ASD ISM 1880 Timely reporting of cyber incidents involving customer data
What it says
Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify customers and the public promptly about cyber security incidents involving their data.
If your business suffers from a cyber attack where customer data is exposed or stolen, this rule means you need to let your customers and the public know about it quickly. This is important because delaying such information can lead to worse outcomes, like financial harm or loss of trust, for both your customers and your business.
Free. Save your status, tasks and notes.
Why it matters
Delayed notification of incidents involving customer data can breach expectations, erode public trust, and increase customer fraud and privacy harm.
How to implement
Business owners should establish a response plan: Decide in advance who in your team will handle communications if there's a cyber incident.
This includes identifying spokespeople and setting up a contact list of customers to notify.
The IT team should set up monitoring systems: Continuously check for breaches or unusual activities that might indicate a cyber incident.
You can use basic logging tools to detect these and must ensure they are active and reviewed regularly.
The communications manager should prepare draft messages: Write template notices that can be quickly customised and sent out to customers in case of a breach.
Make sure these messages are clear, concise, and explain what happened and what steps customers can take next.
Managers should conduct regular training: Ensure all staff understand their role in the event of a cyber incident.
Host yearly or bi-annual sessions to go over the incident response plan and ensure everyone knows who to report issues to.
Assign a legal advisor to review obligations: Your legal team should keep you informed about the legal requirements for reporting data breaches, especially any changes.
They can ensure your notification process complies with regulations like the Australian Privacy Act.
Keep it running
Define notification triggers and timeframes for incidents involving customer data; maintain customer/public comms templates and up-to-date contact channels to notify promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident response plan: Request documentation that outlines steps to take during a cyber incident.
Look at
Its sections for communication with customers.
Good evidence
Plan lists roles, procedures, and communication channels.
- Check 2 of 5What an auditor asks for
Ask for
A list of recent incident reports: Request to see logs or reports of any recent cyber incidents.
Look at
How quickly incidents were reported to customers and what information was shared.
Good evidence
Report will have a timeline and details of the notification sent.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request documents showing any recent staff training on cyber incident response.
Look at
Attendance records and training content.
Good evidence
Record shows regular training sessions with high participation rates.
- Check 4 of 5What an auditor asks for
Ask for
Copies of customer notification templates: Request examples of pre-written communication templates.
Look at
Clarity and completeness in the language.
Good evidence
Template is ready to be customised with specifics and checked for legal compliance.
- Check 5 of 5What an auditor asks for
Ask for
Logs or tools used for monitoring incidents: Request to view logs or demonstrations of monitoring tools in use for detecting breaches.
Look at
How these tools identify and alert on potential incidents.
Good evidence
Setup shows regular checks and alerts being actioned promptly.
Mappings
Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.26.
ISM-1880 requires that incidents involving customer data are communicated externally to customers and the public in a timely manner. ISO/IEC 27001:2022 Annex A 5.26 supports this by requiring incidents to be responded to in accordance with documented procedures, which typically include communication/notification steps and approvals. Annex A 5.26 is broader incident response execution and does not explicitly require external notification to affected customers or the public, which is central to ISM-1880.
This control partially overlaps A.5.34.
Annex A 5.34 requires the organisation to identify and meet applicable legal, regulatory, and contractual requirements for privacy and protection of PII. ISM-1880 relates by requiring notification to customers and the public for cybersecurity incidents involving customer data, which is often a legal or regulatory privacy obligation. ISM-1880 is focused on incident notification while Annex A 5.34 addresses the comprehensive privacy compliance lifecycle.
This control partially overlaps A.6.8.
Annex A 6.8 requires mechanisms for prompt reporting of security events and suspected weaknesses through defined channels. ISM-1880 relates by requiring timely reporting of incidents involving customer data to customers and the public, which is a specific external reporting channel and audience. ISM-1880 is narrower and breach-communications focused, whereas Annex A 6.8 covers general event/weakness reporting by personnel and other parties, not public notification obligations.
ISO/IEC 42001: 2 mappings
This control partially overlaps A.8.4.
Annex A 8.4 requires a documented plan for communicating incidents to users of the AI system. ISM-1880 requires timely reporting of cyber security incidents involving customer data to customers and the public, which overlaps with notifying AI system users when they are customers or affected data subjects. ISM-1880 is conditional on incidents involving customer data and emphasises timeliness and public communication, whereas Annex A 8.4 is AI-system-user specific and requires an upfront documented plan regardless of whether customer data is involved.
This control partially overlaps A.8.5.
Annex A 8.5 requires determining and documenting AI reporting obligations. ISM-1880 mandates reporting of cyber incidents affecting customer data, which could apply if AI systems handling such data are involved in an incident. The overlap is on external reporting obligations, but ISM-1880 is incident-specific, while Annex A 8.5 is broader.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.