CONTROL ASSESSMENT WALKTHROUGH

ASD Essentials for Enterprise IT

A guided walkthrough of every principle and action, one action at a time. Based on ASD Essentials for Enterprise IT, catalogue version 2026.10.15.

SECTIONS

PRINCIPLES

ACTIONS

DOMAINS

529

INDICATORS

38 actions

ATT&CK REFS

ACTIONS ASSESSED0 / 58 · 0%

Demo mode rehearses the whole assessment with dummy ratings. Your recorded assessment data is neither read nor changed while it is on.

HOW THIS FRAMEWORK IS BUILT

Every component of the source document is mapped below: the sections and principles that set intent, the actions that state what must be done, the domains and priority phases each action applies to, the three levels of indicators of good practice used to judge an action, and the ATT&CK techniques the publisher links to it. The walkthrough then takes you through those components one action at a time.

SECTIONS

The document groups its principles into these sections, in the order they appear.

Govern principles6 PRINCIPLES · 8 ACTIONS

Identify principles2 PRINCIPLES · 3 ACTIONS

Protect principles12 PRINCIPLES · 34 ACTIONS

Detect principles5 PRINCIPLES · 9 ACTIONS

Respond principles3 PRINCIPLES · 4 ACTIONS

PRINCIPLES

Each principle states the intent that its actions must deliver.

GOV-011 ACTIONS

Executive cyber security accountability

GOV-031 ACTIONS

Security risk management assurance

GOV-042 ACTIONS

Cyber security resourcing

GOV-081 ACTIONS

Executive artificial intelligence accountability

GOV-112 ACTIONS

Supplier cyber security assurance

GOV-141 ACTIONS

Legacy system management

IDE-012 ACTIONS

Asset identification

IDE-041 ACTIONS

Security risk identification

PRO-012 ACTIONS

Secure system lifecycle

PRO-123 ACTIONS

Least privilege access

PRO-136 ACTIONS

Identity, credential and access management

PRO-162 ACTIONS

Cyber supply chain security

PRO-053 ACTIONS

Secure administration

PRO-043 ACTIONS

Secure configuration management

PRO-063 ACTIONS

Vulnerability management

PRO-072 ACTIONS

Trustworthy software

PRO-103 ACTIONS

Regular and proven backups

PRO-182 ACTIONS

Network segmentation and segregation

PRO-093 ACTIONS

Content filtering

PRO-142 ACTIONS

Cyber security awareness training

DET-013 ACTIONS

Centralised event logging

DET-041 ACTIONS

Baseline high-risk access activities

DET-022 ACTIONS

Cyber security event detection

DET-032 ACTIONS

Cyber security incident identification

DET-051 ACTIONS

Detection capability efficacy

RES-051 ACTIONS

Cyber security incident coordination

RES-031 ACTIONS

Cyber security incident response

RES-042 ACTIONS

Cyber security incident insights

DOMAINS AND PRIORITY PHASES

Actions name the enterprise domains they apply to. Each domain carries the priority phases the document assigns it.

Governance and culturePHASE 1PHASE 2PHASE 3

Policies, risk management processes, roles and security culture that underpin the cyber security program.

Visibility and responsePHASE 1PHASE 2PHASE 3

Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents.

Boundary servicesPHASE 1

Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services and edge devices.

Identity servicesPHASE 1

Enterprise-wide identity, credential and access management services such as directories, authentication and authorisation services or credential stores.

Critical processes and servicesPHASE 2

Core processes and services that are critical to delivering primary organisational outcomes.

Privileged environmentsPHASE 2

Systems and services that support privileged activities, management services and high-impact administrative functions.

Business systemsPHASE 3

Supporting enterprise functions that collectively enable organisational operations.

User devicesPHASE 3

Endpoints issued to the workforce, including desktops and laptops.

PRIORITY PHASES

Phases are assigned by domain in this extract. The counts show how many actions list each phase.

PHASE 158 ACTIONS

Governance and cultureVisibility and responseBoundary servicesIdentity services

PHASE 258 ACTIONS

Governance and cultureVisibility and responseCritical processes and servicesPrivileged environments

PHASE 348 ACTIONS

Governance and cultureVisibility and responseBusiness systemsUser devices

INDICATORS OF GOOD PRACTICE

Publisher-supplied indicators that support assessment and expert judgement; they are not a checklist.

NE · NOT EFFECTIVE160 INDICATORS

example: IT.GOV-01.1.NE-1

PE · PARTIALLY EFFECTIVE174 INDICATORS

example: IT.GOV-01.1.PE-1

FE · FULLY EFFECTIVE195 INDICATORS

example: IT.GOV-01.1.FE-1

ATT&CK REFERENCES

ASD lists these techniques as mitigated by this action. These references do not imply equivalence to ISM controls.

