Guidelines for cyber security incidents

Inform the chief information security officer quickly after any cyber incident is found.

Create and keep a log of any cyber security incidents that occur.

Report cyber incidents to ASD immediately when they're identified.

Organisations must create and keep an updated cyber security incident management and response plan.

Create and manage a program to address threats from within the organisation.

Get legal advice when making and applying plans to handle insider threats.

The organisation tests its cyber incident response plan every year to ensure it's effective.

Keep a record of cyber incidents including dates, actions, and reporting details.

Notify customers and the public promptly about cyber security incidents involving their data.

Inform customers about cyber incidents quickly if no customer data is involved.

When a data spill occurs, notify the data owner and limit access to protect information.

Before collecting evidence of cyber intrusions, get legal advice.

Investigators keep evidence intact by documenting actions, ensuring custody, and following law enforcement guidance.

Systems with malware are isolated, scanned, cleansed, or restored to stop the infection.

After cleaning up an intrusion, watch the affected system more closely than normal, and keep doing so until evidence shows the attacker is gone and has not returned.

System owners must be asked before allowing intrusions to persist for collecting evidence.

Once a system is compromised, the response team plans and coordinates the clean-up on a separate, trusted system so the attacker cannot watch or interfere with the remediation effort.

Plan the order and timing of clean-up actions after an intrusion so the attacker cannot get back in, while keeping disruption to the business within tolerable limits.

When a cyber incident is identified, the organisation activates its response plan.

Ensure malicious code cannot accidentally run by treating it before storage or communication.

Malicious code should be analysed in a separate, isolated environment to prevent system contamination.