ASD ISM 1784 Annual testing of cyber incident response plan
What it says
The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation tests its cyber incident response plan every year to ensure it's effective.
This control means your organisation needs to test its plan for handling cyber incidents every year. It's important because if you don't check your response plan, you might be unprepared when a data breach or cyber attack happens, which could result in lost data, downtime for your business, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
An untested incident response plan may lead to prolonged downtime and chaos during real cyber attacks, increasing recovery costs and reputational damage.
How to implement
The IT team should schedule an annual test of the incident response plan.
This involves running a simulation of a cyber attack to check if everyone knows their role and if the plan works smoothly. Collect feedback afterward to update and improve the plan.
Ensure the management team reviews the updated incident response plan after every test.
This involves looking at what went well and what didn't during the simulation, and then making decisions on any necessary changes. Document these reviews to track improvements over time.
Assign a project manager to coordinate with all departments involved in the incident response.
They should ensure everyone participates in the testing and understands their responsibilities. Use team meetings and follow-up emails to confirm everyone's clear on their tasks.
Have the HR team include cyber incident response training in the annual staff training schedule.
Educate employees on recognising cyber threats and understanding the response process. Use simple examples and interactive sessions to reinforce learning.
The finance department should assess the costs associated with testing and improving the cyber incident response plan.
This includes estimating resources, training, and updates required after the annual test. Regular budgeting meetings can help allocate the right funds.
Keep it running
Exercise the incident response plan at least annually; capture lessons learned, update playbooks and contacts, and confirm each role is understood.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The test schedule and log: Request documentation showing the annual testing schedule for the response plans.
Look at
The dates and details of past tests.
Good evidence
Is a yearly record with clear dates, participants, and outcomes.
- Check 2 of 5What an auditor asks for
Look at
Sections detailing what was done well and what needs improvement. Good reports identify specific changes made to the plan based on test results.
- Check 3 of 5What an auditor asks for
Ask for
To see the current version of the incident response plan post-testing.
Look at
Dates and notes that indicate revisions were made after testing.
Good evidence
Is a recent update with clear revisions reflecting test findings.
- Check 4 of 5What an auditor asks for
Look at
Attendance records and training materials used.
Good evidence
Would show that all relevant personnel received up-to-date training, supported by attendance logs.
- Check 5 of 5What an auditor asks for
Ask for
Budget documentation linked to testing and updating the incident response plan.
Look at
How funds are allocated and used for these activities.
Good evidence
Includes detailed financial records showing planned and actual spending on these processes.
Mappings
Closest match in ISO/IEC 27001: A.5.24, Information security incident management planning and preparation, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.24.
ISM-1784 requires the organisation's cyber security incident management policy and associated incident response plan to be exercised at least annually. Annex A 5.24 requires the organisation to plan and prepare incident management by defining, establishing, and communicating incident management processes, roles, and responsibilities, which are the foundational elements typically exercised during annual tests. The ISO control focuses on establishing readiness, while ISM-1784 specifically mandates periodic exercising to validate that readiness in practice.
This control depends on A.5.26.
Annex A 5.26 requires responding to information security incidents in accordance with documented procedures. ISM-1784 requires exercising the incident management policy and response plan at least annually, which helps validate staff can follow the documented procedures during real incidents. ISM-1784 focuses on assurance/testing frequency.
ASD Essential Eight: 1 mapping
This control supports E8-MF-ML2.12.
E8-MF-ML2.12 requires the organisation to enact its incident response plan once an incident is identified. ISM-1784 requires the incident management policy and response plan to be exercised at least annually, which improves readiness to activate and execute the plan when a real incident occurs. ISM-1784 strengthens effectiveness and timeliness of enactment but does not itself require enactment upon identification.
ASD Essentials for enterprise IT: 3 mappings
- IT.RES-03.1Respond to cyber security incidents using documented, tested and approved proceduresPartially overlaps
This control partially overlaps IT.RES-03.1.
IT.RES-03.1 requires documented, tested and approved procedures to be used when responding to cyber security incidents; ISM-1784 requires the incident management policy and response plan to be exercised at least annually, which covers the tested part.
- IT.RES-04.2Evaluate monitoring coverage and response procedures after incidents and validate improvementsPartially overlaps
This control partially overlaps IT.RES-04.2.
IT.RES-04.2 requires monitoring coverage and incident response procedures to be evaluated after incidents; ISM-1784 requires the incident management policy and response plan to be exercised at least annually, complementing that post-incident evaluation with regular testing.
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresPartially overlaps
This control partially overlaps IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be built into incident response where required; ISM-1784 requires the incident management policy and response plan to be exercised at least annually, a chance to test those external coordination steps.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.