ASD ISM 0043 Cyber security incident response plan requirements

This control partially meets A.5.26.

Annex A 5.26 requires responding to incidents according to documented procedures. ISM-0043 is broader as it details creating a comprehensive incident response plan involving definitions, roles, reporting, and handling. It underpins the documented responses Annex A 5.26 aims to follow.

This control partially overlaps A.5.1.

Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed, including for areas like incident management. ISM-0043 overlaps by mandating a cyber security incident response plan with defined reporting, responsibilities, evidence integrity, and contingency measures, which is typically a topic-specific policy/plan governed under Annex A 5.1. ISM-0043 goes deeper into incident response content, while Annex A 5.1 is broader and focuses on policy governance and lifecycle rather than the plan's detailed operational requirements.

This control partially overlaps A.5.2.

Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0043 overlaps by requiring incident response plans to define reporting pathways and the authorities responsible for investigating and responding to incidents, which is explicit allocation of security responsibilities in the incident domain. ISM-0043 is narrower (incident response planning and authority definitions), while Annex A 5.2 is broader and applies across all information security activities.

This control partially overlaps A.5.5.

Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities to enable engagement when needed. ISM-0043 requires incident response plans to include external incident reporting to relevant authorities, including having those authority contacts defined and current. ISM-0043 is broader and covers comprehensive incident response planning.

This control partially overlaps A.5.24.

ISM-0043 requires systems to have a cyber security incident response plan covering definitions, incident types and responses, reporting (internal/external), authorities, escalation to law enforcement/ASD, evidence integrity, and contingency measures. ISO/IEC 27001:2022 Annex A 5.24 relates by requiring incident management planning and preparation through defined processes, roles and responsibilities that underpin an incident response plan. ISM-0043 is more prescriptive about plan contents (evidence handling, external reporting criteria, and contingency measures), while Annex A 5.24 is broader process governance without specifying those detailed inclusions.

This control partially overlaps A.5.28.

ISM-0043 requires incident response plans to include steps necessary to ensure the integrity of evidence relating to a cyber security incident. ISO/IEC 27001:2022 Annex A 5.28 directly relates by requiring procedures for identification, collection, acquisition and preservation of evidence associated with information security events. ISM-0043 embeds evidence integrity within a broader incident response plan (including reporting and escalation), whereas Annex A 5.28 is deeper and more focused on the evidence lifecycle itself.

This control partially overlaps A.5.29.

Annex A 5.29 requires planning to maintain information security at an appropriate level during disruption. ISM-0043 overlaps by mandating system cyber security incident response plans, including contingency measures, which are a common type of disruption planning to preserve security during and after incidents. The overlap is partial because Annex A 5.29 also covers non-incident disruptions (e.g. outages, disasters) and broader continuity of security controls beyond incident response procedures.

This control partially overlaps A.6.8.

Annex A 6.8 requires a mechanism and defined channels for prompt reporting of information security events and suspected weaknesses. ISM-0043 supports this by requiring incident response plans to define what constitutes an incident and how to report incidents internally and externally, including which parties must be informed. ISM-0043 is broader incident-management planning, whereas Annex A 6.8 is specifically about ensuring reporting mechanisms/channels exist and are available to relevant parties.

This control depends on A.5.25.

Annex A 5.25 requires the organisation to assess information security events and decide whether they are incidents. ISM-0043 supports this by requiring an incident response plan that includes guidelines on what constitutes an incident and how incidents are reported and investigated, which operationalises consistent event-to-incident decisions. ISM-0043 extends beyond Annex A 5.25 into response execution, evidence integrity, and external engagement criteria.

This control is broader than A.8.4.

Annex A 8.4 requires the organisation to determine and document a plan for communicating incidents to users of the AI system. ISM-0043 requires a cyber security incident response plan to specify how to report incidents internally and externally and identify other parties that need to be informed, which can include system users where relevant. ISM-0043 is broader because it covers incident definitions, response governance, evidence integrity and contingency measures, while Annex A 8.4 is specifically about user-facing incident communications for an AI system.

This control partially overlaps A.3.2.

Annex A 3.2 requires the organisation to define and allocate AI roles and responsibilities. ISM-0043 requires a cyber security incident response plan that explicitly defines reporting, responsible authorities for investigating/responding, and engagement with external agencies, which overlaps where AI systems are within the scope of cyber incidents and need clear accountability. ISM-0043 is incident-response specific and prescriptive, while Annex A 3.2 is broader AI governance and not limited to incident handling.

This control partially overlaps A.3.3.

Annex A 3.3 (ISO/IEC 42001) requires a process for reporting concerns about the organisation’s role in AI systems across the AI life cycle. ISM-0043 requires incident response plans to define what constitutes an incident and how to report incidents internally and to relevant authorities, which overlaps with the escalation and reporting channels portion of an AI concerns process when the concern is cyber security-related (e.g. model compromise, data leakage). ISM-0043 is limited to cyber security incidents and evidentiary handling, while Annex A 3.3 also covers broader AI governance concerns that may not be incidents.

