AI and the ASD Essentials.

At a glance

• AI systems are assets to find, govern and place in domains, like any other system.

• Your board or executive committee is accountable for making sure AI is secure, controllable, human-supervised and used in an ethical and accountable way.

• ASD says most enterprise IT principles apply to AI as they do to other technology, although how you put them in place may differ.

• Start with our five first steps, beginning with an accountable executive and a list of the AI you already have.

A starter list: five first steps

Our suggestion, not ASD's list. Each step links to the enterprise IT principles behind it.

1. 01

   Step 1: Name an accountable executive

   Have your board or executive committee name an executive accountable for AI. See executive accountability below for the approvals and reviews that back this up.

   Builds onGOV-08Executive artificial intelligence accountability

2. 02

   Step 2: Find the AI you already have

   List your AI services, the AI in your platforms, your agents and connectors, and the accounts they use, including unapproved tools.

   Builds onIDE-01Asset identificationPRO-07Trustworthy software

3. 03

   Step 3: Limit what each AI agent can reach

   Give each agent its own account with a named owner and only the access it needs. Fix overshared files before you switch on an AI assistant.

   Builds onPRO-13Identity, credential and access managementPRO-12Least privilege access

4. 04

   Step 4: Check AI tools before they touch your data

   Approve AI tools and integrations before they reach your data. For cloud software, the cloud chapter adds a GOV-08 action: get approval from an executive or their delegate before you switch on its AI features. Ask providers where they keep your prompts and outputs, and whether your data trains their models.

   Builds onPRO-16Cyber supply chain securityGOV-11Supplier cyber security assurance

5. 05

   Step 5: Train your people

   Train staff on approved AI use and what data they may put into AI tools. Teach them to check unexpected requests another way, since voices and video can be faked.

   Builds onPRO-14Cyber security awareness training

To plan the wider program, see implementing the Essentials.

Three ways AI shows up

ASD's three views of AI apply in enterprise IT, cloud and operational technology (OT) alike.

• AI as a threatAttackers use AI to work faster and more cheaply. AI tools can be attacked too.
• AI as a solutionAI can help defenders sort alerts and spot problems sooner. People stay accountable.
• AI as an assetAI systems, their data and their accounts are assets. Find them and govern them.

AI as a threat

ASD says AI has not fundamentally changed how attackers get into an environment and move through it, although AI systems open new points of attack. It has made existing attacks faster, cheaper and open to more people.

AI can help attackers scout a target, find weaknesses and write exploits or malware faster. Fake voice and video can copy a trusted person to fool a help desk, or someone who approves payments or access.

AI systems can also be targeted or misused. ASD's examples:

• Data leaks. Staff may put sensitive data into AI services that nobody approved.
• Indirect prompt injection. An attacker hides instructions in an email, document or web page. An AI agent with access to tools or data reads it, and may obey.
• Tampered models. A model taken from a public source may have been altered.

ASD's answer is layered protection, so an attacker who gets past one safeguard meets another. In enterprise IT, the priority phases (groups of domains ASD says to work on in order) build those layers.

AI as a solution

ASD says the benefits of AI security tools, such as sorting alerts faster, depend on effective governance:

• Govern the tool. An AI security product is itself an AI asset. Assess it, configure it and monitor it like one.
• Support the actions, do not replace them. Use AI to help carry out the Essentials actions.
• Check the output. People stay accountable for security outcomes, so check AI output before you use it to inform a significant decision.

AI as an asset

ASD says AI systems are assets within the scope of the Essentials. Depending on how you use AI, they can include the kinds in this table.

AI tools can have their own identities, permissions and access. ASD says to identify and govern these like any other identities and access paths. An AI agent often signs in with a non-person identity (an account used by software).

What it means in enterprise IT

Where AI assets usually sit

ASD gives a path from an AI asset to its domain, drawn below. For any other asset, see which domain an asset belongs in.

1AI asset

What is it?

Any item in the list above, such as a chatbot or an agent.

2Risk profile

Weigh five factors.

ASD names the factors. The questions are ours.

1. Factor 1: Function What does it do for you?
2. Factor 2: Connectivity What can it connect to?
3. Factor 3: Criticality How much do you rely on it?
4. Factor 4: Access What data and rights does it hold?
5. Factor 5: Consequence of compromise What happens if an attacker takes it over?

3Domain

Where does it sit?

ASD's domain for five kinds of AI asset in enterprise IT, quoted. Our reading: "likely" means usually here, "may" means here or elsewhere, and the other verbs mean here.

AI systems supporting core organisational outcomes

are likely to be scoped within Critical processes and services

AI embedded within general enterprise platforms

may belong within Business systems

Public-facing AI services and APIs

are likely to be relevant to Boundary services

AI agents and their non-person identities

are relevant to Identity services

AI tools capable of administrative actions

belong within Privileged environments

ASD does not place any AI asset in User devices by name. Our suggestion: scope an AI tool installed on a staff laptop, such as a browser extension or a local model, with that device. If the tool can take admin actions, ASD places it in Privileged environments.

Principles where AI needs extra thought

For 15 of the enterprise IT chapter's 28 principles, ASD adds points on AI. Here they are in plain words, grouped by us. ASD names principles, not actions, so the closest action links under some points are ours.

Executive accountability for AI

ASD treats AI as a governance issue, not only a technical one. In enterprise IT, that means principle GOV-08 and its one action.

ASD says processes for approval, risk assessment, oversight and ongoing review of AI use cases should back this up. The action's indicators of good practice treat these as basics, not extras. The action is normally rated not effective if any of these is true:

• No named executive is accountable for AI.
• AI is used with no approval, risk assessment or oversight.
• AI risks are not in your risk register.
• AI use has not been reviewed on the schedule you set.

A fully effective rating also needs those risks reported through your usual governance channels. Read all the indicators under IT.GOV-08.1.

Our suggestion: recheck ASD's AI publication when you review your AI risks, since ASD says it will update its AI guidance through supporting publications. For ASD's general questions for executives (none are about AI), see our guide for boards and executives.

Cloud and OT considerations

ASD's AI publication also covers its cloud and OT chapters. Cloud points build on the shared responsibility model, and OT points protect safety and vital OT (the OT systems you cannot afford to have offline for long). To see which chapter fits you, read which Essentials chapter applies to you.