Skip to content
Gateways
ASD ISMISM-1965

ASD ISM 1965 Content checking for imported or exported files

What it says

Files imported or exported via gateways or CDSs undergo content checking.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Files passing through gateways or data systems are checked to ensure they meet security requirements.

When files come into or go out from an organisation, it's important to check them to ensure they don't contain harmful content or expose sensitive information. This process prevents problems like data breaches or malware infections, which could lead to costly disruptions or damage to a business's reputation.

Why it matters

If gateway/CDS content checking is absent, malware can traverse import/export paths and sensitive data may be exfiltrated, causing outages and reportable breaches.

How to implement

  1. The IT team should establish a content filtering system to automatically scan all files imported or exported through data gateways.

    They can set up software tools that scan files for viruses, inappropriate content, or confidential information before allowing them to pass through.

  2. Managers should train staff on the importance of checking files they upload or download, explaining how harmful content can slip through and what they can do to prevent it.

    Regular workshops can be held to demonstrate using the content checking tools effectively.

  3. System administrators should configure the file gateways to quarantine files that don't meet set security standards.

    This involves setting up rules that identify potential threats and automatically isolating those files for further review.

  4. Procurement teams should ensure that content checking software and systems are up-to-date and comply with the latest Australian Cyber Security Centre (ACSC) guidelines.

    When acquiring new systems, they should review ACSC recommendations and ensure vendors provide compliant solutions.

  5. Senior management should regularly review content checking reports to understand the effectiveness of the system.

    They can schedule monthly reviews with the IT team to discuss trends and any incidents of content-blocking, adjusting policies as needed.

Keep it running

Keep gateway/CDS content checking signatures and file-type rules current. Review allow/deny logs and quarantine events to spot repeated detections, tuning rules to reduce false positives.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The documented policy on content checking for file transfers.

    Look at

    The policy to see if it clearly outlines how files are checked, including which tools and processes are used. Good documentation will include specific instructions for staff and regular update schedules.

    Good evidence

    Log will show a history of scans, details of any blocks or quarantines, and follow-up actions taken.

  2. Check 2 of 4What an auditor asks for

    Ask for

    Training records related to file content checking.

    Look at

    Records that show staff have been trained on the content checking process. Good records will include dates of training sessions, attendance lists, and topics covered.

  3. Check 3 of 4What an auditor asks for

    Ask for

    Quarantine folder access reports.

    Look at

    The reports to identify how often files are quarantined and reviewed.

    Good evidence

    Will show regular reviews and resolution of quarantined files in a timely manner.

  4. Check 4 of 4What an auditor asks for

    Good evidence

    Would be an up-to-date certificate showing compliance with relevant security standards.

Mappings

Closest match in ISO/IEC 27001: A.8.12, Data leakage prevention measures, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.12Data leakage prevention measuresPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.