ISM control lookup / Topic

Guidelines for cyber security incidents

21 controls · September 2026 edition

• ISM-0123 · Reporting cyber security incidents

  Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.

• ISM-0125 · Cyber security incident register

  A cyber security incident register is developed, implemented and maintained.

• ISM-0133 · Handling and containing data spills

  When a data spill occurs, data owners are advised and access to the data is restricted.

• ISM-0137 · Handling and containing intrusions

  Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

• ISM-0138 · Maintaining the integrity of evidence

  The integrity of evidence gathered during an investigation is maintained by investigators:

• ISM-0140 · Reporting cyber security incidents to ASD

  Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.

• ISM-0576 · Cyber security incident management policy

  A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained.

• ISM-0917 · Handling and containing malicious code infections

  When malicious code is detected, the following steps are taken to handle the infection:

• ISM-1213 · Handling and containing intrusions

  Following intrusion remediation activities, enhanced monitoring is conducted until there is sufficient evidence-based confidence that malicious actors have been eradicated from a system and have not re-established access.

• ISM-1609 · Handling and containing intrusions

  System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

• ISM-1625 · Insider threat mitigation program

  An insider threat mitigation program is developed, implemented and maintained.

• ISM-1626 · Insider threat mitigation program

  Legal advice is sought regarding the development and implementation of an insider threat mitigation program.

• ISM-1731 · Handling and containing intrusions

  Planning and coordination of intrusion remediation activities are conducted using trusted systems separate from a compromised system.

• ISM-1732 · Handling and containing intrusions

  Intrusion remediation activities are coordinated and sequenced to minimise opportunities for re-compromise of a system while balancing operational risk and business continuity requirements.

• ISM-1784 · Cyber security incident management policy

  The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually.

• ISM-1803 · Cyber security incident register

  A cyber security incident register contains the following for each cyber security incident:

• ISM-1819 · Enacting cyber security incident response plans

  Following the identification of a cyber security incident, the cyber security incident response plan is enacted.

• ISM-1880 · Reporting cyber security incidents to customers and the public

  Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

• ISM-1881 · Reporting cyber security incidents to customers and the public

  Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

• ISM-1969 · Handling and containing malicious code infections

  Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.

• ISM-1970 · Handling and containing malicious code infections

  Malicious code processing for cyber security incident response or research purposes is conducted in a dedicated analysis environment segregated from other systems.