What is the Essentials?
Learn what the ASD Essentials is and how its Principles, Actions and Domains provide organisations with a consistent approach to cyber security.
At a glance
The ASD Essentials provides organisations with a consistent approach to cyber security across different technology environments. The series is made up of a environment-specific chapters. Each chapter applies the same underlying model, using the same three layers - principles, actions and domains.
Principles describe the cyber security outcomes an organisation should achieve.
Actions describe what needs to be done to achieve those outcomes.
Domains describe the business functions and assets to which the actions apply.
What is the Essentials series?
The ASD Essentials series is a framework that provides organisations with a consistent approach to cyber security across different technology environments.
The series is made up of environment-specific chapters. Each chapter applies the same underlying model while accounting for the threats, risks and operational considerations relevant to the environment it covers.
Current ASD Essentials series chapters address enterprise IT, cloud and operational technology. The series is structured so additional environment-specific chapters can be added as needed.
Organisations may find that one chapter is relevant, several chapters apply to different parts of their environment, or a business function depends on assets covered by more than one chapter.
Each chapter uses the same three layers: principles, actions and domains.
How the Essentials framework is structured
Each ASD Essentials series chapter uses principles, actions and domains to describe the security outcomes organisations should aim to achieve, what they need to do and where those requirements apply.
Principles describe the cyber security outcomes an organisation should achieve.
Actions describe what needs to be done to achieve those outcomes.
Domains describe the business functions and assets to which the actions apply.
Figure 1 shows how the three layers answer a sequence of questions.
Principles
ASD Essentials principles are drawn from the cyber security principles in ASD’s Information security manual (ISM) and align with ASD’s Modern defensible architecture. They describe the security outcomes organisations should achieve.
The principles provide a consistent foundation across the ASD Essentials series. The intent of a principle remains the same between chapters, while the actions used to achieve that outcome may differ.
Not every principle is relevant to every chapter. Each chapter identifies the principles that apply to its environment.
Actions
Actions describe the administrative and technical requirements used to implement a principle and achieve its intended security outcome.
Actions may vary between chapters because different technology environments have different risks and constraints. The actions selected for each environment consider:
- the relevant threat model
- operational requirements
- commercial viability.
This allows each chapter to account for factors such as threats affecting the environment, availability and safety requirements, system lifecycles and whether suitable capabilities can be implemented at a practical cost and scale.
Where appropriate, actions are mapped to the techniques in the MITRE ATT&CK knowledge base to show the adversary behaviours they are intended to address. Figure 2 shows how an action is mapped to ATT&CK techniques.
Domains
Domains are groupings of business functions and assets that share similar risks. They help organisations focus security efforts where they will deliver the greatest reduction in risk, rather than applying the same security measures across an entire environment.
Shared risk means comparable exposure and consequence of compromise, not that every asset carries an identical risk rating.
A domain is a logical grouping rather than a network or organisational boundary. Assets within a domain may be spread across different systems, locations, suppliers or parts of an organisation.
Domains are used consistently across the ASD Essentials series. However, the specific assets within a domain may vary between chapters according to the technology environment.
Each chapter identifies the domains relevant to its environment and maps actions to the domains where they are applied. Figure 3 shows how domains are grouped together.
How the three layers work together
Principles, actions and domains are designed to be used together.
The principle establishes the intended security outcome. The action describes what the organisation needs to do to achieve it. The domain establishes the assets and functions to which the action applies.
This means implementation considers an action in the context of a particular domain, rather than treating the action as a standalone requirement.
Using the ASD Essentials series
Organisations should use the ASD Essentials series chapter or chapters relevant to their technology environments. There is no requirement for every organisation to use every chapter or to apply relevant chapters in set order.
When applying an ASD Essentials series chapter, an organisation follows the workflow in Figure 4.
The common structure of principles, actions and domains supports a consistent approach across different environments while allowing implementation to reflect the risks and operational considerations relevant to each environment.
Other publications in the ASD Essentials series provide guidance on selecting a chapter, planning implementation, assessing cyber security posture and transitioning from the Essential Eight.
