ASD Essentials

Check

ASD Essentials glossary.

Plain-English meanings for 99 terms used in the ASD Essentials, including all 56 in ASD's own glossary. ASD's own words sit under each one in small type. Only those marked "ASD's definition" come from ASD's glossary.

Reviewed 17 October 2026 · Current to ASD's Essentials glossary, published 15 October 2026

A to Z

Browse the terms by topic instead

The same terms, grouped by what you are doing.

See the core terms in one worked example

PrincipleWhat outcome?Principles describe the cyber security outcomes an organisation should achieve.

PRO-13Identity, credential and access management

Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.

ActionWhat needs to be done?Actions describe what needs to be done to achieve those outcomes.

IT.PRO-13.4

Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations.

DomainWhere does it apply?Domains describe the business functions and assets to which the actions apply.

IT.PRO-13.4 applies in 6 domains:

Boundary services
Identity services
Critical processes and services
Privileged environments
Business systems
User devices

The three layers for one action, IT.PRO-13.4: its principle, the action itself and the domains it applies in. The sentence that describes each layer, the principle statement and the action are quoted as published by ASD.

Worked example: a 300-person council

The council's contractor portal still accepts a password alone from outside the network, so IT.PRO-13.4 is rated not effective in Boundary services. The same action gets its own rating in Identity services. A gap analysis would have found the portal gap earlier, with the action partially addressed in Boundary services, before any formal assessment.

A

Action: A task that helps you achieve a principle. It says what to do, not which product to buy, and applies in one or more domains.; Example: IT.PRO-13.4 asks for phishing-resistant multi-factor authentication (MFA), such as a security key, when users sign in.; ASD's definition: A technology-agnostic description of a technical or procedural control that supports the achievement of a cyber security principle. ASD, Essentials glossary; See also: Principle, Action rating, IT.PRO-13.4 in full.
Action rating: The result one action gets in one domain: not assessed, not effective, partially effective or fully effective. The same action can be rated differently in each domain.; In ASD's words: Each action is assessed against each applicable domain using a four-tier, outcome-based rating scale: not assessed, not effective, partially effective and fully effective. ASD, Assessment process guide; See also: Indicators of good practice, Principle rating, How the Essentials is assessed.
Action sequencing: ASD's recommended order for working through the domains. Despite the name, it puts domains in order, not single actions.; ASD's definition: The recommended order in which domains should be addressed when applying the framework ASD, Essentials glossary; See also: Priority phase.
Active testing: Live tests of whether a control really stops or detects something. They can give strong evidence but can add operational risk, so ASD says to put them in the assessment plan and get the right authority's approval first.; Example: Trying to run software that is not on the approved list, to check that it is blocked.; In ASD's words: Active testing can provide strong evidence by directly testing whether an action works as intended in the live environment, rather than relying on configuration data alone. ASD, Assessment process guide; See also: Operational evidence, Assessment plan, Tools and active testing.
Addressed: In a gap analysis, an action is addressed when your current controls already cover it. In an assessment, a domain is addressed when every applicable action in it is rated fully effective.; In ASD's words: A domain is considered to be addressed when all applicable actions are operating as intended and are rated as fully effective. ASD, Assessment process guide; See also: Gap analysis, Fully effective.
Applicable (principle or action): A principle or action that ASD says applies in a given domain. Only the actions that apply in a domain are assessed there.; Example: IT.PRO-13.4 applies in six of the eight enterprise IT domains, so it is assessed only in those six.; In ASD's words: Not every principle or action applies to every domain. The relevant Essentials framework identifies which actions to apply to each domain. Only actions mapped to the domain are assessed for that domain. ASD, Assessment process guide; See also: Domain, ASD Essentials for enterprise IT.
ASD Essentials(the Essentials, the Essentials series): ASD's cyber security framework. It is a series of chapters, one per kind of technology environment, each built from principles, actions and domains.; In ASD's words: The ASD Essentials series is a framework that provides organisations with a consistent approach to cyber security across different technology environments. ASD, What is the Essentials?; See also: Chapter, Principle, What is the ASD Essentials?
Assessment: A check of whether each principle's outcome is really achieved, by rating its actions in each domain.; In ASD's words: The purpose of assessment under the Essentials series is to determine whether the security outcomes described by each cyber security principle are being achieved. ASD, Assessment process guide; See also: Assessment plan, Action rating, The four assessment stages.
Assessment dimensions: The four things an assessor weighs for each action: coverage (all relevant assets), consistency (applied the same way), currency (recent evidence) and evidence quality.; Example: Most directory servers are patched on time, but the certificate servers are often late. That is a consistency gap.; In ASD's words: Gaps in coverage or consistency may prevent an action from being rated fully effective. ASD, Assessment process guide; See also: Evidence quality, Partially effective.
Assessment plan: The written plan for an assessment: scope, methods, and the evidence, access and time needed. The right authority approves it before work starts.; In ASD's words: The assessment plan is approved before the assessment begins. ASD, Assessment process guide; See also: Assessment, Sampling, Active testing.
Asset categories: Six kinds of asset ASD uses as prompts when scoping: infrastructure, operating systems, applications, identities, credentials and data. Not every domain will hold every kind.; Example: In Identity services, a service account is an identity and the certificate it uses is a credential.; In ASD's words: For the Essentials for enterprise IT framework, these include infrastructure, operating systems, applications, identities, credentials and data. ASD, Assessment process guide; See also: Scoping, Non-person identity.
Attack surface: Everything an attacker could target to get in or do harm: your systems, services, interfaces and ways in.; Example: Each new internet-facing app adds to your attack surface.; ASD's definition: The systems, services, interfaces and access pathways that could be targeted or exploited by a malicious actor. ASD, Essentials glossary; See also: Internet-facing, Boundary services.
ATT&CK mapping: ASD's links from most actions to the attacker techniques they directly help prevent, detect or limit. It can guide what to fix and test first within a priority phase, but never changes a rating.; Good to know: ASD does not expect less mature organisations to use it for prioritising.; In ASD's words: For assessment purposes, the ATT&CK mapping is a guide rather than a scoring mechanism. ASD, Assessment process guide; See also: MITRE ATT&CK, Techniques, Threat intelligence.

