Essential Eight MF-ML2.10 Report cyber security incidents to the Chief Information Security Officer promptly
What it says
Cybersecurity incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify the Chief Information Security Officer quickly after discovering cyber attacks.
This control is about making sure that any cyber attacks or suspicious activities are reported quickly to the person in charge of your organisation's cyber security. This is important because the sooner they know about a problem, the quicker they can act to fix it and protect your business from potential damage.
Free. Save your status, tasks and notes.
Why it matters
Delayed incident reporting can worsen damage, lead to missed regulatory deadlines, and hinder timely containment and remediation actions.
How to implement
The IT team should establish a clear process for reporting cyber incidents.
This can be done by creating a simple online form or hotline that staff members can use when they notice anything suspicious.
The Chief Information Security Officer (CISO) or their delegate should provide regular training to all employees about recognising cyber threats.
This includes covering phishing emails and suspicious system behaviour.
The IT department should implement a monitoring system for logging cyber security events.
Use a system that can alert the team and the Chief Information Security Officer immediately when potential incidents occur.
The security officer should schedule regular check-ins with department heads to ensure awareness of the incident reporting process.
This is done through monthly meetings or newsletters.
Keep it running
Define a 24/7 reporting path so incidents are notified to the CISO (or delegate) immediately on detection, with clear triggers, contacts, and required incident details.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do employees report cyber security incidents?
Look at
Examine the incident reporting process documentation and logs of reported incidents.
Good evidence
Employees report incidents through a clearly defined process, and all reports are logged promptly.
- Check 2 of 2What an auditor asks for
Ask for
What training is provided to staff about cyber incident awareness?
Look at
Verify training records and materials on security awareness provided to employees.
Good evidence
Regular training sessions are held, and materials are available that cover how to recognise and report incidents.
Mappings
Closest match in ASD Information Security Manual: ISM-0123, Report cyber security incidents promptly, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.26.
E8-MF-ML2.10 requires cyber security incidents to be reported to the Chief Information Security Officer (CISO) or delegates as soon as possible after occurrence or discovery. Annex A 5.26 requires incidents to be responded to in accordance with documented procedures, which typically include escalation and internal reporting to accountable roles such as the CISO. Annex A 5.26 is broader because it covers the full incident response process, whereas E8-MF-ML2.10 focuses specifically on prompt reporting/escalation to the CISO.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-0123.
E8-MF-ML2.10 requires cyber security incidents to be reported to the CISO or delegates as soon as possible after occurrence or discovery. ISM-0123 states the same requirement: report cyber security incidents to the chief information security officer, or delegates, as soon as possible after they occur or are discovered. Both controls have the same reporting target (CISO/delegates) and the same timeliness expectation.
This control is equivalent to ISM-0733.
ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation. E8-MF-ML2.10 explicitly requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered, which directly implements the awareness requirement. Both controls are materially aligned; E8-MF-ML2.10 expresses the requirement as a reporting rule rather than an end-state.
This control is broader than ISM-0142.
ISM-0142 requires organisations to report the compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-MF-ML2.10 similarly mandates prompt reporting of cyber security incidents to the CISO, which would include incidents involving compromised cryptographic devices or keys. The Essential Eight control is broader because it covers all cyber security incidents, not specifically cryptographic compromises.
This control partially overlaps ISM-0140.
E8-MF-ML2.10 requires cyber security incidents to be reported internally to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0140 requires prompt reporting of cyber security incidents to ASD, which is an external reporting pathway that may be triggered in parallel to internal escalation. The controls align on urgency and incident reporting, but differ on recipient and governance scope (internal executive escalation vs external authority notification).
This control partially overlaps ISM-1803.
ISM-1803 calls for an incident register capturing key incident details. E8-MF-ML2.10 overlaps as it requires incidents to be reported to the CISO soon after detection, aligning with ISM-1803's documentation of reporting recipients. Maintaining a register or recording response actions is not addressed by E8-MF-ML2.10.
This control supports ISM-0043.
E8-MF-ML2.10 requires that incidents be reported promptly to the CISO (or delegate). ISM-0043 requires incident response plans to define what constitutes an incident and how to report incidents internally and externally, including who must be informed. In practice, having ISM-0043 in place provides the defined channels and responsibilities that E8-MF-ML2.10 relies on to achieve consistent, prompt reporting.
This control depends on ISM-0252.
E8-MF-ML2.10 requires prompt reporting of cyber security incidents to the CISO (or delegate). ISM-0252 requires annual awareness training that includes security contacts and reporting of incidents and suspected compromises, which equips personnel to recognise when and how to report. While E8-MF-ML2.10 is the reporting requirement, ISM-0252 is a prerequisite enabler to ensure staff can execute that reporting pathway consistently and quickly.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.