ASD Essentials for Enterprise IT RES-05: Incident coordination: integrate external coordination obligations into response

What does RES-05 require?

Where the organisation has external coordination duties, such as regulatory notification, reporting to ASD, law enforcement liaison or contractual notice to customers and partners, those duties are built into the incident response process.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Visibility and response – ASD Essentials for Enterprise IT

DET-01 Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes
DET-02 Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs
DET-03 Incident identification: timely triage against incident thresholds using correlated indicators
DET-05 Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes
IDE-01 Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data
IDE-04 Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously
RES-03 Incident response: use documented, tested and approved procedures
RES-04 Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls