Australian Information Security Manual ISM-1213: Following intrusion remediation activities, full network traffic is captured for at least

Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to determine whether malicious actors have been successfully removed from the system.

Other controls in Guidelines for cyber security incidents

ISM-0120 Cyber security personnel have access to sufficient data sources and tools to ensure that s
ISM-0123 Cyber security incidents are reported to the chief information security officer, or one of
ISM-0125 A cyber security incident register is developed, implemented and maintained.
ISM-0133 When a data spill occurs, data owners are advised and access to the data is restricted.
ISM-0137 Legal advice is sought before allowing intrusion activity to continue on a system for the
ISM-0138 The integrity of evidence gathered during an investigation is maintained by investigators:
ISM-0140 Cyber security incidents are reported to ASD as soon as possible after they occur or are d
ISM-0576 A cyber security incident management policy, and associated cyber security incident respon

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls