ASD Essentials for Enterprise IT IDE-04: Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously

What does IDE-04 require?

Risk assessments draw on known weaknesses, the techniques adversaries use and observed threat behaviour, and those inputs are refreshed continuously rather than at a fixed review date.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Visibility and response – ASD Essentials for Enterprise IT

DET-01 Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes
DET-02 Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs
DET-03 Incident identification: timely triage against incident thresholds using correlated indicators
DET-05 Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes
IDE-01 Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data
RES-03 Incident response: use documented, tested and approved procedures
RES-04 Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures
RES-05 Incident coordination: integrate external coordination obligations into response

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls