Essential Eight MF-ML2.11 Report cyber security incidents to ASD immediately
What it says
Cybersecurity incidents are reported to ASD as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify ASD quickly when a cyber security incident occurs or is discovered.
This control is about reporting any cyber security incidents to the Australian Signals Directorate (ASD) as soon as you find out about them. It's important because a delay in reporting could allow a cyber attack to cause more damage and affect more people.
Free. Save your status, tasks and notes.
Why it matters
Delayed reporting to ASD can worsen an incident, extending attacker dwell time, increasing damage, and raising national security and reputational risk.
How to implement
The IT team should set up a clear process for identifying cyber security incidents.
This can involve installing security software that alerts them to unusual activities.
The security officer should ensure all staff know how to recognise and report a cyber security incident.
This can be done through regular training sessions and clear instructions on whom to contact.
The system administrator should maintain an incident log that includes details of what happened and when it was reported.
This log can be a spreadsheet or a database designed for tracking incidents.
The security manager should develop a relationship with ASD representatives.
This can include setting up regular check-in meetings to discuss cyber security concerns and ensure reporting procedures are understood.
The cyber security officer should create a contact list with phone numbers and email addresses for reporting incidents to ASD.
Distribute this list to key personnel in the organisation.
Keep it running
Report suspected/confirmed incidents to ASD ASAP via approved channels; train staff on triggers and keep contact details, templates and IR playbooks current.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does the organisation ensure incidents are reported to the ASD promptly?
Look at
Review the incident response plan and any logs of past incidents reported.
Good evidence
The response plan includes a step to notify ASD, and there's a log showing incidents were reported promptly with timestamps.
- Check 2 of 2What an auditor asks for
Ask for
What training is in place to teach staff how to recognise and report incidents?
Look at
Examine training materials and attendance records of staff cyber security awareness sessions.
Good evidence
Training records show sessions were held regularly, and materials cover how to report incidents to ASD.
Mappings
Closest match in ASD Information Security Manual: ISM-0140, Prompt reporting of cyber incidents to ASD, which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.5.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.5 supports this by requiring the organisation to establish and maintain contact with relevant authorities, which would include having the right channels and points of contact available for ASD reporting. Annex A 5.5 does not mandate incident reporting or timeliness, but it enables faster, more reliable execution of E8-MF-ML2.11.
This control partially meets A.5.24.
E8-MF-ML2.11 requires timely reporting of cyber security incidents to ASD after occurrence or discovery. Annex A 5.24 is broader because it requires planning and preparation for incident management processes, roles and responsibilities, within which external reporting (including to ASD) would be defined. E8-MF-ML2.11 is a specific reporting requirement that would be implemented as part of the broader incident management framework in Annex A 5.24.
This control partially overlaps A.6.8.
Annex A 6.8 requires the organisation to provide defined channels so personnel and relevant parties can promptly report security events and suspected weaknesses. E8-MF-ML2.11 relates by mandating prompt reporting of cyber security incidents to ASD, which is one possible external reporting channel that could be defined under Annex A 6.8. However, Annex A 6.8 is broader as it also covers establishing reporting mechanisms (including internal reporting and suspected weaknesses), whereas E8-MF-ML2.11 focuses specifically on escalation to ASD after an incident occurs or is discovered.
This control depends on A.5.25.
E8-MF-ML2.11 requires reporting cyber security incidents to ASD as soon as possible after occurrence or discovery. Annex A 5.25 relates as a prerequisite by requiring assessment of security events and a decision on whether they are incidents, which determines what should be reported externally. Annex A 5.25 is about classification/decision-making, while E8-MF-ML2.11 is about the external reporting action once an incident is identified.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-0140.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same requirement explicitly, including the same timing expectation and the same external recipient (ASD). Implementing ISM-0140 would largely satisfy E8-MF-ML2.11 without additional scope changes.
This control partially meets ISM-0043.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0043 is broader because it requires incident response plans that define how to report incidents internally and externally to relevant authorities (including ASD), along with roles, evidence integrity, and escalation criteria. E8-MF-ML2.11 is one specific external-reporting outcome implemented through the broader planning and procedures required by ISM-0043.
This control partially overlaps ISM-0123.
E8-MF-ML2.11 requires prompt external reporting of cyber security incidents to ASD. ISM-0123 overlaps by requiring prompt internal reporting of cyber security incidents to the CISO (or delegate), which is commonly a step in the escalation path before notifying ASD. ISM-0123 is about internal notification and governance, while E8-MF-ML2.11 is specifically about immediate notification to ASD.
This control partially overlaps ISM-0141.
E8-MF-ML2.11 requires organisations to report cyber security incidents to ASD as soon as possible after they occur or are discovered. ISM-0141 relates by requiring contractual terms that force service providers to report incidents quickly to a designated point of contact, which can enable timely onward reporting to ASD. ISM-0141 focuses on third-party contractual governance and designated contacts, while E8-MF-ML2.11 is specifically about reporting to ASD (not contracting mechanics).
This control partially overlaps ISM-0142.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0142 overlaps by mandating rapid reporting of compromises of cryptographic equipment/keying material to the CISO (or delegate), which is a type of incident that may also trigger ASD reporting. ISM-0142 is narrower in incident type and is internal-reporting focused, whereas E8-MF-ML2.11 is external reporting to ASD for incidents more generally.
This control depends on ISM-1228.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-1228 is a prerequisite because events must be analysed in a timely manner to identify which events are incidents that warrant ASD reporting. Without ISM-1228-style analysis and triage, organisations may not reliably discover incidents quickly enough to meet E8-MF-ML2.11 time expectations.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered, a narrower case of that requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.