ASD ISM 1778 Quarantine security-noncompliant data for review
What it says
When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNoncompliant data is quarantined for review before system entry when imported manually.
When adding data to your company's systems by hand, it's important to hold back any information that doesn't pass security checks for closer inspection. This matters because if risky data slips through, it could lead to data breaches, affecting your business financially and damaging its reputation.
Free. Save your status, tasks and notes.
Why it matters
If quarantined import data that fails security checks is not reviewed and approved before release, malware or sensitive data may be introduced, causing unauthorised access and reputational/financial damage.
How to implement
Office managers should coordinate with the IT team to make sure there's a clear process for handling data that doesn't meet security guidelines.
This can be done by reviewing existing procedures and creating a step-by-step checklist for data handling.
IT staff should use security tools to scan incoming data for potential risks or noncompliance issues.
They can set up automated alerts within these tools to highlight any data that fails preset security standards.
Data administrators should keep a record of all data flagged during imports.
They can do this by maintaining a digital logbook that captures details like the date of import, type of data, and reasons for noncompliance.
Business owners should confirm that there's a team in place to review flagged data regularly.
This involves assigning specific team members to this task and scheduling periodic review meetings to discuss findings.
Compliance officers should work with IT personnel to establish criteria for approving or rejecting quarantined data.
They can do this by drafting a policy document outlining acceptable data characteristics and approval processes.
Keep it running
For manual imports, ensure all items failing security checks are automatically quarantined, logged, and only released after a documented security review and explicit approval or rejection.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data import procedures manual: Check if it includes steps to quarantine and review noncompliant data.
Look at
Detailed instructions on handling flagged data.
Good evidence
Is a clear, step-by-step guide tailored to this control.
- Check 2 of 5What an auditor asks for
Good evidence
Shows consistent entries with actions for each flagged piece of data.
- Check 3 of 5What an auditor asks for
Ask for
The minutes from data review meetings.
Look at
These records for evidence of regular meetings and decisions made on quarantined data.
Good evidence
Includes meeting dates, attendees, and a summary of decisions.
- Check 4 of 5What an auditor asks for
Good evidence
Includes a recent report with both passing and noncompliant datasets flagged appropriately.
- Check 5 of 5What an auditor asks for
Ask for
To see the data approval policy: Look to ensure it outlines criteria for data release after quarantine.
Good evidence
Contains detailed requirements and is signed off by a responsible executive.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-1778 requires that, when data is manually imported to systems, any data failing security checks is quarantined until it is reviewed and either approved or not approved for release. This is a specific procedure for one transfer facility, manual data import, of the kind Annex A 5.14 requires the organisation to govern with information transfer rules and procedures. Annex A 5.14 covers all types of transfer within and between organisations, while ISM-1778 addresses only the handling of imported data that fails security checks.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.