Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Event And Incident Response, Continuity Of Operations
  4. >Event And Incident Response, Continuity Of Operations - Objective 3
  5. >C2M2-RESPONSE-3C
C2M2-RESPONSE-3CActive

Reporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc manner

Statement

Reporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc manner

Location

Domain
Event and Incident Response, Continuity of Operations
Objective
Event and Incident Response, Continuity of Operations - Objective 3

Practice Details

Identifier
C2M2-RESPONSE-3C
Domain
Event and Incident Response, Continuity of Operations
Objective
Objective 3
Maturity Level
MIL-1

Help Text

Cybersecurity incident response staff must know what incident information should be reported to various internal and external stakeholders, within what timeframe, and whether there are any constraints (such as legal review of the information to be shared). When possible, assign a single person responsibility for reporting an incident throughout its duration to keep messages consistent as the event evolves. Keep contact information for stakeholders up-to-date. Stakeholders may include personnel, such as public relations team members or legal representatives, that are not involved in the direct response to an incident but must be informed to support the sustainment of the organizational operations.

Related Practices · Information Sharing: This practice is part of a group of cross-domain practices that enable information sharing with organizational stakeholders. These include: THREAT-1i, THREAT-2h, THREAT-2k, RISK-1c1d, SITUATION-3a, SITUATION-3c, SITUATION-3d, SITUATION-3e, RESPONSE-2g, RESPONSE-3c, RESPONSE-3f.

AESCSF
AESCSF-RESPONSE-3cequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Event and Incident Response, Continuity of Operations - Objective 3
Event and Incident Response, Continuity of Operations - Objective 312 controls
C2M2-RESPONSE-3ACybersecurity incident response personnel are identified, and roles are assigned, at least in an ad hoc mannerC2M2-RESPONSE-3BResponses to cybersecurity incidents are executed, at least in an ad hoc manner, to limit impact to the function and restore normal operationsC2M2-RESPONSE-3CReporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc mannerC2M2-RESPONSE-3DCybersecurity incident response plans that address all phases of the incident lifecycle are established and maintainedC2M2-RESPONSE-3ECybersecurity incident response is executed according to defined plans and proceduresC2M2-RESPONSE-3FCybersecurity incident response plans include a communications plan for internal and external stakeholdersC2M2-RESPONSE-3GCybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external eventsC2M2-RESPONSE-3HCybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3ICybersecurity incident root-cause analysis is performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3JCybersecurity incident responses are coordinated with vendors, law enforcement, and other external entities as appropriate, including support for evidence collection and preservationC2M2-RESPONSE-3KCybersecurity incident response personnel participate in joint cybersecurity exercises with other organizationsC2M2-RESPONSE-3LCybersecurity incident responses leverage and trigger predefined states of operation (SITUATION-3g)