Establish which Australian authority applies
Australian government email assurance begins with the entity's status and its adopted security framework. A September 2026 Information Security Manual control is not, merely by existing, a law imposed on every Australian business. The Protective Security Policy Framework applicability page says non-corporate Commonwealth entities subject to the PGPA Act must apply the PSPF, to the extent consistent with legislation. Other organisations need their own adoption, contractual or sector-specific basis recorded. PSPF applicability.
The ministerial Directive on the Security of Government Business was issued on 3 July 2025. It provides an identifiable policy authority for the covered Commonwealth population. Record that authority separately from the technical control catalogue and from the local decision that selects controls for a system. A state department, a university and a Commonwealth entity should not be assigned identical legal status simply because their mail infrastructure looks similar. Ministerial directive.
Preserve the manual edition and control identifiers
The September 2026 ISM email chapter supplies precise implementation targets. ISM-0861 addresses outbound DKIM signing; ISM-1026 addresses verification of inbound signatures. ISM-1540 calls for rejection policy on organisational domains, including subdomains, when messages fail DMARC. ISM-1799 addresses incoming messages that fail DMARC. These are separate records: a published outbound policy does not demonstrate that an inbound gateway performs the required evaluation. September 2026 email controls.
Preserve the control number, revision, updated date and applicability labels exactly in the local assessment. The edition date and an individual control's revision date are different facts. Several authentication controls in the September edition retain earlier revision dates. The displayed Essential Eight field is N/A for these controls; do not rebrand them as an additional Essential Eight maturity level. A source quotation must also retain whether it addresses signing, verification, distribution-list behaviour or policy publication.
Reconcile high-level catalogue labels
The Australian Government Architecture entry creates an important reading caution. It displays a Mandatory compliance label while its applicability text describes the ISM as recommended for non-corporate Commonwealth entities and as ASD's considered advice. That page alone cannot resolve the precise obligation for a particular system. Retain the discrepancy and have the security policy owner identify the governing PSPF requirement, direction, contract or agency policy, rather than choosing whichever label supports a stronger sales claim. AGA ISM entry.
This distinction is useful even where implementation is clearly required. The authority answers who must act; the selected control answers what should be implemented; evidence answers whether the organisation has done it. Combining all three into a single green compliance badge makes later review harder. If the applicable policy changes, the original decision trail should explain why a control was included and which system boundary it covered.
Translate controls into observable evidence
For outbound signing, propose a sample plan spanning approved services, selectors and domains. For inbound validation, propose receiver-side evidence that identifies the gateway, rule version and authentication result. For DMARC policy, preserve the queried name, answer, observation time and subdomain treatment. None of those observations has been collected for this article. The evidence map therefore describes expected artefacts and proposed owners, with acceptance explicitly unfilled.
Technical interpretation should use current protocol semantics. RFC 9989 specifies DMARC's domain-alignment evaluation; it does not turn any successful signature into proof that the visible sender is aligned. A valid DKIM signature from an unrelated domain may not satisfy the policy being assessed. Likewise, a restrictive policy does not prevent an attacker from using a different lookalike domain or a compromised legitimate account. Keep those residual risks outside the narrow control result. DMARC core.
Use a fictional multi-service assessment
Consider a fictional Commonwealth service with staff email, grant notifications and an externally operated mailing list. Its proposed map assigns outbound signing and domain-policy evidence to the messaging team, supplier-message evidence to the grant-service owner, and inbound validation evidence to the gateway operator. The mailing-list row references the ISM control on preserving external senders' DKIM validity, rather than assuming that successful staff-mail delivery covers list redistribution. No such service was inspected here.
The assessment should not demand an immediate DNS change merely because one row is blank. First establish whether the blank means not applicable, not implemented, inaccessible evidence or an unperformed test. These states require different responses. Record a time-bounded investigation and the person who can approve any corrective action. A vendor's claim that it supports DMARC is not evidence that the particular grant-notification route is correctly configured.
Escalate gaps without overstating compliance
Bring material source ambiguity to the agency's policy or legal specialist. Bring protocol interpretation and gateway behaviour to the technical SME. Bring missing supplier commitments to the service owner. The decision record should show who resolved each question and whether the resolution changes scope, control selection or evidence expectations. Do not substitute a commercial deliverability score for an assurance conclusion under the agency's framework.
Review the map when a new ISM edition, PSPF direction, supplier change or system classification affects the service. Retain superseded snapshots with their dates so that historical decisions remain explainable without presenting old controls as current. Policy publication dates do not prove implementation dates, and a document hash does not establish that an agency accepted its contents.
The exact commissioned evidence is: An authority-to-control table reviewed by the appropriate regulatory or legal specialist. This package supplies an unreviewed authority map, not that specialist's determination. Original system evidence, agency applicability, technical acceptance, production presentation and publication permission remain open. No Australian organisation's configuration was queried or changed, and no legal-compliance certificate is issued.