ASD ISM 1609 Consult system owners before continuing intrusions
What it says
System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem owners must be asked before allowing intrusions to persist for collecting evidence.
Before continuing to monitor an ongoing cyber intrusion in your systems, you need to talk with the person who owns the system to get their permission. This is important because if you don't, you could risk further damage or misuse of sensitive information without the system owner's understanding or consent.
Free. Save your status, tasks and notes.
Why it matters
If system owners aren't consulted before allowing intrusion activity to continue, evidence-gathering may breach authority, increase damage, and erode trust.
How to implement
The system owner should organise a meeting with the IT team immediately when an intrusion is detected.
Discuss the extent of the breach and whether continuing to monitor it without immediate action could help gather more evidence or if it poses a risk.
The IT team should prepare a brief report explaining the potential benefits and risks of continuing to monitor the intrusion.
Include examples of data that might be collected and how it could help identify the attacker.
The system owner should consult any relevant privacy officers or legal advisors to ensure that continuing to monitor the intrusion complies with privacy laws and company policies.
System owners should be clear about who has the authority to make decisions about ongoing monitoring.
Document this decision-making process so that everyone involved is aware of the roles and responsibilities.
Once a decision is made, the system owner should ensure that it is documented, including who was consulted, the reasons for the decision, and any conditions or timeframes set for the continued monitoring.
Keep it running
During an intrusion, promptly brief the system owner and obtain explicit approval before continuing activity for evidence collection; record decisions and timeframes.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The documented meeting notes where the system owner consulted with relevant parties.
Look at
A record of the date, attendees, and a summary of the discussion.
Good evidence
Would include a decision to either monitor or not, along with reasons why.
- Check 2 of 3What an auditor asks for
Ask for
Communication records with privacy offices or legal advisors. Ensure these include responses that confirm compliance with legal and policy requirements, indicating consent from decision-makers.
- Check 3 of 3What an auditor asks for
Ask for
The final document that records the decision to continue monitoring.
Look at
Detailed reasons for the decision, who was consulted, and any conditions attached to the monitoring. A comprehensive document should include all these details, demonstrating considered decision-making.
Mappings
Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.26.
ISM-1609 requires consulting system owners before permitting continued intrusion for evidence gathering. Annex A 5.26 encompasses broader incident response procedures, including decision-making for containment or monitoring, making ISM-1609 a specific authorization requirement within the broader process.
This control partially overlaps A.5.28.
ISM-1609 requires consulting system owners before allowing an intrusion to continue for evidence collection, while Annex A 5.28 focuses on the processes for handling evidence from security events. Both involve decisions related to evidence, but ISM-1609 specifically involves governance and authorization for intrusion handling.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.