ASD ISM 0123 Report cyber security incidents promptly
What it says
Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInform the chief information security officer quickly after any cyber incident is found.
When a cyber security problem is spotted, you need to tell the head of IT security about it right away. This is crucial because if you wait too long, the problem could grow, potentially stealing sensitive data or shutting down your systems.
Free. Save your status, tasks and notes.
Why it matters
Delayed reporting of cyber incidents can lead to prolonged exposure, escalating damage, and increased data breach costs for the organisation.
How to implement
Designate a primary point of contact: The office manager should assign a specific person or a team to be responsible for identifying and reporting any cyber security incidents.
Ensure this person knows how to spot unusual activity and how to alert the chief information security officer quickly.
Create a reporting procedure: The IT team should develop a clear and simple guide that explains the steps to take when an incident is noticed.
This should include who to contact and how to contact them, such as by phone, email, or an incident reporting tool.
Conduct regular training: The HR department should organise regular training sessions for all staff to understand what constitutes a cyber security incident and how to report it.
Use simple examples and role-playing to make the training engaging and memorable.
Set up an incident response channel: The IT department should establish a dedicated communication channel, like a specific email or chat group, where incidents can be reported immediately.
Make sure all employees know about this channel and how to access it.
Review and update incident response plans: The security team should periodically revisit the incident response plan to ensure it includes updated contact information and reflects any changes in personnel or technology.
Schedule these reviews at least annually and after any major cyber incident.
Keep it running
Define incident triggers and timeframes, and ensure staff can report to the CISO or delegates 24/7 via a monitored channel with escalation paths and contact details.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident reporting procedure document: Request to see the written procedures employees should follow when reporting incidents.
Look at
The details on how incidents should be reported and to whom.
Good evidence
Includes clear steps, relevant contacts, and is easily understood by non-technical staff.
- Check 2 of 5What an auditor asks for
Look at
Their understanding of the reporting process and whom to contact.
Good evidence
Is a clear explanation that matches the documented procedure.
- Check 3 of 5What an auditor asks for
Ask for
To see how the dedicated communication channel for incident reporting is structured.
Look at
How accessible it is to all staff and whether it has been used recently.
Good evidence
Is active, used regularly and known to staff.
- Check 4 of 5What an auditor asks for
Look at
Clarity, engagement, and the opportunity for staff to ask questions.
Good evidence
Involves interactive elements and practical examples that make the process memorable.
- Check 5 of 5What an auditor asks for
Ask for
Records or logs of past incident reports submitted.
Look at
The time taken to identify and report incidents to the chief information security officer.
Good evidence
Shows prompt reporting, consistent with the established procedure.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.9, Cyber security incidents are reported promptly to CISO, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.24.
ISM-0123 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. Annex A 5.24 is broader because it requires planning and preparation for incident management by defining and communicating processes, roles and responsibilities, within which reporting and escalation to the CISO would sit. ISM-0123 is a specific reporting requirement that would form part of the wider incident management framework required by Annex A 5.24.
This control partially meets A.5.26.
Annex A 5.26 requires incident response to follow documented procedures, which include internal notification and escalation steps. ISM-0123 specifically mandates prompt reporting of incidents to the CISO or delegate, aligning with the reporting/escalation element of response procedures. ISM-0123 focuses narrowly on internal reporting, whereas Annex A 5.26 covers a wider set of response actions.
This control partially overlaps A.6.8.
Annex A 6.8 requires defined channels and mechanisms for personnel and relevant parties to promptly report security events and suspected weaknesses. ISM-0123 relates by requiring that cyber security incidents are reported to the CISO or delegate as soon as possible, specifying a concrete internal reporting path. Annex A 6.8 is broader in scope because it includes suspected weaknesses and multiple potential reporting channels, while ISM-0123 focuses on incident reporting to a particular internal authority.
ASD Essential Eight: 10 mappings
This control is equivalent to E8-AC-ML2.9.
ISM-0123 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery. E8-AC-ML2.9 states the same requirement with the same reporting recipient and timeliness expectation. Implementing E8-AC-ML2.9 would largely satisfy ISM-0123 without additional scope differences.
This control is equivalent to E8-AH-ML2.16.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0123 states the same requirement using essentially identical wording, including the same recipient (CISO/delegate) and the same timeliness expectation. Implementing ISM-0123 would largely satisfy E8-AH-ML2.16 with no material gap.
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlyEquivalent
This control is equivalent to E8-MF-ML2.10.
E8-MF-ML2.10 requires cyber security incidents to be reported to the CISO or delegates as soon as possible after occurrence or discovery. ISM-0123 states the same requirement: report cyber security incidents to the chief information security officer, or delegates, as soon as possible after they occur or are discovered. Both controls have the same reporting target (CISO/delegates) and the same timeliness expectation.
This control is equivalent to E8-RA-ML2.11.
ISM-0123 requires prompt reporting of cyber security incidents to the CISO (or delegate) upon occurrence or discovery. E8-RA-ML2.11 specifies the same reporting obligation to the CISO and the same timing expectation. There is no meaningful difference in required outcome or scope.
This control partially overlaps E8-AH-ML2.18.
ISM-0123 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. E8-AH-ML2.18 requires enacting the incident response plan after an incident is identified, which is facilitated by prompt reporting to senior security leadership. ISM-0123 is a notification/escalation control, whereas E8-AH-ML2.18 addresses activation of response procedures.
This control partially overlaps E8-MF-ML2.11.
E8-MF-ML2.11 requires prompt external reporting of cyber security incidents to ASD. ISM-0123 overlaps by requiring prompt internal reporting of cyber security incidents to the CISO (or delegate), which is commonly a step in the escalation path before notifying ASD. ISM-0123 is about internal notification and governance, while E8-MF-ML2.11 is specifically about immediate notification to ASD.
This control partially overlaps E8-RA-ML2.12.
E8-RA-ML2.12 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0123 requires incidents to be reported to the CISO (or delegate) as soon as possible, which is a common escalation step that can enable ASD notification. ISM-0123 is internal reporting to leadership, whereas E8-RA-ML2.12 is external reporting to ASD, so they align on timeliness but differ on recipient and purpose.
This control partially overlaps E8-RA-ML2.13.
ISM-0123 requires prompt reporting of cyber security incidents to the CISO (or delegate) after they occur or are discovered. E8-RA-ML2.13 requires enacting the incident response plan once an incident is identified, which operationalises the response that typically follows notification. ISM-0123 is about escalation/notification, while E8-RA-ML2.13 is about initiating response activities after identification.
This control depends on E8-AH-ML2.17.
E8-AH-ML2.17 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0123 supports this by requiring incidents to be reported promptly to the CISO (or delegate), creating the internal escalation needed before an organisation can notify ASD quickly and consistently. ISM-0123 addresses internal reporting lines, while E8-AH-ML2.17 addresses external reporting to ASD.
This control depends on E8-MF-ML2.12.
ISM-0123 requires prompt reporting of cyber security incidents to the CISO (or delegate) after occurrence or discovery. E8-MF-ML2.12 requires the incident response plan to be enacted following identification, which is a key action that generally depends on timely notification and escalation. ISM-0123 focuses on who is told and when, while E8-MF-ML2.12 focuses on what is done after identification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.