ASD Essentials for enterprise IT.

Not effective (4)

• NE-1No named executive or board member is accountable for cyber security.
• NE-2Cyber security accountability exists only informally, or is assumed rather than documented.
• NE-3No evidence of cyber security reporting to the executive board.
• NE-4Organisational risk appetite is not set.

Partially effective (4)

• PE-1A named executive or board member is accountable for cyber security, but reporting obligations are not formally defined.
• PE-2Board-level reporting on cyber security occurs but is ad hoc rather than on a defined schedule.
• PE-3Accountability is documented but has not been reviewed within the organisationally defined cadence or following relevant organisational restructuring or leadership changes.
• PE-4Organisational risk appetite is set but is not monitored or adjusted over time.

Fully effective (4)

• FE-1A named executive or board member has documented accountability for cyber security with defined reporting obligations.
• FE-2Regular reporting to the board or executives occurs on a defined cadence with evidence of reporting artefacts.
• FE-3Accountability arrangements are reviewed when organisational structures or leadership changes occur.
• FE-4Organisational risk appetite is set and is monitored and adjusted over time as required.

Not effective (4)

• NE-1No named executive is accountable for the use, governance or risk management of artificial intelligence.
• NE-2Artificial intelligence is used within the organisation with no approval, risk assessment or oversight.
• NE-3Artificial intelligence related risks are not reflected in the organisation’s risk register.
• NE-4Artificial intelligence use and governance arrangements have not been reviewed within the schedule defined by the organisation.

Partially effective (4)

• PE-1A named executive is accountable for artificial intelligence but the governance process is informal or undocumented.
• PE-2Approval and risk assessment occur for some artificial intelligence use cases but coverage is inconsistent across internally developed, third-party and embedded artificial intelligence.
• PE-3Some artificial intelligence related risks are recorded but the organisation’s risk register does not capture all known artificial intelligence use cases.
• PE-4Reviews occur within the schedule defined by the organisation, but do not consistently address changes in artificial intelligence capability, threat environment or organisational use.

Fully effective (4)

• FE-1A named executive has accountability for artificial intelligence, supported by an approved governance process that has evidence of being followed.
• FE-2The governance process addresses approval, risk assessment and oversight for internally developed, third-party and embedded artificial intelligence use cases.
• FE-3Artificial intelligence related risks are reflected in the organisation’s risk register and reported through standard governance channels.
• FE-4Reviews of artificial intelligence use and governance arrangements are conducted on a schedule defined by the organisation and consistently address changes in artificial intelligence capability, threat environment or organisational use.

Not effective (3)

• NE-1Cyber security functions are staffed on an ad hoc basis without reference to required skills or capacity.
• NE-2Critical cyber security roles are unfilled with no approved recruitment plan.
• NE-3No resourcing plan for cyber security personnel exists.

Partially effective (4)

• PE-1Some critical roles are filled but identified skills gaps have no plan for remediation.
• PE-2While assigned personnel provide some capability, there are gaps in capacity, resources, or expertise that hinder the operation, monitoring, maintenance, and lifecycle management of controls.
• PE-3A resourcing plan exists but does not cover all required cyber security functions.
• PE-4Outstanding cyber security positions are being actively recruited, but capacity or skills gaps remain.

Fully effective (4)

• FE-1Sufficient cyber security personnel are assigned to operate, monitor, maintain and manage the lifecycle of controls across the organisation.
• FE-2Skills gaps are identified and addressed through recruitment, training or contracted services.
• FE-3A resourcing plan identifies all required cyber security personnel, roles, skills, resources and capacity.
• FE-4Cyber security responsibilities are defined within applicable role descriptions.

Not effective (2)

• NE-1No review of cyber security resourcing has been conducted.
• NE-2Resourcing has not been reassessed following significant organisational or threat landscape changes.

Partially effective (2)

• PE-1A review has been conducted but did not reference current threat trends, cyber security incident outcomes, or organisational changes.
• PE-2Review outcomes have identified required adjustments, but those adjustments have not been made.

Fully effective (3)

• FE-1A resourcing review has been completed within the review period defined by the organisation.
• FE-2The review references current threat trends, cyber security incident outcomes and organisational changes.
• FE-3Documented review outcomes include resourcing adjustments that are implemented within timeframes defined by the organisation, or formally risk accepted by an appropriate authority.

Not effective (3)

• NE-1No risk management methodology approved by the organisation is in place.
• NE-2No current organisational risk register exists, or the register has not been reviewed within the cycle defined by the organisation.
• NE-3Risk treatment decisions are not documented.

Partially effective (3)

• PE-1An approved risk management methodology exists but risk assessments have not been conducted within the defined cycle.
• PE-2A risk register exists but treatment plans are incomplete or have not been actioned.
• PE-3Risk assessments have been conducted but do not cover all in-scope assets.

Fully effective (3)

• FE-1An approved risk management methodology and plan are in place and used to assess and treat security risks.
• FE-2A current risk register exists with documented and implemented treatment plans for all identified risks.
• FE-3Risk assessments have been conducted or reviewed within the assessment cycle defined by the organisation.

Not effective (4)

• NE-1No documented or approved governance process exists for evaluating the cyber security trustworthiness of suppliers.
• NE-2No cyber security evaluation is performed before suppliers are onboarded.
• NE-3Evaluation outcomes are not documented.
• NE-4Findings from supplier evaluation outcomes are not used to inform supplier approval, contractual requirements or risk treatment decisions where concerns are identified.

Partially effective (3)

• PE-1An evaluation process exists but is not consistently applied to all suppliers within scope.
• PE-2Evaluation is performed for some suppliers, but criteria are not documented or are inconsistently applied.
• PE-3Outcomes are documented but contractual arrangements do not reflect identified risks or required controls.

Fully effective (4)

• FE-1A documented and approved governance process is in place and consistently applied.
• FE-2Cyber security trustworthiness evaluations are performed for all suppliers within scope prior to onboarding.
• FE-3Evaluation criteria are documented, approved and proportionate to the criticality of what the supplier delivers.
• FE-4Evaluation outcomes are documented, reflected in contractual arrangements and recorded in the organisation’s risk register where residual risk remains.

Not effective (3)

• NE-1No process exists to obtain and risk-assess current supplier assurance evidence proportionate to supplier criticality and risk.
• NE-2No documented and approved governance process exists for maintaining assurance that suppliers meet their cyber security commitments.
• NE-3No actions are taken when supplier cyber security assurance lapses or supplier risk changes.