B

Baseline (behavioural): A picture of normal user activity, such as usual sign-in times and the files people usually open, so odd activity stands out.; Example: An account that always signs in from Brisbane in business hours suddenly signs in from overseas at 3 am.; ASD's definition: A baseline of user activity, such as typical login patterns, resource access habits and anomalous actions. ASD, Essentials glossary; See also: Visibility and response.
Baseline configuration: A written, approved standard for how a system should be set up.; Example: The approved build for staff laptops, signed off by the right person in your organisation.; ASD's definition: A documented configuration standard that has been formally reviewed and approved by an appropriate authority within the organisation. ASD, Essentials glossary; See also: Configuration drift, Reusable pattern.
Boundary services (domain): Systems at your network's edges that handle connections and data flows to other environments, such as the internet or a partner's network. In enterprise IT, ASD places it in priority phase 1.; Example: A VPN gateway, an email gateway or a firewall at the internet edge.; ASD's definition: Systems positioned at network boundaries that broker connectivity between internal and external environments, including internet services and edge devices. ASD, Essentials glossary; ASD's placement question: Does it broker connectivity or data flows across a boundary between environments? ASD, Implementation planning guide; See also: Internet-facing, Boundary services actions, Scoping assets into domains.
Break-glass account: An emergency account kept for when the normal ways to get in are not working.; Example: A locked-away admin account used only if your single sign-on service is down.; ASD's definition: An emergency account reserved for exceptional situations where normal access methods are unavailable. ASD, Essentials glossary; See also: Privileged environments, Identity services.
Business systems (domain): The everyday systems that keep the organisation running, where no single one is critical on its own. In enterprise IT, ASD places it in priority phase 3.; Example: The service desk system, office apps and team chat tools.; ASD's definition: Supporting enterprise functions that collectively enable organisational operations. ASD, Essentials glossary; ASD's placement question: Does it support day-to-day operations without being individually critical? ASD, Implementation planning guide; See also: Business systems actions.

