Decrypt Encrypted Files for Content Filtering
Encrypted files must be decrypted to check their content when transferred through gateways.
Plain language
When files are encrypted, they're scrambled so nobody can read them easily. This control means we need to unscramble, or decrypt, these files to check their contents when they cross our network borders. If we skip this, dangerous files could slip through, causing harm or security breaches.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks.
Why it matters
Without decrypting files, harmful content could infiltrate or leave the network undetected, leading to breaches or loss of sensitive information.
Operational notes
Regularly verify encryption software is updated and effective in decrypting files to ensure continuous protection against potentially harmful content.
Implementation tips
- IT team should set up decryption processes at gateways. Use software that automatically decrypts incoming and outgoing files so they can be checked for harmful content.
- Security managers must ensure content filtering tools support decryption. They should review and choose tools that can handle encrypted files, allowing for effective screening.
- System administrators need to align decryption settings with organisation policies. Regularly update configurations to ensure they meet current security standards and any guideline changes.
- Data protection officers should oversee policy compliance. They must regularly audit processes to ensure guidelines for decryption and content checking are followed.
- IT support staff should be trained in handling decrypted files. Provide clear guidelines to manage and store decrypted data securely, minimizing risk of data leaks.
Audit / evidence tips
- Askthe decryption software configuration document. Look if it specifies that all files passing through the gateway are decrypted for checksGoodis a recent document showing the configured processes
- Request logs of recent file transfers through gateways. Look to see logs include entries showing decryption and subsequent content filtering. Good evidence includes detailed logs with timestamps and actions.
- Look atclear instructions on decryption procedures for content filtering. Good policy details processes and roles in place
- Asktraining records of staff handling decrypted filesLook atevidence of comprehensive training sessions on managing decrypted content securely. Good records show participation and understanding
- Request audit reports on decryption and filtering processes. Look if they detail compliance with established controls. Good audits indicate proper implementation and identify areas for improvement.
Cross-framework mappings
How ISM-1293 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| Annex A 8.12 | ISM-1293 requires encrypted files passing through gateways or CDSs to be decrypted so they can undergo content filtering checks | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.