Essential Eight AC-ML2.11 Cyber security incident response plan is enacted after incident identification
What it says
Following the identification of a cybersecurity incident, the cybersecurity incident response plan is enacted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishActivate the cyber security response plan as soon as an incident is identified.
This control means that your business needs to have a plan ready to respond to cyber attacks as soon as they're identified. Without it, a cyber attack could cause more damage because you might not be prepared to act quickly, costing you time, money, and your reputation.
Free. Save your status, tasks and notes.
Why it matters
If the incident response plan is not enacted immediately after identification, containment is delayed and the incident can spread, increasing financial loss and reputational damage.
How to implement
The security officer should create a detailed cyber security incident response plan, outlining specific actions to take when an attack occurs.
The IT team needs to train staff regularly on the incident response plan, ensuring everyone knows their role and responsibilities.
System administrators should run regular simulations of cyber incidents to test and refine the plan, learning from any gaps discovered.
The chief information security officer should ensure the incident response plan includes up-to-date contact information for all key personnel.
IT managers should review and update the plan at least annually or when significant changes occur in the business or threat landscape.
Keep it running
Maintain a defined on-call incident response roster with clear activation triggers, and run regular drills so the plan is enacted immediately upon incident identification.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation have a documented cyber security incident response plan?
Look at
Examine the cyber security incident response plan document.
Good evidence
The organisation has an up-to-date and comprehensive plan that covers all necessary steps during a cyber incident.
- Check 2 of 2What an auditor asks for
Ask for
How often is the incident response plan tested and updated?
Look at
Check records of incident response simulations or drills and minutes from plan review meetings.
Good evidence
Simulations are conducted regularly, and the plan is reviewed and updated annually.
Mappings
Closest match in ASD Information Security Manual: ISM-1819, Enact cyber security incident response plans, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.26.
E8-AC-ML2.11 requires activating the cyber security incident response plan immediately after an incident is identified. Annex A 5.26 requires that information security incidents are responded to in accordance with documented procedures, which encompasses plan activation as part of executing those procedures. Annex A 5.26 is broader because it covers the full conduct of incident response per procedures, not only the specific activation/enactment step.
This control depends on A.5.24.
E8-AC-ML2.11 requires activating the incident response plan once an incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining, establishing and communicating processes, roles and responsibilities. E8-AC-ML2.11 depends on Annex A 5.24 because plan enactment relies on pre-defined processes and roles being established and communicated beforehand.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1819.
E8-AC-ML2.11 requires that once a cyber security incident is identified, the organisation enacts its cyber security incident response plan. ISM-1819 states the same requirement: following identification of a cyber security incident, the incident response plan is enacted. The scope and trigger condition are substantively identical, making the controls directly interchangeable for this requirement.
This control depends on ISM-0043.
E8-AC-ML2.11 requires that the incident response plan is enacted after identifying a cyber security incident. ISM-0043 specifies the required contents of a cyber security incident response plan (e.g., definitions, reporting paths, authorities, evidence integrity, contingency measures). E8-AC-ML2.11 depends on ISM-0043 in practice because effective enactment presupposes a sufficiently defined plan with roles, reporting and response steps.
This control depends on ISM-0576.
E8-AC-ML2.11 requires enacting the cyber security incident response plan once an incident is identified. ISM-0576 requires the organisation to develop, implement and maintain the incident management policy and associated incident response plan. E8-AC-ML2.11 depends on ISM-0576 because a plan must exist, be implemented, and be maintained before it can be reliably enacted during an incident.
This control depends on ISM-1731.
ISM-1731 requires planning and coordination of intrusion remediation to be conducted using trusted systems separate from a compromised system. E8-AC-ML2.11 requires that the organisation enact its cybersecurity incident response plan after incident identification, and ISM-1731 provides a concrete operational control that helps ensure the response plan can be executed securely without adversary visibility. E8-AC-ML2.11 addresses the governance trigger to commence response, whereas ISM-1731 constrains the tooling and environment used for remediation coordination.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresPartially overlaps
This control partially overlaps IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; E8-AC-ML2.11 requires the incident response plan to be enacted once an incident is identified, the core of that requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.