C

Capability domain: One of the two domains that mostly hold your security program rather than your systems: Governance and culture and Visibility and response. Their assets include policies, registers and response plans.; Good to know: ASD says to scope both early, and their scope grows as more technical domains come in.; In ASD's words: Governance and culture and Visibility and response are scoped differently because their assets are largely programs and artefacts rather than digital systems. ASD, Implementation planning guide; See also: Governance and culture, Visibility and response, Technical domain.
Chapter: One part of the Essentials series, written for one kind of technology environment. Today there are chapters for enterprise IT, cloud and operational technology (OT).; Example: A business with an office network and a factory floor may need both the enterprise IT chapter and the OT chapter.; In ASD's words: Current ASD Essentials series chapters address enterprise IT, cloud and operational technology. The series is structured so additional environment-specific chapters can be added as needed. ASD, What is the Essentials?; See also: Operational technology, Which Essentials chapter applies to you?
Cloud service provider(CSP): A company that runs cloud services for you. It runs part of the security, and you run the rest.; ASD's definition: An organisation that delivers cloud services and is responsible for operating elements of those services under a shared responsibility model. ASD, Essentials glossary; See also: Shared responsibility model, Which Essentials chapter applies to you?
Compensating arrangement: A different way of reaching an action's outcome. Normally, if any of an action's not effective indicators matches your setup, the action is rated not effective. But if your different approach clearly achieves the outcome, and the reasons and evidence are written down, the assessor may give a higher rating.; Good to know: ASD uses this phrase when rating an action. The closest term in ASD's glossary is compensating control.; In ASD's words: Where a compensating arrangement demonstrably achieves the action’s intended outcome, the assessor may assign a higher rating if the rationale and supporting evidence are documented. ASD, Assessment process guide; See also: Compensating control, Indicators of good practice.
Compensating control: A stand-in control that gets the same security result as an action, used when that action cannot be applied.; Example: An old system cannot support phishing-resistant MFA. Staff must first sign in to a jump server that enforces it, and reach the old system only from there. Sign-in still gets the protection the action asks for.; ASD's definition: An alternative control that delivers the same intended security outcome as a primary action, where that action cannot be applied. ASD, Essentials glossary; See also: Compensating arrangement, Exception, Legacy.
Configuration drift: When a system's real settings move away from its approved baseline.; Example: A technician turns off a security setting to fix a problem and never turns it back on.; ASD's definition: A change in the actual configuration of a system away from its approved baseline ASD, Essentials glossary; See also: Baseline configuration.
Control plane(management plane): The admin side of a cloud service: the portals, interfaces and settings used to set it up and run it.; Example: Whoever controls your cloud admin portal can change almost anything, so it needs strong protection.; ASD's definition: The interfaces and services used to configure, manage and administer cloud services, including administration portals, management APIs, automation interfaces and policy configuration layers ASD, Essentials glossary; See also: Tenant, Privileged environments.
Critical processes and services (domain): The core systems your organisation cannot do its main job without, and those that help keep people safe. In enterprise IT, ASD places it in priority phase 2.; Example: For a council, the rates and payments system. For a hospital, the patient records system.; ASD's definition: Core processes and services that are essential to delivering primary organisational outcomes or contributing to personnel health and safety. ASD, Essentials glossary; ASD's placement question: Does it directly deliver a primary organisational outcome or contribute to the health or safety of personnel or the community? ASD, Implementation planning guide; See also: Critical processes and services actions.
Cross-cutting (technology): A solution or control that works across many domains instead of just one.; Example: One central logging platform that collects events from every domain is cross-cutting.; ASD's definition: A solution, capability or control that applies across multiple domains rather than being specific to one. ASD, Essentials glossary; See also: Reusable pattern, Principle-focus approach.
Customer responsibility: A security duty that you, the customer, carry out and run yourself.; Example: Removing cloud accounts when staff leave.; ASD's definition: A cyber security responsibility implemented and operated by the customer. ASD, Essentials glossary; See also: Shared responsibility model, Who does what in the cloud.
Cyber threat: Anything that could harm your systems.; Example: A phishing campaign aimed at your staff, or a criminal group scanning for unpatched VPN gateways.; ASD's definition: Any circumstance or event with the potential to harm systems. ASD, Essentials glossary; See also: Threat intelligence, Threat modelling.

