ISM control lookup / Topic

Guidelines for email

26 controls · September 2026 edition

• ISM-0264 · Email usage policy

  An email usage policy is developed, implemented and maintained.

• ISM-0267 · Webmail services

  Access to non-approved webmail services is blocked.

• ISM-0269 · Email distribution lists

  Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed.

• ISM-0270 · Protective markings for emails

  Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments.

• ISM-0271 · Protective marking tools

  Protective marking tools do not automatically insert protective markings into emails.

• ISM-0272 · Protective marking tools

  Protective marking tools do not allow the selection of protective markings that a system has not been authorised to process, store or communicate.

• ISM-0565 · Handling emails with inappropriate, invalid or missing protective markings

  Email servers are configured to block, log and report emails with inappropriate protective markings.

• ISM-0567 · Open relay email servers

  Email servers only relay emails destined for or originating from their domains (including subdomains).

• ISM-0569 · Centralised email gateways

  Emails are routed via centralised email gateways.

• ISM-0570 · Email gateway maintenance activities

  Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway.

• ISM-0571 · Centralised email gateways

  When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation’s centralised email gateways.

• ISM-0572 · Email server transport encryption

  Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.

• ISM-0574 · Sender Policy Framework

  SPF is used to specify authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).

• ISM-0861 · DomainKeys Identified Mail

  DKIM signing is enabled on emails originating from an organisation’s domains (including subdomains).

• ISM-1023 · Handling emails with inappropriate, invalid or missing protective markings

  The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified.

• ISM-1024 · Notifications of undeliverable emails

  Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.

• ISM-1026 · DomainKeys Identified Mail

  DKIM signatures on incoming emails are verified.

• ISM-1027 · DomainKeys Identified Mail

  Email distribution list applications used by external senders is configured such that it does not break the validity of the sender’s DKIM signature.

• ISM-1089 · Protective marking tools

  When replying to or forwarding emails, protective marking tools do not allow the selection of protective markings lower than previously used.

• ISM-1151 · Sender Policy Framework

  SPF is used to verify the authenticity of incoming emails.

• ISM-1183 · Sender Policy Framework

  A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).

• ISM-1234 · Email content filtering

  Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.

• ISM-1502 · Blocking suspicious emails

  Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway.

• ISM-1540 · Domain-based Message Authentication, Reporting and Conformance

  DMARC records are configured for an organisation’s domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.

• ISM-1589 · Email server transport encryption

  MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.

• ISM-1799 · Domain-based Message Authentication, Reporting and Conformance

  Incoming emails are rejected if they do not pass DMARC checks.