Essential Eight AC-ML2.9 Cyber security incidents are reported promptly to CISO
What it says
Cybersecurity incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReport security incidents quickly to the security chief or their team.
If a cyber security incident happens, it's important to let the person in charge of security know as soon as possible. This helps the organisation respond quickly to limit the damage and prevent further issues from developing. Without this control, an incident might go unnoticed, leading to severe consequences like data breaches or loss of trust.
Free. Save your status, tasks and notes.
Why it matters
Delayed incident reporting risks escalating breaches, potentially compromising sensitive data and damaging organisational reputation.
How to implement
The IT team should set up an internal procedure for reporting cyber security incidents.
This can be done by creating a simple, easy-to-follow guide for staff on what incidents to report, how, and to whom.
Security officers should establish a dedicated communication channel, like a phone line or an email address, for reporting incidents.
Make sure this channel is monitored regularly by trained personnel.
Systems administrators must ensure all staff know who the Chief Information Security Officer (CISO) or their delegate is.
This can be achieved through regular communication and training sessions.
The HR department should include incident reporting protocols as part of new employee onboarding.
They can do this by integrating it into the initial training materials and orientation sessions.
Security officers should conduct periodic drills or exercises simulating security incidents to ensure staff are familiar with the reporting procedure.
The IT team should regularly review and update the incident reporting procedure to keep up with evolving cyber threats.
Make sure any changes are communicated to all staff promptly.
Keep it running
Document and publicise an incident reporting workflow with CISO/delegate contact paths, and run periodic drills to ensure incidents are reported immediately on discovery.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Are team members aware of the procedure for reporting cyber security incidents?
Look at
Check training records for mentions of incident reporting procedures.
Good evidence
Staff training files indicate regular sessions covering incident reporting, with clear documentation of procedures shared.
- Check 2 of 3What an auditor asks for
Ask for
Is there a dedicated communication channel for incident reporting?
Look at
Review the contact details and accessibility of the channel for reporting incidents.
Good evidence
A dedicated, monitored communication channel is available, with clear instructions on usage, showing evidence of regular monitoring.
- Check 3 of 3What an auditor asks for
Ask for
How quickly are incidents reported to the CISO or their delegate?
Look at
Examine incident logs and reports for timestamps showing when incidents were reported.
Good evidence
Logs display consistent timestamps of quick reporting to the CISO or delegate, with incidents reported within the expected timeframe.
Mappings
Closest match in ASD Information Security Manual: ISM-0123, Report cyber security incidents promptly, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.26.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate) after they occur or are discovered. Annex A 5.26 requires organisations to respond to information security incidents in accordance with documented procedures, which typically includes reporting and escalation steps. E8-AC-ML2.9 is a specific reporting/escalation requirement within the broader incident response procedural framework described by Annex A 5.26.
This control partially overlaps A.6.8.
Annex A 6.8 requires the organisation to provide defined channels for prompt reporting of security events and suspected weaknesses. E8-AC-ML2.9 relates by mandating that cyber security incidents are reported promptly to the CISO or delegate, which is a defined internal reporting channel. Annex A 6.8 is broader because it encompasses reporting of suspected weaknesses and reporting by other relevant parties, not only incident escalation to the CISO.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-0123.
E8-AC-ML2.9 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery. ISM-0123 states the same reporting requirement to the CISO (or delegate) with the same urgency trigger. Both controls are aligned in intent, audience and timing, making implementation of one largely satisfy the other.
This control is broader than ISM-0142.
E8-AC-ML2.9 requires all cyber security incidents to be reported to the CISO (or delegate) as soon as possible. ISM-0142 requires prompt reporting to the CISO (or delegate) specifically for compromise or suspected compromise of cryptographic equipment or keying material. ISM-0142 is a specific incident subtype within the broader reporting obligation described by E8-AC-ML2.9.
This control partially meets ISM-0714.
ISM-0714 requires the organisation to appoint a CISO to provide cyber security leadership and guidance. E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate), which assumes the CISO role exists and is identifiable. ISM-0714 is therefore broader in establishing the leadership role that enables the reporting pathway specified by E8-AC-ML2.9.
This control partially overlaps ISM-0140.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-0140 requires incidents to be reported to ASD as soon as possible, which is a different reporting destination and external escalation path. They overlap on the principle of prompt incident reporting, but each control targets a different audience (internal executive vs external authority).
This control partially overlaps ISM-1803.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-1803 requires documenting and reporting details of incidents in an incident register, including to whom the incident was reported, which evidences that reporting occurred. ISM-1803 focuses on recordkeeping and completeness of incident details, while E8-AC-ML2.9 focuses on timeliness and the specific recipient (CISO).
This control partially overlaps ISM-1819.
ISM-1819 requires that once a cyber security incident is identified, the organisation activates its incident response plan. E8-AC-ML2.9 focuses on promptly reporting incidents to the CISO or delegate, which commonly occurs as part of enacting an incident response plan. The candidate is about escalation and notification, whereas ISM-1819 is about triggering the whole response capability, including containment and recovery activities.
This control supports ISM-0733.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-0733 requires that the CISO is fully aware of all cyber security incidents in the organisation, which is achieved in practice through timely reporting and escalation pathways. E8-AC-ML2.9 is one concrete mechanism to meet the broader awareness outcome required by ISM-0733.
This control supports ISM-1618.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-1618 assigns the CISO responsibility to oversee the organisation's response to cyber security incidents, which depends on timely visibility of incidents. Prompt reporting per E8-AC-ML2.9 strengthens the CISO's ability to fulfil the oversight role described in ISM-1618, though ISM-1618 is broader than reporting alone.
This control depends on ISM-0125.
ISM-0125 requires an organisation to develop, implement and maintain a cyber security incident register to record incidents. E8-AC-ML2.9 requires incidents be reported promptly to the CISO (or delegate), and the register supports this by providing the mechanism to document discovery time, reporting time, and incident particulars. ISM-0125 is about maintaining the register, whereas E8-AC-ML2.9 is about timely internal reporting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.