Essential Eight MF-ML2.12 Cyber security incident response plan enacted after incident identification
What it says
Following the identification of a cybersecurity incident, the cybersecurity incident response plan is enacted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishActivate the response plan immediately once a cyber incident is detected.
This control is about having a plan ready to respond to cyber incidents as soon as they're detected. It matters because quick action can reduce damage from attacks, limit downtime, and protect sensitive information from being misused.
Free. Save your status, tasks and notes.
Why it matters
Delays in enacting the incident response plan after an incident is identified can worsen breaches, slow recovery, and increase damage.
How to implement
Security officer should ensure there is a clear incident response plan in place by developing a document that details roles, responsibilities, and step-by-step actions following a cyber incident.
IT team should regularly update the incident response plan by reviewing it quarterly and making necessary changes to reflect new threats or organisational changes.
System administrator should test the incident response plan by conducting simulated incident scenarios to ensure staff know their roles and responsibilities.
Management should communicate the incident response plan to all staff by organising training sessions to familiarise employees with the procedures and steps involved.
Security officer should coordinate a review after a real or simulated incident by gathering input from all involved to identify areas of improvement.
Keep it running
Define who can declare an incident and trigger the response plan; practise activation regularly so containment and communications start immediately.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation have a documented incident response plan?
Look at
Examine the incident response plan document and ensure it is up-to-date and comprehensive.
Good evidence
The organisation provides a current incident response plan that outlines roles, responsibilities, and specific incident management procedures.
- Check 2 of 2What an auditor asks for
Ask for
How often is the incident response plan tested?
Look at
Review records of incident response plan tests or drills.
Good evidence
The organisation conducts regular tests of the incident response plan, with documented results and evidence of improvements made thereafter.
Mappings
Closest match in ASD Information Security Manual: ISM-1819, Enact cyber security incident response plans, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.5.29.
Annex A 5.29 requires planning to maintain information security during disruptions. E8-MF-ML2.12 overlaps by requiring that, once a cyber security incident is identified, the incident response plan is enacted, which is an operational step that maintains security during a disruptive incident. E8-MF-ML2.12 is narrower because it triggers only after incident identification, while Annex A 5.29 also requires pre-planned arrangements for maintaining security across broader disruption types and timeframes.
This control depends on A.5.24.
E8-MF-ML2.12 requires the organisation to enact its incident response plan once a cyber incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining processes, roles and responsibilities, which is foundational to having an enactable plan. In practice, E8-MF-ML2.12 relies on the preparatory activities in Annex A 5.24 to ensure activation is actionable and properly owned.
This control depends on A.5.25.
E8-MF-ML2.12 requires enacting the incident response plan after a cyber security incident is identified. ISO/IEC 27001:2022 Annex A 5.25 is a prerequisite because it requires assessing events and deciding whether they are incidents, which establishes the point at which the response plan should be activated. Annex A 5.25 is about classification/decision-making, while E8-MF-ML2.12 is about the subsequent activation of response actions.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1819.
E8-MF-ML2.12 requires that once a cyber security incident is identified, the organisation enacts (activates) its cyber security incident response plan. ISM-1819 states the same requirement: following identification of an incident, the incident response plan is enacted. The scope and trigger condition (incident identification) align closely, with no material difference in depth.
This control is broader than ISM-1805.
ISM-1805 requires a denial-of-service (DoS) response plan specifically for video conferencing and IP telephony, including identification, source tracing, maintaining capability, and response actions. E8-MF-ML2.12 requires that an incident response plan is enacted once a cybersecurity incident is identified, which would include enacting the DoS response plan when a DoS is confirmed. E8-MF-ML2.12 is broader on incident type but narrower on the DoS-specific planning detail that ISM-1805 mandates.
This control partially overlaps ISM-1618.
E8-MF-ML2.12 requires the organisation to activate its cyber security incident response plan immediately after a cyber incident is identified. ISM-1618 focuses on governance by requiring the CISO to oversee the organisation's incident response, which includes ensuring plan activation occurs appropriately. ISM-1618 adds role-accountability and oversight expectations that E8-MF-ML2.12 does not specify, while E8-MF-ML2.12 is explicit about the enactment trigger.
This control supports ISM-0123.
ISM-0123 requires prompt reporting of cyber security incidents to the CISO (or delegate) after occurrence or discovery. E8-MF-ML2.12 requires the incident response plan to be enacted following identification, which is a key action that generally depends on timely notification and escalation. ISM-0123 focuses on who is told and when, while E8-MF-ML2.12 focuses on what is done after identification.
This control depends on ISM-0043.
E8-MF-ML2.12 requires that following identification of a cyber security incident, the incident response plan is enacted. ISM-0043 specifies the required contents of cyber security incident response plans (e.g., reporting pathways, investigation authority, evidence integrity and contingency measures), which must exist for enactment to be meaningful. E8-MF-ML2.12 therefore depends on ISM-0043 to ensure the plan is sufficiently defined to be activated and executed.
This control depends on ISM-0576.
E8-MF-ML2.12 requires enacting the incident response plan after identifying a cyber incident. ISM-0576 requires that an incident management policy and associated incident response plan are developed, implemented and maintained, which is a prerequisite for activation. Without the ISM-0576 artefacts in place, E8-MF-ML2.12 cannot be reliably satisfied beyond ad hoc response.
This control depends on ISM-1784.
E8-MF-ML2.12 requires the organisation to enact its incident response plan once an incident is identified. ISM-1784 requires the incident management policy and response plan to be exercised at least annually, which improves readiness to activate and execute the plan when a real incident occurs. ISM-1784 strengthens effectiveness and timeliness of enactment but does not itself require enactment upon identification.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresPartially overlaps
This control partially overlaps IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; E8-MF-ML2.12 requires the incident response plan to be enacted following identification of an incident, the point where those procedures are put to use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.