D

Detailed view: See Summary view and detailed view.
Domain: A group of business functions and assets that face similar risks. Domains set where each action applies, and they are logical groups, not network segments or teams.; Example: Three teams may run your directory, sign-in service and certificate authority. All three still belong in one domain: Identity services.; ASD's definition: Groupings of business functions and assets that share similar risks. ASD, Essentials glossary; See also: Technical domain, Capability domain, Scoping assets into domains.
Domain score: A domain's result as a percentage (our name for ASD's "% effective"). Fully effective principles score 1, partially effective 0.5 and not effective 0, averaged over the applicable principles. Not assessed principles get no score. ASD's example report lists them in their own column, and shows a domain with nothing assessed as N/A, not 0%.; Example: In ASD's example, 5 principles are fully effective, 4 partially effective and 1 not effective.; (5 × 1 + 4 × 0.5 + 1 × 0) ÷ 10 = 70%; In ASD's words: Each principle rating is assigned a score: not effective is scored 0, partially effective 0.5 and fully effective 1. The sum of the principle scores is divided by the number of applicable principles in the domain. ASD, Assessment process guide; See also: Principle rating, Summary view and detailed view, How domain scores work.
Domain-focus approach: Delivering the work one domain at a time, applying every principle that applies there. It is ASD's recommended default if you are just starting out, or lack the in-house skills to weigh the trade-offs confidently.; Example: Finish Boundary services, then start on Identity services.; ASD's definition: A method of implementing the framework in which the organisation selects a single domain and applies all applicable principles before moving to the next. ASD, Essentials glossary; See also: Principle-focus approach, Implementing the Essentials.

E

Endpoint (technology): A device staff use to get to your systems and data, such as a laptop, desktop or phone.; ASD's definition: A device used by personnel to access organisational systems and data. ASD, Essentials glossary; See also: User devices.
Evidence: Records that show an action is working, such as logs and test results. Start with evidence you already hold. Proof a control is switched on is not proof it works.; In ASD's words: Deployment is not effectiveness. Evidence that a control is configured or enabled does not prove it is achieving the intended outcome. ASD, Assessment process guide; See also: Evidence quality, Operational evidence, Evidence register.
Evidence quality: How well a piece of evidence shows that an action works, rated excellent, good, fair or poor. ASD calls these levels a guide, not a rule.; Example: A policy that says MFA is required is poor evidence. A test that tries to sign in without MFA and gets blocked is excellent, though one test may not cover a whole domain.; In ASD's words: Excellent evidence provides direct evidence that the action works as intended in the live environment. ASD, Assessment process guide; And at the other end: Poor evidence shows or asserts that the action exists but does not directly demonstrate that it is operating effectively or achieving its intended outcome. ASD, Assessment process guide; See also: Evidence, Assessment dimensions.
Evidence register: A working file, one per domain. For each applicable action it records how you meet it, what it covers, where the evidence is and your current self-assessed rating.; In ASD's words: Structured in this way, the register serves as the primary working paper for self-assessment, the evidence package for independent assessment and the supporting detail for security posture reporting. ASD, Implementation planning guide; See also: Evidence, Self-assessment, Independent assessment.
Exception: An approved, time-limited decision not to apply a control in full. Review every exception at each reassessment, because exceptions often let security slip.; Example: A legacy system cannot support modern sign-in, so an exception covers it until it is replaced next year.; In ASD's words: Exceptions, compensating controls and accepted risks are common sources of security posture degradation. Each should be reviewed as part of every reassessment. ASD, Implementation planning guide; See also: Exception register, Compensating control, Residual risk.
Exception register: A list of every exception, compensating control and accepted risk. For each one it records an owner, the approval, how it is reviewed and when it expires.; In ASD's words: At a minimum, the register should record named owners, approval details, review requirements and expiry dates. ASD, Implementation planning guide; See also: Exception, Compensating control.

F

Federation (identity): A trust link between identity systems, so a sign-in checked by one system is accepted by another.; Example: Staff sign in once with their work account and can then use a partner's portal without a second password.; ASD's definition: A trust relationship between identity systems that allows authentication and authorisation in one system to be recognised by another ASD, Essentials glossary; See also: Identity services.
Fully effective: The action clearly achieves its outcome across the whole domain, and you have enough evidence to show it.; Example: Every system in scope enforces phishing-resistant MFA for routine sign-ins, including from untrusted, external or high-risk locations. Customer-facing services offer a phishing-resistant MFA option, and emergency access is tested, reviewed and kept for emergencies only. Logs and tests show it working.; In ASD's words: The action is implemented in a way the demonstrably achieves the intended security outcome across the domain and is supported by sufficient evidence. ASD, Assessment process guide; See also: Action rating, Evidence.

