Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

RES-04 Cyber security incident insights

two actionsAlso in ASD Essentials for enterprise IT

After a cyber security incident, review it to find the security gaps that let each stage of the incident happen. Then check how well your monitoring coverage and incident response procedures held up, so you can improve them.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner.

ASD, Information Security Manual (ISM), Principle RES-04

The two actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 2

    Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.

    In plain English: After a cyber security incident, review it. Find the security gaps that let each stage of the incident happen.

    Domains
    Visibility and response
    Who does it
    PaaSCustomer
    SaaSCustomer

  2. Action 2 of 2

    Evaluate monitoring coverage and cyber security incident response procedures following cyber security incidents.

    In plain English: After an incident, check what your monitoring did and did not cover. Also check how well your incident response procedures worked.

    Domains
    Visibility and response
    Who does it
    PaaSCustomer
    SaaSCustomer

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.