ASD ISM 0137 Seek legal advice for intrusion evidence collection
What it says
Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore collecting evidence of cyber intrusions, get legal advice.
If your computer systems get hacked, it's important to act carefully when collecting evidence. You should ask a lawyer for advice before gathering any data about the intrusion. This is crucial because doing it wrong could lead to legal trouble or not being able to use the evidence later to catch the culprit.
Free. Save your status, tasks and notes.
Why it matters
Without legal guidance, improper evidence collection can result in inadmissible data, jeopardising legal action against attackers.
How to implement
Business owners or managers should contact a legal professional: Before taking any steps when a cyber intrusion is suspected, reach out to a lawyer who understands technology-related legal issues.
This helps ensure that any evidence you collect can be used later on if needed.
IT managers should prepare a list of legal contacts: Keep an up-to-date list of lawyers or legal firms that specialise in cyber security.
Make sure this list is easily accessible to all relevant personnel to avoid delays during an incident.
Designate a response team: Appoint a small group responsible for handling intrusions and ensure they are briefed about seeking legal advice first.
Provide them with training on the importance of legal considerations in evidence collection.
Develop an incident response checklist: Include a step that says 'Seek legal advice' as soon as you suspect a cyber intrusion.
Train your staff to follow this checklist so they automatically think about legal counsel at the right time.
Communicate with staff about legal procedures: Hold a company-wide meeting or send out a memo to explain why seeking legal advice is necessary when dealing with a cyber intrusion.
Clarify that this step helps protect the organisation legally and practically.
Keep it running
Seek legal advice before letting suspected intrusion continue to gather evidence, and document approvals and scope.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Records of legal consultation during past incidents: Request documents or emails showing that legal advice was sought when handling previous intrusions.
Look at
The date and content to ensure it was obtained timely with relevant legal counsel involved.
Good evidence
Is evidence showing a consultation before major incident-handling decisions were made.
- Check 2 of 5What an auditor asks for
Ask for
Them to describe the procedure followed to seek legal advice during an intrusion. Listen for a clear process, including when and who they contact for legal support.
Good evidence
Is a step-by-step explanation that matches documented procedures.
- Check 3 of 5What an auditor asks for
Look at
Dated signatures showing regular reviews of the plan.
Good evidence
Plan has clear legal consultation steps and a review date of no more than a year ago.
- Check 4 of 5What an auditor asks for
Look at
Prompt and knowledgeable actions by the team.
Good evidence
Drill includes swift initiation of legal consultations without reminders.
- Check 5 of 5What an auditor asks for
Ask for
To see the training materials for incident response: Review these materials to confirm they cover the importance and process of seeking legal advice.
Look at
Inclusion of realistic scenarios where legal advice is a highlighted step.
Good evidence
Set of training materials is updated regularly and includes practical examples.
Mappings
Closest match in ISO/IEC 27001: A.5.24, Information security incident management planning and preparation, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.24.
ISM-0137 requires legal advice to be sought before choosing to let intrusion activity continue to collect further data or evidence. This supports Annex A 5.24 because incident management planning should define roles, responsibilities and escalation pathways (including legal counsel engagement) for such high-risk decisions. Annex A 5.24 is broader planning and preparedness, while ISM-0137 is a specific operational decision control during an incident.
This control partially meets A.5.26.
ISM-0137 requires organisations to seek legal advice before allowing an intrusion to continue for evidence collection purposes. This supports Annex A 5.26 because incident response procedures should incorporate legal decision points and constraints, particularly when evidence collection and attacker engagement could affect liability or admissibility. Annex A 5.26 is broader in covering response activities overall, whereas ISM-0137 focuses narrowly on the legal-advice requirement for continued intrusion monitoring/collection.
This control partially overlaps A.5.28.
Annex A 5.28 requires the organisation to implement procedures for identifying, collecting and preserving evidence from information security events. ISM-0137 overlaps by requiring legal advice before allowing intrusion activity to continue for the purpose of collecting additional data or evidence, which directly affects how evidence collection procedures are executed. ISM-0137 is narrower and situational (intrusion continuation for evidence-gathering), while Annex A 5.28 is broader and applies to evidence handling across all event types.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.