ASD Essentials for enterprise IT 

Guidance to help organisations protect their enterprise IT environments from sophisticated cyber threats.

ASD Essentials - Domains

The ASD Essentials uses domains to describe where actions apply. In the Essentials for enterprise for IT, there are 6 technical domains that group systems, services and assets that share similar cyber security risks.

Implementing the domains

The six technical domains are grouped into priority phases. The phases set out ASD’s recommended implementation sequence, focusing effort where it can deliver the greatest and most rapid reduction in cyber security risk.

Priority phases are a sequencing mechanism, not a rating or maturity model. The two capability domains (Governance and culture, and Visibility and response) apply across all three priority phases and expand as implementation progresses.

Governance and culture

Governance and culture covers the policies, risk management processes, roles, and security culture that support an organisation’s cyber security program. It helps establish clear ownership, accountability and consistent security decision-making.

Find out more about governance and culture

Visibility and response

Visibility and response covers the processes and capabilities used to detect, analyse and respond to cyber security events and incidents. Effective visibility and response reduces delays in identifying, analysing and containing intrusions.

Find out more about visibility and response

Priority Phase 1

Boundary services and identity services are addressed first because they are common pathways for adversaries seeking initial access. Strong identity services also provide the trust foundation for later phases.

Identity services

Identity services manage identities, credentials and access, including directories, authentication and authorisation services and credential stores.

Compromise can give an adversary persistent or privileged access across the environment and undermine controls that rely on trusted identities.

Find out more about identity services

Priority Phase 1

Boundary services and identity services are addressed first because they are common pathways for adversaries seeking initial access. Strong identity services also provide the trust foundation for later phases.

Boundary services

Boundary services are gateways and access at network boundaries that manage connectivity between environments of different trust levels, including internet-facing services and edge devices.

These systems are routinely exposed to adversary scanning and exploitation. Weaknesses can provide a direct path into the environment and undermine protections implemented elsewhere.

Find out more about boundary services

Priority Phase 2

Privileged environments and critical processes and services are addressed together to limit an adversary’s ability to escalate access and reduce the impact of a successful intrusion.

Critical processes and services

Critical processes and services are the core processes and services needed to deliver an organisation’s primary outcomes.

Compromise can cause direct disruption to the organisation’s functioning or interrupt its customers or services. It includes both supporting IT and operational systems.

Malicious actors targeting this domain typically pursue disruption (rendering services unavailable through ransomware or destructive attacks), or theft (exfiltration of high-value data for intelligence, competitive advantage or extortion). As these assets represent the highest-value targets, they attract the most capable and deliberate malicious actor activity.

Find out more about critical processes and services

Priority Phase 2

Privileged environments and critical processes and services are addressed together to limit an adversary’s ability to escalate access and reduce the impact of a successful intrusion.

Privileged environments

Privileged environments are the systems, services and accounts that support privileged activities, management services and high-impact administrative functions.

Compromise can give an adversary extensive control over systems, services and security controls, enabling further access and making detection and containment more difficult.

Find out more about privileged environments

Priority Phase 3

Business systems and user devices are addressed after the earlier phases because they are the largest and most widely distributed parts of the environment. The controls established earlier make these assets easier to secure consistently at scale.

Business systems

Business systems support the enterprise functions that enable day-to-day operations.

Compromise can disrupt those operations and provide pathways to more sensitive or critical systems.

Find out more about business systems

Priority Phase 3

Business systems and user devices are addressed after the earlier phases because they are the largest and most widely distributed parts of the environment. The controls established earlier make these assets easier to secure consistently at scale.

User devices

User devices are endpoints people use, including workstations.

Their widespread use and connection to other systems make them pathways for compromise. Protecting them at scale reduces the impact of everyday activity and adversary movement to other systems.

Find out more about user devices

ASD Essentials - Domains

The ASD Essentials uses domains to describe where actions apply. In the Essentials for enterprise for IT, there are 6 technical domains that group systems, services and assets that share similar cyber security risks.

Implementing the domains

The six technical domains are grouped into priority phases. The phases set out ASD’s recommended implementation sequence, focusing effort where it can deliver the greatest and most rapid reduction in cyber security risk.

Priority phases are a sequencing mechanism, not a rating or maturity model. The two capability domains (Governance and culture, and Visibility and response) apply across all three priority phases and expand as implementation progresses.

Governance and culture

Governance and culture covers the policies, risk management processes, roles, and security culture that support an organisation’s cyber security program. It helps establish clear ownership, accountability and consistent security decision-making.

Visibility and response

Visibility and response covers the processes and capabilities used to detect, analyse and respond to cyber security events and incidents. Effective visibility and response reduces delays in identifying, analysing and containing intrusions.

Priority Phase 1

Boundary services and identity services are addressed first because they are common pathways for adversaries seeking initial access. Strong identity services also provide the trust foundation for later phases.

Identity services

Identity services manage identities, credentials and access, including directories, authentication and authorisation services and credential stores.

Compromise can give an adversary persistent or privileged access across the environment and undermine controls that rely on trusted identities.

Find out more about identity services

Boundary services

Boundary services are gateways and access at network boundaries that manage connectivity between environments of different trust levels, including internet-facing services and edge devices.

These systems are routinely exposed to adversary scanning and exploitation. Weaknesses can provide a direct path into the environment and undermine protections implemented elsewhere.

Find out more about boundary services

Priority Phase 2

Privileged environments and critical processes and services are addressed together to limit an adversary’s ability to escalate access and reduce the impact of a successful intrusion.

Critical processes and services

Critical processes and services are the core processes and services needed to deliver an organisation’s primary outcomes.

Compromise can cause direct disruption to the organisation’s functioning or interrupt its customers or services. It includes both supporting IT and operational systems.

Malicious actors targeting this domain typically pursue disruption (rendering services unavailable through ransomware or destructive attacks), or theft (exfiltration of high-value data for intelligence, competitive advantage or extortion). As these assets represent the highest-value targets, they attract the most capable and deliberate malicious actor activity.

Find out more about critical processes and services

Privileged environments

Privileged environments are the systems, services and accounts that support privileged activities, management services and high-impact administrative functions.

Compromise can give an adversary extensive control over systems, services and security controls, enabling further access and making detection and containment more difficult.

Find out more about privileged environments

Priority Phase 3

Business systems and user devices are addressed after the earlier phases because they are the largest and most widely distributed parts of the environment. The controls established earlier make these assets easier to secure consistently at scale.

User devices

User devices are endpoints people use, including workstations.

Their widespread use and connection to other systems make them pathways for compromise. Protecting them at scale reduces the impact of everyday activity and adversary movement to other systems.

Find out more about user devices
Was this helpful?
Yes this was helpful
No this was not helpful

Thanks for your feedback!

We welcome additional feedback below.

How easy was it to find information?
How easy was it to understand this information?
After reading this, how confident are you that you know what to do next?
Overall, how satisfied were you with your experience on this website today?
vertical_align_top Back to top