Essential Eight AC-ML2.10 Report cyber security incidents to ASD quickly
What it says
Cybersecurity incidents are reported to ASD as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify ASD promptly when cyber security incidents occur or are discovered.
If a cyber security incident happens, like hackers trying to break into your business systems, it's crucial to let the Australian Signals Directorate (ASD) know about it as soon as possible. This helps protect not only your business but also others by allowing ASD to provide guidance and possibly stop further attacks.
Free. Save your status, tasks and notes.
Why it matters
Delaying incident reports to ASD can slow threat correlation and response, increasing the chance of ongoing compromise and broader harm.
How to implement
Business owner: Set up a clear process for when and how to report incidents to the ASD, including who is responsible for making the report.
IT manager: Ensure the IT team knows about the ASD reporting requirements and include them in the company's incident response plan.
Security officer: Regularly train staff on recognising cyber incidents and the importance of reporting them quickly.
System administrator: Monitor systems for suspicious activity and prepare draft incident reports ready for quick submission to the ASD.
Keep it running
Document when to notify ASD, keep ASD contact details current, and rehearse the reporting workflow so incidents are reported as soon as discovered.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation have a procedure for reporting cyber incidents to the ASD?
Look at
Review the organisation's incident response plan for steps on reporting to ASD.
Good evidence
The plan includes clear instructions to report incidents to the ASD as soon as they're detected.
- Check 2 of 2What an auditor asks for
Ask for
Has the staff been trained on reporting incidents to the ASD?
Look at
Check training records and materials.
Good evidence
Staff training sessions include information on identifying incidents and reporting them to ASD.
Mappings
Closest match in ASD Information Security Manual: ISM-0140, Prompt reporting of cyber incidents to ASD, which asks for the same thing.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-0140.
E8-AC-ML2.10 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same requirement with the same trigger (occur or discovered), recipient (ASD), and timeliness expectation (as soon as possible). Implementing ISM-0140 would largely satisfy E8-AC-ML2.10 and vice versa.
This control partially overlaps ISM-0142.
ISM-0142 requires organisations to report compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-AC-ML2.10 requires reporting cyber security incidents to ASD promptly, which may be triggered by the same crypto-compromise events that ISM-0142 targets. They overlap on prompt incident notification for crypto-related incidents, but differ in recipient (CISO vs ASD) and scope (crypto-specific vs any cyber incident).
This control depends on ISM-0043.
E8-AC-ML2.10 requires timely reporting of cyber security incidents to ASD after occurrence or discovery. ISM-0043 requires incident response plans to define how to report incidents internally and externally to relevant authorities, including criteria for requesting ASD assistance. ISM-0043 is broader planning and process guidance, while E8-AC-ML2.10 is a specific operational obligation to notify ASD quickly.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-AC-ML2.10 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered, one specific external obligation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.