RES-04 Respond
Cyber security incident insights
Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner.
Enterprise IT actions
-
IT.RES-04.1
Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.
- Every phaseVisibility and response
ASD’s indicators
Not effective
- Post-incident reviews are not conducted.
Partially effective
- Post-incident reviews are conducted for some incidents but not all that meet the severity threshold defined by the organisation.
- Reviews are conducted but findings are not documented or actioned.
Fully effective
- Post-incident reviews are conducted for all incidents meeting the severity threshold defined by the organisation.
- Findings identify the specific gaps that enabled each stage of the incident.
- Remediation actions arising from findings are implemented and tracked to closure.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-0125, ISM-1526, ISM-1803
- NIST CSF 2.0
- RS.AN-03, RS.AN-08, ID.IM-01, ID.IM-02
- NIST SP 800-171r3
- 03.06.02, 03.06.01, 03.11.01
- AESCSF v2
- RESPONSE-3h, RESPONSE-3i, RISK-2a
-
IT.RES-04.2
Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.
- Every phaseVisibility and response
ASD’s indicators
Not effective
- Detection rules, monitoring coverage and response procedures are not reviewed following incidents.
Partially effective
- Reviews are conducted but do not result in documented changes to detection or response capabilities.
- Some improvements are made but not systematically tracked or validated.
Fully effective
- Detection rules, monitoring coverage and cyber security incident response procedures are reviewed following incidents, with identified lessons incorporated into updates.
- Changes are documented, tested and validated for effectiveness.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-1526, ISM-1617, ISM-1784
- NIST CSF 2.0
- RS.AN-03, ID.IM-01, ID.IM-03, GV.OV-01
- NIST SP 800-171r3
- 03.06.03, 03.06.05, 03.12.03
- AESCSF v2
- RESPONSE-3h, RESPONSE-3g, SITUATION-2i
Cloud actions
-
Action 1
Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.
- Every phaseVisibility and response
- ResponsibilityPaaS: Customer, SaaS: Customer
-
Action 2
Evaluate monitoring coverage and cyber security incident response procedures following cyber security incidents.
- Every phaseVisibility and response
- ResponsibilityPaaS: Customer, SaaS: Customer
More Respond principles
- RES-01Cyber security incident planning
- RES-02Cyber security incident reporting
- RES-03Cyber security incident response
- RES-05Cyber security incident coordination
Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.