Partially effective (3)

• PE-1Supplier assurance evidence is obtained for some suppliers, but coverage is incomplete or the evidence is not reviewed and actioned.
• PE-2Some findings are actioned but the response process is informal or inconsistent.
• PE-3A process exists but acceptable forms and currency of assurance evidence are not defined or applied consistently.

Fully effective (3)

• FE-1Current assurance evidence is obtained from suppliers in proportion to their criticality and risk, and is reviewed for findings that affect the organisation.
• FE-2Material concerns are addressed through contractual remediation, compensating controls or supplier substitution within defined timeframes.
• FE-3A documented and approved governance process specifies the acceptable forms, scope and currency of supplier assurance evidence.

Not effective (5)

• NE-1No documented or approved governance process exists for identifying or managing legacy systems.
• NE-2Legacy systems are not formally identified within the environment.
• NE-3Cyber security risks associated with legacy systems are not assessed or are assessed informally.
• NE-4There are no interim compensating controls to manage identified cyber security risks associated with legacy systems.
• NE-5Legacy systems remain in operation indefinitely with no documented decommissioning, replacement or migration path.

Partially effective (5)

• PE-1A process exists but the criteria for classifying a system as legacy are not documented or are inconsistently applied.
• PE-2Some legacy systems are identified but the inventory is incomplete or is not maintained.
• PE-3Risk assessments are conducted for some legacy systems but treatment decisions are not documented or approved.
• PE-4Some compensating controls are in place to address risks associated with legacy systems, but coverage is not complete.
• PE-5A path exists for some legacy systems but is not tracked to completion.

Fully effective (5)

• FE-1A documented and approved governance process exists with clear criteria for classifying systems as legacy.
• FE-2Legacy systems are formally identified, inventoried and reviewed on a cycle defined by the organisation.
• FE-3Cyber security risks associated with legacy systems are assessed, treated and approved by an appropriate authority.
• FE-4Compensating controls are applied to manage cyber security risks for legacy systems while decommissioning or migration efforts are in progress.
• FE-5A documented decommissioning, replacement or migration path exists for retained legacy systems and is tracked to completion.

Not effective (2)

• NE-1No approved asset inventory mechanism is in place.
• NE-2Asset inventory records are maintained manually with no automated discovery capability.

Partially effective (2)

• PE-1An approved asset inventory mechanism is deployed but does not cover all network segments or asset types.
• PE-2Automated discovery scans to detect new and changed physical and non-physical assets occur on a schedule but reconciliation with the approved inventory is manual or inconsistent.

Fully effective (2)

• FE-1An approved asset inventory mechanism which supports automated discovery is deployed to cover all applicable assets and network segments.
• FE-2Discovery runs on a regular schedule defined by the organisation and new or changed physical or non-physical assets that are detected are reconciled with the approved inventory.

Not effective (2)

• NE-1A maintained record of infrastructure, operating systems, applications, identities, credentials and data assets has not been established.
• NE-2There is no defined process for identifying, recording, reviewing and updating asset records.

Partially effective (2)

• PE-1Asset records are maintained, but identified omissions, inaccuracies or newly discovered assets are not triaged and addressed within the timeframes or tolerances defined by the organisation.
• PE-2A process to update the asset inventory runs on a schedule but the results are not reconciled or updated within a period defined by the organisation.

Fully effective (2)

• FE-1At each scheduled review or update, records of infrastructure, operating systems, applications, identities, credentials and data assets are complete and accurate within the tolerances defined by the organisation.
• FE-2A defined process identifies changes and newly discovered assets between scheduled reviews, and ensures that records are reviewed, reconciled and updated within timeframes commensurate with the associated cyber security risk.

Not effective (3)

• NE-1Risk assessments do not reference relevant weaknesses, malicious actor techniques and cyber threat behaviours.
• NE-2No process exists to incorporate threat information into risk assessment activities.
• NE-3Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are not reviewed or updated.

Partially effective (3)

• PE-1Risk assessments reference threat intelligence but coverage is limited to well-known or generic threats.
• PE-2Threat information is considered but not systematically mapped to organisational assets or detection gaps.
• PE-3Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are reviewed or updated, but are not used to inform risk assessments or are reviewed only on an ad hoc basis.

Fully effective (3)

• FE-1Risk assessments incorporate and reference relevant weaknesses, malicious actor techniques relevant to the sector, and cyber threat behaviours.
• FE-2Relevant weaknesses, malicious actor techniques and cyber threat behaviours are systematically related to applicable assets and used to inform risk treatment decisions.
• FE-3Current weaknesses, malicious actor techniques and cyber threat behaviours relevant to the organisation are reviewed or updated on a continuous basis at a frequency that enables noted changes to inform risk assessments.

Not effective (3)

• NE-1Systems are deployed with default configurations and no evidence of security design considerations.
• NE-2Unnecessary services, protocols or functionality remain enabled with no documented rationale.
• NE-3Security telemetry is not enabled or is not considered as part of system design.

Partially effective (3)

• PE-1Security is considered during system design but not consistently applied across all assets.
• PE-2Some unnecessary services have been disabled but a systematic review has not been completed.
• PE-3Security telemetry is partially enabled but gaps in coverage exist.

Fully effective (3)

• FE-1Systems are designed and deployed with exposed services limited, required and default permissions minimised, data protections in place, authorised access enforced, and only required functionality enabled.
• FE-2Security telemetry is enabled by default.
• FE-3Evidence exists that security design decisions are recorded and reviewed during system changes.

Not effective (2)

• NE-1No controlled build or deployment process exists for applicable assets.
• NE-2Changes to systems are applied ad hoc, without any version control, testing or approval.

Partially effective (2)

• PE-1A controlled deployment process exists but is not consistently followed for all changes.
• PE-2Version control is in place but pre-deployment security verification is not performed.

Fully effective (3)

• FE-1A controlled build and deployment process is in place and consistently followed.
• FE-2Configuration changes are subject to version control, testing and approval before deployment.
• FE-3Security controls are confirmed to be implemented consistently across systems following deployment processes.

Not effective (3)

• NE-1No verification of software, component or update integrity or authenticity is performed before introduction into systems.
• NE-2Verification outcomes are not recorded or available for review.
• NE-3Where verification cannot be performed, no compensating control or remediation paths are documented.

Partially effective (4)

• PE-1Verification is performed for some categories of software but not consistently across operating systems, applications, firmware and dependencies.
• PE-2Integrity or provenance checks are performed, but they do not provide sufficient assurance for all software, components or updates.
• PE-3Verification outcomes are recorded for some software, components or updates prior to being introduced into systems, but not consistently.
• PE-4Compensating controls exist for some unverifiable components but are not formally approved or time-bound.

