Search

Categories

System Hardening Cryptography gateways Networking System Management Communications Infrastructure Personnel Security Media software development Enterprise Mobility Communications Systems Procurement and Outsourcing cybersecurity roles Email Information Technology Equipment system monitoring Database Systems Physical Security Cyber Security Incidents Data Transfers

16 controls

Cyber Security Incidents

ISM-0133

When a data spill occurs, data owners are advised and access to the data is restricted.

ISM-0137

Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

ISM-0138

The integrity of evidence gathered during an investigation is maintained by investigators:<br>• recording all of their actions<br>• maintaining a proper chain of custody<br>• following all instructions provided by relevant law enforcement agencies.

ISM-0917

When malicious code is detected, the following steps are taken to handle the infection: • the infected systems are isolated • all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary • antivirus software is used to remove the infection from infected systems and media • if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.

ISM-1213

Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to determine whether malicious actors have been successfully removed from the system.

ISM-1433

Service providers and their customers maintain 24/7 contact details for each other, including additional out-of-band contact details for when normal communication channels fail, in order to report cyber security incidents.

ISM-1434

Organisations and service providers provide each other with additional out-of-band contact details for use when normal communication channels fail.

ISM-1609

System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

ISM-1625

An insider threat mitigation program is developed, implemented and maintained.

ISM-1626

Legal advice is sought regarding the development and implementation of an insider threat mitigation program.

ISM-1731

Planning and coordination of intrusion remediation activities are conducted on a separate system to that which has been compromised.

ISM-1732

To the extent possible, all intrusion remediation activities are conducted in a coordinated manner during the same planned outage.

ISM-1819

Following the identification of a cyber security incident, the cyber security incident response plan is enacted.

ISM-1880

Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

ISM-1881

Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

ISM-1969

Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.

Last updated May 21, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy