search account_circle

policyASD ISM

Guidelines for email

26 controls in this part of theASD ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Email gateways and servers

Restrict Email Relay to Specific Domains

Ensure email servers only relay emails within their own domains to prevent misuse.

Centralise Email Routing via Gateways

Emails are processed through central gateways for improved control and security.

Maintain Backup Email Gateways to Primary Standards

Alternative email gateways must be kept to the same standards as the main gateway to ensure consiste

Ensure Secure Email Transmission via Gateways

Emails should be sent through secure and encrypted channels using central gateways.

Enable Opportunistic TLS for Email Server Encryption

Ensure email servers use encryption to protect emails sent over public networks.

Use SPF to Authorise Email Servers

SPF helps confirm which email servers are allowed to send emails for your organisation's domain.

Enable DKIM Signing for Organisational Emails

Ensure emails from your organisation's domains use DKIM to verify authenticity and prevent forgery.

Verify Senders for Email Failure Notifications

Only verified senders get notified if their email cannot be delivered.

Verification of DKIM Signatures on Incoming Emails

Ensure that DKIM signatures on received emails are checked to identify legitimate sources.

Configure Email Distribution Lists to Preserve DKIM Signatures

Ensure email lists don't invalidate DKIM signatures from external senders.

Verify Email Authenticity Using SPF

SPF helps confirm if an email really comes from who it claims to, preventing fake emails.

Implement Hard Fail SPF Records for Email Security

Use a strict SPF record to ensure only authorised servers send emails on behalf of the organisation.

Protect Email Systems with Content Filtering

Checks emails for harmful content to keep systems safe.

Ensure Multi-factor Authentication for Online Services

Use two or more forms of identity verification to access sensitive data online.

Configuring DMARC for Email Security

Ensure emails from your domains are legitimate by rejecting ones that fail DMARC checks.

Enable MTA-STS for Secure Email Transport

Ensure email is encrypted during transfer between servers to enhance security.

Enforce Email Rejection for Failed DMARC Checks

Emails not verified by DMARC are blocked to enhance email security.

Email usage

Develop and Maintain an Email Usage Policy

Create and uphold a policy to guide the use of email communications.

Blocking Access to Unapproved Webmail Services

Prevent access to webmail services that haven't been approved by the organisation.

Restrict Sensitive Emails to Verified Recipients

Sensitive emails must not go to groups unless all recipients' nationalities are confirmed.

Apply Protective Markings to Emails Based on Sensitivity

Emails must be marked to show their highest confidentiality level based on content.

Prevent Automatic Email Marking by Protective Tools

Protective tools for emails don't automatically add security labels to your messages.

Prevent Unauthorised Protective Marking Selection

Ensure users cannot choose classification levels the system cannot handle.

Email Security for Protective Markings

Email servers stop and track emails with wrong markings to prevent mistakes.

Notify Parties of Blocked Emails

Notify people if their sent or received emails are blocked due to marking issues.

Prevent Lower Email Protective Marking Selection

Email reply or forward tools must not allow reducing security markings from the original.

Back to the full Australian Government Information Security Manual control list, or browse the complete control library.