ASD ISM 1748 Lock email client security settings against user changes
What it says
Email client security settings cannot be changed by human users.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmail client security settings are set and enforced centrally so that people using the client cannot switch them off, weaken them or override them.
Email clients such as Outlook, Apple Mail or a mobile mail app carry a set of security settings: whether attachments and remote content are blocked, whether scripts and macros in messages can run, whether add-ins can load, whether connections must be encrypted, and so on. This control says those settings must be configured by the organisation and locked, so a human user cannot open the client's options and change them. It matters because email is one of the most common ways attackers get into an organisation. If a user can turn off a protection (for example to make a blocked attachment open, or because a setting seems inconvenient), they can undo the whole defence with one click. Attackers know this, and phishing messages sometimes coach the victim through exactly those steps. Locking the settings means a well-meaning but hurried user, or someone following an attacker's instructions, cannot lower the client's defences. It also means the settings the organisation believes are in place actually are in place on every device.
Free. Save your status, tasks and notes.
Why it matters
If users can change email client security settings, protections can be silently disabled on individual devices, leaving those users exposed to malicious attachments, harmful links and remote content. A single weakened client can become the entry point for malware or credential theft, and the organisation loses confidence that its email security posture is consistent across the fleet.
How to implement
The email or endpoint administrator identifies every email client in use (desktop, mobile and web) and lists the security-related settings each one exposes to users.
The security team decides the required value for each security setting and records it as the organisation's approved email client security configuration.
The endpoint administrator applies the approved configuration through a central management tool (such as Group Policy, Intune or the mail service's client policy) using the enforced or locked mode, so the setting is pushed to all clients rather than left as a changeable default.
The endpoint administrator removes or hides the relevant options in the client interface where the tool supports it, and tests on a standard user account that each security setting cannot be changed from the client or its configuration files.
The service desk creates a request process so that any legitimate need to vary a security setting is handled by administrators centrally, keeping local user changes unnecessary.
Keep it running
Day to day, this control lives in the central configuration tool that manages the email client (for example Group Policy, Intune or another device management platform, or the mail service's own client policy). The approved security settings are defined once, applied to every managed client, and marked as enforced or locked rather than merely defaulted, so the corresponding options in the client are greyed out or hidden for users.
Administrators should re-check enforcement whenever the email client is upgraded, a new client or platform is introduced (including mobile and web clients), or the management tool is changed, since these events can expose settings that were previously locked. Users who genuinely need a different setting should raise a request so the change is made centrally and deliberately, never on the endpoint.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the document or policy export that defines the required email client security settings.
Look at
Check that it names the specific security settings and their required values for each email client in use, including mobile and web clients.
Good evidence
There is a single approved configuration covering all email clients, with each security setting and its value clearly stated.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the configuration from the central management tool that pushes these settings to email clients.
Look at
Confirm each security setting is deployed in an enforced or locked mode, not just set as a default the user can override.
Good evidence
Every security setting is marked as enforced, and the policy is assigned to all users or devices that run an email client.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see a demonstration on a standard user account of trying to change an email client security setting.
Look at
Watch whether the option is greyed out, hidden or reverts to the enforced value when the user attempts to change it.
Good evidence
The user cannot change any security setting; the options are unavailable or revert immediately.
- Check 4 of 5What an auditor asks for
Ask for
Ask for a compliance or deployment report from the management tool showing which devices have received the policy.
Look at
Compare the number of devices reporting the policy as applied with the total number of devices running an email client.
Good evidence
All in-scope devices show the policy as applied, and any exceptions are explained and being resolved.
- Check 5 of 5What an auditor asks for
Ask for
Ask how changes to email client security settings are requested and approved when a user has a legitimate need.
Look at
Look for a process that routes changes through administrators and the central tool rather than allowing local changes.
Good evidence
Changes are made only centrally by administrators following an approval, and there is no route for users to change settings themselves.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.4, Web browser security settings locked down to users, which partially overlaps with this control.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-AH-ML1.4.
ISM-1748 requires that users cannot change security settings in their email clients. E8-AH-ML1.4 is closely related in intent because it similarly requires preventing users from changing security settings, but for web browsers rather than email clients. The overlap is the 'lock down user-modifiable security settings' implementation pattern, while each control applies to a different application class and therefore protects different attack surfaces.
This control partially overlaps E8-AH-ML2.7.
ISM-1748 requires email client security settings to be centrally enforced so human users cannot change, weaken or override them. E8-AH-ML2.7 requires office productivity suite security settings to be immutable by users, which can include email-client settings where the email client forms part of the suite (e.g. Outlook), and is typically enforced through centrally managed policy. The overlap is the shared intent of preventing end-user modification of client application security posture, but ISM-1748 is specifically scoped to email clients, whereas E8-AH-ML2.7 is broader across the productivity suite and may not cover standalone/non-suite email clients.
This control partially overlaps E8-RM-ML1.4.
ISM-1748 requires that email client security settings cannot be changed by users. E8-RM-ML1.4 relates by applying the same control objective (preventing user tampering with security posture) to Microsoft Office macro security settings. The common ground is restricting user ability to weaken client-side protections, but E8-RM-ML1.4 is macro-specific and does not address email client configuration controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.