RES-03 · Respond

Cyber security incident response

Cyber security incidents are contained, eradicated and recovered from in a timely manner.

Enterprise IT actions

• IT.RES-03.1

  Use documented, tested and approved cyber security incident response procedures when responding to cyber security incidents.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • No documented cyber security incident response plan or procedures exist.
  • Incident response activities are conducted on an ad hoc basis without any defined roles, escalation paths, procedures or response objectives.
  • Available incident records demonstrate systemic failures to contain, eradicate or recover from cyber security incidents within organisationally defined timeframes, and the causes of these failures are not addressed.

  Partially effective

  • A cyber security incident response plan exists but has not been exercised or invoked within the organisationally defined test cycle.
  • The cyber security incident response plan defines roles, escalation paths, and response procedures, but target timeframes or intended response outcomes are not clearly defined.
  • Incident records or exercise results demonstrate that response activities do not consistently meet organisationally defined timeframes or intended outcomes, but identified deficiencies are documented and subject to improvement actions.

  Fully effective

  • An approved cyber security incident response plan is in place and defines roles, escalation paths, response procedures, target timeframes and intended containment, eradication and recovery outcomes.
  • The incident response plan and associated procedures have been exercised or invoked within the organisationally defined test cycle.
  • Incident records demonstrate that cyber security incidents are contained, eradicated and recovered from within organisationally defined target timeframes and achieve the intended response outcomes, taking into account incident severity, complexity and business impact.
  • Where target timeframes or intended outcomes are not achieved, the causes are analysed, improvement actions are assigned and tracked, and relevant plans, procedures and controls are updated.
  • Where no relevant cyber security incident has occurred during the assessment period, appropriately scoped exercises demonstrate the organisation's capability to achieve its target timeframes and intended response outcomes.
  Related frameworks

  ISM

  ISM-0043, ISM-0576, ISM-1784

  NIST CSF 2.0

  RS.MA-01, RS.MA-02, ID.IM-01, GV.OV-01

  NIST SP 800-171r3

  03.06.01, 03.06.05, 03.06.03

  AESCSF v2

  RESPONSE-3d, RESPONSE-3e, RESPONSE-3g

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Establish, maintain and exercise a plan to rapidly disconnect remote access when malicious activity is identified.

  • Every phaseVisibility and response
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Use documented, tested and approved incident response procedures when responding to cyber security incidents, covering tenant and identity-provider compromise, provider-side incidents, token and session revocation, removal of unauthorised consent grants and validation of a trusted state before resuming operations

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Respond principles

• RES-01Cyber security incident planning
• RES-02Cyber security incident reporting
• RES-04Cyber security incident insights
• RES-05Cyber security incident coordination

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.