ASD ISM 1740 Manage and report business email compromise
What it says
Personnel dealing with banking details and payment requests are advised of what business email compromise is and how to manage and report it.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmployees should know about email fraud in banking and how to manage and report it.
Business email compromise is when a hacker tricks someone into sending money to a fraudulent account. If your staff don't know how to handle this, your organisation could lose thousands or even millions of dollars-and damage its reputation.
Free. Save your status, tasks and notes.
Why it matters
Failing to manage email scams can lead to financial loss and harm your company's trustworthiness with clients and partners.
How to implement
Managers should educate their teams about what business email compromise looks like.
Conduct regular training sessions using real-world examples and discuss common tricks that hackers use.
Finance officers should check with senders whenever they receive new payment instructions.
They can do this by calling the person requesting the change using a known phone number to confirm the request.
Staff should report suspicious emails to the IT team immediately.
Use a clear, simple process, such as forwarding the email to a specific 'security' email address.
Department heads should maintain a list of key contacts to verify payment requests.
Ensure this list is updated quarterly with current phone numbers and email addresses.
HR should include guidelines on recognising and reporting email fraud in staff induction materials.
This ensures new employees are aware from day one.
Keep it running
Regularly update and review payment processing guidelines with staff to ensure awareness of the latest phishing tactics used by scammers.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the email security policy document: Ensure it includes procedures for verifying payment requests.
Look at
specific steps outlined.
Good evidence
policy will have clear instructions on how staff should verify payments.
- Check 2 of 5What an auditor asks for
Ask for
records of staff training sessions on email security.
Look at
attendance lists and training content. Good records will show regular training with high staff participation.
- Check 3 of 5What an auditor asks for
Look at
the response and resolution times.
Good evidence
will show timely actions taken after each report.
- Check 4 of 5What an auditor asks for
Ask for
to see the contact verification list used by finance teams.
Look at
how often it is updated and method of its distribution.
Good evidence
list is current and accessible to all relevant staff.
- Check 5 of 5What an auditor asks for
Ask for
HR's induction materials regarding email security. Check for content that explains fraud recognition and reporting clearly. Good materials cover practical examples and clear steps.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.6.3.
Annex A 6.3 requires an organisation-wide, role-appropriate security awareness and training program with regular updates to relevant policies and procedures. ISM-1740 is a specific instance of that requirement, mandating training for staff who handle banking details and payment requests on business email compromise and reporting expectations. ISM-1740 is narrower in scope (one threat scenario and one role group) than Annex A 6.3.
This control supports A.6.8.
ISM-1740 requires personnel handling payment details to know what BEC is and how to report it through the organisation's processes. This supports ISO/IEC 27001:2022 Annex A 6.8 by increasing the likelihood that personnel will use defined channels to report suspected security events (e.g., suspected invoice/bank-detail fraud) promptly. Annex A 6.8 focuses on having reporting mechanisms and channels, whereas ISM-1740 focuses on training a specific cohort to recognise and report BEC scenarios.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.