ASD ISM 1240 Ensure input validation and sanitisation for internet data
What it says
Validation and sanitisation are performed on all input received over the internet by software.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll internet-received inputs for software must be validated and cleaned to prevent security issues.
This control is about making sure that any information your software receives from the internet is checked and cleaned up before it's used. It's crucial because if untrusted data is allowed into your system, it could lead to security breaches, where someone could steal information or damage your system.
Free. Save your status, tasks and notes.
Why it matters
Unchecked internet input can enable injection attacks (e.g. SQLi/XSS), causing data breaches, fraud, or service disruption.
How to implement
The IT team should implement input validation by setting up rules in the software to check that all internet data fits expected patterns before it's used.
This can be done by using built-in features of programming languages or security libraries to ensure data is safe.
Software developers should sanitise input data by removing or altering any potentially harmful parts.
They can achieve this through programming methods that strip out harmful characters or commands that could cause damage if entered into the system.
The security manager should regularly train staff involved in software development on safe data handling practices.
This includes how to identify insecure input sources and what best practices to follow to mitigate risks.
Team leaders should integrate input validation and sanitisation checks into the development lifecycle.
This involves making these steps part of the software testing phase, ensuring every new piece of code runs through these checks before it goes live.
The IT security team should continuously monitor input validation and sanitisation processes.
They can use automated tools to scan applications for vulnerabilities and report issues for quick resolution, maintaining strong security over time.
Keep it running
Validate and sanitise all internet input server-side using allow-lists, encoding and safe parsers; add tests and monitor logs for suspicious payloads.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation of the input validation processes: Request the specific guidelines or policies developers follow for input validation.
Look at
Whether these policies are comprehensive and address all potential data sources.
Good evidence
Shows detailed policies outlining specific validation methods used for different types of inputs.
- Check 2 of 5What an auditor asks for
Look at
Examples where potentially malicious input was neutralised.
Good evidence
Provides clear before-and-after data showing how input was cleaned.
- Check 3 of 5What an auditor asks for
Ask for
Training logs: Request records showing staff training sessions on input validation and sanitisation.
Look at
The frequency and content of these sessions.
Good evidence
Includes recent, detailed records showing regular training and updates aligned with current threats.
- Check 4 of 5What an auditor asks for
Ask for
Documentation showing that input validation and sanitisation checks are part of the software testing process.
Look at
Whether these checks are applied consistently across all software updates.
Good evidence
Includes test results verifying that all tested software versions passed input handling checks.
- Check 5 of 5What an auditor asks for
Ask for
Monitoring reports: Request reports from any tools used to monitor input validation and sanitisation efforts.
Look at
The coverage and issues identified.
Good evidence
Includes recent reports showing active monitoring and instances where issues were detected and resolved.
Mappings
Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.25.
ISM-1240 requires validation and sanitisation of all input received over the internet by software to prevent exploitation via untrusted data. Annex A 8.25 requires an organisation to establish and apply secure development lifecycle rules, within which input validation is a common secure coding requirement. ISM-1240 is a specific technical control expectation, while Annex A 8.25 is broader and covers the full lifecycle beyond input handling.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.