ASD ISM 1819 Enact cyber security incident response plans
What it says
Following the identification of a cyber security incident, the cyber security incident response plan is enacted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen a cyber incident is identified, the organisation activates its response plan.
Having a cyber security incident response plan in place and ready to go is like having a fire drill plan for emergencies. If a cyber attack happens and there's no plan, the organisation could suffer extensive damage, financial losses, and harm to its reputation due to a delayed or ineffective response.
Free. Save your status, tasks and notes.
Why it matters
Delayed incident response can lead to prolonged breaches, escalating costs, data loss, and significant reputational harm.
How to implement
The IT manager should create a detailed incident response plan.
This plan should outline the steps the team will take when a cyber attack occurs, including identifying the roles and responsibilities of each team member.
Business leaders should ensure all staff are trained on the incident response plan.
This involves organising regular training sessions and simulations, so everyone knows what to do and where to find the plan during an actual event.
The HR team should maintain an up-to-date contact list of all key personnel involved in the incident response.
This list should be distributed to all relevant team members to ensure quick communications during an incident.
The IT team should establish a clear communication plan.
This involves specifying who will communicate with law enforcement, stakeholders, and potentially impacted customers during a cyber incident.
The risk management team should routinely review and test the incident response plan.
Use scenarios to test the plan, update it based on test outcomes, and ensure it aligns with the guidelines provided by the Australian Cyber Security Centre (ACSC).
Keep it running
Run incident response exercises and confirm triggers, roles and contacts so the plan is enacted immediately after incident identification.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The documented incident response plan: Check that the plan includes specific roles, actions, and communication strategies for different types of incidents.
Good evidence
Includes a detailed, written plan that specifies responsibilities and is easily accessible to everyone who needs it.
- Check 2 of 3What an auditor asks for
Ask for
Records of incident response training sessions.
Look at
Training attendance logs and materials used.
Good evidence
Outcome is recent dated records showing that all staff have attended training within the last year.
- Check 3 of 3What an auditor asks for
Ask for
To see the up-to-date contact list for response team members: Verify that this list includes names, roles, and multiple contact methods. Good documentation will show it is easily accessible and periodically reviewed to ensure accuracy.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.11, Cyber security incident response plan is enacted after incident identification, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.24.
ISM-1819 requires that the incident response plan is enacted after a cyber security incident is identified. ISO/IEC 27001:2022 Annex A 5.24 is broader because it focuses on planning and preparation for incident management, including defining processes, roles and responsibilities. Enacting the plan in ISM-1819 is one execution step that sits within the wider planning-and-preparation expectations of Annex A 5.24.
This control supports A.5.28.
ISM-1819 requires the organisation to enact its cyber security incident response plan following identification of an incident. ISO/IEC 27001:2022 Annex A 5.28 supports that response by requiring procedures to identify, collect and preserve evidence related to information security events, which is a key activity frequently executed during incident response. Annex A 5.28 does not itself require activation of the plan, but it strengthens the quality and defensibility of actions taken once ISM-1819 is triggered.
ASD Essential Eight: 6 mappings
- E8-AC-ML2.11Cyber security incident response plan is enacted after incident identificationEquivalent
This control is equivalent to E8-AC-ML2.11.
ISM-1819 requires the organisation to enact its cyber security incident response plan once an incident is identified. E8-AC-ML2.11 contains the same enactment requirement with the same trigger. There is no meaningful difference in scope beyond wording.
This control is equivalent to E8-AH-ML2.18.
ISM-1819 requires that, once a cyber security incident is identified, the organisation enacts its cyber security incident response plan. E8-AH-ML2.18 states the same trigger (incident identification) and the same required action (enact the incident response plan). The two controls align in scope and intent with no material difference in depth.
This control is equivalent to E8-MF-ML2.12.
ISM-1819 requires that, following identification of a cyber security incident, the cyber security incident response plan is enacted. E8-MF-ML2.12 mirrors this requirement by specifying enactment of the incident response plan after incident identification. Both controls describe the same operational step in the incident management lifecycle.
This control is equivalent to E8-RA-ML2.13.
E8-RA-ML2.13 requires that once a cyber security incident is identified, the organisation enacts its cyber security incident response plan. ISM-1819 states the same requirement: following identification of a cyber security incident, the incident response plan is enacted. Both controls focus on the activation trigger and immediate commencement of the planned response.
This control partially overlaps E8-AC-ML2.9.
ISM-1819 requires that once a cyber security incident is identified, the organisation activates its incident response plan. E8-AC-ML2.9 focuses on promptly reporting incidents to the CISO or delegate, which commonly occurs as part of enacting an incident response plan. The candidate is about escalation and notification, whereas ISM-1819 is about triggering the whole response capability, including containment and recovery activities.
This control partially overlaps E8-AH-ML2.16.
ISM-1819 requires the organisation to enact its cyber security incident response plan following identification of an incident. E8-AH-ML2.16 requires incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery, which is a common initiation activity within many response plans. E8-AH-ML2.16 emphasises internal escalation/reporting, while ISM-1819 emphasises activation of the broader response plan (which may include many actions beyond notifying the CISO).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.