Visibility and response

Visibility and response covers the processes and capabilities used to detect, analyse and respond to cyber security events and incidents. Effective visibility and response reduces delays in identifying, analysing and containing intrusions.

The guidance within the ASD Essentials is organised into Domains, Principles and Actions.

Domains describe logical groupings of assets within systems and their operating environments.
Principles describe the security outcomes organisations should achieve.
Actions describe prioritised activities for each of those security outcomes.

These resources provide additional guidance to support the implementation of the Essentials for enterprise IT. They provide implementation guidance for achieving the indicators of good practice associated with each Action.

ASD’s Information security manual (ISM) also provides a catalogue of security controls that can be used to achieve the implementation of each Principle and Action.

Asset identification

Foundations for modern defensible architecture

Build secure and more resilient systems using modern defensible architecture. Apply key design foundations to help prevent, detect, and respond to cyber threats.

Managing the risks of legacy IT: Executive guidance

Manage the cyber security risks of legacy information technology through planning, governance and active management of technology.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Security risk identification

Defending against AI-enabled cyber attacks

Learn how government, critical infrastructure and businesses can protect against AI-enabled cyber threats.

Foundations for modern defensible architecture

Build secure and more resilient systems using modern defensible architecture. Apply key design foundations to help prevent, detect, and respond to cyber threats.

Network segmentation and segregation – Anti-patterns

Spot hidden network security gaps and learn how to strengthen segmentation to reduce risk and limit cyber threats.

Security considerations for edge devices

Learn how to protect your organisation by keeping internet-facing devices secure, monitored and up to date.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Identity, credential and access management

Detecting and mitigating Active Directory compromises

Learn how to find and respond to Active Directory compromises by identifying suspicious activity and using controls to limit attacker access.

Implementing multi-factor authentication

Improve your organisation’s account security by implementing multi-factor authentication to reduce the risk of unauthorised access.

Secure administration

Protect administrator accounts and critical systems by using secure administration practices to lower cyber security risks.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Centralised event logging

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances

Use network devices that log and monitor activity to support investigation, detection and response to cyber incidents.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Priority logs for SIEM ingestion: Practitioner guidance

Learn how to prioritise key event logs to improve threat detection, investigations and incident response.

Windows event logging and forwarding

Improve visibility of system activity by implementing Windows Event Logging and Centralised Forwarding.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Cyber security event detection

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Detecting and mitigating Active Directory compromises

Learn how to find and respond to Active Directory compromises by identifying suspicious activity and using controls to limit attacker access.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Opportunities for AI in cyber defence

Use AI to strengthen cyber security. When used safely and responsibly, AI helps detect threats faster, prioritise risks and reduce manual effort.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Cyber security incident identification

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Cyber security incident response planning: Practitioner guidance

Develop and implement an effective cyber incident response plan with clear processes, tools and testing to reduce the impact of cyber attacks.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Detection capability efficacy

Best practices for event logging and threat detection

Improve threat detection and incident response by implementing effective event logging and monitoring practices.

Implementing SIEM and SOAR platforms: Practitioner guidance

Learn how to plan, implement and maintain SIEM and SOAR platforms to improve threat detection, incident response and cyber security monitoring.

Opportunities for AI in cyber defence

Use AI to strengthen cyber security. When used safely and responsibly, AI helps detect threats faster, prioritise risks and reduce manual effort.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Cyber security incident response

Cyber security incident response planning: Executive guidance

Prepare for cyber incidents with a clear response plan so that your organisation can act quickly, reduce damage and recover faster.

Cyber security incident response planning: Practitioner guidance

Develop and implement an effective cyber incident response plan with clear processes, tools and testing to reduce the impact of cyber attacks.

Ransomware Playbook

This interactive guide is here to assist you with taking all of the appropriate steps to prepare for, respond to and recover from a ransomware incident.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Cyber security incident insights

Cyber security incident response planning: Executive guidance

Prepare for cyber incidents with a clear response plan so that your organisation can act quickly, reduce damage and recover faster.

Cyber security incident response planning: Practitioner guidance

Develop and implement an effective cyber incident response plan with clear processes, tools and testing to reduce the impact of cyber attacks.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Cyber security incident coordination

Communicating under pressure: Best practices for service providers

Understand how to effectively communicate during IT and OT outages to reduce disruption, support users, and share clear, transparent information as incidents evolve.

Cyber security incident response planning: Executive guidance

Prepare for cyber incidents with a clear response plan so that your organisation can act quickly, reduce damage and recover faster.

Cyber security incident response planning: Practitioner guidance

Develop and implement an effective cyber incident response plan with clear processes, tools and testing to reduce the impact of cyber attacks.

Cyber supply chain risk management

Learn how to manage cyber supply chain risks by setting clear security rules, checking suppliers and monitoring third-party services.

Information security manual

The Information security manual is a cyber security framework organisations can use to protect information and operational technology systems from cyber threats.

Visibility and response

Foundations for modern defensible architecture

Managing the risks of legacy IT: Executive guidance

Information security manual

Defending against AI-enabled cyber attacks

Foundations for modern defensible architecture

Network segmentation and segregation – Anti-patterns

Security considerations for edge devices

Information security manual

Detecting and mitigating Active Directory compromises

Implementing multi-factor authentication

Secure administration

Information security manual

Best practices for event logging and threat detection

Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances

Implementing SIEM and SOAR platforms: Practitioner guidance

Priority logs for SIEM ingestion: Practitioner guidance

Windows event logging and forwarding

Information security manual

Best practices for event logging and threat detection

Detecting and mitigating Active Directory compromises

Implementing SIEM and SOAR platforms: Practitioner guidance

Opportunities for AI in cyber defence

Information security manual

Best practices for event logging and threat detection

Cyber security incident response planning: Practitioner guidance

Implementing SIEM and SOAR platforms: Practitioner guidance

Information security manual

Best practices for event logging and threat detection

Implementing SIEM and SOAR platforms: Practitioner guidance

Opportunities for AI in cyber defence

Information security manual

Cyber security incident response planning: Executive guidance

Cyber security incident response planning: Practitioner guidance

Ransomware Playbook

Information security manual

Cyber security incident response planning: Executive guidance

Cyber security incident response planning: Practitioner guidance

Information security manual

Communicating under pressure: Best practices for service providers

Cyber security incident response planning: Executive guidance

Cyber security incident response planning: Practitioner guidance

Cyber supply chain risk management

Information security manual

Thanks for your feedback!