Fully effective (4)

• FE-1Verification of integrity and provenance is performed for software, components and updates across all relevant categories, and provenance is verified where suitable supplier evidence is available.
• FE-2Verification uses one or more mechanisms appropriate to the software, component, update and source to provide reliable assurance of integrity and provenance.
• FE-3Verification outcomes are recorded and available for review.
• FE-4Where verification cannot be performed, compensating controls are applied, exceptions are time-bound and remediation paths are documented.

Not effective (4)

• NE-1No monitoring is performed for indicators of supply chain compromise affecting software, components or services in use.
• NE-2Vendor security notifications and threat advisories are not reviewed or actioned.
• NE-3When supply chain compromise is identified, neither containment nor investigation is performed.
• NE-4Supply chain compromise events are integrated into neither incident response nor risk management.

Partially effective (4)

• PE-1Monitoring occurs but does not draw on relevant threat intelligence sources or does not cover all in-scope systems.
• PE-2Notifications and advisories are reviewed but exposure assessment and response are not conducted in a timely manner.
• PE-3Containment occurs but investigation for evidence of exploitation is not consistently undertaken.
• PE-4Some integration exists but findings are not reflected in the risk register or incident response procedures.

Fully effective (4)

• FE-1Monitoring covers software, components and services in use, drawing on relevant threat intelligence sources.
• FE-2Vendor security notifications and threat advisories are reviewed, exposure is assessed and response actions are initiated within defined timeframes.
• FE-3Identified supply chain compromises are responded to in timeframes defined by the organisation.
• FE-4Supply chain compromise events are integrated with incident response and reflected in the risk register.

Not effective (3)

• NE-1No review of default or unused accounts has been conducted within the review period defined by the organisation.
• NE-2Default vendor accounts remain enabled on production systems without appropriate documentation, justification, hardening and monitoring in place for their use.
• NE-3No process exists to identify accounts that have not authenticated within a defined period.

Partially effective (3)

• PE-1A review has been conducted but does not cover all assets.
• PE-2Default accounts have been identified but some remain enabled without documented justification.
• PE-3Unused accounts are identified but remediation is incomplete or delayed beyond defined timeframes.

Fully effective (3)

• FE-1A review of accounts has been completed within the defined review period covering all assets.
• FE-2Default accounts are disabled or have approved justification for remaining active, with appropriate monitoring and compensating controls for their use in place.
• FE-3Accounts that show no evidence of use, other than approved emergency access accounts, are identified and either disabled or removed in accordance with defined timeframes.

Not effective (4)

• NE-1Credentials are stored in plaintext, spreadsheets, shared drives or other unapproved locations as standard practice.
• NE-2No approved secure repository is in use to store authentication keys, secrets and tokens.
• NE-3Access to credential stores is neither controlled nor audited.
• NE-4Access controls such as MFA are not enabled for authentication to secure repositories.

Partially effective (3)

• PE-1An approved secure repository is in use but does not cover all authentication keys, secrets and tokens within scope.
• PE-2Access controls for secure repositories are in place but access logging is not enabled or not reviewed.
• PE-3MFA is enforced for some, but not all, applicable users, repositories or authentication pathways, and the remaining exceptions are documented and subject to remediation.

Fully effective (2)

• FE-1Authentication keys, secrets and tokens within scope are stored in approved secure repositories, with any authorised exceptions documented, risk-assessed and managed in accordance with organisationally defined requirements.
• FE-2Access to secure repositories is restricted using attribute or role-based access controls, MFA is enforced for all applicable authentication pathways, and access is logged and reviewed and investigated where necessary.

Not effective (3)

• NE-1No secret scanning capability is deployed.
• NE-2No process exists to identify credentials exposed in codebases, configuration files, file shares or user collaboration platforms.
• NE-3Unsecured keys, secrets and credentials found exposed in codebases, configuration files, scripts, file shares or user collaboration platforms are left in place with no action taken.

Partially effective (3)

• PE-1Secret scanning is deployed but does not cover all repositories, pipelines or user collaboration platforms.
• PE-2Scanning runs but discovered credentials are not assessed in a timely manner.
• PE-3Unsecured keys, secrets and credentials that are discovered are assessed, but are not rotated or revoked in a timely manner.

Fully effective (3)

• FE-1Secret scanning tooling is deployed across codebases, configuration files, file shares and user collaboration platforms.
• FE-2Scans to identify unsecured keys, secrets and credentials run on a regular schedule defined by the organisation.
• FE-3Unsecured keys, secrets and credentials that are discovered are assessed, then rotated and/or revoked within timeframes defined by the organisation.

Not effective (4)

• NE-1Phishing-resistant MFA is not enforced for interactive user authentication to systems.
• NE-2MFA is deployed but uses non-phishing-resistant methods, such as SMS, voice, or push-only authentication instead of phishing-resistant MFA.
• NE-3No access policies differentiate between trusted and untrusted, external or high-risk locations.
• NE-4Access from untrusted, external or high-risk locations is permitted without MFA, or with non-phishing-resistant MFA.

Partially effective (3)

• PE-1Phishing-resistant MFA is deployed for some but not all systems within scope.
• PE-2Access policies exist but do not cover all organisationally defined high-risk location categories.
• PE-3Exceptions or alternative authentication pathways allow routine or recurring authentication without phishing-resistant MFA, or emergency access arrangements are not adequately restricted, monitored, tested or reviewed.

Fully effective (4)

• FE-1Phishing-resistant MFA is enforced for all routine interactive user authentication to systems within scope.
• FE-2Phishing-resistant MFA is enforced for routine authentication attempts from untrusted, external or high-risk locations.
• FE-3Customer-facing services provide a phishing-resistant MFA option for authentication.
• FE-4Emergency access arrangements are periodically tested and reviewed to confirm that they remain operational, appropriately protected and limited to their intended purpose. Credentials or authentication factors used for emergency access are securely managed and are not used for routine administration.

Not effective (4)

• NE-1Legacy authentication protocols that cannot enforce modern authentication controls remain enabled and in active use without restriction.
• NE-2No assessment has been conducted to identify which legacy authentication protocols are in use within the environment.
• NE-3Authentication mechanisms transmitting credentials in cleartext or using weak cryptographic primitives remain enabled and no action has been taken to disable them.
• NE-4Where legacy protocols are retained, no compensating controls, no monitoring and no decommissioning timelines are in place.

