Skip to content

S/MIME

What is S/MIME?

Secure/Multipurpose Internet Mail Extensions, a standard for public key encryption and signing of email messages to ensure confidentiality, integrity, and authentication.

Information Security

Terms that appear alongside s/mime

Each of these is named in at least one of the same controls as s/mime. The number is how many controls name both.

Frameworks that govern s/mime

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on s/mime

Requirements naming s/mime across 6 standards, quoted from the control text.

Australian Information Security Manual1 control

Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.

ISM-0490 · Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections. →
ITU-T X.805 - Security Architecture for End-to-End Communications3 controls

Security Dimension 3 Non-Repudiation per X.805 Clause 6.3: Non-repudiation provides means for preventing an individual or entity from denying having performed a particular action related to data by making available proof of various network-related actions (e.g...

X805-Dim3-Non-Repudiation-Proof-Origin-Delivery-Sender-Receiver-Denial-Prevention · ITU-T X.805 Security Dimension 3 - Non-Repudiation + Proof of Origin + Proof of Delivery + Sender + Receiver Denial Prevention + Digital Signatures + Timestamping + Audit Logs + Forensic Evidence + Court-Admissible Records →
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)2 controls

Implement STANAG 4774/4778 label handling across email per RFC 8551 S/MIME + RFC 9580 OpenPGP profiles, documents per OOXML/ODF embedded metadata + PDF/X-3 embedded XML, file storage per NTFS/EXT4 extended attributes + cloud object storage tags.

STANAG-6 · Label Handling in Email, Documents, and Storage →
IRS Publication 10751 control

Sections 9.1-9.2 of IRS Publication 1075 establish FTI-specific requirements that are NOT covered by NIST SP 800-53 but are specific to the IRS FTI protection regime.

IRSPub1075-Section91-92-FTI-Specific-Recordkeeping-Disclosure-Transmission-Restriction-MinSafeguards · IRS Publication 1075 Sections 9.1-9.2 + FTI-Specific Requirements + Recordkeeping + Disclosure Restrictions + Transmission Requirements + Minimum Protection Standards + Printing + Inventory + Destruction →
Monetary Authority of Singapore Technology Risk Management Guidelines1 control

Implement Access Control + Cryptography + Network and Infrastructure Security per MAS TRM Chapters 9 + 10. Chapter 9 Access Control + Cryptography - access control policy + user identification + authentication (Multi-Factor Authentication MFA required for priv...

MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation · MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation →
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)1 control

Deploy FIPS 140-3 validated cryptographic modules (NIST CMVP) supporting ML-KEM + ML-DSA + SLH-DSA. Test against NIST CAVP (Cryptographic Algorithm Validation Program) test vectors.

PQC-7 · FIPS Validated Modules, HSM Readiness, and Algorithm Validation →

Questions people ask about s/mime

What is S/MIME?
Secure/Multipurpose Internet Mail Extensions, a standard for public key encryption and signing of email messages to ensure confidentiality, integrity, and authentication.
Why is S/MIME important for compliance?
S/MIME is a key concept in Information Security. Understanding s/mime helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address S/MIME?
S/MIME appears in the requirement text of Australian Information Security Manual, ITU-T X.805 - Security Architecture for End-to-End Communications, NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding), IRS Publication 1075, Monetary Authority of Singapore Technology Risk Management Guidelines. Across these standards we have identified 9 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about S/MIME?
Explore our compliance framework pages to see how s/mime applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how S/MIME applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.