ASD ISM 1288 Antivirus scanning of gateway files
What it says
Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles going through gateways are checked with several antivirus programs for safety.
When files enter or leave your network through gateways, they are scanned using multiple antivirus programs to catch harmful software. This matters because without these scans, your organisation could unknowingly spread viruses or malware, leading to data breaches and financial losses.
Free. Save your status, tasks and notes.
Why it matters
Without antivirus scanning of files crossing gateways/CDSs, malware can enter or leave the network, causing breaches and data loss.
How to implement
IT team should ensure that antivirus software is installed on all gateways: Verify that every gateway device, through which files pass, has robust antivirus programs installed.
Choose software that's known for its reliability and ability to work with other security tools.
IT manager should configure multiple antivirus engines: Set up the gateway to use several different antivirus tools, as each might catch different threats.
Refer to guidelines from the Australian Cyber Security Centre (ACSC) or products recommended by the Australian Signals Directorate (ASD) to ensure effectiveness.
System administrators should regularly update antivirus signatures: Keep the antivirus software's threat databases current to detect the latest threats.
Schedule automatic updates or a daily manual check to ensure the antivirus tools are updated promptly.
Office manager should coordinate regular training sessions: Organise training for staff to understand the importance of secure file handling and recognise suspicious file attachments.
Run these sessions quarterly to keep awareness high.
Business owner should review antivirus gateway logs quarterly: Go over the logs with your IT team to understand the kinds of threats being intercepted.
Use this information to inform future security measures and training needs.
Keep it running
Keep multiple AV engines current and enabled on all gateway/CDS transfer paths; monitor scan failures and quarantine or block unscannable files.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The antivirus gateway configuration reports: Request documentation that outlines which antivirus solutions are deployed at the gateways.
Look at
Recognised security products and their version numbers in the report.
Good evidence
Shows multiple approved, up-to-date antivirus engines listed and configured.
- Check 2 of 5What an auditor asks for
Ask for
A log of recent file transfers through the gateways: Review the logs to see if files are consistently scanned.
Look at
Timestamps and results from each antivirus tool used.
Good evidence
Shows logs with regular, automatic scanning by multiple antivirus engines.
- Check 3 of 5What an auditor asks for
Ask for
The antivirus update schedule and logs: Request the schedule for virus signature updates and any logs showing past updates. Check that updates are scheduled frequently and have been completed as planned.
Good evidence
Ensures no missed updates and seamless protection.
- Check 4 of 5What an auditor asks for
Ask for
Antivirus testing results: Request any testing reports or cases that simulate virus detections to check system response.
Look at
Test results that document successful malware interceptions.
Good evidence
Demonstrates the system's reliability to detect and handle real threats.
- Check 5 of 5What an auditor asks for
Ask for
Employee training attendance records: Request records from the latest cyber security training sessions focusing on file security.
Look at
Comprehensive attendance across the organisation.
Good evidence
Shows regular training sessions that most staff have attended.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1288 requires that files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines. This relates to Annex A 8.7, which requires organisations to implement protection against malware as a general control objective. ISM-1288 is a specific technical implementation pattern (multi-engine scanning at boundary transfer points), whereas Annex A 8.7 is broader and also includes non-gateway contexts and user awareness.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.