G

Gap analysis: A domain-by-domain check of how far your current controls already cover each action. Each action is marked addressed, partially addressed or not addressed, which are planning labels, not ratings.; Example: The council finds phishing-resistant MFA covers the VPN, but its contractor portal still accepts a password alone. In Boundary services, IT.PRO-13.4 is partially addressed.; Implementation status: where the work on an action stands, which ASD says you may record during the gap analysis. Our suggestion: use these three labels for it.; In ASD's words: The purpose of a gap analysis is not to assign formal effectiveness ratings. For implementation planning purposes, each action is classified as addressed, partially addressed or not addressed. ASD, Implementation planning guide; In ASD's words: Organisations should record the effectiveness rating and implementation status in separate fields or columns within the assessment register. ASD, Implementation planning guide; See also: Addressed, Action rating, Evidence register, Running a gap analysis.
Governance and culture (domain): The policies, risk processes, roles and security culture behind your cyber security program. It is a capability domain and, in enterprise IT, spans every priority phase.; Example: Your cyber security strategy, risk register, policies and staff training program.; ASD's definition: The policies, risk management processes, roles, responsibilities and security culture that underpin the cyber security program. ASD, Essentials glossary; What ASD says it includes: Governance and culture includes cyber security strategies, policies and procedures, awareness and training programs, security roadmaps and risk registers. ASD, Implementation planning guide; See also: Capability domain, Governance and culture actions.

H

Hybrid environment: A mix of your own on-site systems and cloud services, run together as one environment.; Example: A council runs its own directory and file servers, some rented virtual servers and about 20 software-as-a-service apps.; Not in ASD's glossary: this meaning is ours.; Where ASD uses it: Where an organisation operates on-premises infrastructure, a hybrid environment or infrastructure-as-a-service, the enterprise IT chapter is the ideal starting point. ASD, Which chapter should I start with?; See also: Infrastructure-as-a-service, Software-as-a-service, Enterprise IT or cloud?

I

Identity services (domain): The services that decide who and what to trust: your directories, sign-in and access services, and credential stores. In enterprise IT, ASD places it in priority phase 1.; Example: Your directory servers, single sign-on service and the system that issues your digital certificates.; ASD's definition: Identity, credential and access management services including identity providers, directories, authentication and authorisation enforcement capabilities and credential stores. ASD, Essentials glossary; ASD's placement question: Does it anchor decisions about who and what to trust through authentication, authorisation or identity lifecycle functions? ASD, Implementation planning guide; See also: Federation, Non-person identity, Identity services actions.
Implementation status: See Gap analysis.
Independent assessment: An assessment by someone outside the team that runs the controls, who may spot gaps others no longer notice. ASD does not require it, but advises periodic ones, especially where you need external assurance.; In ASD's words: Where proportionate and affordable, organisations may choose to engage an independent assessor, but this is not required. ASD, Implementation planning guide; See also: Self-assessment, Reassessment cadence.
Independent OT authentication: Sign-in services run inside the OT environment, so OT does not rely on corporate or outside systems to let people in.; ASD's definition: Authentication services operated independently within the OT environment to reduce reliance on non-OT and external systems. ASD, Essentials glossary; See also: OT self-reliance, Identity services.
Indicators of good practice(IGPs): Short statements for each action that describe what not effective, partially effective and fully effective look like. They guide the assessor's judgement; they are not a checklist.; Example: For IT.PRO-13.4, ASD gives 4 not effective, 3 partially effective and 4 fully effective statements.; Key rule: if one not effective statement applies, the action is normally rated not effective.; ASD's definition: A set of statements used to inform expert judgement about whether an action should be rated not effective, partially effective or effective. ASD, Essentials glossary; See also: Action rating, Compensating arrangement, The indicators for IT.PRO-13.4.
Infrastructure-as-a-service(IaaS): Rented virtual servers, storage and networks that you set up and run yourself. You stay responsible for the operating systems, apps, sign-in systems and network you build on them.; Not in ASD's glossary: this meaning is ours.; Where ASD uses it: Where an organisation operates on-premises infrastructure, a hybrid environment or infrastructure-as-a-service, the enterprise IT chapter is the ideal starting point. ASD, Which chapter should I start with?; See also: Hybrid environment, Platform-as-a-service, Enterprise IT or cloud?
Integrations and connectors: The links that let a cloud service swap data with other systems, such as plug-ins, third-party apps and automated workflows.; ASD's definition: Interfaces and components that enable data exchange or functionality between cloud services and external systems, including APIs, third-party applications, plug-ins and automated workflows. ASD, Essentials glossary; See also: Tenant, Software-as-a-service.
Internet-facing (technology): Reachable from the public internet, either directly or through a controlled way in.; Example: Your public website, webmail and remote access portal.; ASD's definition: A system, service or component that is reachable from the public internet, either directly or through controlled ingress mechanisms, interfaces or integrations. ASD, Essentials glossary; See also: Boundary services, Attack surface.

