User devices

User devices are workforce endpoints such as desktops and laptops. Their widespread use and exposure make them common entry points for adversaries. Protecting them at scale builds on the trusted identity and boundary services established in earlier phases.

The guidance within the ASD Essentials is organised into Domains, Principles and Actions.

Domains describe logical groupings of assets within systems and their operating environments.
Principles describe the security outcomes organisations should achieve.
Actions describe prioritised activities for each of those security outcomes.

These resources provide additional guidance to support the implementation of the Essentials for enterprise IT. They provide implementation guidance for achieving the indicators of good practice associated with each Action.

ASD’s Information security manual (ISM) also provides a catalogue of security controls that can be used to achieve the implementation of each Principle and Action.

Asset identification

Foundations for modern defensible architecture

Build secure and more resilient systems using modern defensible architecture. Apply key design foundations to help prevent, detect, and respond to cyber threats.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Managing the risks of legacy IT: Executive guidance

Manage the cyber security risks of legacy information technology through planning, governance and active management of technology.

Secure system lifecycle

Blueprint for Secure Cloud

Use the Blueprint for Secure Cloud to design, configure and deploy secure cloud and hybrid services.

Foundations for modern defensible architecture

Build secure and more resilient systems using modern defensible architecture. Apply key design foundations to help prevent, detect, and respond to cyber threats.

Guidelines for secure AI system development

Secure your AI systems from design to deployment with practical guidance on how to reduce risks, protect data, and build trust.

Safe software deployment: How software manufacturers can ensure reliability for customers

Learn how to release software updates safely by following secure practices to reduce risks, prevent disruptions and build customer trust.

Secure by Design foundations

Learn the six Secure by Design foundations for building, procuring and maintaining secure digital products and services.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Secure configuration management

Blueprint for Secure Cloud

Use the Blueprint for Secure Cloud to design, configure and deploy secure cloud and hybrid services.

Hardening Linux workstations and servers

Harden Linux systems by using security controls to reduce vulnerabilities and protect workstations and servers from being compromised.

Hardening Microsoft Windows 11 workstations

Harden Windows 11 workstations by using security settings and controls to reduce vulnerabilities and protect against threats.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Vulnerability management

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Patching applications and operating systems

Reduce security risks by keeping applications and operating systems updated to fix weaknesses and protect against cyber threats.

Trustworthy software

2026 Minimum Elements for a Software Bill of Materials (SBOM)

Improve software supply chain visibility with a Software Bills of Materials (SBOMs) to identify dependencies and better manage cyber security risks.

Choosing secure and verifiable technologies

Learn how to select secure and verifiable technologies that reduce cyber risks and help build reliable systems.

Implementing application control

Use application controls to prevent unauthorised software from running and so reduce the risk of malware infecting your system.

Restricting Microsoft Office macros

Learn about the different approaches organisations can take to protect their systems and data from malicious Microsoft Office macros.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Least privilege access

Agentic AI harnesses

Learn how an agentic AI harness influences security, governance and operational risk, and apply practical measures to adopt agentic AI securely.

Foundations for modern defensible architecture

Build secure and more resilient systems using modern defensible architecture. Apply key design foundations to help prevent, detect, and respond to cyber threats.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Restricting administrative privileges

Learn how to effectively restrict administrative privileges to reduce the risk of unauthorised access, system compromise and malicious activity.

Secure administration

Protect administrator accounts and critical systems by using secure administration practices to lower cyber security risks.

Identity, credential and access management

Detecting and mitigating Active Directory compromises

Learn how to find and respond to Active Directory compromises by identifying suspicious activity and using controls to limit attacker access.

Implementing multi-factor authentication

Improve your organisation’s account security by implementing multi-factor authentication to reduce the risk of unauthorised access.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Secure administration

Protect administrator accounts and critical systems by using secure administration practices to lower cyber security risks.

Cyber supply chain security

2026 Minimum Elements for a Software Bill of Materials (SBOM)

Improve software supply chain visibility with a Software Bills of Materials (SBOMs) to identify dependencies and better manage cyber security risks.

Choosing secure and verifiable technologies

Learn how to select secure and verifiable technologies that reduce cyber risks and help build reliable systems.

Cyber supply chain risk management

Learn how to manage cyber supply chain risks by setting clear security rules, checking suppliers and monitoring third-party services.

Identifying cyber supply chain risks

Learn to identify cyber supply chain risks by understanding your systems, checking your suppliers, and spotting weak points across your services.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Safe software deployment: How software manufacturers can ensure reliability for customers

Learn how to release software updates safely by following secure practices to reduce risks, prevent disruptions and build customer trust.

Centralised event logging

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances

Use network devices that log and monitor activity to support investigation, detection and response to cyber incidents.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Priority logs for SIEM ingestion: Practitioner guidance

Learn how to prioritise key event logs to improve threat detection, investigations and incident response.

Windows event logging and forwarding

Improve visibility of system activity by implementing Windows Event Logging and Centralised Forwarding.

Cyber security event detection

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Detecting and mitigating Active Directory compromises

Learn how to find and respond to Active Directory compromises by identifying suspicious activity and using controls to limit attacker access.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Opportunities for AI in cyber defence

Use AI to strengthen cyber security. When used safely and responsibly, AI helps detect threats faster, prioritise risks and reduce manual effort.

User devices

Foundations for modern defensible architecture

Information security manual

Managing the risks of legacy IT: Executive guidance

Blueprint for Secure Cloud

Foundations for modern defensible architecture

Guidelines for secure AI system development

Safe software deployment: How software manufacturers can ensure reliability for customers

Secure by Design foundations

Information security manual

Blueprint for Secure Cloud

Hardening Linux workstations and servers

Hardening Microsoft Windows 11 workstations

Information security manual

Information security manual

Patching applications and operating systems

2026 Minimum Elements for a Software Bill of Materials (SBOM)

Choosing secure and verifiable technologies

Implementing application control

Restricting Microsoft Office macros

Information security manual

Agentic AI harnesses

Foundations for modern defensible architecture

Information security manual

Restricting administrative privileges

Secure administration

Detecting and mitigating Active Directory compromises

Implementing multi-factor authentication

Information security manual

Secure administration

2026 Minimum Elements for a Software Bill of Materials (SBOM)

Choosing secure and verifiable technologies

Cyber supply chain risk management

Identifying cyber supply chain risks

Information security manual

Safe software deployment: How software manufacturers can ensure reliability for customers

Best practices for event logging and threat detection

Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances

Implementing SIEM and SOAR platforms: Practitioner guidance

Information security manual

Priority logs for SIEM ingestion: Practitioner guidance

Windows event logging and forwarding

Best practices for event logging and threat detection

Detecting and mitigating Active Directory compromises

Implementing SIEM and SOAR platforms: Practitioner guidance

Information security manual

Opportunities for AI in cyber defence

Thanks for your feedback!