Essential Eight AH-ML2.17 Report cyber security incidents to ASD promptly
What it says
Cybersecurity incidents are reported to ASD as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReport cyber security incidents to ASD as soon as they're found.
This control is about making sure that any cyber attacks or suspicious activity in your organisation's computer systems are reported to the Australian Signals Directorate (ASD) as soon as you find out about them. This is important because quick reporting helps ASD provide guidance to limit damage and stop similar attacks from happening to anyone else.
Free. Save your status, tasks and notes.
Why it matters
Delayed reporting to ASD allows attackers to operate undetected, increasing damage and reducing the chance to mitigate further attacks.
How to implement
The IT team should set up a process for detecting cyber security incidents.
This can be done by using monitoring tools that alert staff when anomalies are detected.
The IT manager should establish a clear incident reporting procedure.
This involves creating a checklist of what needs to be reported and in what format to the ASD.
The security officer should train staff on recognising and reporting incidents.
Provide training sessions that cover what an incident looks like and whom to inform.
System administrators should ensure communication channels with the ASD are streamlined.
This involves having the correct contact details and communication protocols ready.
The IT team should regularly review and test the incident reporting process.
Conduct mock drills to ensure everyone knows what to do and can act quickly.
Keep it running
Define incident triage and an ASD notification workflow so incidents are reported promptly with accurate, complete details.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Is there a defined process for reporting cyber incidents to ASD?
Look at
Examine the organisation's incident response policy and procedures.
Good evidence
The policy should clearly outline the steps and responsible persons for reporting incidents to ASD.
- Check 2 of 3What an auditor asks for
Ask for
How quickly are incidents typically reported to ASD?
Look at
Review past incident reports and ASD communication records.
Good evidence
Incident reports should show prompt reporting to ASD, ideally within a few hours of discovery.
- Check 3 of 3What an auditor asks for
Ask for
Have staff been trained on incident recognition and reporting?
Look at
Check training records and materials used in staff education.
Good evidence
There should be documentation of recent staff training sessions related to incident reporting and recognition.
Mappings
Closest match in ASD Information Security Manual: ISM-0140, Prompt reporting of cyber incidents to ASD, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.5.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.5 supports this by requiring the organisation to establish and maintain contact with relevant authorities, which enables timely, effective incident notification to bodies such as ASD. Annex A 5.5 does not itself mandate reporting specific incidents, but it facilitates meeting E8-AH-ML2.17 by ensuring the authority contact pathways are in place.
This control partially meets A.5.26.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.26 is broader because it requires organisations to respond to information security incidents in accordance with documented procedures, which can include reporting but also covers containment, eradication, and recovery activities. E8-AH-ML2.17 maps to a specific procedural requirement (external reporting to ASD) within the wider incident response capability expected by Annex A 5.26.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-0140.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same requirement to report cyber security incidents to ASD promptly after occurrence or discovery. The scope, trigger, and recipient (ASD) align closely, so implementing either would largely satisfy the other.
This control partially meets ISM-0043.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0043 is broader because it requires incident response plans that define what constitutes an incident and include how to report incidents externally, including criteria for requesting ASD assistance, as well as other response and evidence-handling steps. E8-AH-ML2.17 is one specific external-notification outcome that would be implemented through the processes ISM-0043 requires.
This control supports ISM-0123.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0123 supports this by requiring incidents to be reported promptly to the CISO (or delegate), creating the internal escalation needed before an organisation can notify ASD quickly and consistently. ISM-0123 addresses internal reporting lines, while E8-AH-ML2.17 addresses external reporting to ASD.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-AH-ML2.17 requires incidents to be reported to ASD as soon as possible after they occur or are discovered, a concrete example of such an obligation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.