ASD Essentials IT.RES-04.2 Evaluate Monitoring Coverage and Response Procedures After Incidents and Validate Improvements
What it says
Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks monitoring coverage and incident response procedures after each incident, and improves them where they fell short.
After an incident, the organisation looks back at how well it spotted and handled the attack. Did logs and alert rules catch what the attacker did, and did the response steps work? To meet this, review monitoring, alert rules and response steps after incidents, and record a change for each lesson. Test every change, for example by checking that a fixed alert rule now fires.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without these reviews, the gaps from the last attack stay in place: blind spots, missed alerts and weak steps that hid it or slowed the response. The next attacker then stays hidden longer and does more damage.
How to implement
The incident response manager should make this review a required step in the incident response plan.
Name who leads it and who takes part: analysts, responders, system owners and any outside security provider.
The detection engineering lead should check each attacker action: was it logged, and did an alert fire?
Record how the incident was first found, and each monitoring gap and its cause.
The incident response manager should run a no-blame walk-through of the response against the plan and response guides (playbooks).
Record where steps worked, where they were unclear or missing, and where responders had to improvise.
The incident response manager should log each lesson in the improvement register, with an owner, risk-based priority and due date.
Owners make each change, such as tuning a rule, adding a log source or updating a playbook, through change management.
Each item's owner should test the change before closing it, for example by running new rules against the incident's logs or rehearsing revised steps.
Reopen any change that does not work.
Keep it running
Run the review before closing each incident, scaled to how serious it was. Gather the timeline, alerts, logs and case notes while they are fresh. Go through the improvement register at regular security operations meetings, so items are not dropped or closed untested. This action applies organisation-wide, in every priority phase, so cover every system the incident reached, including ones not yet centrally monitored.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the incident register and the review record for each incident in the period.
Look at
Whether incidents closed without review, or reviews skipped monitoring coverage or alert rules.
Good evidence
Each register entry links to a dated review covering alert rules, monitoring coverage and response steps.
- Check 2 of 5What an auditor asks for
Ask for
Request a sample of reviews with the timelines, alerts and rule history they used.
Look at
Whether they show what monitoring saw and missed, or are general stories without specific findings.
Good evidence
Each review names specific monitoring and alert gaps, their causes and the lessons.
- Check 3 of 5What an auditor asks for
Ask for
Request one incident's response log and review, with the plan and playbooks in force then.
Look at
Whether the review compared the actual response with the steps, or just says it went well.
Good evidence
Each shortfall in the response steps is recorded as a lesson for updating them.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the improvement register and change records for the rules, log sources and playbooks listed.
Look at
Whether reviews produced no recorded change, or improvements were informal, untracked or overdue.
Good evidence
Lessons become recorded changes, each tracked with an owner, priority and status to closure.
- Check 5 of 5What an auditor asks for
Ask for
Request test evidence for a sample of closed items, such as detection tests or exercise reports.
Look at
Whether changes closed untested, or tests proved a rule was deployed but not that it works.
Good evidence
Each closed item has test results showing the change works, such as new alerts firing.
ASD indicators of good practice (5)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(1)
- NE-1Detection rules, monitoring coverage and response procedures are not reviewed following incidents.
Partially effective(2)
- PE-1Reviews are conducted but do not result in documented changes to detection or response capabilities.
- PE-2Some improvements are made but not systematically tracked or validated.
Fully effective(2)
- FE-1Detection rules, monitoring coverage and cyber security incident response procedures are reviewed following incidents, with identified lessons incorporated into updates.
- FE-2Changes are documented, tested and validated for effectiveness.
Mappings
Closest match in ISO/IEC 27001: A.5.27, Learning from information security incidents, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.27.
IT.RES-04.2 requires monitoring coverage and cyber security incident response procedures to be evaluated following cyber security incidents. This applies the learning from incidents required by Annex A 5.27, under which knowledge gained from incidents must be used to strengthen and improve information security controls, to two specific areas. Annex A 5.27 applies to all controls and requires improvements to be made, while IT.RES-04.2 is limited to evaluating monitoring and response.
This control partially overlaps A.5.24.
IT.RES-04.2 requires monitoring coverage and cyber security incident response procedures to be evaluated following cyber security incidents. Evaluating the response procedures after each incident strengthens the incident management processes that Annex A 5.24 requires the organisation to define, establish and communicate in advance. Annex A 5.24 covers planning and preparation, including roles and responsibilities, while IT.RES-04.2 is a post-incident evaluation that also extends to monitoring coverage.
This control partially overlaps A.8.16.
IT.RES-04.2 requires monitoring coverage and cyber security incident response procedures to be evaluated following cyber security incidents. Evaluating monitoring coverage after an incident exposes blind spots and so strengthens the monitoring of networks, systems and applications for anomalous behaviour required by Annex A 8.16. IT.RES-04.2 is a post-incident evaluation, while Annex A 8.16 covers ongoing monitoring and the evaluation of potential incidents.
ASD Information Security Manual: 3 mappings
- ISM-1526System Owners Continuously Monitor Security and Manage Threats, Risks and ControlsPartially overlaps
This control partially overlaps ISM-1526.
IT.RES-04.2 requires monitoring coverage and incident response procedures to be evaluated after incidents; ISM-1526 requires system owners to continuously monitor each system's security and manage its threats, risks and controls, the monitoring whose coverage that evaluation checks.
This control partially overlaps ISM-1617.
IT.RES-04.2 requires monitoring coverage and incident response procedures to be evaluated after incidents; ISM-1617 requires the CISO to regularly review and update the cyber security program to keep it relevant to cyber threats, a wider review not tied to incidents.
This control partially overlaps ISM-1784.
IT.RES-04.2 requires monitoring coverage and incident response procedures to be evaluated after incidents; ISM-1784 requires the incident management policy and response plan to be exercised at least annually, complementing that post-incident evaluation with regular testing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.