Essential Eight MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptly
Official control statement
Cybersecurity incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Notify the Chief Information Security Officer quickly after discovering cyber attacks.
What this means in practice
This control is about making sure that any cyber attacks or suspicious activities are reported quickly to the person in charge of your organisation's cyber security. This is important because the sooner they know about a problem, the quicker they can act to fix it and protect your business from potential damage.
Framework
ASD Essential Eight
Control effect (Control Stack)
Responsive
E8 mitigation strategy
Multi-factor authentication
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML2
Why it matters
Delayed incident reporting can worsen damage, lead to missed regulatory deadlines, and hinder timely containment and remediation actions.
Operational notes
Define a 24/7 reporting path so incidents are notified to the CISO (or delegate) immediately on detection, with clear triggers, contacts, and required incident details.
Implementation tips
- The IT team should establish a clear process for reporting cyber incidents. This can be done by creating a simple online form or hotline that staff members can use when they notice anything suspicious.
- The Chief Information Security Officer (CISO) or their delegate should provide regular training to all employees about recognising cyber threats. This includes covering phishing emails and suspicious system behaviour.
- The IT department should implement a monitoring system for logging cyber security events. Use a system that can alert the team and the Chief Information Security Officer immediately when potential incidents occur.
- The security officer should schedule regular check-ins with department heads to ensure awareness of the incident reporting process. This is done through monthly meetings or newsletters.
Audit / evidence tips
- AskHow do employees report cyber security incidents?
- Look atExamine the incident reporting process documentation and logs of reported incidents
- GoodEmployees report incidents through a clearly defined process, and all reports are logged promptly
- AskWhat training is provided to staff about cyber incident awareness?
- Look atVerify training records and materials on security awareness provided to employees
- GoodRegular training sessions are held, and materials are available that cover how to recognise and report incidents
Cross-framework mappings
How E8-MF-ML2.10 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.26 | E8-MF-ML2.10 requires cyber security incidents to be reported to the Chief Information Security Officer (CISO) or delegates as soon as po... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(2)expand_less | ||
| ISM-0123 | E8-MF-ML2.10 requires cyber security incidents to be reported to the CISO or delegates as soon as possible after occurrence or discovery | |
| ISM-0733 | ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation | |
open_in_fullBroader than(1)expand_less | ||
| ISM-0142 | ISM-0142 requires organisations to report the compromise or suspected compromise of cryptographic equipment or associated keying material... | |
sync_altPartially overlaps(2)expand_less | ||
| ISM-0140 | E8-MF-ML2.10 requires cyber security incidents to be reported internally to the CISO (or delegate) as soon as possible after they occur o... | |
| ISM-1803 | ISM-1803 calls for an incident register capturing key incident details | |
handshakeSupports(1)expand_less | ||
| ISM-0043 | E8-MF-ML2.10 requires that incidents be reported promptly to the CISO (or delegate) | |
extensionDepends on(1)expand_less | ||
| ISM-0252 | E8-MF-ML2.10 requires prompt reporting of cyber security incidents to the CISO (or delegate) | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Multi-factor authentication
See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.