ASD ISM 0733 Ensure CISO awareness of cyber incidents
What it says
The CISO is fully aware of all cyber security incidents within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO should be informed about all cyber security incidents in the organisation.
This control means that the Chief Information Security Officer (CISO) must be kept in the loop about every cyber security issue that happens within the organisation. It matters because if incidents are kept hidden or not communicated promptly, the organisation could face bigger security risks, leading to data breaches, financial loss, or damage to its reputation.
Free. Save your status, tasks and notes.
Why it matters
Unchecked cyber incidents can escalate threats, causing severe reputational damage and financial loss if the CISO is not promptly informed.
How to implement
CIO (Chief Information Officer) should establish a process: Develop a clear communication plan to inform the CISO of any cyber incidents.
Set up automatic alerts through email or a secure messaging platform each time an incident is reported.
IT security team should document incidents: Keep a detailed record of what happens during each incident, complete with timelines and response actions.
Use a shared system where the CISO can access and review these records anytime.
Office Manager should coordinate regular updates: Schedule a weekly briefing with the CISO to review all incidents reported during the period.
Use this time to discuss any changes in response strategies or upcoming risks.
HR should train staff: Educate employees about the importance of reporting cyber security incidents.
Provide simple guidelines on how to escalate issues to ensure the CISO is informed quickly.
Procurement should ensure tools are in place: Acquire the right tools for tracking and managing incidents.
Ensure these tools have user-friendly reporting features so that incidents can be logged and accessed by the CISO efficiently.
Keep it running
Ensure incident reports are relayed to the CISO within 24 hours, enabling timely decision-making and effective response coordination.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident communication plan: Request a written document that outlines how cyber incidents are communicated to the CISO.
Look at
Details on incident types, notification procedures, and responsible parties.
Good evidence
Includes clear procedures and contact channels for alerting the CISO.
- Check 2 of 5What an auditor asks for
Ask for
To see incident logs: Request access to recent cyber security incident records.
Look at
The details and ensure they are thorough and timely.
Good evidence
Shows complete logs with time stamps and actions taken.
- Check 3 of 5What an auditor asks for
Ask for
Meeting records: Request minutes or notes from the CISO's regular briefing meetings.
Look at
Consistency and the discussion of relevant incidents.
Good evidence
Includes dates, attendees, and summarised discussions of incidents.
- Check 4 of 5What an auditor asks for
Ask for
About staff training records: Obtain proof of staff training on reporting incidents.
Look at
Attendance and training materials.
Good evidence
Shows high participation rates and relevant, up-to-date content.
- Check 5 of 5What an auditor asks for
Ask for
Tool usage reports: Request data on the usage of tools designed for incident tracking and reporting.
Look at
User logs and access by the CISO.
Good evidence
Shows regular, documented usage and CISO engagement.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.9, Cyber security incidents are reported promptly to CISO, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.24.
Annex A 5.24 requires the organisation to define and communicate incident management processes and roles to be prepared to manage incidents. ISM-0733 relates by ensuring the CISO is fully aware of all cyber security incidents, which supports effective incident coordination and role fulfilment within those processes. ISM-0733 is more specific to situational awareness and reporting to a single role, whereas Annex A 5.24 covers the full planning and preparation of incident management across the organisation.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AC-ML2.9.
ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation. E8-AC-ML2.9 directly requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered, which is the operational mechanism that achieves that awareness. Both controls are focused on ensuring CISO visibility of incidents; E8-AC-ML2.9 is more explicit about reporting timeliness and allows delegation.
This control is equivalent to E8-AH-ML2.16.
ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation. E8-AH-ML2.16 requires incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery, directly ensuring the CISO becomes aware. The intent and outcome are effectively the same, with E8-AH-ML2.16 specifying the reporting action and permitting a delegate.
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlyEquivalent
This control is equivalent to E8-MF-ML2.10.
ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation. E8-MF-ML2.10 explicitly requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after they occur or are discovered, which directly implements the awareness requirement. Both controls are materially aligned; E8-MF-ML2.10 expresses the requirement as a reporting rule rather than an end-state.
This control is equivalent to E8-RA-ML2.11.
ISM-0733 requires that the CISO is fully aware of all cyber security incidents within their organisation. E8-RA-ML2.11 mandates prompt reporting of cyber security incidents to the CISO (or delegate), which directly ensures that awareness. The controls match in scope (all cyber security incidents) and practical effect, with E8-RA-ML2.11 adding an explicit immediacy expectation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.