Essential Eight AH-ML2.16 Cyber security incidents must be reported immediately to the CISO
What it says
Cybersecurity incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReport any cyber security incidents to the Chief Information Security Officer as soon as they happen.
This control is about making sure that any cyber attacks or breaches are quickly reported to the person who oversees computer security in your business. This matters because the sooner you report a problem, the faster it can be dealt with to prevent further harm or data loss.
Free. Save your status, tasks and notes.
Why it matters
Delayed incident reporting can impede effective response, risking greater data loss, reputational damage, and non-compliance penalties.
How to implement
Security Officer should inform all employees about the importance of reporting cyber incidents immediately and clearly define what constitutes an incident.
IT team should establish a straightforward reporting process for employees, such as a dedicated email address or phone number to use when security incidents occur.
System administrator should set up real-time alerts and monitoring tools to automatically notify the security team when certain thresholds indicating potential incidents are crossed.
HR department should integrate cyber security incident reporting protocols into employee onboarding training.
Security Officer should conduct regular training sessions for staff on recognising and reporting cyber security incidents to ensure readiness.
Keep it running
Publish clear CISO/delegate reporting channels and escalation steps; train staff to report incidents immediately and test the process with regular exercises.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are cyber security incidents reported and to whom?
Look at
Review the incident response protocol documents to see if there is a clear reporting chain to the Chief Information Security Officer.
Good evidence
The protocol documents should show a designated and clear procedure for incident reporting directly to the CISO, including contact methods and responsible individuals.
- Check 2 of 2What an auditor asks for
Ask for
How quickly do incidents get reported to the CISO?
Look at
Examine records of previously reported incidents to verify timestamps and confirm they align with the organisation's immediate reporting requirement.
Good evidence
Incident reports should show that communication with the CISO or their delegate happens immediately or very soon after detection.
Mappings
Closest match in ASD Information Security Manual: ISM-0123, Report cyber security incidents promptly, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.24.
E8-AH-ML2.16 requires prompt reporting of cyber security incidents to the CISO (or delegate). ISO/IEC 27001:2022 Annex A 5.24 requires planning and preparation for incident management, including defining and communicating roles, responsibilities and processes. E8-AH-ML2.16 is a specific role-based reporting requirement that sits within the broader incident management framework required by Annex A 5.24.
This control partially overlaps A.6.8.
Annex A 6.8 requires mechanisms and defined channels for prompt reporting of security events and suspected weaknesses. E8-AH-ML2.16 relates by requiring immediate reporting of cyber security incidents to the CISO or delegate, specifying a key internal reporting route. The Essential Eight control is narrower (incident-to-CISO escalation), whereas Annex A 6.8 is broader and includes suspected weaknesses and reporting by other relevant parties via multiple channels.
ASD Information Security Manual: 14 mappings
This control is equivalent to ISM-0123.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0123 states the same requirement using essentially identical wording, including the same recipient (CISO/delegate) and the same timeliness expectation. Implementing ISM-0123 would largely satisfy E8-AH-ML2.16 with no material gap.
This control is equivalent to ISM-0733.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery. ISM-0733 requires that the CISO is fully aware of all cyber security incidents within the organisation, which in practice is achieved via immediate reporting/escalation to the CISO or their delegates. ISM-0733 is framed as an outcome (CISO awareness) while E8-AH-ML2.16 is the procedural requirement (immediate reporting), but they are substantially the same intent and scope.
This control is broader than ISM-0714.
ISM-0714 requires appointing a CISO to lead and guide cyber security across IT and OT. E8-AH-ML2.16 mandates that incidents are reported immediately to the CISO (or delegate), which relies on the existence of that CISO function and its authority to receive escalations. ISM-0714 establishes the role and leadership accountability, while E8-AH-ML2.16 is a specific procedural requirement for incident reporting.
This control partially meets ISM-0043.
E8-AH-ML2.16 requires immediate reporting of cyber security incidents to the CISO (or delegate). ISM-0043 requires a cyber security incident response plan that includes how to report incidents internally and externally and who must be informed. E8-AH-ML2.16 is one specific reporting rule that would be documented within the broader ISM-0043 planning requirement.
This control partially meets ISM-0576.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible. ISM-0576 requires an incident management policy and associated incident response plan to be developed, implemented and maintained. E8-AH-ML2.16 is a specific operational reporting expectation that would typically be defined and governed through the broader policy/plan framework required by ISM-0576.
This control partially overlaps ISM-0140.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0140 focuses on reporting cyber security incidents to ASD as soon as possible. They overlap on the principle of prompt incident reporting, but they differ in the required reporting recipient (internal CISO vs external ASD).
This control partially overlaps ISM-0142.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery. ISM-0142 requires reporting to the CISO (or delegate) as soon as possible, but only for compromise or suspected compromise of cryptographic equipment or keying material. ISM-0142 is narrower in incident type, while E8-AH-ML2.16 is broader across cyber security incidents generally.
This control partially overlaps ISM-1088.
ISM-1088 requires personnel to rapidly report potential compromise of mobile devices, removable media, or credentials, particularly when travelling overseas and interacting with foreign officials or observing unusual device behaviour. E8-AH-ML2.16 requires cyber security incidents to be reported immediately to the CISO (or delegate) once they occur or are discovered. They overlap on the requirement for prompt incident reporting, but ISM-1088 is more specific to overseas mobile/credential compromise scenarios, while E8-AH-ML2.16 is broader on incident types but narrower on the mandated recipient (CISO).
This control partially overlaps ISM-1618.
E8-AH-ML2.16 requires cyber security incidents to be reported immediately to the CISO (or delegate). ISM-1618 requires the CISO to oversee the organisation's response to cyber security incidents, which relies on the CISO being notified and engaged early. ISM-1618 extends beyond reporting into coordination and management of response activities, while E8-AH-ML2.16 is limited to the escalation/notification requirement.
This control partially overlaps ISM-1803.
ISM-1803 mandates the documentation of cyber security incidents in a register, including timing, details, actions, and reporting pathways. E8-AH-ML2.16 overlaps by enforcing prompt reporting to the CISO, relevant to ISM-1803's reporting field. It does not cover the complete register or action documentation.
This control partially overlaps ISM-1819.
ISM-1819 requires the organisation to enact its cyber security incident response plan following identification of an incident. E8-AH-ML2.16 requires incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery, which is a common initiation activity within many response plans. E8-AH-ML2.16 emphasises internal escalation/reporting, while ISM-1819 emphasises activation of the broader response plan (which may include many actions beyond notifying the CISO).
This control supports ISM-0125.
E8-AH-ML2.16 requires immediate reporting of cyber security incidents to the CISO (or delegate). ISM-0125 requires a cyber security incident register to be developed, implemented and maintained, which supports demonstrating and tracking that incidents were reported and escalated appropriately. ISM-0125 does not itself mandate reporting to the CISO or timeliness, but it strengthens governance and auditability of E8-AH-ML2.16.
This control supports ISM-0141.
E8-AH-ML2.16 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-0141 supports this by requiring contractual arrangements to mandate service providers report incidents promptly to a designated point of contact, which can be the CISO/delegate. ISM-0141 is supplier/contract focused, while E8-AH-ML2.16 is an internal organisational reporting requirement.
This control supports ISM-1881.
ISM-1881 requires timely reporting of cyber incidents (without customer data involvement) to customers and the public. E8-AH-ML2.16 requires immediate reporting of incidents to the CISO, which is typically required to validate the incident, approve messaging, and coordinate external communications. E8-AH-ML2.16 does not cover communications to external parties, only internal escalation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.