Essential Eight AH-ML2.18 Cyber incident response plan is enacted after identification
What it says
Following the identification of a cybersecurity incident, the cybersecurity incident response plan is enacted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishActivate the response plan immediately after identifying a cyber incident.
This control is like having a pre-set plan of action for when a cyber attack happens. It's crucial because acting quickly can stop a problem from getting worse. Without it, a business could face greater damage or downtime if an attack happens and no one knows what to do next.
Free. Save your status, tasks and notes.
Why it matters
Delays in enacting an incident response plan can amplify damage, extend downtime and lead to loss of sensitive data.
How to implement
The IT manager should develop a detailed cyber incident response plan, outlining specific actions to take in the event of a cyber attack.
A security officer should ensure that all staff members are trained on their roles in the incident response plan, regularly conducting practice drills.
The IT team should establish clear communication channels so that everyone knows who to contact immediately when a cyber incident is detected.
System administrators should regularly review and update the incident response plan to include new threats or changes in technology.
Keep it running
Define triggers for incident identification and empower the on-call lead to immediately activate the IR plan, notify stakeholders and start containment steps.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you describe the process for enacting the incident response plan once a cyber incident is identified?
Look at
Request to see the documented incident response plan.
Good evidence
A detailed incident response plan is accessible and has been recently reviewed and updated.
- Check 2 of 2What an auditor asks for
Ask for
How often do you conduct drills for the incident response plan?
Look at
Review logs of recent incident response drills or training sessions.
Good evidence
Drills are conducted regularly, with records showing increased readiness and updated procedures.
Mappings
Closest match in ASD Information Security Manual: ISM-1819, Enact cyber security incident response plans, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.26.
E8-AH-ML2.18 requires that once a cyber security incident is identified, the organisation enacts (activates) its incident response plan. ISO/IEC 27001:2022 Annex A 5.26 requires incidents be responded to in accordance with documented procedures, which encompasses activating and executing an incident response plan as part of those procedures. Annex A 5.26 is broader because it covers the overall requirement to respond to incidents, not just the trigger point immediately after identification.
This control depends on A.5.24.
E8-AH-ML2.18 requires that once an incident is identified, the organisation enacts its incident response plan. Annex A 5.24 requires planning and preparation for incident management by defining, establishing and communicating processes, roles and responsibilities. Enacting a plan in practice (E8-AH-ML2.18) depends on having these processes and roles established and communicated (Annex A 5.24), which is broader preparation rather than incident-time activation.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1819.
E8-AH-ML2.18 requires that following identification of a cyber security incident, the cyber security incident response plan is enacted. ISM-1819 states the same requirement using effectively identical wording and intent, mandating activation of the incident response plan after incident identification. The scope and depth align closely, making these controls directly equivalent in practice.
This control partially overlaps ISM-0123.
ISM-0123 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. E8-AH-ML2.18 requires enacting the incident response plan after an incident is identified, which is facilitated by prompt reporting to senior security leadership. ISM-0123 is a notification/escalation control, whereas E8-AH-ML2.18 addresses activation of response procedures.
This control partially overlaps ISM-1618.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-AH-ML2.18 focuses on enacting the incident response plan once an incident is identified, an activity typically overseen by the CISO for prompt and correct execution. The E8 control emphasises the action trigger, while ISM-1618 highlights leadership and accountability.
This control depends on ISM-0043.
E8-AH-ML2.18 requires that the organisation enacts the cyber security incident response plan immediately after identifying an incident. ISM-0043 requires organisations to develop an incident response plan with defined incident criteria, reporting pathways, responsible authorities, evidence integrity steps, and contingencies. E8-AH-ML2.18 depends on ISM-0043 being satisfied because a plan must exist and be sufficiently defined before it can be enacted meaningfully.
This control depends on ISM-0576.
E8-AH-ML2.18 requires that the incident response plan is enacted following identification of a cyber security incident. ISM-0576 requires a cyber security incident management policy and associated response plan to be developed, implemented and maintained. E8-AH-ML2.18 depends on ISM-0576 because enactment presupposes a maintained policy/plan framework exists and is current.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresPartially overlaps
This control partially overlaps IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; E8-AH-ML2.18 requires the incident response plan to be enacted after an incident is identified, and IT.RES-03.1 adds that the procedures be tested and approved.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.