ASD ISM 0576 Develop and maintain cyber security incident plans
What it says
A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and keep an updated cyber security incident management and response plan.
Every organisation needs a plan for handling cyber security incidents, like a blueprint for tackling unexpected problems with your computer systems. This is important because if you're unprepared, a cyber attack can lead to major disruptions, loss of sensitive information, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without a robust incident plan, organisations risk prolonged disruptions and data breaches, damaging trust and escalating recovery costs.
How to implement
The business owner or manager should initiate the creation of a cyber security incident response plan by consulting with their IT expert.
Discuss likely scenarios where your computer systems could be compromised and outline clear steps for each situation. This plan should be documented and easily accessible to key team members.
The IT team should implement regular training sessions for all staff on the incident response plan.
Use these sessions to walk through the procedures so everyone knows their role when an incident occurs. Role-playing different scenarios can be a practical way to ensure the team understands the plan.
Management should appoint a response team leader whose role is to coordinate during a cyber incident.
This person should have in-depth knowledge of the incident response plan and be empowered to make decisions quickly. Make sure this leader knows how to reach external technical support quickly if needed.
The response plan should be reviewed and updated regularly by the IT team to ensure it covers any new cyber threats.
Schedule a bi-annual review to discuss changes needed and improve the plan based on any past incidents. Document these reviews and any changes made.
The business owner should ensure there is a communication strategy for notifying affected parties in the event of a cyber incident.
Develop templates for communicating with customers and regulatory bodies to save time during an incident. Update these templates regularly to reflect current regulations and company policy.
Keep it running
Regularly update and drill response plans to ensure team readiness and adapt to emerging threats and evolving business processes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented incident response plan: Request a copy of the response plan created by the organisation.
Look at
Comprehensive steps outlined for different scenarios and roles assigned to team members.
Good evidence
Includes a detailed, clearly written plan that is up to date and customised to the specific needs of the organisation.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Check the schedule and attendance of incident response training sessions.
Look at
Regular intervals and high attendance rates.
Good evidence
Shows consistent, regular training with documented improvements and active participation from team members.
- Check 3 of 5What an auditor asks for
Ask for
To see the list of designated incident response team members: Verify the list of people who are responsible for managing incidents.
Look at
Their roles and contact information in the document.
Good evidence
Includes a current, clearly defined list with designated roles and contact details.
- Check 4 of 5What an auditor asks for
Ask for
Meeting minutes or reports from incident plan reviews: Request records of past review meetings or reports.
Look at
Evidence of changed procedures in response to previous incidents and updates for new threats.
Good evidence
Includes detailed notes and actions taken following the reviews.
- Check 5 of 5What an auditor asks for
Ask for
Communication templates: Request examples of prepared messages for stakeholders during an incident.
Look at
Clarity and relevancy to the types of incidents that the organisation might face.
Good evidence
Includes updated, professional-looking templates that meet current communication needs.
Mappings
Closest match in ISO/IEC 42001: A.8.4, Document a plan for communicating incidents to AI system users, which this control covers in full and more.
ISO/IEC 27001: 5 mappings
This control partially overlaps A.5.26.
Annex A 5.26 requires incidents to be responded to in line with documented procedures. ISM-0576 requires developing, implementing and maintaining an incident management policy and associated incident response plan, which provides the documented basis for those procedures. Implementing ISM-0576 ensures consistent alignment with Annex A 5.26's 'documented procedures' expectation.
This control partially overlaps A.5.29.
Annex A 5.29 requires the organisation to plan for maintaining information security during disruptions. ISM-0576 relates by requiring an incident management policy and incident response plan, which supports maintaining security when disruptions are caused by cyber incidents. The primary control is broader because it covers disruption scenarios beyond incidents and expects planning for maintaining security levels across operations, not just incident handling governance and playbooks.
This control partially overlaps A.5.37.
