RES-05 · Respond

Cyber security incident coordination

Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities.

Enterprise IT actions

• IT.RES-05.1

  Integrate external coordination obligations into cyber security incident response activities where required.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • External coordination requirements for Cyber security incident response activities are neither identified nor documented.
  • No defined triggers, contacts or timeframes exist for external reporting.

  Partially effective

  • External coordination requirements are documented but are not integrated into operational response procedures.
  • Contacts and triggers are defined for some but not all required external parties.

  Fully effective

  • Cyber security incident response procedures include documented external coordination requirements with defined triggers, contacts and timeframes.
  • Requirements cover all relevant external parties identified by applicable legal, regulatory, contractual and organisational obligations.
  • Coordination procedures have been exercised or invoked and lessons learnt have been incorporated.
  Related frameworks

  ISM

  ISM-0043, ISM-0576, ISM-1784

  NIST CSF 2.0

  RS.CO-02, RS.CO-03, GV.OC-03, RS.MA-01

  NIST SP 800-171r3

  03.06.02, 03.06.05, 03.12.05

  AESCSF v2

  RESPONSE-3c, RESPONSE-3f, RESPONSE-3j

  Essential Eight

  Multi-factor authentication, Restrict administrative privileges, Application control, User application hardening

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Maintain alternative communications for site-to-site and site-to-staff use during degradation or loss of normal communications, and establish processes to have the right staff at the right site when isolation is enacted.

  • Every phaseVisibility and response
  Rate this action in the Navigator →
• Action 2

  Build into response plans the capability to collect forensic artefacts for later offline analysis within pre-approved areas.

  • Every phaseVisibility and response
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Integrate external coordination obligations and requirements into incident response activities, including provider notifications arrangements, escalation contacts and the division of investigative responsibilities under shared responsibility

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Respond principles

• RES-01Cyber security incident planning
• RES-02Cyber security incident reporting
• RES-03Cyber security incident response
• RES-04Cyber security incident insights

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.