Skip to content
OT principles
ASD Essentials

Essentials for OT

RES-05 Cyber security incident coordination

two actionsAlso in ASD Essentials for enterprise IT

Be ready to coordinate a response across sites when normal communications degrade or fail. Keep backup communications between sites and staff, and get the right people to the right site when you isolate OT. Plan to collect evidence for later analysis.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities.

ASD, Information Security Manual (ISM), Principle RES-05

The two actions

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 2

    Maintain alternative communications for site-to-site and site-to-staff use during degradation or loss of normal communications, and establish processes to have the right staff at the right site when isolation is enacted.

    In plain English: Keep backup site-to-site and site-to-staff communications for when normal ones degrade or fail. Have processes to get the right staff to the right site when isolation begins.

    Domains
    Visibility and response

  2. Action 2 of 2

    Build into response plans the capability to collect forensic artefacts for later offline analysis within pre-approved areas.

    In plain English: Build into response plans a way to collect forensic evidence (digital traces of what happened) for later offline analysis within pre-approved areas.

    Domains
    Visibility and response

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.