ASD ISM 1286 Ensure content conversion at gateways
What it says
Files imported or exported via gateways or CDSs undergo content conversion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles going through gateways must be converted to ensure security and compatibility.
This control is about making sure that any files coming into or leaving your organisation through internet gateways are converted into a safe and compatible format. It's like checking your mail for suspicious packages-if you don't, bad stuff could get in, which might damage your systems or leak important information.
Free. Save your status, tasks and notes.
Why it matters
Without content conversion at gateways/CDSs, imported or exported files may retain active content or malware, causing compromise or downtime.
How to implement
IT team should set up a system to automatically convert files: They should use software that checks and changes file formats at the gateway before files enter the organisation.
This protects against harmful files sneaking in.
IT manager should train staff on file handling: They should organise regular training sessions to show employees what types of files might be risky and why converting them is important.
Use simple examples like changing suspicious email attachments into safe formats.
System administrators should configure gateway settings: They need to adjust the settings on hardware like firewalls or routers to ensure they always convert files passing through.
This can involve selecting options in device menus to automatically handle certain file types.
Security officer should conduct regular checks: They should regularly review if the conversion system is working properly by running test files through the gateway to see if it catches risks.
This helps ensure the system is always active and effective.
Procurement officer should confirm vendor capabilities: When purchasing new software or services, ensure vendors can provide file conversion capabilities at the gateway level.
It involves having specific contractual agreements or confirmations in writing.
Keep it running
Keep gateway/CDS content conversion profiles current; test new file types and ensure sanitisation removes active content (macros/scripts) before transfer.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The gateway configuration file: Request the current configuration or settings file for the gateway device.
Look at
Whether content conversion is enabled for incoming and outgoing files.
Good evidence
Includes detailed settings indicating active file conversions.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request logs or records of employee training sessions on file handling and conversion.
Look at
Attendance lists and session content summaries.
Good evidence
Is a dated record showing regular training sessions with attendance by relevant staff.
- Check 3 of 5What an auditor asks for
Ask for
Test logs: Request logs or reports of recent test files passed through the gateway.
Look at
Logged attempts of file conversions and their results.
Good evidence
Is a detailed log showing successful file conversions and the absence of harmful file entries.
- Check 4 of 5What an auditor asks for
Ask for
A vendor contract document: Request the document that outlines the file conversion capabilities agreed upon with a vendor.
Look at
Specific mentions of file conversion features or support.
Good evidence
Is a signed contract explicitly stating conversion requirements.
- Check 5 of 5What an auditor asks for
Ask for
Policy documents on file handling: Request the internal policy document that outlines procedures for file handling and conversion at gateways.
Look at
Clear guidelines on which file types are to be converted.
Good evidence
Is a formally approved policy document.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control depends on.
ISO/IEC 27001: 1 mapping
This control depends on A.8.20.
ISM-1286 requires that files imported or exported via gateways or CDSs undergo content conversion to reduce the risk of unsafe or incompatible content crossing security boundaries. Annex A 8.20 requires networks and network devices (including boundary gateways) to be secured, managed and controlled, and content conversion is a concrete gateway control that strengthens that boundary protection. Annex A 8.20 is broader as it covers overall network/device security controls beyond file sanitisation/content transformation, while ISM-1286 is specifically about file handling through gateways/CDSs.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.