Partially effective (4)

• PE-1Legacy authentication protocols have been identified and are partially restricted but some remain enabled across systems within scope without justification.
• PE-2An assessment has been conducted but does not cover all in-scope systems, or the inventory of legacy protocols in use is not maintained.
• PE-3Some weak authentication mechanisms have been disabled but others remain enabled without documented justification or remediation plan.
• PE-4Compensating controls exist for some retained legacy protocols but monitoring is inconsistent or decommissioning timelines are not defined.

Fully effective (4)

• FE-1Legacy authentication protocols that cannot enforce modern authentication controls have been identified and disabled across systems within scope, excluding documented and risk accepted exceptions.
• FE-2An assessment of legacy authentication protocol use has been conducted across in-scope systems and the inventory is maintained.
• FE-3Where retention is necessary, compensating controls are applied and decommissioning timelines are recorded and tracked.
• FE-4Ongoing use of legacy authentication protocols is regularly risk reviewed, accepted and recorded in the organisation’s risk register.

Not effective (4)

• NE-1Local administrator credentials are shared across the device fleet, or service or privileged account credentials are routinely reused across systems.
• NE-2Credential uniqueness is not enforced for applicable user, machine, system or service identities.
• NE-3Credential uniqueness has not been addressed in high-privilege contexts, including domain administration, cloud administration or automation platforms.
• NE-4Where credential uniqueness cannot be enforced, neither compensating controls nor remediation paths are in place.

Partially effective (4)

• PE-1Local administrator credential uniqueness has been implemented for some device populations but coverage is incomplete across the device fleet.
• PE-2A technical mechanism is in place but applies to only a subset of credential types or systems within scope.
• PE-3Credential uniqueness has been addressed in some high-privilege contexts but gaps remain in others.
• PE-4Compensating controls exist for some shared credentials but monitoring is inconsistent or remediation plans do not exist.

Fully effective (4)

• FE-1Credentials for applicable local administrative accounts are unique to each system or account.
• FE-2Credential uniqueness is consistently enforced for applicable user, machine, system and service identities.
• FE-3Credential uniqueness is enforced consistently in high-privilege contexts, with managed identities or equivalent capabilities used in preference to shared static credentials wherever feasible.
• FE-4Where uniqueness cannot be enforced, compensating controls are applied, the use of the shared credentials is monitored, and a remediation plan exists.

Not effective (4)

• NE-1Access privileges are not reviewed against current roles, duties and business requirements.
• NE-2Access reviews do not identify privileges that are no longer required.
• NE-3Access privileges are not updated when personnel roles, duties or business requirements change.
• NE-4Access privileges are not mapped to roles, duties and business requirements.

Partially effective (4)

• PE-1Access reviews are conducted for some accounts or systems, but coverage is incomplete.
• PE-2Reviews identify excessive or obsolete privileges, but updates are incomplete or not completed within timeframes defined by the organisation.
• PE-3A process to review access privileges exists but only occurs on an ad hoc basis.
• PE-4Some access privileges are mapped to roles, duties and business requirements, but not all.

Fully effective (4)

• FE-1Access privileges for all applicable accounts and systems are reviewed within a cycle defined by the organisation and aligned with current roles, duties and business requirements.
• FE-2Privileges identified as excessive or obsolete are removed or updated within timeframes defined by the organisation.
• FE-3Review outcomes and resulting access changes are documented and available as evidence.
• FE-4Access privileges are mapped to current roles, duties and business requirements.

Not effective (2)

• NE-1Non-administrative users can create, modify or delete accounts or roles.
• NE-2Delegated permissions are broad and have not been audited.

Partially effective (2)

• PE-1Permissions are restricted to administrative roles but some delegated permissions are broader than required.
• PE-2Approval workflows exist for some high-impact changes but not all.

Fully effective (3)

• FE-1Only designated administrative roles can create, modify or delete accounts and roles.
• FE-2Delegated permissions are audited and scoped to the minimum required.
• FE-3Approval workflows are enforced for high-impact identity and access changes.

Not effective (2)

• NE-1Accounts are provisioned with broad default permissions that exceed operational requirements.
• NE-2Administrative and day-to-day user functions share the same account, with no separate privileged accounts.

Partially effective (2)

• PE-1Minimum privilege provisioning is defined but not consistently applied to all account types.
• PE-2Administrative accounts are separated from user accounts but some exceptions exist without documented justification.

Fully effective (3)

• FE-1All accounts are provisioned with documented minimum permissions aligned to defined operational functions.
• FE-2Separate accounts are allocated for privileged and day-to-day functions, and controls prevent privileged use from day-to-day context.
• FE-3Non-person and service accounts are scoped to their specific integration requirements.

Not effective (3)

• NE-1Administrative access to systems is routinely performed from standard user devices without additional controls to protect the administrative session.
• NE-2No dedicated or hardened administrative environment exists.
• NE-3Exceptions to the use of dedicated administrative environments are neither identified nor assessed.

Partially effective (3)

• PE-1A dedicated administrative environment has been established, but administrative access is not consistently routed through it.
• PE-2Administrative endpoints have been hardened, but unprivileged user workloads or unnecessary functions remain accessible.
• PE-3Exceptions are documented, but their justification, risk acceptance, compensating controls or review arrangements are incomplete or inconsistently applied.

Fully effective (3)

• FE-1Administrative sessions originate from dedicated and hardened administrative environments that are isolated from unprivileged user workloads. Where this cannot be technically enforced, exceptions are documented, risk-assessed, formally accepted and protected by compensating controls.
• FE-2Administrative environments are hardened and restricted to the functions required for authorised administration.
• FE-3Exceptions are limited to systems or services that cannot support administration through a dedicated environment, are periodically reviewed and are removed when the technical limitation no longer applies.

Not effective (2)

• NE-1Privileged access is standing and does not require explicit activation or time-bound grants, excluding approved break-glass and emergency access accounts.
• NE-2No re-authentication or step-up authentication is required before privileged sessions.

Partially effective (2)

• PE-1Time-bound access is implemented for some privileged roles but standing access remains for others.
• PE-2Session duration limits exist but are not consistently enforced or are set excessively long.

Fully effective (3)

• FE-1Time-bound privilege grants are enforced for applicable privileged roles, with defined maximum session durations and approved emergency access arrangements.
• FE-2Re-authentication or step-up authentication is required before privilege activation.
• FE-3All privilege activations are logged with activating user, role and timeframes.

Not effective (2)

• NE-1Administrative or management actions that modify systems, configurations or controls are not logged.
• NE-2Logs do not capture sufficient detail to identify who made a change, when and to what target.

Partially effective (2)

• PE-1Logging is enabled and provides useful coverage, but does not cover all applicable administrative or management platforms.
• PE-2Logs capture the administrator identity and action but lack detail on the target or change nature.

