PRO-09 Protect
Content filtering
Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification.
Enterprise IT actions
-
IT.PRO-09.1
Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
ASD’s indicators
Not effective
- No outbound content inspection is deployed.
- Sensitive data can leave the organisation through any egress path without detection or control.
Partially effective
- Outbound inspection is deployed but does not cover all applicable egress paths.
- Rules are configured but do not cover all classified, regulated or high-value data types.
- Alerts are generated but are not triaged or acted upon in a timely manner.
Fully effective
- Outbound content inspection is deployed covering all applicable egress paths.
- Rules are configured to detect unauthorised transfer of classified, regulated and high-value data.
- Alerts are triaged and responded to within accepted risk timeframes defined by the organisation.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-0659, ISM-0963, ISM-1237
- NIST CSF 2.0
- PR.DS-02, DE.CM-01, DE.CM-06, PR.IR-01
- NIST SP 800-171r3
- 03.01.03, 03.13.01, 03.14.06
- AESCSF v2
- ARCHITECTURE-5f, SITUATION-2d, ARCHITECTURE-5c
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1090 Proxy
-
IT.PRO-09.2
Block outbound network connections to known malicious or untrusted destinations.
- Phase 1Boundary services
- Phase 2Critical processes and services
ASD’s indicators
Not effective
- No controls are deployed to prevent systems from establishing outbound connections to known malicious or untrusted destinations.
- Blocking decisions are not informed by current threat intelligence.
- Destination categorisation is not used.
Partially effective
- Controls to prevent outbound connections being established are deployed but cover only a subset of in-scope systems or egress paths.
- Threat intelligence is used to inform block decisions for outbound connections, but updates are infrequent, manual or limited to a single source.
- Categorisation is in place, but the categories blocked do not reflect the organisation's risk position.
Fully effective
- Controls are deployed and applied across in-scope systems, egress paths, services, and network boundaries.
- Blocking decisions draw on current threat intelligence, with destination lists updated on a cycle defined by the organisation.
- Destination reputation, category and age are considered alongside threat intelligence, with category-based blocking aligned to the organisation's risk position.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-0958, ISM-0963, ISM-1171, ISM-1236
- NIST CSF 2.0
- PR.IR-01, DE.CM-01, PR.PS-01
- NIST SP 800-171r3
- 03.13.01, 03.13.06, 03.01.03
- AESCSF v2
- ARCHITECTURE-2e, ARCHITECTURE-3m, SITUATION-2d
- MITRE ATT&CK
- T1566 Phishing, T1204 User Execution, T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1090 Proxy
-
IT.PRO-09.3
Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.
- Phase 1Boundary services
- Phase 2Critical processes and services
ASD’s indicators
Not effective
- No inbound content inspection is deployed.
Partially effective
- Inbound inspection is deployed but does not cover all applicable content channels.
- Inspection is in place but detection signatures or rules are not maintained or updated.
Fully effective
- Inbound content inspection covers all applicable content channels.
- Detection signatures and rules are maintained and updated on a regular cycle defined by the organisation.
- Blocked content is logged and available for review.
- Current cyber threat intelligence is considered when implementing controls to prevent the delivery of malicious or unsafe content.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-0651, ISM-0652, ISM-0659, ISM-0963, ISM-1234
- NIST CSF 2.0
- PR.IR-01, DE.CM-01, PR.DS-02
- NIST SP 800-171r3
- 03.13.01, 03.14.02, 03.13.13
- AESCSF v2
- ARCHITECTURE-3b, ARCHITECTURE-2e, THREAT-2d
- MITRE ATT&CK
- T1566 Phishing, T1021 Remote Services, T1105 Ingress Tool Transfer
Cloud actions
-
Action 1
Block outbound network connections to known malicious or untrusted destinations.
- Phase 1Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Supplied, SaaS: Provider
-
Action 2
Inspect and control outbound flows from cloud services to detect unauthorised transfer of sensitive or high-value data.
- Phase 1Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
-
Action 3
Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.
- Phase 1Boundary services
- Phase 2Critical processes and services
- Phase 3Business systems
- ResponsibilityPaaS: Supplied, SaaS: Provider
More Protect principles
- PRO-01Secure system lifecycle
- PRO-04Secure configuration management
- PRO-05Secure administration
- PRO-06Vulnerability management
- PRO-07Trustworthy software
- PRO-08Cryptographic protection
- PRO-10Regular and proven backups
- PRO-12Least privilege access
- PRO-13Identity, credential and access management
- PRO-14Cyber security awareness training
- PRO-15Physical access control
- PRO-16Cyber supply chain security
- PRO-18Network segmentation and segregation
- PRO-19Operational technology isolation
- PRO-20Remote access to operational technology
Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.