ASD Essentials reference

Every ASD Essentials principle and its actions, with the domains and priority phases each one applies to.

Chapters

• Enterprise IT

  For organisations operating their own IT environment, including staff devices, servers, networks and accounts.

• Operational technology

  For organisations monitoring or controlling physical processes, such as in factories, pipelines or power plants.

• Cloud

  For organisations whose technology environment runs entirely on software-as-a-service and platform-as-a-service.

Principles

Govern

• GOV-01Executive cyber security accountabilityEnterprise IT, OT, Cloud
• GOV-03Security risk management assuranceEnterprise IT, Cloud
• GOV-04Cyber security resourcingEnterprise IT, OT, Cloud
• GOV-07Continuous cyber security improvementOT
• GOV-08Executive artificial intelligence accountabilityEnterprise IT, OT, Cloud
• GOV-09Security risk management responsibilitiesCloud
• GOV-10System exposure minimisationOT
• GOV-11Supplier cyber security assuranceEnterprise IT, OT, Cloud
• GOV-14Legacy system managementEnterprise IT, OT, Cloud

Identify

• IDE-01Asset identificationEnterprise IT, OT, Cloud
• IDE-02Business criticality rating identificationOT
• IDE-04Security risk identificationEnterprise IT, OT, Cloud
• IDE-05Asset interdependenciesOT
• IDE-06Resilience requirement identificationOT

Protect

• PRO-01Secure system lifecycleEnterprise IT, OT, Cloud
• PRO-04Secure configuration managementEnterprise IT, OT, Cloud
• PRO-05Secure administrationEnterprise IT, OT, Cloud
• PRO-06Vulnerability managementEnterprise IT, OT, Cloud
• PRO-07Trustworthy softwareEnterprise IT, OT, Cloud
• PRO-08Cryptographic protectionCloud
• PRO-09Content filteringEnterprise IT, Cloud
• PRO-10Regular and proven backupsEnterprise IT, OT, Cloud
• PRO-12Least privilege accessEnterprise IT, OT, Cloud
• PRO-13Identity, credential and access managementEnterprise IT, OT, Cloud
• PRO-14Cyber security awareness trainingEnterprise IT, OT, Cloud
• PRO-15Physical access controlOT
• PRO-16Cyber supply chain securityEnterprise IT, OT, Cloud
• PRO-18Network segmentation and segregationEnterprise IT, OT, Cloud
• PRO-19Operational technology isolationOT
• PRO-20Remote access to operational technologyOT

Detect

• DET-01Centralised event loggingEnterprise IT, OT, Cloud
• DET-02Cyber security event detectionEnterprise IT, OT, Cloud
• DET-03Cyber security incident identificationEnterprise IT, Cloud
• DET-04Baseline high-risk access activitiesEnterprise IT, OT, Cloud
• DET-05Detection capability efficacyEnterprise IT, Cloud

Respond

• RES-01Cyber security incident planningOT
• RES-02Cyber security incident reportingOT
• RES-03Cyber security incident responseEnterprise IT, OT, Cloud
• RES-04Cyber security incident insightsEnterprise IT, Cloud
• RES-05Cyber security incident coordinationEnterprise IT, OT, Cloud

Recover

• REC-02System recovery assuranceOT

Open the Navigator →

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.