Skip to content
Gateways
ASD ISMISM-1284

ASD ISM 1284 Ensure content validation for gateway files

What it says

Files imported or exported via gateways or CDSs undergo content validation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Check files coming in and out of gateways to ensure they meet security standards.

This control is about making sure that any files moving in or out through your organisation's computer gateways (like email or file transfer systems) are checked to meet security standards. This is crucial because if harmful files get in, they could cause serious problems, like data breaches, operational failures, or financial loss.

Why it matters

Without content validation at gateways/CDSs, malicious or unauthorised files can enter or leave, causing data breaches, system compromise and financial loss.

How to implement

  1. IT team should set up a file scanning software: Ensure this software is installed on all gateways such as email servers or FTP sites.

    The software should be configured to automatically scan every file entering or leaving the network.

  2. Compliance officer should define security standards: Draft a clear policy on what types of files are considered safe.

    Communicate these standards to all employees and make sure the file scanning tools are updated to reflect these rules.

  3. Security team should conduct regular training: Educate staff on the importance of not sending or opening suspicious files.

    Provide simple guidelines on what to look for and who to contact if they suspect a file is unsafe.

  4. IT manager should enforce policy breaches: Set up alerts for when unsafe files are detected.

    Develop a response plan that includes notifying the relevant staff and rectifying any vulnerabilities immediately.

Keep it running

Maintain gateway/CDS content validation by updating signatures/rules, testing import/export samples, and reviewing validation logs to tune allow/deny policies and catch bypasses.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The file scanning software logs: Request records showing scans from the past three months.

    Look at

    The types of files blocked or flagged and ensure they follow the organisation's security standards.

    Good evidence

    Shows consistent scanning with zero missed threats.

  2. Check 2 of 5What an auditor asks for

    Ask for

    The file transfer policy document: Request the written policy outlining the acceptable file types and sizes for transfer.

    Look at

    Signatures from senior management and last reviewed dates.

    Good evidence

    Shows clear, up-to-date guidelines.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training session records: Request evidence of security training sessions provided to the staff.

    Look at

    Attendance sheets and training content summaries.

    Good evidence

    Is regular, comprehensive training with broad employee participation.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Alert notifications: Request records of alerts triggered by unsafe files.

    Look at

    The response actions taken post-alert.

    Good evidence

    Includes a timely response log and effective remedial action outlined for each incident.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A list of authorised personnel: Request a list of who is allowed to manage and override file scanning protocols.

    Look at

    Recent access records and any noted exceptions.

    Good evidence

    Is limited to only necessary personnel, with logs showing minimal and justified overrides.

Mappings

Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.14Information transfer policies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.