ASD ISM 1589 Enable MTA-STS for secure email transport
What it says
MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure email is encrypted during transfer between servers to enhance security.
This control is about setting up a system called MTA-STS to make sure emails sent from your server to another are always encrypted. If you don't do this, sensitive information in those emails, like financial details or personal data, could be easily intercepted by cyber criminals during the transfer.
Free. Save your status, tasks and notes.
Why it matters
Without MTA-STS, sensitive emails risk unencrypted transit, making them vulnerable to interception and exposure of confidential data.
How to implement
IT Manager should assess the email server setup: Start by taking inventory of the email servers in use.
Confirm that they support MTA-STS encryption protocols, either natively or with updates.
IT Team should configure MTA-STS: Implement the policy by adjusting the server's settings to specify that emails can only be sent if the receiving server supports encryption.
Use guides from trusted sources like the Australian Cyber Security Centre.
Email Administrator should test the setup: Conduct tests to ensure that the email server only sends emails when they are encrypted properly.
Use various scenarios to test the settings and track the test results.
Business Owner should verify vendor compliance: If using a third-party email service, contact them to ensure MTA-STS is enabled and supported.
Request written confirmation that they comply with the encryption standards.
Security Officer should update documentation: Document the configuration changes and the testing process.
This includes detailing the steps taken and any support sources consulted, like the Australian Signals Directorate guidelines.
Keep it running
Regularly verify the MTA-STS policy file and DNS record for changes or errors that could disrupt enforced TLS delivery.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The MTA-STS policy documentation: Request the configuration document that describes how MTA-STS is implemented on the servers.
Look at
Technical settings that enforce encryption rules.
Good evidence
Shows a detailed description matching official guidelines.
- Check 2 of 5What an auditor asks for
Ask for
Email server configuration logs: Request the logs that demonstrate email transactions only occur with encryption in place.
Look at
Consistent entries showing successful encrypted connections.
Good evidence
Reveals no unencrypted transmission attempts.
- Check 3 of 5What an auditor asks for
Ask for
The encryption compliance report: Request a report on the compliance status of the organisation's email service with MTA-STS requirements.
Look at
Evidence of recent tests and conformity with standards.
Good evidence
Provides recent, positive test outcomes.
- Check 4 of 5What an auditor asks for
Ask for
An email service third-party audit: Request an audit or correspondence with a third-party provider proving their compliance with encryption standards.
Look at
Documentation that the provider has MTA-STS enabled.
Good evidence
Includes confirmation from the provider on their letterhead.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request evidence of training given to IT staff regarding setting up and maintaining MTA-STS.
Look at
Completed training sessions, dates, and attendee records.
Good evidence
Shows regular training and complete attendance by relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-1589 requires organisations to enable MTA-STS to prevent unencrypted SMTP transport between mail transfer agents. Annex A 5.14 requires information transfer rules and procedures across transfer methods and parties, under which secure email transport requirements (including mandating TLS and enforcing it via MTA-STS) would be defined. Annex A 5.14 is broader and governance-focused, while ISM-1589 is a specific technical implementation for email in transit.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.