Valid Accounts8 ACTIONS

Disable or Modify Tools7 ACTIONS

Exploit Public-Facing Application6 ACTIONS

Exploitation for Privilege Escalation5 ACTIONS

Account Manipulation4 ACTIONS

Brute Force4 ACTIONS

Command and Scripting Interpreter4 ACTIONS

Remote Services4 ACTIONS

Supply Chain Compromise4 ACTIONS

User Execution4 ACTIONS

Create Account3 ACTIONS

Data Encrypted for Impact3 ACTIONS

Exploitation for Client Execution3 ACTIONS

Exploitation of Remote Services3 ACTIONS

Indicator Removal3 ACTIONS

Inhibit System Recovery3 ACTIONS

OS Credential Dumping3 ACTIONS

Phishing3 ACTIONS

Server Software Component3 ACTIONS

System Binary Proxy Execution3 ACTIONS

Windows Management Instrumentation3 ACTIONS

Adversary-in-the-Middle2 ACTIONS

Exfiltration Over Alternative Protocol2 ACTIONS

Exfiltration Over C2 Channel2 ACTIONS

External Remote Services2 ACTIONS

Modify Registry2 ACTIONS

Process Injection2 ACTIONS

Proxy2 ACTIONS

Unsecured Credentials2 ACTIONS

Create or Modify System Process1 ACTIONS

Credentials from Password Stores1 ACTIONS

Data from Local System1 ACTIONS

Ingress Tool Transfer1 ACTIONS

Lateral Tool Transfer1 ACTIONS

Multi-Factor Authentication Request Generation1 ACTIONS

Network Service Discovery1 ACTIONS

Steal or Forge Kerberos Tickets1 ACTIONS

Use Alternate Authentication Material1 ACTIONS

ACTIONS (58)

Every action in the extract, with the catalogue status the document records for it.

IT.GOV-01.1Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.NEW

IT.GOV-03.1Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.NEW

IT.GOV-04.1Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.NEW

IT.GOV-04.2Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.NEW

IT.GOV-08.1Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.NEW

IT.GOV-11.1Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.NEW

IT.GOV-11.2Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.NEW

IT.GOV-14.1Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.NEW

IT.IDE-01.1Use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets.NEW

IT.IDE-01.2Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets.NEW

IT.IDE-04.1Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.NEW

IT.PRO-01.1Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality.NEW

IT.PRO-01.2Secure build and deployment processes to enforce controls consistently across systems.NEW

IT.PRO-12.1Periodically review and update access privileges in alignment with current roles, duties and business requirements.NEW

IT.PRO-12.2Grant only authorised administrative roles permissions to create, modify or delete accounts and roles, and access privileged functions or applications.NEW

IT.PRO-12.3Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.NEW

IT.PRO-13.1Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored.NEW

IT.PRO-13.2Store authentication keys, secrets and tokens in approved secure repositories with access controls, including MFA.NEW

IT.PRO-13.3Identify and remediate unsecured keys, secrets and credentials by regularly scanning codebases, configuration files, file shares and user collaboration platforms.NEW

IT.PRO-13.4Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations.NEW

IT.PRO-13.5Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.NEW

IT.PRO-13.6Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts.NEW

IT.PRO-16.1Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available.NEW

IT.PRO-16.2Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.NEW

IT.PRO-05.1Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads.NEW

IT.PRO-05.2Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants.NEW

IT.PRO-05.3Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target.NEW

IT.PRO-04.1Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols.NEW

IT.PRO-04.2Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications.NEW

IT.PRO-04.3Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.NEW

IT.PRO-06.1Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities.NEW

IT.PRO-06.2Apply security patches or updates within defined risk-based timeframes or automatically where operational impact is low.NEW

IT.PRO-06.3Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness.NEW

IT.PRO-07.1Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.NEW

IT.PRO-07.2Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.NEW

IT.PRO-10.1Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls.NEW

IT.PRO-10.2Isolate backup repositories from general user environments and production workloads, ensuring they are separated from primary systems to prevent unauthorised access, modification or deletion.NEW

IT.PRO-10.3Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives.NEW

IT.PRO-18.1Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services.NEW

IT.PRO-18.2Limit lateral movement between, and within, network segments to explicitly approved pathways and services, based on business requirements and trust levels.NEW

IT.PRO-09.1Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data.NEW

IT.PRO-09.2Block outbound network connections to known malicious or untrusted destinations.NEW

IT.PRO-09.3Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.NEW

IT.PRO-14.1Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data.NEW

IT.PRO-14.2Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.NEW

IT.DET-01.1Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them.NEW

IT.DET-01.2Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability.NEW

IT.DET-01.3Establish a centralised event log storage capability that protects logs from unauthorised access or modification.NEW

IT.DET-04.1Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes.NEW

IT.DET-02.1Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments.NEW

IT.DET-02.2Ensure detection logic identifies unauthorised changes, anomalous authentication activity and suspicious software execution.NEW

IT.DET-03.1Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.NEW

IT.DET-03.2Use indicators from across identities, applications, data and infrastructure activity rather than isolated signals when identifying cyber security incidents.NEW

IT.DET-05.1Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.NEW

IT.RES-05.1Integrate external coordination obligations into cyber security incident response activities where required.NEW

IT.RES-03.1Use documented, tested and approved cyber security incident response procedures when responding to cyber security incidents.NEW

IT.RES-04.1Perform post-cyber security incident reviews to identify the security gaps that enabled each stage of the cyber security incident.NEW

IT.RES-04.2Evaluate the monitoring coverage and cyber security incident response procedures following cyber security incidents.NEW

Supporting resources

Everything else you need, one click away

The reference library and the workbook open full screen over the walkthrough, with a back button that returns you exactly where you left off.

Reference library

Jump straight to a part - it opens at that section in the full-screen library.

This walkthrough is an informational demonstration. It is not an official ASD assessment, certification or endorsement, and it does not replace the ASD publications themselves. Framework text and figures are reproduced from the ASD Essentials series, © Commonwealth of Australia, provided under a Creative Commons Attribution 4.0 International licence (creativecommons.org/licenses/by/4.0); the original publications at cyber.gov.au remain authoritative.