Skip to content
OT principles
ASD Essentials

Essentials for OT

RES-02 Cyber security incident reporting

one actionNot in enterprise IT

Reporting starts with your own people. Give personnel an effective, ongoing process to raise an OT cyber security concern. Make sure it does not depend on any system outside OT, so it still works if those systems fail.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Cyber security incidents, including associated response and recovery activities, are reported internally and externally to relevant bodies and stakeholders in a timely manner.

ASD, Information Security Manual (ISM), Principle RES-02

The action

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 1

    Establish and maintain an effective process, independent of systems outside the OT environment, for personnel to raise an OT cyber security concern.

    In plain English: Set up and keep an effective process for personnel to raise an OT cyber security concern. It must not rely on systems outside OT.

    Domains
    Visibility and response

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.