Skip to content
Cyber security incidents
ASD ISMISM-1213

ASD ISM 1213 Enhanced monitoring after intrusion remediation until eradication is confirmed

What it says

Following intrusion remediation activities, enhanced monitoring is conducted until there is sufficient evidence-based confidence that malicious actors have been eradicated from a system and have not re-established access.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

After cleaning up an intrusion, watch the affected system more closely than normal, and keep doing so until evidence shows the attacker is gone and has not returned.

Fixing an intrusion is not the end of the incident. Once the remediation work is done (malware removed, accounts reset, systems rebuilt, backdoors closed), this control requires you to step up monitoring of the affected system and keep it stepped up until you have real evidence that the malicious actor has been fully eradicated and has not quietly regained access. The key words are "evidence-based confidence". It is not enough to assume the clean-up worked or to let a fixed number of days pass. You need to decide in advance what evidence would show the attacker is gone (for example, no further activity matching their known indicators, no unexplained new accounts or persistence mechanisms, no suspicious outbound connections), then monitor at a heightened level until that evidence has accumulated. This matters because skilled attackers plan for being discovered. They often leave more than one way back in, keep stolen credentials in reserve, or simply wait for the defenders to relax and then re-enter. Remediation frequently misses something, and the period right after clean-up is exactly when a returning attacker is most likely to reveal themselves. Enhanced monitoring during that window is how you catch them before the incident starts again.

Why it matters

If monitoring returns to normal straight after remediation, an attacker who survived the clean-up or who re-enters using retained credentials or an overlooked backdoor can operate undetected. The organisation is likely to declare the incident closed while the compromise is still active, allowing further data theft, lateral movement or destructive action, and forcing a second, more costly incident response later.

How to implement

  1. The incident lead documents, before remediation is closed out, the specific eradication criteria for the affected system: the attacker's known indicators, the accounts, hosts and network paths they used, and what evidence would show they have been removed and have not re-established access.

  2. The security operations team raises the monitoring level on the affected system by adding targeted detections and alerts for the attacker's indicators and techniques, and by increasing the frequency of log and alert review for those assets during the enhanced monitoring period.

  3. The security operations team configures alerting for signs of re-established access on the affected system, such as new or re-enabled accounts, new persistence mechanisms, unexpected remote access, and connections to infrastructure associated with the intrusion.

  4. The incident lead runs regular review points during the enhanced monitoring period where the team compares the evidence collected against the eradication criteria and records whether confidence has been reached or whether further monitoring, or further remediation, is needed.

  5. The incident lead records a formal decision to end enhanced monitoring only when the collected evidence supports confidence that the attacker has been eradicated and has not returned, and files that decision and its supporting evidence with the incident record.

Keep it running

In practice this control is handled by the incident response team and the security operations function together. Before remediation is declared complete, the incident lead should document the eradication criteria: the specific indicators, behaviours and conditions that would show the attacker is either still present or has returned, and the evidence that would justify standing the enhanced monitoring down.

Enhanced monitoring then runs on the affected system for as long as it takes to reach that confidence. Day to day this typically means more frequent log review, tighter alerting on the accounts, hosts and network paths the attacker used, and regular review meetings where the team checks the evidence gathered against the criteria. The decision to end enhanced monitoring should be a deliberate, recorded one, made because the evidence supports it, not because a calendar date arrived or the team moved on to other work.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the incident records of recent intrusions where remediation was carried out.

    Look at

    Look for a documented enhanced monitoring phase that started after remediation, with a defined start point and a recorded decision to end it.

    Good evidence

    Every remediated intrusion shows enhanced monitoring being conducted after clean-up, with clear dates and a named decision-maker for standing it down.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the eradication criteria used for a specific incident.

    Look at

    Look at whether the criteria describe what evidence would show the attacker was gone and had not re-established access, rather than a fixed waiting period.

    Good evidence

    The criteria are specific to the intrusion, name the indicators and behaviours being watched for, and describe the evidence required before monitoring returns to normal.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the monitoring and alerting configuration that applied to the affected system during the enhanced period.

    Look at

    Compare it with the normal monitoring baseline to confirm it was genuinely heightened and focused on the attacker's known indicators and access paths.

    Good evidence

    Additional detections, tighter alerts and more frequent review were in place for the affected system, clearly linked to the intrusion.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for the review notes or meeting records from the enhanced monitoring period.

    Look at

    Look for evidence being assessed against the eradication criteria at regular points, and for any findings of continued or renewed attacker activity being acted on.

    Good evidence

    Reviews happened regularly, referenced the criteria, and any indication that the attacker remained or had returned led to further remediation rather than closure.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the record of the decision to end enhanced monitoring for a specific incident.

    Look at

    Look at whether the decision cites the evidence gathered and shows that confidence was based on that evidence, not on elapsed time or resource pressure.

    Good evidence

    The stand-down decision is documented, references the specific evidence that the attacker was eradicated and had not re-established access, and was approved by the incident lead.

Mappings

Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.5.26Response to information security incidentsPartially meets
  • A.8.15Logging of activities and eventsPartially meets
  • A.8.16Monitoring networks and systems for anomalous behaviourPartially meets
Essential Eight

ASD Essential Eight: 1 mapping

  • E8-MF-ML2.9Cyber security events are analysed to identify incidents timelySupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.