Essential Eight RA-ML2.13 Enact cyber incident response plan after an incident is identified

This control depends on A.5.24.

E8-RA-ML2.13 requires enacting the incident response plan once an incident is identified. Annex A 5.24 requires planning and preparation for incident management by defining and communicating processes, roles and responsibilities, which underpins the ability to enact the plan effectively.

This control is equivalent to ISM-1819.

E8-RA-ML2.13 requires that once a cyber security incident is identified, the organisation enacts its cyber security incident response plan. ISM-1819 states the same requirement: following identification of a cyber security incident, the incident response plan is enacted. Both controls focus on the activation trigger and immediate commencement of the planned response.

This control is broader than ISM-1731.

ISM-1731 requires that planning and coordination of intrusion remediation occur on trusted systems that are separate from any potentially compromised system. E8-RA-ML2.13 requires the organisation to enact its incident response plan once an incident is identified, and using separate trusted coordination systems is a practical measure that strengthens safe execution of that plan. E8-RA-ML2.13 is broader about initiating response activities, while ISM-1731 is a specific safeguard about where remediation coordination must occur to prevent attacker observation or interference.

This control partially overlaps ISM-0123.

ISM-0123 requires prompt reporting of cyber security incidents to the CISO (or delegate) after they occur or are discovered. E8-RA-ML2.13 requires enacting the incident response plan once an incident is identified, which operationalises the response that typically follows notification. ISM-0123 is about escalation/notification, while E8-RA-ML2.13 is about initiating response activities after identification.

This control partially overlaps ISM-1732.

ISM-1732 requires intrusion remediation activities to be coordinated and sequenced to reduce re-compromise risk while balancing operational risk and continuity needs. E8-RA-ML2.13 overlaps because enacting the incident response plan is the mechanism that typically governs how remediation tasks are coordinated, approved and timed after an incident is identified. E8-RA-ML2.13 is broader at a programmatic level (plan activation across the response lifecycle), whereas ISM-1732 is specifically about sequencing and coordination of remediation steps to prevent re-entry.

This control supports ISM-1618.

ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-RA-ML2.13 mandates enacting the response plan after incident identification, driven by the CISO's oversight. The Essential Eight control is procedural, while ISM-1618 details a role and accountability requirement.

This control depends on ISM-0043.

E8-RA-ML2.13 requires enacting the cyber security incident response plan after an incident is identified. ISM-0043 requires that systems have an incident response plan with defined content (definitions, reporting paths, authorities, evidence integrity, contingency measures), which must exist to be enacted.

This control depends on ISM-0576.

E8-RA-ML2.13 requires the organisation to enact the cyber incident response plan immediately after an incident is identified. ISM-0576 requires that an incident management policy and associated incident response plan are developed, implemented and maintained, which is a prerequisite for being able to enact the plan.

This control partially overlaps IT.RES-03.1.

IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; E8-RA-ML2.13 requires the incident response plan to be enacted once an incident is identified, so the two overlap on using the plan during a real incident.