Fully effective (2)

• FE-1Comprehensive audit logging to capture all administrative or management actions is enabled on all platforms in scope.
• FE-2Logs capture administrator identity, timestamp, target object and nature of change.

Not effective (2)

• NE-1No documented configuration baseline exists for assets.
• NE-2Systems are deployed with vendor defaults and no documented hardening has been applied.

Partially effective (3)

• PE-1A baseline exists but does not address all applicable asset types.
• PE-2The baseline is documented but has not been reviewed or updated within the cycle defined by the organisation.
• PE-3The baseline exists but rationale for configuration decisions is not documented.

Fully effective (4)

• FE-1A documented and approved baseline exists for all applicable asset types.
• FE-2The baseline disables or removes unnecessary services, insecure settings, and unsupported or weak communication protocols.
• FE-3Configuration decisions are documented with rationale to support drift assessment.
• FE-4The baseline is reviewed and updated on a cycle defined by the organisation.

Not effective (2)

• NE-1Approved baselines have not been applied to assets.
• NE-2Baseline deployment has not been validated through technical assessment.

Partially effective (3)

• PE-1Approved baselines have been implemented where available, but some relevant asset types are not covered by an approved baseline.
• PE-2Deployment has occurred but validation through technical assessment is incomplete or not current.
• PE-3Approved baselines have been deployed, but coverage for all applicable assets is inconsistent.

Fully effective (3)

• FE-1Approved baselines have been applied to all applicable assets.
• FE-2Deployment has been validated through technical assessment.
• FE-3Coverage metrics are available demonstrating deployment completeness.

Not effective (3)

• NE-1No mechanism exists to detect configuration drift from approved baselines.
• NE-2Assessments to detect configuration drift have not been conducted within the review period defined by the organisation.
• NE-3Assessments do not systematically identify instances of configuration drift for assets.

Partially effective (2)

• PE-1Drift detection is in place but does not cover all applicable assets.
• PE-2Drift is detected but the remediation process is informal or response timeframes are not defined.

Fully effective (3)

• FE-1Automated configuration monitoring or regular technical assessments detect drift across the applicable assets, occurring at a frequency based on system criticality and change rate.
• FE-2A documented remediation process exists with defined response timeframes aligned to severity.
• FE-3Drift events are tracked to closure with evidence of remediation.

Not effective (3)

• NE-1Vulnerability scanning activities are not undertaken.
• NE-2No routine vulnerability assessment activity has been conducted within a period defined by the organisation.
• NE-3Advisories for relevant software and configuration weaknesses for organisational assets are not reviewed and assessed for impact.

Partially effective (5)

• PE-1Vulnerability scanning is deployed but does not cover all applicable assets.
• PE-2Vulnerability scans are conducted but results are not reviewed and prioritised within timeframes defined by the organisation.
• PE-3Vulnerability scans are conducted but frequency is not regular enough to enable timely response.
• PE-4Scanning covers software vulnerabilities but not configuration weaknesses.
• PE-5Advisories for relevant software and configuration weaknesses for organisational assets are reviewed on an ad hoc basis, or only for some assets.

Fully effective (4)

• FE-1All applicable assets are included in routine vulnerability scanning, and scanning frequency enables timely response.
• FE-2Scanning covers both software vulnerabilities and configuration weaknesses.
• FE-3Results are reviewed and prioritised within timeframes defined by the organisation.
• FE-4Advisories for relevant software and configuration weaknesses in all organisational assets are regularly reviewed and assessed for impact.

Not effective (2)

• NE-1No defined patching timeframes exist for applicable assets.
• NE-2Patches are not applied or are applied on an ad hoc basis with no tracking.

Partially effective (3)

• PE-1Expected patching timeframes are defined by the organisation but are not consistently met.
• PE-2Patches are applied but compensating controls are not documented where operational constraints prevent timely patching.
• PE-3Patching coverage metrics exist but show significant gaps.

Fully effective (5)

• FE-1Risk-based patching timeframes defined by the organisation are in place and consistently met.
• FE-2Patching is prioritised based on vulnerability severity, exposure and exploit availability.
• FE-3Where operational constraints prevent timely patching, compensating controls are documented and approved.
• FE-4Patching coverage metrics account for all applicable assets, with any exclusions identified and formally risk accepted.
• FE-5Automatic patching of assets is applied where available and the organisation has determined operational impact is low.

Not effective (2)

• NE-1No risk thresholds are defined for vulnerability remediation.
• NE-2Vulnerabilities exceeding acceptable risk levels are not tracked or remediated.

Partially effective (2)

• PE-1Risk thresholds are defined but vulnerabilities exceeding them are not consistently remediated within defined timeframes.
• PE-2Compensating controls are applied in some cases but are not formally documented or approved.

Fully effective (3)

• FE-1Risk thresholds defined by the organisation exist, and vulnerabilities exceeding them are remediated or have approved compensating controls within organisationally defined timeframes.
• FE-2Remediation and mitigation actions are tracked to closure with verification that actions reduced the risk as intended.
• FE-3The process is sustained, with historical data demonstrating consistent performance across organisationally defined reporting periods.

Not effective (2)

• NE-1Unsupported, unverified or unauthorised software can execute without restriction.
• NE-2The list of approved software does not exist.

Partially effective (4)

• PE-1Execution restriction controls are deployed but do not cover all applicable assets.
• PE-2The organisation maintains a list of approved software, but it has not been reviewed within timeframes defined by the organisation.
• PE-3Execution restrictions are in place but integrity verification of approved software is not performed.
• PE-4Exceptions to execution restrictions are granted without formal approval or time-bounding.

Fully effective (4)

• FE-1Controls restrict execution to supported, organisation-authorised and integrity-verified software on all applicable assets.
• FE-2The organisation maintains a list of approved software and reviews it within the timeframes defined by the organisation.
• FE-3Integrity of permitted software is verified using trusted mechanisms appropriate to the software and its source.
• FE-4Exceptions are formally approved, documented, time-bound and reviewed on a regular cycle defined by the organisation.

Not effective (3)

• NE-1No approved administrative toolset is defined.
• NE-2No restrictions are placed on the location administrative tooling can be executed from.
• NE-3No controls prevent unapproved administrative tools, including tools commonly used in post-compromise activity, from executing on managed assets.

Partially effective (3)

• PE-1An approved toolset is defined but not consistently enforced across all assets.
• PE-2Administrative tooling is configured to execute from known locations, but privileged users can still run tooling from unapproved locations.
• PE-3Some unapproved administrative tools are blocked but enforcement gaps exist.

