ASD ISM 1524 Ensure rigorous testing of content filters
What it says
Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishContent filters need thorough testing to make sure they work properly and can't be bypassed.
This control is about making sure that content filters, which block harmful or unwanted information from entering an organisation's systems, are thoroughly tested. If these filters don't work properly or can be easily bypassed, the organisation is at risk of data breaches, exposure to malware, or inappropriate content reaching employees, which could lead to legal trouble or damage to the organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Poorly tested CDS content filters may be bypassed, enabling unauthorised data transfer or malware ingress and causing breaches.
How to implement
IT team should conduct regular testing: Develop a testing schedule where the IT team systematically tests content filters by using legitimate and malicious content to ensure they are effectively blocking and allowing the right information.
This can be done by simulating attacks in a safe environment to see if the filters catch them.
System administrators should verify filter updates: Regularly check and update the content filtering software to the latest version to ensure it has the newest protections.
This involves reviewing update logs from the software provider and applying updates as soon as they become available.
Procurement should ensure contracts include testing: When acquiring content filters, include requirements in supplier contracts for the provision of testing methodologies and validation results.
This means working with the vendor to get detailed explanations of how the product is tested and proven to work effectively.
Managers should review filter effectiveness reports: Set up regular reviews where managers evaluate reports on content filtering effectiveness generated by the IT team or automated systems.
These reports should include instances of successfully blocked content and any false positives where legitimate content was blocked.
IT security staff should perform bypass testing: Try methods commonly used by hackers to bypass content filters and see if these attempts are detected and blocked.
This can involve using known software flaws or other techniques that malicious users might employ, ensuring that the filters stay robust.
Keep it running
Routinely regression-test CDS content filters using known bypass cases (encoding tricks, polyglots, archives, malformed files) and verify blocks.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The content filter testing schedule: Request the documented schedule that details when and how the content filters are tested.
Look at
The frequency of tests and type of tests conducted.
Good evidence
Includes a clear timeline with diverse test methods conducted regularly.
- Check 2 of 5What an auditor asks for
Ask for
Filter update logs: Request the logs or reports that show updates to the content filtering software.
Look at
Recent entries and version changes that align with the vendor's update schedule.
Good evidence
Is a documented list showing timely updates and patches applied.
- Check 3 of 5What an auditor asks for
Ask for
The contract with the filter provider: Request the procurement documents or contracts made with content filter suppliers.
Look at
Clauses that specify testing methodologies and quality assurance.
Good evidence
Includes contractual commitments for product testing proof.
- Check 4 of 5What an auditor asks for
Ask for
Filter effectiveness reports: Request effectiveness reports that detail recent content filtering incidents.
Look at
How often harmful content was blocked and any incidents of false positives.
Good evidence
Includes statistics showing high accuracy in filtering and rapid incident resolution.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of bypass testing: Request documentation or results from recent bypass tests conducted by internal staff.
Look at
The testing methods used and any vulnerabilities discovered.
Good evidence
Will include detailed test records and improvements made to the filters.
Mappings
Closest match in ISO/IEC 27001: A.8.29, Security testing in development and acceptance, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.29.
ISM-1524 requires that content filters used by Cross Domain Solutions (CDSs) are subjected to rigorous security testing to confirm they work as intended and cannot be bypassed. Annex A 8.29 requires defined and implemented security testing within the development and acceptance lifecycle, which would include testing of security-relevant components such as content filters. ISM-1524 is a specific, high-rigour testing requirement for a particular security control (CDS content filters), whereas Annex A 8.29 is broader and applies to security testing across the SDLC generally.
This control partially overlaps A.8.34.
ISM-1524 requires rigorous security testing of CDS content filters to ensure they perform as expected and cannot be bypassed. Annex A 8.34 focuses on planning and agreeing audit tests and assurance activities when assessing operational systems, which is directly relevant when content filter testing occurs in production-like or operational environments. The overlap is in controlled, planned testing activities, but ISM-1524 is about the technical effectiveness and bypass resistance of filters, while Annex A 8.34 is about governance and safety of conducting tests on live systems.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.4.
Annex A 6.2.4 requires defined and documented verification and validation measures to confirm an AI system performs as intended against specified criteria. ISM-1524 requires rigorous security testing of content filters to ensure they perform as expected and cannot be bypassed, which aligns with validating a specific safety/security control that may be part of an AI system's boundary protections (e.g., prompt/output filtering). ISM-1524 is narrower and security-bypass oriented, whereas Annex A 6.2.4 covers the overall AI system V&V lifecycle, including functional and quality criteria beyond filter robustness.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.