ASD ISM 1618 CISO's role in cyber security incident response
What it says
The CISO oversees their organisation's response to cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO is responsible for managing the organisation's reactions to cyber security threats.
The Chief Information Security Officer (CISO) is like the safety manager for the digital side of a business. They make sure that the company knows how to handle any cyber security threats or issues. If this isn't done, the organisation might not respond quickly to a cyber attack, leading to data loss, financial damage, or reputational harm.
Free. Save your status, tasks and notes.
Why it matters
Without CISO oversight, incident response can be delayed or misdirected, increasing attack impact and risking regulatory, legal and financial consequences.
How to implement
CISOs should create a clear plan: They need to develop a detailed incident response plan that outlines what to do if a cyber security threat is detected.
This plan should include steps for identifying, handling, and recovering from incidents.
The IT team should set up regular training: They need to train staff on how to recognise and report cyber threats.
This can be done through workshops or e-learning modules that explain the role each person plays during an incident.
Managers should organise practice drills: They should conduct simulated cyber attack exercises so employees know their roles and the plan can be tested for effectiveness.
This involves setting up a fake scenario and timing the response.
The communication team should develop a public communication strategy: They need to prepare templates for customer and public notifications in case of a data breach.
This includes having a pre-written media statement reviewed by legal advisors.
The CISO should review and update policies: Regularly revisiting the incident response plan and updating it based on lessons learned from drills and actual incidents is crucial.
This might involve making notes about what worked well and what didn't, then making relevant changes.
Keep it running
Have the CISO review incident response plans and major response decisions, and ensure timely communication to executives and key stakeholders during incidents.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident response plan: Request the document that outlines how the organisation will respond to cyber security incidents.
Look at
Details such as roles, responsibilities, and steps to handle different types of incidents.
Good evidence
Would include a comprehensive, up-to-date plan with clear instructions and assignments.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request documentation of staff training sessions on incident response.
Look at
Attendance records and topics covered.
Good evidence
Shows regular training with all relevant employees attending.
- Check 3 of 5What an auditor asks for
Ask for
Incident logs: Request to see records of past incidents that the organisation has responded to.
Look at
The details of the response actions and outcomes for each incident.
Good evidence
Shows detailed logs with clear follow-up actions and resolutions.
- Check 4 of 5What an auditor asks for
Ask for
To see evidence of practice drills: Request documents summarising any mock exercises or drills conducted.
Look at
Scenarios used, participant lists, and findings.
Good evidence
Has records showing regular exercises and improvements made from lessons learned.
- Check 5 of 5What an auditor asks for
Ask for
Communication templates: Request copies of pre-prepared public communications for a potential data breach.
Look at
Text that clearly explains what happened and what steps the organisation is taking.
Good evidence
Includes approved templates ready for rapid use.
Mappings
Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.26.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. Annex A 5.26 mandates procedural compliance in incident response, providing an overarching requirement for CISO-led oversight. Annex A 5.26 is broader as it applies to all incident response procedures, whereas ISM-1618 focuses on the CISO's governance role.
This control partially overlaps A.5.24.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. Annex A 5.24 requires the organisation to plan and prepare incident management by defining and communicating processes, roles and responsibilities, aligning with the CISO's oversight role. The ISO control is broader, covering all incident management governance, whereas ISM-1618 is specific to the CISO's leadership role.
ASD Essential Eight: 6 mappings
This control partially overlaps E8-AH-ML2.18.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-AH-ML2.18 focuses on enacting the incident response plan once an incident is identified, an activity typically overseen by the CISO for prompt and correct execution. The E8 control emphasises the action trigger, while ISM-1618 highlights leadership and accountability.
- E8-MF-ML2.12Cyber security incident response plan enacted after incident identificationPartially overlaps
This control partially overlaps E8-MF-ML2.12.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-MF-ML2.12 involves enacting the incident response plan after identification, part of the activities the CISO oversees for effectiveness. The candidate is narrower and action-focused, while ISM-1618 is broader about oversight across the lifecycle.
This control depends on E8-AC-ML2.9.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-AC-ML2.9 requires incidents be reported promptly to the CISO, enabling the initiation of oversight. The Essential Eight control concerns notifying the role, while ISM-1618 concerns exercising oversight.
This control depends on E8-AH-ML2.16.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-AH-ML2.16 mandates reporting incidents to the CISO as a prerequisite for commencing oversight. ISM-1618 focuses on actions post-reporting, while E8-AH-ML2.16 specifies reporting needs.
This control depends on E8-RA-ML2.11.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-RA-ML2.11 involves prompt incident reporting to the CISO, necessary for timely oversight initiation. E8-RA-ML2.11 defines the reporting requirement, while ISM-1618 focuses on post-reporting oversight.
This control depends on E8-RA-ML2.13.
ISM-1618 requires that the CISO oversees the organisation's response to cyber security incidents. E8-RA-ML2.13 mandates enacting the response plan after incident identification, driven by the CISO's oversight. The Essential Eight control is procedural, while ISM-1618 details a role and accountability requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.