Fully effective (2)

• FE-1A defined and enforced approved toolset exists for administrative and management activities, and execution is limited to authorised, known locations.
• FE-2Administrative and management tooling outside the approved set is blocked from execution, including from unauthorised locations.

Not effective (2)

• NE-1No managed backup process exists for important data, applications and settings.
• NE-2Backup storage is neither encrypted nor protected by immutable, offline, logically isolated or equivalent controls.

Partially effective (3)

• PE-1Important data, applications and settings are backed up, but backup schedules are not defined, do not cover all important assets, or are not consistently met.
• PE-2Backups are encrypted but no immutable, offline, logically isolated or equivalent resilience controls are consistently applied.
• PE-3Backups use immutable, offline, logically isolated or equivalent controls, but encryption is not consistently enforced.

Fully effective (3)

• FE-1All important data, applications and settings are backed up according to schedules defined by the organisation and aligned with their recovery requirements.
• FE-2Backup schedules are monitored, and missed or unsuccessful backups are identified, investigated and remediated within timeframes defined by the organisation.
• FE-3Backup storage is encrypted and protected by immutable, offline, logically isolated or equivalent controls.

Not effective (2)

• NE-1Backup repositories are accessible from the production environment or by production administrators.
• NE-2Compromise of a system would provide a direct path to access, modify or delete its own backups.

Partially effective (2)

• PE-1Backup repositories are logically separated but use credentials managed by the same identity platform as production.
• PE-2Isolation is implemented but has not been tested or validated.

Fully effective (3)

• FE-1Backup repositories are isolated from production environments and general user access.
• FE-2Access is controlled through credentials and administrative paths isolated from compromise of the primary identity environment.
• FE-3Isolation has been validated to confirm that compromise of a system does not provide access to backups.

Not effective (3)

• NE-1No restoration test has been conducted within the test cycle defined by the organisation.
• NE-2No backup or restoration procedures exist.
• NE-3Restoration testing demonstrates that backups cannot be restored, or consistently fail to meet defined recovery time or recovery point objectives.

Partially effective (3)

• PE-1Restoration testing has been conducted but does not cover all important assets.
• PE-2Backup procedures exist but have never been tested.
• PE-3Testing has been conducted but coverage is incomplete or some tests did not meet the expected recovery time or recovery point objectives.

Fully effective (3)

• FE-1Restoration testing covering important assets is conducted within the test cycle defined by the organisation.
• FE-2Testing validates that restoration meets the expected recovery time and recovery point objectives.
• FE-3Test results are documented and gaps identified during testing are remediated.

Not effective (4)

• NE-1Systems are deployed on shared or flat network segments with no segregation between functions or trust levels.
• NE-2No access controls restrict network access from external or general user networks to in-scope systems.
• NE-3Segmentation is documented or administratively defined but not enforced by technical controls.
• NE-4Segmentation has not been validated through technical assessment.

Partially effective (5)

• PE-1Network segmentation has been implemented but does not cover all in-scope systems, or segments are defined inconsistently.
• PE-2Access controls exist between segments, but deny-by-default is not enforced, or some pathways are permitted without documented approval.
• PE-3Technical enforcement is in place for some segments but relies on a single mechanism that does not provide meaningful isolation.
• PE-4Validation has been performed for some segments but not consistently across in-scope systems, or validation is out of date.
• PE-5Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation.

Fully effective (5)

• FE-1Systems within scope are deployed in network segments defined according to function, criticality and trust level, with segmentation applied consistently.
• FE-2Deny-by-default access controls are enforced between segments, with access from external and general user networks limited to documented and approved pathways.
• FE-3Segmentation is enforced through network-layer technical controls that provide meaningful isolation.
• FE-4Segmentation has been validated through technical assessment with results documented and gaps remediated.
• FE-5Approved pathways are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and changes reflected in the access control configuration.

Not effective (5)

• NE-1No controls limit lateral movement between or within network segments.
• NE-2Lateral movement is permitted by default across the environment, with restrictions applied only on an exception basis.
• NE-3Approved pathways are not documented.
• NE-4Lateral movement controls have not been validated through technical assessment.
• NE-5Pathways and services are not reviewed after initial approval.

Partially effective (5)

• PE-1Controls limit lateral movement between segments but no controls operate within segments.
• PE-2Restrictions are applied to some pathways, but the default position remains permissive in parts of the environment.
• PE-3Approved pathways are documented but documentation is out of date or incomplete.
• PE-4Validation has been performed but does not cover all in-scope segments, or is out of date.
• PE-5Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation.

Fully effective (5)

• FE-1Controls limit lateral movement both between and within segments, with deny-by-default applied at each boundary.
• FE-2Pathways and services are explicitly approved based on documented business requirements and trust levels, with all other lateral movement denied.
• FE-3Approved pathways are documented, reflect the current configuration and identify the business requirement and trust relationship justifying each.
• FE-4Lateral movement controls have been validated through technical assessment with results documented and gaps remediated.
• FE-5Pathways and services are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and the configuration updated to reflect approved changes.

Not effective (2)

• NE-1No outbound content inspection is deployed.
• NE-2Sensitive data can leave the organisation through any egress path without detection or control.

Partially effective (3)

• PE-1Outbound inspection is deployed but does not cover all applicable egress paths.
• PE-2Rules are configured but do not cover all classified, regulated or high-value data types.
• PE-3Alerts are generated but are not triaged or acted upon in a timely manner.

Fully effective (3)

• FE-1Outbound content inspection is deployed covering all applicable egress paths.
• FE-2Rules are configured to detect unauthorised transfer of classified, regulated and high-value data.
• FE-3Alerts are triaged and responded to within accepted risk timeframes defined by the organisation.

Not effective (3)

• NE-1No controls are deployed to prevent systems from establishing outbound connections to known malicious or untrusted destinations.
• NE-2Blocking decisions are not informed by current threat intelligence.
• NE-3Destination categorisation is not used.

Partially effective (3)

• PE-1Controls to prevent outbound connections being established are deployed but cover only a subset of in-scope systems or egress paths.
• PE-2Threat intelligence is used to inform block decisions for outbound connections, but updates are infrequent, manual or limited to a single source.
• PE-3Categorisation is in place, but the categories blocked do not reflect the organisation’s risk position.

Fully effective (3)

• FE-1Controls are deployed and applied across in-scope systems, egress paths, services, and network boundaries.
• FE-2Blocking decisions draw on current threat intelligence, with destination lists updated on a cycle defined by the organisation.
• FE-3Destination reputation, category and age are considered alongside threat intelligence, with category-based blocking aligned to the organisation’s risk position.