This control partially overlaps A.8.5.

Annex A 8.5 requires determining and documenting obligations to report information about the AI system to interested parties. ISM-0043 requires a cyber security incident response plan that explicitly includes how to report incidents internally and externally to relevant authorities and other parties that need to be informed. The overlap is on defining who must be informed and reporting pathways, but ISM-0043 is limited to cyber incidents, whereas Annex A 8.5 covers broader AI reporting obligations (including non-incident reporting such as disclosures, governance reporting, or user communications).

This control is broader than E8-AH-ML2.16.

E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible. ISM-0043 requires incident response plans to define what constitutes an incident and how to report incidents internally and externally, including who must be informed. E8-AH-ML2.16 is one specific internal reporting requirement that would be captured within the broader planning and procedural requirements of ISM-0043.

This control is broader than E8-MF-ML2.11.

E8-MF-ML2.11 requires organisations to report cyber security incidents to ASD as soon as possible after they occur or are discovered. ISM-0043 is broader because it requires developing an incident response plan that includes how to report incidents externally to relevant authorities (including ASD) and other related incident management elements. E8-MF-ML2.11 is one specific outcome/action within the broader planning and preparation required by ISM-0043.

This control is broader than E8-RA-ML2.11.

ISM-0043 requires developing incident response plans that include how to report incidents internally/externally, who must be informed, and roles responsible for investigation and response. E8-RA-ML2.11 is one specific reporting requirement that would typically be implemented via the broader planning and process requirements in ISM-0043. E8-RA-ML2.11 requires incidents to be reported promptly to the CISO (or delegate) upon occurrence or discovery.

This control partially meets E8-MF-ML2.12.

E8-MF-ML2.12 requires activating the incident response plan when a cyber security incident is identified. ISM-0043 is broader because it specifies what the response plan must contain (definitions, reporting pathways, authorities, evidence integrity and contingency measures). E8-MF-ML2.12 assumes such a plan exists and focuses on timely enactment rather than plan content and completeness.

This control supports E8-AC-ML2.10.

E8-AC-ML2.10 requires timely reporting of cyber security incidents to ASD after occurrence or discovery. ISM-0043 requires incident response plans to define how to report incidents internally and externally to relevant authorities, including criteria for requesting ASD assistance. ISM-0043 is broader planning and process guidance, while E8-AC-ML2.10 is a specific operational obligation to notify ASD quickly.

This control supports E8-AH-ML2.17.

E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0043 requires incident response plans to define how to report incidents externally to relevant authorities (including ASD), which establishes the process and decision points needed to achieve prompt reporting.

This control supports E8-RA-ML2.13.

E8-RA-ML2.13 requires enacting the cyber security incident response plan after an incident is identified. ISM-0043 requires that systems have an incident response plan with defined content (definitions, reporting paths, authorities, evidence integrity, contingency measures), which must exist to be enacted.

This control depends on E8-AC-ML2.11.

E8-AC-ML2.11 requires organisations to enact the cyber security incident response plan immediately after an incident is identified. ISM-0043 requires that a cyber security incident response plan be developed with defined incident types, reporting paths, authorities, evidence integrity steps, and contingencies. E8-AC-ML2.11 is difficult to satisfy unless the ISM-0043 plan exists and has been defined and communicated.

This control depends on E8-AH-ML2.18.

E8-AH-ML2.18 requires that the cyber security incident response plan is enacted after a cyber security incident is identified. ISM-0043 requires systems to have a cyber security incident response plan with defined content (definitions, reporting pathways, authorities, evidence integrity, and contingencies). Enacting a plan (E8-AH-ML2.18) depends on having a fit-for-purpose plan established (ISM-0043) first, while ISM-0043 does not itself require activation at the time of an incident.

This control depends on E8-MF-ML2.10.

E8-MF-ML2.10 requires that incidents be reported promptly to the CISO (or delegate). ISM-0043 requires incident response plans to define what constitutes an incident and how to report incidents internally and externally, including who must be informed. In practice, having ISM-0043 in place provides the defined channels and responsibilities that E8-MF-ML2.10 relies on to achieve consistent, prompt reporting.

This control depends on E8-RA-ML2.12.

E8-RA-ML2.12 requires prompt reporting of cyber security incidents to ASD. ISM-0043 is a prerequisite because it requires incident response plans to define external reporting to relevant authorities (including ASD) and the criteria/process for requesting ASD assistance. Without ISM-0043-style documented processes and roles, timely and consistent execution of E8-RA-ML2.12 is less reliable.

This control partially overlaps IT.RES-03.1.

IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; ISM-0043 covers the documented part, listing what each system's incident response plan must include, from incident types and expected responses to evidence integrity.

This control partially overlaps IT.RES-05.1.

IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-0043 puts this in each system's incident response plan, which must include external reporting, other parties to inform and when to seek investigation by law enforcement or ASD.