ASD Essentials for Enterprise IT
The Australian Signals Directorate's enterprise IT chapter of the ASD Essentials series: ISM principles with technology-agnostic actions across governance and culture, visibility and response, and the six technical domains (boundary services, identity services, critical processes and services, privileged environments, business systems and user devices), sequenced in three priority phases as the successor to the Essential Eight framing.
ASD Essentials for Enterprise IT is a compliance framework from Australia with 6 domains and 28 controls. The largest domains are Capability domain: Visibility and response – ASD Essentials for Enterprise IT (9 controls), Capability domain: Governance and culture – ASD Essentials for Enterprise IT (7 controls), Technical domains: configuration, vulnerability management, trustworthy software and backups – ASD Essentials for Enterprise IT (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Capability domain: Governance and culture – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::GOV-01 | Executive cyber security accountability: define board and executive accountabilities, risk appetite and a review cadence |
| asd-essentials-for-enterprise-it::GOV-03 | Security risk management assurance: maintain a risk management methodology and plan |
| asd-essentials-for-enterprise-it::GOV-04 | Cyber security resourcing: assign skilled personnel, define responsibilities in roles and review resourcing periodically |
| asd-essentials-for-enterprise-it::GOV-08 | Executive accountability for artificial intelligence use, governance and risk |
| asd-essentials-for-enterprise-it::GOV-11 | Supplier cyber security assurance: risk-assess suppliers proportionately, retain evidence and keep assurance current |
| asd-essentials-for-enterprise-it::GOV-14 | Legacy system management: identify, assess and treat the risks of legacy and unsupported technologies until removed |
| asd-essentials-for-enterprise-it::PRO-14 | Cyber security awareness training: role-tailored before access, updated regularly for current threats |
Capability domain: Visibility and response – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::DET-01 | Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes |
| asd-essentials-for-enterprise-it::DET-02 | Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs |
| asd-essentials-for-enterprise-it::DET-03 | Incident identification: timely triage against incident thresholds using correlated indicators |
| asd-essentials-for-enterprise-it::DET-05 | Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes |
| asd-essentials-for-enterprise-it::IDE-01 | Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data |
| asd-essentials-for-enterprise-it::IDE-04 | Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously |
| asd-essentials-for-enterprise-it::RES-03 | Incident response: use documented, tested and approved procedures |
| asd-essentials-for-enterprise-it::RES-04 | Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures |
| asd-essentials-for-enterprise-it::RES-05 | Incident coordination: integrate external coordination obligations into response |
Technical domains: asset identification, secure lifecycle and supply chain – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::PRO-01 | Secure system lifecycle: design for visibility, authorised access, data protection, minimal privilege and exposure, and secure build and deployment |
| asd-essentials-for-enterprise-it::PRO-16 | Cyber supply chain security: verify software integrity, authenticity and provenance, and act on advisories within risk-based timeframes |
Technical domains: configuration, vulnerability management, trustworthy software and backups – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::PRO-04 | Secure configuration management: approved hardening baselines deployed everywhere, with drift detection and response |
| asd-essentials-for-enterprise-it::PRO-06 | Vulnerability management: continuous scanning, risk-based patching timeframes and verified remediation |
| asd-essentials-for-enterprise-it::PRO-07 | Trustworthy software: application control with minimised, risk-accepted exceptions, and restricted administrative tooling |
| asd-essentials-for-enterprise-it::PRO-10 | Regular and proven backups: scheduled, encrypted and immutable or isolated backups, separated from production, tested against recovery objectives |
Technical domains: identity, credentials, least privilege and secure administration – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::PRO-05 | Secure administration: dedicated hardened administration environments, explicit session controls with time-bound privilege, and recorded administrative actions |
| asd-essentials-for-enterprise-it::PRO-12 | Least privilege access: periodic privilege reviews, restricted account administration rights and minimum-privilege provisioning |
| asd-essentials-for-enterprise-it::PRO-13 | Identity, credential and access management: find exposed secrets, remove default and unused accounts, secure secrets with MFA, phishing-resistant MFA, no legacy authentication, unique credentials |
Technical domains: network segmentation, content filtering, awareness training and event logging – ASD Essentials for Enterprise IT
| Code | Title |
|---|---|
| asd-essentials-for-enterprise-it::DET-04 | Baselined high-risk access activities: monitor software execution behaviour for misuse of legitimate tools |
| asd-essentials-for-enterprise-it::PRO-09 | Content filtering: inspect inbound content, block known malicious destinations and inspect outbound flows for data exfiltration |
| asd-essentials-for-enterprise-it::PRO-18 | Network segmentation and segregation: zone systems by criticality and trust, restrict and monitor approved pathways, limit lateral movement |
What is ASD Essentials for Enterprise IT and who does it apply to?
ASD Essentials for Enterprise IT is a compliance framework from Australia with 6 domains and 28 controls. The Australian Signals Directorate's enterprise IT chapter of the ASD Essentials series: ISM principles with technology-agnostic actions across governance and culture, visibility and response, and the six technical domains (boundary services, identity services, critical processes and services, privileged environments, business systems and user devices), sequenced in three priority phases as the successor to the Essential Eight framing. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ASD Essentials for Enterprise IT actually require?
ASD Essentials for Enterprise IT has 28 controls organised across 6 domains. The largest domains are Capability domain: Visibility and response – ASD Essentials for Enterprise IT (9 controls), Capability domain: Governance and culture – ASD Essentials for Enterprise IT (7 controls), Technical domains: configuration, vulnerability management, trustworthy software and backups – ASD Essentials for Enterprise IT (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ASD Essentials for Enterprise IT do I already cover?
ASD Essentials for Enterprise IT does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ASD Essentials for Enterprise IT?
Start your ASD Essentials for Enterprise IT compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ASD Essentials for Enterprise IT requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required