ASD Essentials Navigator
The easiest way to understand & assess your ASD Essentials readiness.
Navigate controls in an interactive app. See how the framework applies to your environment, understand where the gaps are and print an action plan.
Open the NavigatorASD Essentials in 5 minutes
New to ASD Essentials? Click through a short interactive explainer to learn what it is, how principles, actions, domains and priority phases fit together, and how to assess where you stand today.
Start the explainer
What is ASD Essentials?
ASD Essentials is guidance from the Australian Signals Directorate that sets out cyber security principles and the actions behind them. Actions are grouped into domains such as governance and culture, identity services, boundary services and user devices, and domains are ordered into priority phases.
It has chapters for enterprise IT, operational technology and cloud. For each action, ASD describes what not effective, partially effective and fully effective look like in its Indicators of Good Practice.
What does this app do?
-
Navigate and understand controls. Explore principles and actions in one matrix, grouped by function and priority phase. Use ASD’s indicators and short yes/no questions to understand the requirements.
-
Assess your current posture. Rate each action, identify gaps and see where you stand across each domain.
-
Plan and communicate next steps. Prioritise the weakest principles and export a summary to brief your team and stakeholders.
Frequently asked questions
Is the ASD Essentials Navigator free?
Yes. It is a free community project with no account, email address or payment required. Open it and start your assessment.
How does ASD Essentials relate to the Essential Eight?
ASD Essentials covers a broader range of security outcomes, including governance, identity, boundary services, detection and response, across enterprise IT, operational technology and cloud.
In the enterprise IT chapter, actions show their related Essential Eight strategy and maturity level. You can also filter by strategy. Maturity levels do not translate directly into effectiveness ratings. Existing investment in Essential Eight controls can contribute to actions in the Essentials series where they achieve the required outcomes.
Which chapter should I use?
- Enterprise IT: For organisations operating their own IT environment, including staff devices, servers, networks and accounts.
- Operational technology: For organisations monitoring or controlling physical processes, such as in factories, pipelines or power plants.
- Cloud: For organisations whose technology environment runs entirely on software-as-a-service and platform-as-a-service.
You can switch chapters at any time. Each chapter keeps its own ratings.
How are principle ratings and domain scores calculated?
You rate each action in every domain where it applies. The principle’s rating follows its weakest assessed action: not effective takes precedence over partially effective, which takes precedence over fully effective. Unassessed actions are excluded.
Domain scores count fully effective principles as 1 and partially effective principles as 0.5, following ASD’s assessment process guide.
What are priority phases?
Priority phases set ASD’s recommended order of work. For enterprise IT:
- Phase 1: Boundary services and identity services.
- Phase 2: Critical processes and services, and privileged environments.
- Phase 3: Business systems and user devices.
Governance and culture and Visibility and response apply across every phase. Other chapters have their own order.
Can I share or export my results?
Yes. Download an Excel workbook, print a summary or copy a results link. You can also save labelled snapshots to compare progress over time.
Can I use it for an audit?
The Navigator supports self-assessment. Use it to identify gaps, plan improvements and brief stakeholders, and retain supporting evidence for any formal assessment.