Not effective (1)

• NE-1No inbound content inspection is deployed.

Partially effective (2)

• PE-1Inbound inspection is deployed but does not cover all applicable content channels.
• PE-2Inspection is in place but detection signatures or rules are not maintained or updated.

Fully effective (4)

• FE-1Inbound content inspection covers all applicable content channels.
• FE-2Detection signatures and rules are maintained and updated on a regular cycle defined by the organisation.
• FE-3Blocked content is logged and available for review.
• FE-4Current cyber threat intelligence is considered when implementing controls to prevent the delivery of malicious or unsafe content.

Not effective (2)

• NE-1No requirement exists for personnel to complete cyber security awareness training before being granted access to critical, privileged or business systems.
• NE-2No training completion records are maintained.

Partially effective (3)

• PE-1A training program exists but is not tailored to the specific risks of the systems in-scope.
• PE-2A requirement to complete training before access is granted exists but is not consistently enforced.
• PE-3Completion records are maintained but show significant gaps in coverage.

Fully effective (3)

• FE-1Role-tailored training programs address the specific risks, data handling obligations and incident reporting requirements relevant to in-scope systems.
• FE-2All personnel complete role-tailored training before being granted access to organisational systems and data, with refresher training mandated within a cycle defined by the organisation.
• FE-3Completion records are maintained and demonstrate full coverage.

Not effective (4)

• NE-1No cyber security awareness training program exists.
• NE-2Cyber security awareness training is not reviewed or updated after initial deployment.
• NE-3Lessons learnt from cyber security incidents are not incorporated into training content.
• NE-4The cadence of review is not defined.

Partially effective (4)

• PE-1Training is reviewed but updates do not reflect current threat intelligence, sector relevant adversary techniques or organisational changes.
• PE-2Some lessons are incorporated but the process is informal, or coverage is limited to a small number of incidents.
• PE-3Some changes are reflected, but training is not updated to address recently introduced systems or significant changes to working arrangements.
• PE-4A review cadence exists, but is not consistently met, or is not proportionate to the rate of change.

Fully effective (4)

• FE-1Training content is reviewed and updated on a defined cycle, with updates reflecting current threat intelligence, adversary techniques relevant to the workforce and organisation’s operating context.
• FE-2Lessons learnt from cyber security incidents within the organisation or its sector are systematically incorporated into training content.
• FE-3Training reflects the systems, platforms and working arrangements that personnel currently interact with, including newly introduced platforms and changes to ways of working.
• FE-4The cadence of review is defined, proportionate to the rate of change in the threat environment, and consistently met.

Not effective (3)

• NE-1Logs generated by applicable assets are not protected from modification or deletion.
• NE-2Log access is not restricted to authorised roles with a business need.
• NE-3Logs are neither encrypted during transit nor at rest.

Partially effective (3)

• PE-1Logs are forwarded but integrity protections are not in place at the source.
• PE-2Log access is restricted but some roles retain the ability to modify or delete logs.
• PE-3Logs are encrypted during transit but are not protected with encryption at rest (or vice versa).

Fully effective (3)

• FE-1Logs are protected against modification or deletion.
• FE-2Logs are encrypted in transit and at rest.
• FE-3Access to logs is restricted to authorised roles with a business need.

Not effective (2)

• NE-1Security-relevant logs from assets are not forwarded to a central logging capability.
• NE-2High-value, security-relevant event logs or configuration changes from infrastructure, operating systems or applications are not forwarded.

Partially effective (4)

• PE-1High-value, security-relevant event logs are forwarded, but coverage gaps are identified or completeness has not been validated.
• PE-2Configuration change logs are forwarded inconsistently.
• PE-3The utility of security log sources is reviewed, but on an ad hoc basis rather than according to a defined schedule.
• PE-4Log forwarding is in place but latency is excessive for effective detection.

Fully effective (4)

• FE-1High-value security-relevant event logs and configuration changes from all relevant infrastructure, operating systems and application sources are forwarded to the central logging capability.
• FE-2Security log sources are reviewed at regular intervals to ensure their continued utility in detecting and responding to changing adversary techniques.
• FE-3Log completeness has been validated against the expected log sources.
• FE-4Logs are forwarded at a frequency that enables timely detection.

Not effective (4)

• NE-1No centralised capability exists for storing event logs collected from systems across the environment.
• NE-2Stored logs have no protection against modification or deletion by administrators of the systems generating them.
• NE-3Access to the centralised capability is not restricted, or access is granted to roles without a documented need.
• NE-4Log retention requirements are not defined.

Partially effective (4)

• PE-1A centralised capability exists but does not receive logs from in-scope systems, or coverage is inconsistent.
• PE-2Stored logs are protected from modification, but the controls do not consistently prevent deletion, or controls are not applied to all log types.
• PE-3Access is restricted to a defined set of roles but access is not logged or monitored.
• PE-4A retention period is defined but is inconsistently applied, or some log types are retained for shorter periods than required.

Fully effective (4)

• FE-1A centralised event log storage capability is in place for logs collected from in-scope systems.
• FE-2Stored logs are protected against unauthorised access, modification and deletion through technical controls including access restrictions, encryption at rest and integrity protection.
• FE-3Access to the centralised capability is restricted to security operations personnel and other roles with a documented need, with access logged and monitored.
• FE-4Log retention requirements are defined and aligned to investigative, regulatory and contractual obligations, with retention applied consistently across log types.

Not effective (2)

• NE-1No monitoring or equivalent analysis is used to identify anomalous or unexpected use of legitimate tools and utilities on applicable systems.
• NE-2Existing controls do not provide a reasonable capability to detect security-relevant patterns of legitimate software being used for malicious purposes.

Partially effective (3)

• PE-1Monitoring or equivalent analysis covers some priority tools, execution behaviours or applicable systems, but risk-significant coverage gaps exist.
• PE-2Security-relevant execution telemetry is collected, but detection rules, behavioural analytics or equivalent analysis are incomplete or not consistently operational.
• PE-3Alerts relating to anomalous or unexpected software execution are generated, but they are not consistently triaged and investigated within organisationally defined timeframes.

Fully effective (4)

• FE-1The organisation identifies the legitimate tools, utilities and execution behaviours that present heightened risk of malicious use within applicable systems.
• FE-2Security-relevant telemetry and contextual information are analysed using detection rules, behavioural analytics or equivalent methods to identify anomalous or unexpected use of priority tools and utilities.
• FE-3Detection coverage is periodically reviewed and adjusted in response to changes in applicable systems, threat intelligence, observed activity and the organisation’s risk profile.
• FE-4Alerts are prioritised, triaged and investigated within timeframes defined according to their assessed security risk.

