ASD ISM 1289 Unpack archive files for content filtering at gateways
What it says
Archive files imported or exported via gateways or CDSs are unpacked to undergo content filtering checks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishArchive files moving through gateways or Cross Domain Solutions are unpacked first so their contents can be content-filtered before being allowed through.
When compressed bundles of files (called archive files, such as ZIP files) are sent in or out through your security checkpoints, they must be opened up so the security checks can look inside. The checkpoints here are gateways (the controlled doorway between your network and the outside world) and Cross Domain Solutions, or CDSs (special systems that move data between networks of different sensitivity). If an archive is not unpacked first, harmful files can hide inside it and slip past your filtering unchecked.
Free. Save your status, tasks and notes.
Why it matters
If archives pass through gateways or Cross Domain Solutions without being unpacked, malware or unauthorised data can hide inside them and bypass filtering, leading to infection or data leakage.
How to implement
IT or the gateway administrator configures the gateway and any Cross Domain Solution (CDS) to automatically decompress incoming and outgoing archive files (such as ZIP, RAR, 7z and TAR) before the content filtering rules run on them.
The security team enables recursive unpacking so that archives nested inside other archives are also opened, and sets a sensible depth limit so deeply nested files cannot be used to bypass or overload the filtering.
The gateway administrator sets the filtering policy to block or quarantine any archive that cannot be fully unpacked, such as password-protected or corrupted files, rather than letting it pass through unchecked.
IT configures the system to apply the same content filtering checks (for example malware scanning and file type checks) to every file extracted from an archive, not just to the outer archive itself.
The security team tests the configuration regularly by sending a known test archive (such as one containing the EICAR test file) through the gateway to confirm it is unpacked and the contents are filtered as expected.
Keep it running
Review the unpacking and filtering rules whenever new archive formats appear or the gateway is updated, and re-run a test archive to confirm filtering still applies to extracted contents.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the gateway and Cross Domain Solution (CDS) configuration that handles archive files.
Look at
whether decompression is set to run before content filtering.
Good evidence
shows the unpack step happens first and feeds every extracted file into the filtering rules.
- Check 2 of 5What an auditor asks for
Ask for
how nested archives (an archive inside an archive) are handled.
Look at
the recursive unpacking settings and any depth limit.
Good evidence
shows nested files are opened and filtered, with a limit that prevents abuse.
- Check 3 of 5What an auditor asks for
Ask for
what happens to archives that cannot be unpacked, such as encrypted or password-protected files.
Look at
the policy rule.
Good evidence
shows these are blocked or quarantined, not allowed through.
- Check 4 of 5What an auditor asks for
Ask for
recent filtering logs or quarantine records.
Look at
entries showing archives being unpacked and individual files being scanned or blocked.
Good evidence
shows real examples of extracted files being acted on.
- Check 5 of 5What an auditor asks for
Ask for
evidence of testing.
Look at
results from sending a test archive (for example one with the EICAR test file) through the gateway.
Good evidence
shows the archive was unpacked and the threat inside was detected and stopped.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1289 requires archive files imported or exported via gateways or CDSs to be unpacked so the extracted contents can be content-filtered and inspected. This relates to Annex A 8.7 because unpacking and inspecting compressed containers at the boundary is a concrete malware-prevention measure that helps detect malicious payloads hidden inside archives. Annex A 8.7 is broader in scope, covering organisation-wide malware protection measures (e.g., endpoint protection, email/web filtering, user awareness) beyond gateway/CDS handling of archive formats.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.