Essential Eight RA-ML2.12 Report cyber security incidents to ASD promptly
What it says
Cybersecurity incidents are reported to ASD as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify ASD quickly about any cyber attacks or breaches.
This control is all about quickly letting the Australian Signals Directorate (ASD) know if your organisation experiences a cyber attack or data breach. The reason this is important is because if you delay reporting, your organisation might suffer greater damage and you could miss out on help from ASD to handle the situation. In worst cases, attackers could cause ongoing harm to your systems and data.
Free. Save your status, tasks and notes.
Why it matters
Delayed reporting to ASD can prolong active compromises, reduce access to ASD assistance and coordination, and increase broader sector impacts.
How to implement
The IT team should create a clear reporting procedure.
Design a simple step-by-step plan for reporting cyber incidents, ensuring everyone knows who to contact and what information is needed.
The IT manager should train all staff on the importance of reporting incidents.
Conduct regular sessions where staff learn why speed is crucial and how they can spot potential incidents.
Security officers should set up automatic alerts for suspicious activities.
Use software features that notify the right people immediately when something unusual is detected on the network.
The office manager should keep a list of contacts for reporting.
Maintain a current list of internal and ASD contacts who need to be informed if an incident occurs.
The system administrator should conduct regular drills.
Simulate potential cyber incidents to ensure everyone knows their role and the importance of prompt reporting.
Keep it running
Report cyber security incidents to ASD as soon as identified; include timeline, affected systems, indicators, severity, and a 24/7 contact for follow-up.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
What is the procedure for reporting cyber incidents to ASD?
Look at
Examine the documented incident response plan.
Good evidence
The plan clearly states the steps and contact points for notifying ASD, including timelines.
- Check 2 of 3What an auditor asks for
Ask for
How do you ensure staff understand the incident reporting procedure?
Look at
Check training records and materials from awareness sessions.
Good evidence
Regular training sessions are documented, with records showing high attendance.
- Check 3 of 3What an auditor asks for
Ask for
How quickly are incidents reported to the ASD?
Look at
Review recent incident reports with timestamps.
Good evidence
Reports show incidents are consistently reported to ASD shortly after detection, as per procedure.
Mappings
Closest match in ASD Information Security Manual: ISM-0140, Prompt reporting of cyber incidents to ASD, which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.26.
E8-RA-ML2.12 requires prompt reporting of cyber security incidents to ASD. Annex A 5.26 requires responding to information security incidents in accordance with documented procedures, which can include external notifications to authorities such as ASD. Annex A 5.26 is broader incident response governance and execution, while E8-RA-ML2.12 is one specific response requirement focused on timely ASD reporting.
This control partially overlaps A.5.5.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities, which can include ASD to enable effective reporting. Annex A 5.5 is broader relationship-management, while E8-RA-ML2.12 is a specific incident-reporting action with a timeliness requirement.
This control depends on A.5.24.
E8-RA-ML2.12 requires organisations to report cyber security incidents to ASD as soon as possible after discovery. Annex A 5.24 requires planning and preparation for incident management by defining processes, roles, and responsibilities, which are prerequisites for timely external notification. Annex A 5.24 is broader readiness and operating model, while E8-RA-ML2.12 is a specific external reporting outcome to ASD.
This control depends on A.6.8.
E8-RA-ML2.12 requires prompt reporting of cyber security incidents to ASD once they occur or are discovered. Annex A 6.8 requires mechanisms and defined channels for personnel and relevant parties to report security events promptly, which helps ensure incidents are detected/escalated quickly enough to enable ASD notification. Annex A 6.8 focuses on internal event reporting intake, while E8-RA-ML2.12 focuses on external reporting to ASD after discovery.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-0140.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same obligation with the same trigger and timing expectation. Implementing either control would largely satisfy the other for ASD notification timeliness and audience.
This control partially overlaps ISM-0123.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0123 requires incidents to be reported to the CISO (or delegate) as soon as possible, which is a common escalation step that can enable ASD notification. ISM-0123 is internal reporting to leadership, whereas E8-RA-ML2.12 is external reporting to ASD, so they align on timeliness but differ on recipient and purpose.
This control depends on ISM-0043.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0043 requires incident response plans to define how to report incidents internally and externally to relevant authorities (including criteria for involving ASD), providing the process and decision points needed to perform ASD reporting consistently. Without ISM-0043-style planning, meeting E8-RA-ML2.12 promptly and reliably is harder because roles, channels, and thresholds may be unclear.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; E8-RA-ML2.12 requires incidents to be reported to ASD as soon as possible after they occur or are discovered, an external obligation for that response to include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.