ASD ISM 1234 Protect email systems with content filtering
What it says
Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks emails for harmful content to keep systems safe.
Email content filtering means setting up systems to check incoming and outgoing emails for harmful content, like viruses or phishing attempts, before they can cause damage. This is important because without it, dangerous content could reach your employees and compromise business data, leading to financial and reputational harm.
Free. Save your status, tasks and notes.
Why it matters
Without email content filtering, malicious links and attachments can reach users, leading to malware infection, data loss and business disruption.
How to implement
The IT team should set up email filtering software on the email server.
This involves installing and configuring software to automatically scan incoming and outgoing emails for viruses and phishing attempts. Follow the vendor's setup guide to implement the recommended security settings.
Managers should ensure employees are aware of email filtering.
Conduct regular training sessions to explain how email filtering helps protect them and why it might occasionally block legitimate emails. Encourage employees to report suspicious messages that might have slipped through.
System administrators need to establish rules for the email filter.
Define what types of content should be flagged or blocked, such as executable files or suspicious links. Work with the IT security officer to regularly update these rules based on new threats.
The IT security officer should monitor the email filtering logs weekly.
Review the logs to identify any patterns or repeated attempts of attacks. If certain email addresses or types of content are frequently flagged, consider adjusting the filtering rules or alerting the company.
HR should coordinate with IT to handle quarantined emails.
Establish a process for safely reviewing and releasing legitimate emails that have been mistakenly flagged. Ensure this process respects privacy and keeps email security in mind.
Keep it running
Regularly update filtering rules to tackle new threats. Analyse quarantine items to tune filters, minimise false positives and detect emerging malicious campaigns.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email filtering configuration document.
Look at
The specific filtering rules and software settings listed.
Good evidence
Includes detailed setups that match current best practices and blocking rules for known malicious content.
- Check 2 of 5What an auditor asks for
Look at
How the importance of email filtering is communicated and what instructions are provided. Good materials include clear explanations of the risks of phishing and how to report suspicious emails.
- Check 3 of 5What an auditor asks for
Look at
Patterns in the logs that indicate the system is identifying and stopping threats effectively.
Good evidence
Is a report showing consistent filtering activity and a low number of missed threats.
- Check 4 of 5What an auditor asks for
Ask for
Details of the process for handling quarantined emails.
Look at
How legitimate emails are reviewed and who is responsible for this task.
Good evidence
Includes a defined procedure with roles clearly assigned and steps for safely releasing emails.
- Check 5 of 5What an auditor asks for
Ask for
To speak with the IT security officer about regular filter updates.
Look at
Evidence of recent updates to filter rules based on new threat intelligence.
Good evidence
Includes a routine update schedule and recent changes documented in a log.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1234 requires organisations to implement email content filtering to detect and block potentially harmful content in email bodies and attachments. ISO/IEC 27001:2022 Annex A 8.7 requires implementing malware protection measures (with user awareness) to prevent, detect and recover from malware across the environment, which commonly includes email scanning/filtering as a key control. ISM-1234 is a specific, email-focused implementation, while Annex A 8.7 is broader and covers malware protections beyond email and includes an awareness component.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.3Inspect all inbound content channels and block malicious or unsafe contentPartially overlaps
This control partially overlaps IT.PRO-09.3.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content; ISM-1234 requires email content filtering of potentially harmful content in email bodies and attachments, applying that inspection to email.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.