Not effective (2)

• NE-1Logs are not time-synchronised to an authoritative source.
• NE-2Logs are ingested in raw format and are neither normalised nor enriched.

Partially effective (2)

• PE-1Logs are time-synchronised but are not normalised to a common schema.
• PE-2Some enrichment is applied but critical contextual data such as asset classification or account type is missing.

Fully effective (3)

• FE-1Logs are time-synchronised to the authoritative time source.
• FE-2Logs are normalised into the common log schema and enriched with contextual metadata.
• FE-3Enriched logs support correlation across relevant systems, environments and data sources in the central logging platform.

Not effective (2)

• NE-1No detection logic is deployed to identify unauthorised changes, anomalous authentication activity or suspicious software execution events originating from assets.
• NE-2Detection relies entirely on manual log review with no automated rules or alerting.

Partially effective (2)

• PE-1Detection logic exists but does not cover all three categories (unauthorised changes, anomalous authentication, suspicious execution).
• PE-2Rules are deployed but are not tested or tuned on a regular cycle defined by the organisation.

Fully effective (3)

• FE-1Detection logic is deployed, and unauthorised configuration changes, anomalous authentication patterns and suspicious process execution events are captured and produce alerts.
• FE-2Detection logic is tested and tuned on a regular cycle defined by the organisation to maintain effectiveness.
• FE-3Detection coverage is reviewed following cyber security incidents or significant environmental changes.

Not effective (3)

• NE-1No documented triage process exists.
• NE-2Alerts are routinely ignored or left unreviewed.
• NE-3No incident severity thresholds are defined.

Partially effective (2)

• PE-1A triage process exists but response times are not defined or consistently met.
• PE-2Severity thresholds are defined but escalation procedures are informal.

Fully effective (3)

• FE-1A documented triage process with defined severity thresholds and response timeframes is in place.
• FE-2Alerts are triaged within the timeframes defined by the organisation and escalated where cyber security incident thresholds are met.
• FE-3Triage performance is tracked and reported.

Not effective (2)

• NE-1Investigation relies on single-source alerts with no cross-source correlation.
• NE-2Correlation rules do not consider signals from multiple data sources.

Partially effective (2)

• PE-1Some correlation exists but is limited to specific data source pairs.
• PE-2Cross-source investigation is performed manually but not supported by automated correlation.

Fully effective (2)

• FE-1Correlation rules and investigation procedures consider signals across identities, applications, data and infrastructure.
• FE-2Automated correlation supports detection of multi-stage adversary activity.

Not effective (2)

• NE-1No review of detection coverage has been conducted within the period defined by the organisation.
• NE-2No process exists to assess new assets and services for log coverage or detection applicability.

Partially effective (2)

• PE-1A review of detection coverage has been conducted but does not cover all recently deployed assets or services.
• PE-2Detection gaps have been identified and remediation is planned, but remediation has not been executed within timeframes defined by the organisation.

Fully effective (3)

• FE-1A detection coverage review has been completed within the cycle defined by the organisation.
• FE-2New assets and services are assessed for log coverage and detection rule applicability.
• FE-3Identified detection gaps are remediated within risk-based timeframes defined by the organisation.

Not effective (2)

• NE-1External coordination requirements for Cyber security incident response activities are neither identified nor documented.
• NE-2No defined triggers, contacts or timeframes exist for external reporting.

Partially effective (2)

• PE-1External coordination requirements are documented but are not integrated into operational response procedures.
• PE-2Contacts and triggers are defined for some but not all required external parties.

Fully effective (3)

• FE-1Cyber security incident response procedures include documented external coordination requirements with defined triggers, contacts and timeframes.
• FE-2Requirements cover all relevant external parties identified by applicable legal, regulatory, contractual and organisational obligations.
• FE-3Coordination procedures have been exercised or invoked and lessons learnt have been incorporated.

Not effective (3)

• NE-1No documented cyber security incident response plan or procedures exist.
• NE-2Incident response activities are conducted on an ad hoc basis without any defined roles, escalation paths, procedures or response objectives.
• NE-3Available incident records demonstrate systemic failures to contain, eradicate or recover from cyber security incidents within organisationally defined timeframes, and the causes of these failures are not addressed.

Partially effective (3)

• PE-1A cyber security incident response plan exists but has not been exercised or invoked within the organisationally defined test cycle.
• PE-2The cyber security incident response plan defines roles, escalation paths, and response procedures, but target timeframes or intended response outcomes are not clearly defined.
• PE-3Incident records or exercise results demonstrate that response activities do not consistently meet organisationally defined timeframes or intended outcomes, but identified deficiencies are documented and subject to improvement actions.

Fully effective (5)

• FE-1An approved cyber security incident response plan is in place and defines roles, escalation paths, response procedures, target timeframes and intended containment, eradication and recovery outcomes.
• FE-2The incident response plan and associated procedures have been exercised or invoked within the organisationally defined test cycle.
• FE-3Incident records demonstrate that cyber security incidents are contained, eradicated and recovered from within organisationally defined target timeframes and achieve the intended response outcomes, taking into account incident severity, complexity and business impact.
• FE-4Where target timeframes or intended outcomes are not achieved, the causes are analysed, improvement actions are assigned and tracked, and relevant plans, procedures and controls are updated.
• FE-5Where no relevant cyber security incident has occurred during the assessment period, appropriately scoped exercises demonstrate the organisation’s capability to achieve its target timeframes and intended response outcomes.

Not effective (1)

• NE-1Post-incident reviews are not conducted.

Partially effective (2)

• PE-1Post-incident reviews are conducted for some incidents but not all that meet the severity threshold defined by the organisation.
• PE-2Reviews are conducted but findings are not documented or actioned.

Fully effective (3)

• FE-1Post-incident reviews are conducted for all incidents meeting the severity threshold defined by the organisation.
• FE-2Findings identify the specific gaps that enabled each stage of the incident.
• FE-3Remediation actions arising from findings are implemented and tracked to closure.

Not effective (1)

• NE-1Detection rules, monitoring coverage and response procedures are not reviewed following incidents.

Partially effective (2)

• PE-1Reviews are conducted but do not result in documented changes to detection or response capabilities.
• PE-2Some improvements are made but not systematically tracked or validated.

Fully effective (2)

• FE-1Detection rules, monitoring coverage and cyber security incident response procedures are reviewed following incidents, with identified lessons incorporated into updates.
• FE-2Changes are documented, tested and validated for effectiveness.