ASD ISM 0140 Prompt reporting of cyber incidents to ASD
What it says
Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReport cyber incidents to ASD immediately when they're identified.
When a cyber security incident happens, it's crucial to let the Australian Signals Directorate (ASD) know about it straight away. This is important because if we delay, it might give attackers more time to cause damage and could lead to bigger problems for us, like data breaches or financial losses.
Free. Save your status, tasks and notes.
Why it matters
Delays in reporting cyber incidents to ASD increase attack severity, risking data breaches and financial losses.
How to implement
IT Team should set up a simple reporting process: Create a clear step-by-step guide for staff on how to report a cyber incident directly to the IT team.
This might include filling out a form or sending an email with specific details about what happened.
Business Owners need to identify the key contact for reporting: Designate a person in the organisation who will be responsible for notifying ASD about any cyber incidents.
Ensure staff know who this contact is and how to reach them quickly.
Managers should run training sessions: Hold regular sessions with all staff to explain what counts as a cyber incident and how to identify it.
Use examples relevant to the organisation to make it relatable.
Office Administrators to maintain a reporting checklist: Develop and distribute a checklist that includes all steps for reporting incidents, including who to contact at ASD and what information is needed.
IT Managers should establish communication channels with ASD: Ensure there's a direct phone line or email contact with ASD that can be used immediately when an incident is discovered, and test these channels periodically to confirm they are working.
Keep it running
Define an incident reporting procedure that notifies ASD as soon as possible after detection, with escalation paths, contacts and time targets.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
Incident reporting procedure documents.
Look at
The procedure document for steps on how to report incidents to ASD.
Good evidence
Includes clear steps, contact information, and is easy for non-technical staff to understand.
- Check 2 of 4What an auditor asks for
Ask for
Them to describe the process of reporting to ASD and their role in it.
Good evidence
Is that they can detail the steps, including any communications with ASD.
- Check 3 of 4What an auditor asks for
Look at
The incident logs for any recent entries and check if they show prompt reporting to ASD. Good logs will show timely entries with a clear description of actions taken.
- Check 4 of 4What an auditor asks for
Look at
Records that show staff have attended training sessions on identifying and reporting cyber incidents.
Good evidence
Is high participation rates and regular trainings scheduled.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.10, Report cyber security incidents to ASD quickly, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.5.
Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities to support rapid coordination during security issues. ISM-0140 directly connects by requiring cyber security incidents to be reported to ASD as soon as possible, which depends on having an established ASD reporting mechanism and contact pathway. Annex A 5.5 is broader because it is not limited to ASD nor to incidents, and includes maintaining contact with other authorities relevant to the organisation.
ASD Essential Eight: 8 mappings
This control is equivalent to E8-AC-ML2.10.
E8-AC-ML2.10 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same requirement with the same trigger (occur or discovered), recipient (ASD), and timeliness expectation (as soon as possible). Implementing ISM-0140 would largely satisfy E8-AC-ML2.10 and vice versa.
This control is equivalent to E8-AH-ML2.17.
ISM-0140 requires organisations to report cyber security incidents to ASD as soon as possible after they occur or are discovered. E8-AH-ML2.17 expresses the same requirement to report incidents to ASD promptly upon occurrence or discovery. There is no material difference in scope or depth between the two controls.
This control is equivalent to E8-MF-ML2.11.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0140 states the same requirement explicitly, including the same timing expectation and the same external recipient (ASD). Implementing ISM-0140 would largely satisfy E8-MF-ML2.11 without additional scope changes.
This control is equivalent to E8-RA-ML2.12.
ISM-0140 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. E8-RA-ML2.12 mirrors this requirement, specifying prompt reporting to ASD with the same trigger conditions. The controls are substantively the same and align one-to-one.
This control partially overlaps E8-AC-ML2.9.
E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-0140 requires incidents to be reported to ASD as soon as possible, which is a different reporting destination and external escalation path. They overlap on the principle of prompt incident reporting, but each control targets a different audience (internal executive vs external authority).
This control partially overlaps E8-AH-ML2.16.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0140 focuses on reporting cyber security incidents to ASD as soon as possible. They overlap on the principle of prompt incident reporting, but they differ in the required reporting recipient (internal CISO vs external ASD).
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlyPartially overlaps
This control partially overlaps E8-MF-ML2.10.
E8-MF-ML2.10 requires cyber security incidents to be reported internally to the CISO (or delegate) as soon as possible after they occur or are discovered. ISM-0140 requires prompt reporting of cyber security incidents to ASD, which is an external reporting pathway that may be triggered in parallel to internal escalation. The controls align on urgency and incident reporting, but differ on recipient and governance scope (internal executive escalation vs external authority notification).
This control partially overlaps E8-RA-ML2.11.
E8-RA-ML2.11 requires cyber security incidents to be reported promptly to the CISO (or delegate) after they occur or are discovered. ISM-0140 also mandates prompt reporting, but the recipient is ASD rather than the internal CISO function. They overlap on the need for rapid incident notification, but each control targets a different reporting destination (internal executive oversight vs external authority notification).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.