Assess your enterprise IT against the ASD Essentials
Scope the eight domains, record what you observe against ASD's indicators of good practice for each action, and see where the gaps are.
Your assessment stays in this browser. Nothing is sent anywhere. Progress is saved in local storage on this device; use Export to keep a copy or move it between browsers.
A working aid, not a score. Priority phases are a sequencing mechanism and not a maturity rating. Ratings here are your own judgement against ASD's published indicators and are not an ASD or IRAP assessment.
Local storage is unavailable in this browser, so progress will be lost when the page closes. Export your assessment before leaving.
Scope
Mark each domain in or out of scope. Actions only count where at least one of their domains is in scope. Record a reason when you exclude a domain.
Technical domains
ASD recommends working through these in phase order.
Phase 1
Boundary services
Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services and edge devices.
Risk: Internet-facing and boundary systems are routinely exposed to adversary scanning and exploitation making them common targets for initial access.
Phase 1
Identity services
Enterprise-wide identity, credential and access management services such as directories, authentication and authorisation services or credential stores.
Risk: Compromise of enterprise-wide identity services can enable an adversary to gain persistent or privileged access across the enterprise.
Phase 2
Critical processes and services
Core processes and services that are critical to delivering primary organisational outcomes.
Risk: Compromise or loss of these systems can disrupt the organisation's ability to deliver critical outcomes or services.
Phase 2
Privileged environments
Systems and services that support privileged activities, management services and high-impact administrative functions.
Risk: Compromise of privileged systems can give an adversary extensive control over systems, services and security controls.
Phase 3
Business systems
Supporting enterprise functions that collectively enable organisational operations.
Risk: Compromise can disrupt day-to-day operations and provide pathways to more sensitive or critical systems.
Phase 3
User devices
Endpoints issued to the workforce, including desktops and laptops.
Risk: Widespread use and exposure make user devices common entry points for adversaries seeking access to the environment.
Capability domains
These apply across all phases.
All phases
Governance and culture
Policies, risk management processes, roles and security culture that underpin cyber security program.
Risk: Unclear ownership and accountability can lead to inconsistent security decisions and outcomes degrading over time.
All phases
Visibility and response
Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents.
Risk: Limited visibility and response can delay the detection, analysis and containment of intrusions.
Summary
Actions in scope0Across in-scope domainsAssessed0Actions with a ratingFully effective0Partially effective0Not effective0Not assessed0
Fully effective Partially effective Not effective Not assessed
By priority phase
Phase
Actions
Fully
Partially
Not
Not assessed
Progress
By domain
Domain
Actions
Fully
Partially
Not
Not assessed
Progress
By principle (28)
Principle
Actions
Fully
Partially
Not
Not assessed
Progress
Actions that apply to several domains are counted in each domain row, and once in the totals. Phases show the sequence ASD recommends; they are not a maturity level.
Gaps
In-scope actions rated Not effective or Partially effective, worst first, then by priority phase.
No gaps recordedRate some actions below to see gaps here.
Actions
Tick each indicator you have seen evidence for. The suggested rating is the most cautious reading of those ticks: any Not effective indicator gives Not effective, then any Partially effective indicator gives Partially effective, and all Fully effective indicators gives Fully effective. Override it whenever your judgement differs.
Govern
GOV-01 Executive cyber security accountability
The board of directors or executive committee is accountable for cyber security.
IT.GOV-01.1Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.Not assessed
The board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner.
IT.GOV-08.1Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.Not assessed
Applies to:Governance and culture
GOV-04 Cyber security resourcing
Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities.
IT.GOV-04.1Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.Not assessed
Applies to:Governance and culture
IT.GOV-04.2Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.Not assessed
Applies to:Governance and culture
GOV-03 Security risk management assurance
Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.
IT.GOV-03.1Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.Not assessed
Applies to:Governance and culture
GOV-11 Supplier cyber security assurance
Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly verified or otherwise risk-assessed.
IT.GOV-11.1Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.Not assessed
IT.GOV-11.2Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.Not assessed
Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.
IT.GOV-14.1Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.Not assessed
Applies to:Governance and culture
Identify
IDE-01 Asset identification
Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented.
IT.IDE-01.1Use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets.Not assessed
Applies to:Visibility and response
IT.IDE-01.2Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IDE-04 Security risk identification
Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions.
IT.IDE-04.1Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.Not assessed
Applies to:Visibility and response
Protect
PRO-01 Secure system lifecycle
Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices.
IT.PRO-01.1Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-01.2Secure build and deployment processes to enforce controls consistently across systems.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
PRO-16 Cyber supply chain security
Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.
IT.PRO-16.1Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-16.2Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.
IT.PRO-13.1Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-13.3Identify and remediate unsecured keys, secrets and credentials by regularly scanning codebases, configuration files, file shares and user collaboration platforms.Not assessed
IT.PRO-13.5Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-13.6Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.
IT.PRO-12.1Periodically review and update access privileges in alignment with current roles, duties and business requirements.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-12.2Grant only authorised administrative roles permissions to create, modify or delete accounts and roles, and access privileged functions or applications.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
IT.PRO-12.3Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner.
IT.PRO-05.1Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
IT.PRO-05.2Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
IT.PRO-05.3Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.
IT.PRO-04.1Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-04.3Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.
IT.PRO-06.1Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.PRO-06.3Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.
IT.PRO-07.1Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities.
IT.PRO-10.1Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
IT.PRO-10.2Isolate backup repositories from general user environments and production workloads, ensuring they are separated from primary systems to prevent unauthorised access, modification or deletion.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
IT.PRO-10.3Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.
IT.PRO-18.1Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
IT.PRO-18.2Limit lateral movement between, and within, network segments to explicitly approved pathways and services, based on business requirements and trust levels.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification.
IT.PRO-09.1Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems
Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats.
IT.PRO-14.1Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
IT.PRO-14.2Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.Not assessed
Applies to:Governance and culture
Detect
DET-01 Centralised event logging
Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.
IT.DET-01.1Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
IT.DET-01.2Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.
IT.DET-04.1Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.
IT.DET-02.1Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments.Not assessed
Applies to:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systemsUser devices
Cyber security events are analysed in a timely manner to identify cyber security incidents.
IT.DET-03.1Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.Not assessed
Applies to:Visibility and response
IT.DET-03.2Use indicators from across identities, applications, data and infrastructure activity rather than isolated signals when identifying cyber security incidents.Not assessed
Applies to:Visibility and response
DET-05 Detection capability efficacy
Cyber security event detection capabilities are regularly evaluated for effectiveness and continuously refined, including by using current strategic and sector-specific cyber threat intelligence, to improve the detection of cyber security events.
IT.DET-05.1Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.Not assessed
Applies to:Visibility and response
Respond
RES-05 Cyber security incident coordination
Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities.
IT.RES-05.1Integrate external coordination obligations into cyber security incident response activities where required.Not assessed
Applies to:Visibility and response
RES-03 Cyber security incident response
Cyber security incidents are contained, eradicated and recovered from in a timely manner.
IT.RES-03.1Use documented, tested and approved cyber security incident response procedures when responding to cyber security incidents.Not assessed
Applies to:Visibility and response
RES-04 Cyber security incident insights
Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner.
IT.RES-04.1Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.Not assessed
Applies to:Visibility and response
IT.RES-04.2Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.Not assessed
Applies to:Visibility and response
No actions match these filtersReset the filters to see every action.