Annex A 5.37 requires operational procedures for information processing to be documented and made available to relevant personnel. ISM-0576 requires documented incident management policy and incident response plan, which are a class of operating procedures used during incident handling. ISM-0576 is focused specifically on cyber security incidents, whereas Annex A 5.37 applies to operating procedures across all information processing activities.
This control depends on A.5.5.
ISM-0576 requires an incident management policy and incident response plan that are implemented and maintained, which typically include external notification and coordination procedures during incidents. Annex A 5.5 requires the organisation to establish and maintain contact with relevant authorities, enabling the practical execution of the external liaison steps that the ISM-0576 plan would call for (e.g. knowing who to contact and how). Annex A 5.5 does not require an incident response plan or incident governance, but it supports ISM-0576 by making authority engagement feasible when the plan is enacted.
This control depends on A.5.27.
Annex A 5.27 requires organisations to use knowledge from incidents to strengthen and improve information security controls. ISM-0576 requires a cyber security incident management policy and response plan, which creates the process framework where post-incident reviews and improvement actions can be embedded. ISM-0576 focuses on establishing incident management capability, while Annex A 5.27 focuses specifically on feeding incident learnings into control improvements.
ISO/IEC 42001: 1 mapping
This control is broader than A.8.4.
Annex A 8.4 requires the organisation to determine and document a plan for communicating incidents to users of the AI system. ISM-0576 requires an organisation-wide cyber security incident management policy and associated incident response plan to be developed, implemented and maintained, within which communication to impacted parties can be defined. ISM-0576 is broader and less specific about user communications, while Annex A 8.4 is a targeted requirement for documented incident communications to AI system users.
ASD Essential Eight: 6 mappings
This control is broader than E8-AH-ML2.16.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible. ISM-0576 requires an incident management policy and associated incident response plan to be developed, implemented and maintained. E8-AH-ML2.16 is a specific operational reporting expectation that would typically be defined and governed through the broader policy/plan framework required by ISM-0576.
This control is broader than E8-RA-ML2.11.
ISM-0576 requires an incident management policy and associated incident response plan to be developed, implemented and maintained, which would define escalation paths including CISO notification. E8-RA-ML2.11 requires cyber security incidents to be reported promptly to the CISO (or delegate). The primary control is a specific operational requirement that would typically be implemented as part of the broader governance and planning mandated by ISM-0576.
This control supports E8-AC-ML2.11.
E8-AC-ML2.11 requires enacting the cyber security incident response plan once an incident is identified. ISM-0576 requires the organisation to develop, implement and maintain the incident management policy and associated incident response plan. E8-AC-ML2.11 depends on ISM-0576 because a plan must exist, be implemented, and be maintained before it can be reliably enacted during an incident.
This control supports E8-AH-ML2.18.
E8-AH-ML2.18 requires that the incident response plan is enacted following identification of a cyber security incident. ISM-0576 requires a cyber security incident management policy and associated response plan to be developed, implemented and maintained. E8-AH-ML2.18 depends on ISM-0576 because enactment presupposes a maintained policy/plan framework exists and is current.
This control supports E8-MF-ML2.12.
E8-MF-ML2.12 requires enacting the incident response plan after identifying a cyber incident. ISM-0576 requires that an incident management policy and associated incident response plan are developed, implemented and maintained, which is a prerequisite for activation. Without the ISM-0576 artefacts in place, E8-MF-ML2.12 cannot be reliably satisfied beyond ad hoc response.
This control supports E8-RA-ML2.13.
E8-RA-ML2.13 requires the organisation to enact the cyber incident response plan immediately after an incident is identified. ISM-0576 requires that an incident management policy and associated incident response plan are developed, implemented and maintained, which is a prerequisite for being able to enact the plan.
ASD Essentials for enterprise IT: 2 mappings
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresPartially overlaps
This control partially overlaps IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; ISM-0576 requires an incident management policy and response plan to be developed, implemented and maintained, providing the documented basis for that response.
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-0576 requires an incident management policy and response plan to be developed, implemented and maintained, the documents where those obligations can be set out.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.