Essential Eight RA-ML2.11 Report cyber incidents to the CISO promptly
What it says
Cybersecurity incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReport security incidents to the security officer quickly after finding them.
This control means that whenever there's a suspected cyber security incident, such as a data breach or hacking attempt, it needs to be reported to the Chief Information Security Officer (CISO) or their delegate immediately. This matters because quick reporting allows the organisation to respond swiftly, minimising potential damage and costs.
Free. Save your status, tasks and notes.
Why it matters
Failure to promptly report incidents to the CISO can delay crisis management, worsening data breaches and increasing recovery costs.
How to implement
Security Officer: Ensure all staff know who the CISO or their delegate is so they can report incidents quickly.
IT Team: Set up a clear and simple procedure for staff to report security incidents, such as a dedicated phone line or email address.
System Administrator: Regularly review and test the incident reporting procedure to make sure it's efficient and easy to use.
Business Manager: Include a basic overview of what constitutes a cyber incident in staff training sessions so everyone has a clear understanding.
Keep it running
Escalate suspected cyber security incidents to the CISO (or delegate) via the defined process immediately upon discovery, and record time and details.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are staff trained to recognise and report cyber security incidents?
Look at
Examine training materials and records of training sessions.
Good evidence
Shows regular and comprehensive training sessions have been conducted and documented.
- Check 2 of 2What an auditor asks for
Ask for
Is there a procedure in place for reporting incidents to the CISO promptly?
Look at
Review the written procedure for incident reporting.
Good evidence
The procedure is documented, accessible, and includes clear steps and contact information.
Mappings
Closest match in ASD Information Security Manual: ISM-0123, Report cyber security incidents promptly, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.24.
E8-RA-ML2.11 calls for prompt incident reporting to the CISO (or delegate). Annex A 5.24 mandates preparation for incident management by establishing roles and responsibilities. E8-RA-ML2.11 is a specific escalation action under the broader Annex A 5.24 framework.
This control partially meets A.5.26.
E8-RA-ML2.11 requires incidents to be reported to the CISO promptly for governance. Annex A 5.26 mandates incident response based on procedures, which is enhanced when the CISO is informed. E8-RA-ML2.11 focuses on escalating to the CISO, while Annex A 5.26 focuses on executing a response.
This control partially meets A.6.8.
E8-RA-ML2.11 requires prompt incident escalation to the CISO (or delegate). Annex A 6.8 mandates defined channels for personnel to report security events promptly. E8-RA-ML2.11 is a specific internal escalation requirement, while Annex A 6.8 is broader.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-0123.
E8-RA-ML2.11 requires cyber security incidents to be reported to the CISO (or delegate). ISM-0123 states this requirement using similar wording. Implementing ISM-0123 satisfies E8-RA-ML2.11 without material scope differences.
This control is broader than ISM-0142.
ISM-0142 requires organisations to report the compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-RA-ML2.11 requires prompt reporting of cyber security incidents to the CISO, which would encompass cryptographic compromises when they arise as incidents. ISM-0142 is more specific in scope (crypto equipment/keying material), while the candidate is organisation-wide for incidents generally.
This control partially meets ISM-0043.
E8-RA-ML2.11 requires prompt incident reporting to the CISO (or delegate). ISM-0043 requires incident response plans to define reporting processes, including who must be informed. E8-RA-ML2.11 is a specific expectation within the broader ISM-0043 requirements.
This control partially meets ISM-0576.
E8-RA-ML2.11 requires reporting cyber incidents to the CISO promptly. ISM-0576 requires an incident management policy, which defines escalation paths, including CISO notification. E8-RA-ML2.11 specifies an escalation requirement within ISM-0576 governance.
This control partially overlaps ISM-0140.
E8-RA-ML2.11 requires cyber security incidents to be reported promptly to the CISO (or delegate) after they occur or are discovered. ISM-0140 also mandates prompt reporting, but the recipient is ASD rather than the internal CISO function. They overlap on the need for rapid incident notification, but each control targets a different reporting destination (internal executive oversight vs external authority notification).
This control partially overlaps ISM-0141.
E8-RA-ML2.11 requires prompt reporting of cyber incidents to the CISO (or delegate) when incidents occur or are discovered. ISM-0141 requires contractual obligations for service providers to report incidents promptly to a designated point of contact. The overlap is in timeliness and formal reporting pathways, but ISM-0141 is supplier/contract focused and may not specifically require reporting to the CISO unless that is the designated contact.
This control partially overlaps ISM-0733.
E8-RA-ML2.11 requires cyber security incidents to be reported to the CISO (or delegate) promptly. ISM-0733 emphasises CISO awareness of all incidents, which depends on prompt reporting. E8-RA-ML2.11 is timeliness-focused while ISM-0733 is outcome-focused, but they address the core requirement of CISO incident awareness.
This control partially overlaps ISM-1088.
ISM-1088 requires personnel to rapidly report potential compromise of mobile devices, removable media, or credentials, particularly in overseas situations such as device seizure, forced decryption, or suspicious behaviour. E8-RA-ML2.11 requires cyber security incidents to be reported promptly to the CISO (or delegate) after occurrence or discovery. They overlap in driving timely reporting, but ISM-1088 is tailored to travel-related mobile/credential compromise triggers, whereas E8-RA-ML2.11 is a general reporting requirement focused on notifying the CISO.
This control partially overlaps ISM-1803.
E8-RA-ML2.11 focuses on timely reporting of incidents to the CISO (or delegate). ISM-1803 requires incident documentation, including whom it was reported to, providing evidence of CISO reporting. ISM-1803 adds register content requirements, while E8-RA-ML2.11 emphasises reporting timeliness.
This control supports ISM-1618.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-RA-ML2.11 involves prompt incident reporting to the CISO, necessary for timely oversight initiation. E8-RA-ML2.11 defines the reporting requirement, while ISM-1618 focuses on post-reporting oversight.
This control depends on ISM-1478.
ISM-1478 requires the CISO to oversee the cyber security program and ensure compliance with cyber security policy and related obligations. E8-RA-ML2.11 supports this by requiring cyber security incidents to be reported promptly to the CISO (or delegate), enabling governance, decision-making, and compliance actions such as notification, containment and reporting. E8-RA-ML2.11 is narrower because it only addresses incident reporting workflow, while ISM-1478 encompasses overall compliance management across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.