ASD ISM 1779 Quarantine data failing security checks during manual export
What it says
When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishData failing security checks during manual export is quarantined until reviewed for approval.
When you manually move data from one place to another, it's important to make sure that any data not meeting security checks is put aside, or 'quarantined', until someone can review it. This process matters because if unchecked data gets out, it could lead to a leak of sensitive information, harming your business or client relationships.
Free. Save your status, tasks and notes.
Why it matters
If data failing export security checks is not quarantined, sensitive data may be released, causing breaches and reputational damage.
How to implement
The IT team should create a process for handling data exports.
They can start by setting up a secure folder where any data that doesn't pass security checks is automatically stored until further review.
A manager should assign a trained staff member to regularly review quarantined data.
This person should have a checklist to ensure every piece of data is reviewed for security risks before deciding if it can be safely shared or needs more attention.
System owners need to coordinate with their security officer to set up automated alerts that notify the right people when data is quarantined.
This ensures timely review and prevents data from sitting unreviewed for too long.
The compliance officer should develop clear guidelines for what types of data should be quarantined.
These guidelines can be based on government regulations or industry standards and should be communicated clearly to all staff involved in data exports.
HR should organise regular training sessions for staff involved in data handling.
These sessions should cover how to recognise when data needs to be quarantined and the steps to take when this happens.
Keep it running
During manual exports, automatically quarantine files that fail security checks and review/approve or reject release within defined timeframes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
The data quarantine log: This should be a record of all data that has been quarantined due to security check failures.
Look at
Timestamps, reviewer names, and the decision made on each data set.
Good evidence
Is a complete and up-to-date log showing regular reviews and timely decisions.
- Check 2 of 2What an auditor asks for
Ask for
Documentation of the data review process: Inspect the process to see if it includes steps for evaluating quarantined data. Good documentation will have clear steps with designated responsible persons.
Look at
The secure folder access logs where quarantined data is stored: Check if access is restricted to authorised personnel only.
Good evidence
Security measure will list who accessed the data and have limited access permissions.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.14.
ISM-1779 requires quarantining data that fails security checks during manual export until it is reviewed and approved for release. Annex A 5.14 requires information transfer rules and procedures for all transfer methods, which would typically include defined approval gates and handling of failed checks for outbound transfers. Annex A 5.14 is broader, covering all transfer facilities and agreements, whereas ISM-1779 is more specific on the quarantine-and-review mechanism for manual exports.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.