Step 1 of 2
Choose what to review 0 of 9 selected
01 Identity and access Who can get in, with what privilege, and how that changes over time. 4 practices · Identities and credentials domain 02 Assets, data and ownership Knowing what you are protecting before deciding how to protect it. 4 practices · Scoping and domain assets 03 Hardening and configuration Building systems to a known standard, and noticing when they drift. 4 practices · Operating systems and applications domains 04 Patching and vulnerability management Closing known weaknesses in an order that reflects real risk. 4 practices · Infrastructure and applications domains 05 Backup and recovery Being able to get back to work, not just holding copies of data. 4 practices · Data domain and continuity 06 Logging, monitoring and detection Producing the evidence that something happened, and noticing it in time. 4 practices · Assessment evidence and logging 07 Incident response readiness Knowing what you will do, and who decides, before the pressure arrives. 4 practices · Incident response planning 08 Cloud and service providers Being clear about which parts of the service you are responsible for. 4 practices · SaaS and PaaS environments 09 Operational technology Protecting control environments where safety and availability lead. 4 practices · Operational technology
Start workbook Choose a narrow scope first - one or two areas is enough to be useful.
This workbook is an informational self-assessment. It is not an official ASD assessment, certification or endorsement, and it does not replace the ASD publications themselves. Practically, an assessor would need current evidence for each practice, and a practice is only in place when that evidence is available. Practices are summarised and reorganised from the ASD Essentials series, © Commonwealth of Australia, provided under a Creative Commons Attribution 4.0 International licence (creativecommons.org/licenses/by/4.0); the original publications at cyber.gov.au remain authoritative.
