ASD ISM 0125 Maintaining a cyber security incident register
What it says
A cyber security incident register is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and keep a log of any cyber security incidents that occur.
A cyber security incident register is like a diary where you write down any security mishaps that happen in your business, like a data breach or a suspicious email. This is important because if you don't keep track, you might not notice patterns or recurring problems, which could make your organisation vulnerable to future attacks.
Free. Save your status, tasks and notes.
Why it matters
Without a maintained cyber security incident register, recurring incidents can be missed, trends go unrecognised and response times increase.
How to implement
The office manager should create a simple spreadsheet to record cyber incidents.
Include columns for the date, time, description of the incident, what was affected, and how it was resolved.
The IT team should regularly update the incident register.
Each time an incident occurs, they should add a new entry as soon as possible after the incident is managed.
Managers should ensure staff know how to report incidents.
They can conduct short training sessions, explaining what counts as an incident and showing how to use the register or notify the IT team.
The board or school principal should receive a summary report quarterly.
The office manager can prepare a brief overview of the incidents and preventive measures taken, presenting it during a meeting.
Keep it running
Maintain a central incident register: record date/time, impact, indicators, actions and closure; review regularly to identify trends and improve response.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The latest version of the cyber security incident register: Request the actual document or file where incidents are recorded.
Look at
How often entries are made and specific details about each incident.
Good evidence
Register is up-to-date, with clear and comprehensive information for each incident.
- Check 2 of 4What an auditor asks for
Ask for
Several team members how they report a cyber incident.
Look at
Consistency in their responses and understanding of the process.
Good evidence
Shows staff are aware and comfortable with the reporting process.
- Check 3 of 4What an auditor asks for
Good evidence
Process is easy to follow, ensuring reliable data entry.
- Check 4 of 4What an auditor asks for
Ask for
Training materials or schedules that show staff were trained on incident reporting. Ensure the sessions cover critical aspects of recognising and reporting incidents.
Look at
Training records for incident management.
Good evidence
Record shows comprehensive and regular training.
Mappings
Closest match in ISO/IEC 27001: A.5.24, Information security incident management planning and preparation, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.24.
ISM-0125 requires an organisation to develop, implement and maintain a cyber security incident register to record incidents. ISO/IEC 27001:2022 Annex A 5.24 requires broader incident management planning and preparation, including defining processes, roles, and responsibilities for managing incidents. ISM-0125 is a specific artefact/control within that broader incident management capability rather than covering all planning and preparation elements.
This control partially overlaps A.6.8.
Annex A 6.8 requires mechanisms and defined channels for prompt reporting of security events and suspected weaknesses. ISM-0125 relates by requiring a cyber security incident register, which is a mechanism for recording and managing reported incidents once they have been raised. The register supports traceability and follow-up, but it does not by itself ensure personnel have clear reporting channels, so it only partially aligns with Annex A 6.8's reporting-mechanism requirement.
This control supports A.5.27.
Annex A 5.27 requires that knowledge gained from information security incidents is used to strengthen and improve information security controls. ISM-0125 mandates maintaining a cyber security incident register, which provides the evidence base and trend data needed to derive lessons learned and prioritise control uplift. ISM-0125 is primarily about recording and tracking incidents, whereas Annex A 5.27 is about converting that knowledge into control changes.
ASD Essential Eight: 2 mappings
This control supports E8-AC-ML2.9.
ISM-0125 requires an organisation to develop, implement and maintain a cyber security incident register to record incidents. E8-AC-ML2.9 requires incidents be reported promptly to the CISO (or delegate), and the register supports this by providing the mechanism to document discovery time, reporting time, and incident particulars. ISM-0125 is about maintaining the register, whereas E8-AC-ML2.9 is about timely internal reporting.
This control depends on E8-AH-ML2.16.
E8-AH-ML2.16 requires immediate reporting of cyber security incidents to the CISO (or delegate). ISM-0125 requires a cyber security incident register to be developed, implemented and maintained, which supports demonstrating and tracking that incidents were reported and escalated appropriately. ISM-0125 does not itself mandate reporting to the CISO or timeliness, but it strengthens governance and auditability of E8-AH-ML2.16.
ASD Essentials for enterprise IT: 2 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; ISM-0125 requires a cyber security incident register to be developed, implemented and maintained, where incidents confirmed through triage can be recorded.
- IT.RES-04.1Perform post-incident reviews to identify security gaps behind each incident stagePartially overlaps
This control partially overlaps IT.RES-04.1.
IT.RES-04.1 requires post-incident reviews to identify the security gaps that enabled each stage of an incident; ISM-0125 requires a cyber security incident register to be developed, implemented and maintained, a record those reviews can draw on.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.