Australian Information Security Manual

Guidelines for cyber security incidents

Australian Information Security Manual ISM-1609: System owners are consulted before allowing intrusion activity to continue on a system for

System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

Other controls in Guidelines for cyber security incidents

ISM-0120 Cyber security personnel have access to sufficient data sources and tools to ensure that s
ISM-0123 Cyber security incidents are reported to the chief information security officer, or one of
ISM-0125 A cyber security incident register is developed, implemented and maintained.
ISM-0133 When a data spill occurs, data owners are advised and access to the data is restricted.
ISM-0137 Legal advice is sought before allowing intrusion activity to continue on a system for the
ISM-0138 The integrity of evidence gathered during an investigation is maintained by investigators:
ISM-0140 Cyber security incidents are reported to ASD as soon as possible after they occur or are d
ISM-0576 A cyber security incident management policy, and associated cyber security incident respon

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls