Skip to content
arrow_back
E8-MF-ML2.11
search account_circle
boltASD Essential Eight

Essential Eight MF-ML2.11Report cyber security incidents to ASD immediately

Official control statement

Cybersecurity incidents are reported to ASD as soon as possible after they occur or are discovered.
boltASD Essential EightE8-MF-ML2.11

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Notify ASD quickly when a cyber security incident occurs or is discovered.

ML2Essential EightMulti-factor authentication
Control Stack classificationResponsiveIncident reportingInformation sharing
record_voice_over

What this means in practice

This control is about reporting any cyber security incidents to the Australian Signals Directorate (ASD) as soon as you find out about them. It's important because a delay in reporting could allow a cyber attack to cause more damage and affect more people.

Framework

ASD Essential Eight

Control effect (Control Stack)

Responsive

E8 mitigation strategy

Multi-factor authentication

Classifications

N/A

Official last update

N/A

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML2

priority_high

Why it matters

Delayed reporting to ASD can worsen an incident, extending attacker dwell time, increasing damage, and raising national security and reputational risk.

settings

Operational notes

Report suspected/confirmed incidents to ASD ASAP via approved channels; train staff on triggers and keep contact details, templates and IR playbooks current.

build

Implementation tips

  • The IT team should set up a clear process for identifying cyber security incidents. This can involve installing security software that alerts them to unusual activities.
  • The security officer should ensure all staff know how to recognise and report a cyber security incident. This can be done through regular training sessions and clear instructions on whom to contact.
  • The system administrator should maintain an incident log that includes details of what happened and when it was reported. This log can be a spreadsheet or a database designed for tracking incidents.
  • The security manager should develop a relationship with ASD representatives. This can include setting up regular check-in meetings to discuss cyber security concerns and ensure reporting procedures are understood.
  • The cyber security officer should create a contact list with phone numbers and email addresses for reporting incidents to ASD. Distribute this list to key personnel in the organisation.
fact_check

Audit / evidence tips

  • AskHow does the organisation ensure incidents are reported to the ASD promptly?
  • Look atReview the incident response plan and any logs of past incidents reported
  • GoodThe response plan includes a step to notify ASD, and there's a log showing incidents were reported promptly with timestamps
  • AskWhat training is in place to teach staff how to recognise and report incidents?
  • Look atExamine training materials and attendance records of staff cyber security awareness sessions
  • GoodTraining records show sessions were held regularly, and materials cover how to report incidents to ASD
link

Cross-framework mappings

How E8-MF-ML2.11 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

ControlNotesDetails
layersPartially meets(2)expand_less
Annex A 5.5E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered
Annex A 5.24E8-MF-ML2.11 requires timely reporting of cyber security incidents to ASD after occurrence or discovery
sync_altPartially overlaps(1)expand_less
Annex A 6.8Annex A 6.8 requires the organisation to provide defined channels so personnel and relevant parties can promptly report security events a...
extensionDepends on(1)expand_less
Annex A 5.25E8-MF-ML2.11 requires reporting cyber security incidents to ASD as soon as possible after occurrence or discovery

ASD ISM

ControlNotesDetails
equalEquivalent(1)expand_less
ISM-0140E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered
layersPartially meets(1)expand_less
ISM-0043E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered
sync_altPartially overlaps(3)expand_less
ISM-0123E8-MF-ML2.11 requires prompt external reporting of cyber security incidents to ASD
ISM-0141E8-MF-ML2.11 requires organisations to report cyber security incidents to ASD as soon as possible after they occur or are discovered
ISM-0142E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered
extensionDepends on(1)expand_less
ISM-1228E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Related Essential 8 controls in Multi-factor authentication

E8-MF-ML2.8
Timely analysis of event logs from internet-facing servers
E8-MF-ML2.9
Cyber security events are analysed to identify incidents timely
E8-MF-ML2.10
Report cyber security incidents to the Chief Information Security Officer promptly
E8-MF-ML2.12
Cyber security incident response plan enacted after incident identification
E8-MF-ML3.1
Multi-factor authentication is used to authenticate users of data repositories
E8-MF-ML3.2
Phishing-resistant multi-factor authentication for online customer services

See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.

Mapping detail

Mapping

Direction

Controls