ASD Essentials for enterprise IT

For organisations operating their own IT environment, including staff devices, servers, networks and accounts.

Domains and priority phases

Priority phases set ASD’s recommended order of work.

Every phase

• Governance and culture

  Policies, risk management processes, roles and security culture that underpin cyber security program.

  Unclear ownership and accountability can lead to inconsistent security decisions and outcomes degrading over time.

• Visibility and response

  Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents.

  Limited visibility and response can delay the detection, analysis and containment of intrusions.

Phase 1

• Boundary services

  Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services and edge devices.

  Internet-facing and boundary systems are routinely exposed to adversary scanning and exploitation making them common targets for initial access.

• Identity services

  Enterprise-wide identity, credential and access management services such as directories, authentication and authorisation services or credential stores.

  Compromise of enterprise-wide identity services can enable an adversary to gain persistent or privileged access across the enterprise.

Phase 2

• Critical processes and services

  Core processes and services that are critical to delivering primary organisational outcomes.

  Compromise or loss of these systems can disrupt the organisation's ability to deliver critical outcomes or services.

• Privileged environments

  Systems and services that support privileged activities, management services and high-impact administrative functions.

  Compromise of privileged systems can give an adversary extensive control over systems, services and security controls.

Phase 3

• Business systems

  Supporting enterprise functions that collectively enable organisational operations.

  Compromise can disrupt day-to-day operations and provide pathways to more sensitive or critical systems.

• User devices

  Endpoints issued to the workforce, including desktops and laptops.

  Widespread use and exposure make user devices common entry points for adversaries seeking access to the environment.

Principles

Govern

• GOV-01Executive cyber security accountability
• GOV-08Executive artificial intelligence accountability
• GOV-04Cyber security resourcing
• GOV-03Security risk management assurance
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Identify

• IDE-01Asset identification
• IDE-04Security risk identification

Protect

• PRO-01Secure system lifecycle
• PRO-16Cyber supply chain security
• PRO-13Identity, credential and access management
• PRO-12Least privilege access
• PRO-05Secure administration
• PRO-04Secure configuration management
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-10Regular and proven backups
• PRO-18Network segmentation and segregation
• PRO-09Content filtering
• PRO-14Cyber security awareness training

Detect

• DET-01Centralised event logging
• DET-04Baseline high-risk access activities
• DET-02Cyber security event detection
• DET-03Cyber security incident identification
• DET-05Detection capability efficacy

Respond

• RES-05Cyber security incident coordination
• RES-03Cyber security incident response
• RES-04Cyber security incident insights

Open the Navigator →

Source: ASD Essentials for enterprise IT, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.