IDE-04 · Identify

Security risk identification

Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions.

Enterprise IT actions

• IT.IDE-04.1

  Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • Risk assessments do not reference relevant weaknesses, malicious actor techniques and cyber threat behaviours.
  • No process exists to incorporate threat information into risk assessment activities.
  • Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are not reviewed or updated.

  Partially effective

  • Risk assessments reference threat intelligence but coverage is limited to well-known or generic threats.
  • Threat information is considered but not systematically mapped to organisational assets or detection gaps.
  • Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are reviewed or updated, but are not used to inform risk assessments or are reviewed only on an ad hoc basis.

  Fully effective

  • Risk assessments incorporate and reference relevant weaknesses, malicious actor techniques relevant to the sector, and cyber threat behaviours.
  • Relevant weaknesses, malicious actor techniques and cyber threat behaviours are systematically related to applicable assets and used to inform risk treatment decisions.
  • Current weaknesses, malicious actor techniques and cyber threat behaviours relevant to the organisation are reviewed or updated on a continuous basis at a frequency that enables noted changes to inform risk assessments.
  Related frameworks

  ISM

  ISM-1203, ISM-1526, ISM-1921, ISM-2116

  NIST CSF 2.0

  ID.RA-01, ID.RA-02, ID.RA-03, ID.RA-05

  NIST SP 800-171r3

  03.11.01, 03.11.02, 03.14.03, 03.12.03

  AESCSF v2

  THREAT-2a, THREAT-2b, THREAT-1a, RISK-2a

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Identify and analyse the OT attack surface, security boundaries and connectivity, including the points through which complete isolation can be enacted, and review these inputs on a continuous basis.

  • Every phaseVisibility and response
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Identify principles

• IDE-01Asset identification
• IDE-02Business criticality rating identification
• IDE-05Asset interdependencies
• IDE-06Resilience requirement identification

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.