ASD Essentials for enterprise IT

Scope. ASD says the chapter is designed to help organisations protect enterprise IT environments from sophisticated cyber threats. Enterprise IT means the IT environments of organisations whose scale, complexity, regulatory exposure or reliance on technology requires a structured and deliberate approach to managing cyber security. It is one of three current ASD Essentials chapters: enterprise IT, cloud and operational technology (OT).

Eight domains

The chapter has six technical domains that group systems, services and assets that share similar cyber security risks, plus two capability domains: Governance and culture, and Visibility and response.

Priority phases are an order, not a score

ASD groups the six technical domains into three priority phases. The phases set out ASD's recommended implementation sequence, putting effort where it can deliver the greatest and most rapid reduction in risk. ASD says priority phases are a sequencing mechanism, not a rating or maturity model. Do not report a phase as a level of compliance or assurance.

Priority phase 1: Identity services and Boundary services. They come first because they are common pathways for adversaries seeking initial access, and strong identity services give later phases their trust foundation. Identity services manage identities, credentials and access, including directories, authentication and authorisation services and credential stores. Boundary services are gateways and access at network boundaries between environments of different trust levels, including internet-facing services and edge devices.

Priority phase 2: Critical processes and services, and Privileged environments. They are addressed together to limit an adversary's ability to escalate access and to reduce the impact of a successful intrusion. Critical processes and services are the core processes and services needed to deliver an organisation's primary outcomes, including supporting IT and operational systems. Privileged environments are the systems, services and accounts that support privileged activities, management services and high-impact administrative functions.

Priority phase 3: Business systems and User devices. They come last because they are the largest and most widely distributed parts of the environment, and controls set up earlier make them easier to secure consistently at scale. Business systems support day-to-day enterprise functions. User devices are the endpoints people use, including workstations.

Capability domains

Governance and culture covers the policies, risk management processes, roles and security culture behind a cyber security program. Visibility and response covers the processes and capabilities used to detect, analyse and respond to cyber security events and incidents. Both apply across all three priority phases and expand as implementation progresses.

Supporting material

ASD publishes an asset scoping guide and an assessment evidence guide for this chapter, OSCAL releases of the chapter, and guidance on transitioning an existing Essential Eight implementation. Planning follows the Implementation planning guide.