ASD ISM 0141 Report cyber incidents promptly to designated contacts
What it says
The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishService providers must report cyber incidents quickly to a specified contact as part of their contract.
This control means that if a company providing you service experiences any cyber incidents, they must let you know right away. It's important because if they don't, unidentified issues could spread, harming your business, damaging your reputation, or leading to data breaches.
Free. Save your status, tasks and notes.
Why it matters
Delayed incident reporting by service providers can lead to unchecked breaches, escalating damage and costs, and reputation loss due to incomplete response efforts.
How to implement
Procurement team should ensure contracts include reporting requirements: Make sure any contract with a service provider clearly states that they must report any cyber incidents as soon as they happen.
Include the specific contact person on your team who should be notified.
IT manager should establish a standard reporting process: Set up a simple, clear procedure that service providers should follow to report incidents.
Provide them with a phone number or email address that is monitored regularly.
Business owner should review incident response timelines: Meet with your service provider to agree on a timeline for reporting incidents-from discovery to notification.
Document these in the contract to hold each party accountable.
HR or training officer should educate relevant staff: Conduct a workshop to ensure key staff understand what constitutes a reportable incident and who in your organisation should respond and follow-up.
Compliance officer should set up regular check-ins: Schedule regular meetings with service providers to discuss reporting requirements and any incidents they've encountered or lessons learned from them.
Document these discussions in writing.
Keep it running
Include incident reporting timeframes and a designated contact in service contracts. Exercise reporting channels with providers to confirm prompt notification.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The contract with the service provider: Ensure it includes a clause about incident reporting requirements.
Look at
Details on who to contact and how quickly incidents should be reported.
Good evidence
Has explicit names, contact methods, and timeframes.
- Check 2 of 5What an auditor asks for
Good evidence
Includes clear descriptions, time of notification, and follow-up actions.
- Check 3 of 5What an auditor asks for
Ask for
How they handle incident reports and if any recent examples have been processed as per the contract.
Good evidence
Will show familiarity with the process and mention any recent incidents.
- Check 4 of 5What an auditor asks for
Good evidence
Includes a visible, organised tracking method.
- Check 5 of 5What an auditor asks for
Look at
The schedule of past incidents and meetings with providers regarding incidents.
Good evidence
Shows regular and timely communications documented and filed.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-0141 requires a specific supplier-relationship outcome: service provider contracts must document prompt cyber incident reporting to a designated contact. ISO/IEC 27001:2022 Annex A 5.19 is broader, requiring processes and procedures to manage information security risks across supplier relationships, which commonly includes incident notification and escalation expectations. ISM-0141 is a concrete contractual requirement that fits within the wider supplier security management framework of Annex A 5.19.
This control partially meets A.5.20.
ISM-0141 requires supplier agreements to explicitly include prompt cyber incident reporting to a designated contact. ISO/IEC 27001:2022 Annex A 5.20 is broader, requiring that relevant information security requirements are established and agreed with each supplier, which would typically include incident reporting obligations and notification timeframes. ISM-0141 is a specific clause-level requirement that can be implemented as part of Annex A 5.20's supplier agreement security clauses.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-MF-ML2.11.
E8-MF-ML2.11 requires organisations to report cyber security incidents to ASD as soon as possible after they occur or are discovered. ISM-0141 relates by requiring contractual terms that force service providers to report incidents quickly to a designated point of contact, which can enable timely onward reporting to ASD. ISM-0141 focuses on third-party contractual governance and designated contacts, while E8-MF-ML2.11 is specifically about reporting to ASD (not contracting mechanics).
This control partially overlaps E8-RA-ML2.11.
E8-RA-ML2.11 requires prompt reporting of cyber incidents to the CISO (or delegate) when incidents occur or are discovered. ISM-0141 requires contractual obligations for service providers to report incidents promptly to a designated point of contact. The overlap is in timeliness and formal reporting pathways, but ISM-0141 is supplier/contract focused and may not specifically require reporting to the CISO unless that is the designated contact.
This control depends on E8-AH-ML2.16.
E8-AH-ML2.16 requires cyber security incidents to be reported promptly to the CISO (or delegate). ISM-0141 supports this by requiring contractual arrangements to mandate service providers report incidents promptly to a designated point of contact, which can be the CISO/delegate. ISM-0141 is supplier/contract focused, while E8-AH-ML2.16 is an internal organisational reporting requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.