improper markings before export
What it says
When manually exporting data from systems, the data is checked for unsuitable protective markings.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen exporting data manually, ensure it doesn't have improper protective markings.
When you export data from your systems, you need to make sure that it doesn't have any mistakes in the way it's labelled or marked. If the data is wrongly marked as secret or confidential, or not marked when it should be, it could accidentally be shared with the wrong people or not protected as it should be.
Free. Save your status, tasks and notes.
Why it matters
If exported data is not checked for unsuitable protective markings, sensitive information may be mislabelled and disclosed or mishandled.
How to implement
Managers should ensure staff are trained in recognising and applying correct protective markings.
Organise training sessions that explain what different protective markings mean and provide examples of how to apply them correctly.
IT teams should implement a review process for data before it is exported.
Establish a step-by-step checklist that includes verifying that all data is appropriately marked according to its sensitivity level.
Data handlers should perform a visual check of the data labels before export.
Use a simple guide alongside the data to compare what markings should appear and rectify any mismatches immediately.
System owners should utilise software tools that assist in checking data markings.
Identify and install data loss prevention (DLP) software that can scan and identify potentially mislabelled data automatically.
Team leads should create a culture where employees double-check each other's work related to data exports.
Encourage a buddy system where a colleague confirms the accuracy of data markings before export.
Keep it running
Before manual exports, verify each file's protective marking matches its contents; use a checklist and document checks for auditability.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training materials related to protective markings. Check that they cover the correct application of these markings and include practical examples. Good evidence includes comprehensive materials that all relevant staff have access to and records of attendance.
- Check 2 of 5What an auditor asks for
Ask for
A sample export checklist.
Look at
How it ensures data is reviewed, with a focus on checking protective markings.
Good evidence
Checklist is clear, concise, and includes specific steps for verifying data markings.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of data loss prevention (DLP) software being used.
Look at
The software's capabilities to detect incorrectly marked data.
Good evidence
Setup shows logs or reports of issues found and resolved.
- Check 4 of 5What an auditor asks for
Ask for
Documentation of buddy checks or double-checking processes.
Look at
Records or logs that show data was reviewed by a second person before export. Good documentation highlights detailed entries with names and dates of reviews conducted.
- Check 5 of 5What an auditor asks for
Ask for
Records of data exports.
Look at
The included protective markings and the approval process before data is sent out. Good records include clear details on steps taken and signatures of authorised personnel.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.10.
ISM-1187 requires a procedural check during manual export to ensure data does not have unsuitable protective markings. Annex A 5.10 requires documented acceptable use rules and handling procedures for information and assets, which is where an organisation would define how protective markings must be applied/validated and how exports are to be performed. Annex A 5.10 does not mandate the specific 'check before export' step, but it supports ISM-1187 by establishing the governance and handling expectations that make such checks consistent and enforceable.
This control partially overlaps A.8.12.
ISM-1187 requires that when data is manually exported from systems, it is checked to ensure it does not carry unsuitable protective markings before it leaves the system. Annex A 8.12 requires organisations to apply data leakage prevention (DLP) measures to prevent sensitive information being inappropriately transmitted or disclosed, which can include controls around export and exfiltration paths. The overlap is that both aim to prevent inappropriate release of sensitive information during transfer/export, but ISM-1187 is specifically about validating protective markings during manual export, whereas Annex A 8.12 is broader and technology/control-pattern focused (e.g., detection/prevention across systems and networks).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.