ASD ISM 1293 Decrypt encrypted files for content filtering
What it says
Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEncrypted files must be decrypted to check their content when transferred through gateways.
When files are encrypted, they're scrambled so nobody can read them easily. This control means we need to unscramble, or decrypt, these files to check their contents when they cross our network borders. If we skip this, dangerous files could slip through, causing harm or security breaches.
Free. Save your status, tasks and notes.
Why it matters
Without decrypting files, harmful content could infiltrate or leave the network undetected, leading to breaches or loss of sensitive information.
How to implement
IT team should set up decryption processes at gateways.
Use software that automatically decrypts incoming and outgoing files so they can be checked for harmful content.
Security managers must ensure content filtering tools support decryption.
They should review and choose tools that can handle encrypted files, allowing for effective screening.
System administrators need to align decryption settings with organisation policies.
Regularly update configurations to ensure they meet current security standards and any guideline changes.
Data protection officers should oversee policy compliance.
They must regularly audit processes to ensure guidelines for decryption and content checking are followed.
IT support staff should be trained in handling decrypted files.
Provide clear guidelines to manage and store decrypted data securely, minimising risk of data leaks.
Keep it running
Regularly verify encryption software is updated and effective in decrypting files to ensure continuous protection against potentially harmful content.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the decryption configuration document for the gateway or CDS content filtering solution.
Look at
Check that it specifies all encrypted files imported or exported via the gateway or CDS are decrypted before content filtering checks are applied.
Good evidence
A recent, current document that shows the configured decryption and filtering processes in place.
- Check 2 of 5What an auditor asks for
Ask for
Request logs of recent file transfers through the gateways or CDSs.
Look at
Confirm the logs include entries showing encrypted files being decrypted and then undergoing content filtering checks.
Good evidence
Detailed logs with timestamps and actions that show decryption followed by content filtering for the transferred files.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the policy document on handling encrypted files at gateways and CDSs.
Look at
Look for clear instructions on decryption procedures so files can undergo content filtering checks.
Good evidence
A policy that details the decryption and filtering processes and the roles responsible for them.
- Check 4 of 5What an auditor asks for
Ask for
Ask for training records of staff who handle decrypted files at gateways or CDSs.
Look at
Look for evidence of training sessions on managing decrypted content securely during content filtering.
Good evidence
Records that show staff participation and demonstrate understanding of the decryption and filtering process.
- Check 5 of 5What an auditor asks for
Ask for
Request audit reports covering the decryption and content filtering processes at gateways and CDSs.
Look at
Check whether they detail compliance with the requirement that encrypted files are decrypted for content filtering checks.
Good evidence
Audits that confirm the control is properly implemented and identify any areas for improvement.
Mappings
Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.8.12.
ISM-1293 requires encrypted files passing through gateways or CDSs to be decrypted so they can undergo content filtering checks. This supports Annex A 8.12 by enabling DLP-style inspection of file contents that would otherwise be obscured by encryption when traversing network boundaries. Annex A 8.12 is broader (covering a range of data leakage prevention measures across systems, networks and devices), while ISM-1293 is a specific gateway/CDS processing requirement focused on enabling inspection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.