ASD Essentials IT.RES-05.1 Build External Reporting and Coordination Obligations into Incident Response Procedures
What it says
Integrate external coordination obligations into cyber security incident response activities where required.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBuilds every duty to tell or work with outside parties into the steps people follow in an incident.
During an incident, an organisation may have to tell or work with outside parties, such as ASD, regulators, police, insurers, customers or IT providers. Laws, regulations, contracts or its own commitments can require this. To meet this, list every party that applies and add each to the response steps. For each, set what triggers contact, who to contact and how quickly. Practise these steps and update them after each exercise or incident.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
Missed or late reports, or reports made by someone without authority, can bring regulator action, breach of contract and lost trust. Poor coordination also delays outside help, for example from ASD or IT providers, so it takes longer to stop the attack and recover.
How to implement
The head of security and legal team should list every party the organisation must notify or work with.
Sources include the Privacy Act 1988, Security of Critical Infrastructure Act 2018, Cyber Security Act 2024, regulators, insurers, contracts and internal commitments.
The incident response manager should record, for each party, an owner, the trigger and contact details, with a backup such as a phone number.
Add who may make contact and the deadline, set by risk if the obligation sets none.
The incident response manager should add a check for outside obligations when an incident is assessed, declared or escalated.
Add steps for working with each party to the response guides (playbooks), and log who was told, by whom and when.
The incident response manager should run exercises that trigger outside obligations, such as a personal data breach or a ransomware attack.
Test that responders pick the right parties and notify them on time.
The incident response manager should update the register, procedures, contacts and templates with lessons from every exercise and real incident.
Legal re-checks the register when laws, regulations or insurers change, and the purchasing team adds each new contract's notice clauses.
Keep it running
Keep the obligations register, contact list and notice templates where responders can reach them if email is down. Confirm contacts on a set cycle. When an incident is first assessed, declared or changes in scope, the incident manager checks every trigger and tracks each notice to completion. This action applies organisation-wide, in every priority phase, so one set of steps covers incidents anywhere. Revisit it as new systems and suppliers come into scope.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of outside obligations and how it was put together.
Look at
Whether obligations rely on memory, or sources such as privacy law, regulators, insurers and contracts were missed.
Good evidence
Every party required by law, regulators, contracts and the organisation's commitments is listed, with an owner.
- Check 2 of 5What an auditor asks for
Ask for
Ask for each party's trigger, contact details, authorised role and deadline.
Look at
Whether some parties lack a trigger, contact or deadline, or contact details are out of date.
Good evidence
Every party has a trigger, current contacts with a backup, an authorised role and a deadline.
- Check 3 of 5What an auditor asks for
Ask for
Request the incident response plan, response guides and the assessment and declaration checklists.
Look at
Whether outside obligations appear in the steps responders follow, or only in a separate document.
Good evidence
The steps prompt responders to check outside obligations when an incident is assessed, declared or escalated.
- Check 4 of 5What an auditor asks for
Ask for
Ask for records of exercises and real incidents that triggered outside obligations, including notice logs.
Look at
Whether coordination was never tested, or notices were missed, late or sent without authority.
Good evidence
The right parties were told on time by authorised people, as the steps require.
- Check 5 of 5What an auditor asks for
Ask for
Ask for lessons learnt reports and the change history of the register and procedures.
Look at
Whether problems with outside coordination were recorded but the register and procedures never changed.
Good evidence
Each lesson led to a traceable update of the register, procedures, contacts or templates.
ASD indicators of good practice (7)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1External coordination requirements for Cyber security incident response activities are neither identified nor documented.
- NE-2No defined triggers, contacts or timeframes exist for external reporting.
Partially effective(2)
- PE-1External coordination requirements are documented but are not integrated into operational response procedures.
- PE-2Contacts and triggers are defined for some but not all required external parties.
Fully effective(3)
- FE-1Cyber security incident response procedures include documented external coordination requirements with defined triggers, contacts and timeframes.
- FE-2Requirements cover all relevant external parties identified by applicable legal, regulatory, contractual and organisational obligations.
- FE-3Coordination procedures have been exercised or invoked and lessons learnt have been incorporated.
Mappings
Closest match in ISO/IEC 27001: A.5.24, Information security incident management planning and preparation, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.24.
IT.RES-05.1 requires external coordination obligations to be integrated into cyber security incident response activities where required. This is a specific element of the incident management processes, roles and responsibilities that Annex A 5.24 requires the organisation to define, establish and communicate when planning and preparing for incidents. Annex A 5.24 covers incident management planning as a whole, while IT.RES-05.1 addresses only external coordination.
This control depends on A.5.31.
IT.RES-05.1 requires external coordination obligations to be integrated into cyber security incident response activities where required. It depends on Annex A 5.31, which requires legal, statutory, regulatory and contractual requirements and the organisation's approach to meeting them to be identified, documented and kept up to date, because obligations must be identified before they can be built into incident response. Annex A 5.31 covers all information security obligations, while IT.RES-05.1 addresses only those relating to external coordination during incidents.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-AC-ML2.10.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-AC-ML2.10 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered, one specific external obligation.
This control partially overlaps E8-AH-ML2.17.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-AH-ML2.17 requires incidents to be reported to ASD as soon as possible after they occur or are discovered, a concrete example of such an obligation.
This control partially overlaps E8-MF-ML2.11.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered, a narrower case of that requirement.
This control partially overlaps E8-RA-ML2.12.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-RA-ML2.12 requires incidents to be reported to ASD as soon as possible after they occur or are discovered, an external obligation for that response to include.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0043.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-0043 puts this in each system's incident response plan, which must include external reporting, other parties to inform and when to seek investigation by law enforcement or ASD.
This control partially overlaps ISM-0576.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-0576 requires an incident management policy and response plan to be developed, implemented and maintained, the documents where those obligations can be set out.
This control partially overlaps ISM-1784.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-1784 requires the incident management policy and response plan to be exercised at least annually, a chance to test those external coordination steps.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.