L

Lateral movement: How an attacker spreads from the first system they break into to other systems in your network.; Example: An attacker takes over one laptop through a phishing email, then uses stolen passwords to reach a file server.; ASD's definition: The activity by which an adversary moves from a point of compromise to other systems within an environment. ASD, Essentials glossary; See also: User devices, Privileged environments.
Legacy (technology): Technology that its maker no longer supports.; Example: An old server operating system that no longer gets security updates.; ASD's definition: Any technology that is no longer supported by the manufacturer, developer or vendor ASD, Essentials glossary; See also: Compensating control, Exception.

M

Maturity level: The Essential Eight's way of measuring progress. In the Essentials, maturity levels are no longer implementation targets, and they do not line up directly with the priority phases.; In ASD's words: Maturity levels are no longer defined as implementation targets and do not correspond directly to the priority phases. ASD, Implementation planning guide; See also: Priority phase, Transitioning from the Essential Eight.
MITRE ATT&CK: A public catalogue of the tactics and techniques real attackers use, kept by the not-for-profit group MITRE. ASD maps most Essentials actions to it.; ASD's definition: A public knowledge base of adversary tactics and techniques based on observed real-world behaviour, maintained by the not-for-profit organisation MITRE ASD, Essentials glossary; See also: Techniques, ATT&CK mapping.
Multi-domain asset: An asset that does more than one job, so it goes in each domain it serves. Its actions may be rated differently in each, though evidence can be reused where it fits.; Example: In enterprise IT, an internet-facing customer app can sit in Boundary services (phase 1) and in Critical processes and services (phase 2).; In ASD's words: When an asset supports more than one domain it should be included in each relevant domain. ASD, Assessment process guide; See also: Domain, Scoping, Scoping assets into domains.

N

Non-person identity: An identity used by software, a service, a device or an automated task, not by a person.; Example: The service account a backup job uses to reach your file servers.; ASD's definition: A digital identity used by an application, workload, service, device or automated process rather than an individual. ASD, Essentials glossary; See also: Identity services, Asset categories.
Not assessed: A neutral rating: the action has not been checked yet, or there was not enough evidence to decide. Reports must always show it separately from not effective.; Example: A council still working on phase 1 records its phase 3 domains as not assessed.; In ASD's words: The action has not yet been assessed against the domain, or there was insufficient evidence to determine whether the intended security outcome is being achieved. This is a neutral rating that may reflect assessment scope, sequencing or a limitation encountered during the assessment. This rating must remain distinguishable from not effective in all reporting. ASD, Assessment process guide; See also: Action rating, Not effective.
Not effective: The action is missing, or in place but not delivering the outcome. Something can exist and still be not effective if it gives no real security benefit.; Example: MFA is switched on, but it sends codes by SMS where the action asks for phishing-resistant MFA.; In ASD's words: The action is absent or implemented in a way that does not achieve the intended security outcome for the assets in scope. An action may be present in some form and still be rated not effective if it delivers no meaningful security benefit. ASD, Assessment process guide; See also: Action rating, Indicators of good practice.

O

Offline licensing: Software licensing that keeps working when systems are offline, cut off from other networks, or unable to reach the vendor.; Example: Plant control software that keeps running if the internet link drops.; ASD's definition: A licensing approach that allows systems to operate offline or in air-gapped environments, or to continue operating when disconnected from external networks or vendor services. ASD, Essentials glossary; See also: OT self-reliance.
Operating context: The facts about your organisation that shape your scoping choices: legal duties, partners, stakeholders, risk appetite and budget.; Example: Whether a link to another agency counts as a boundary service can depend on your operating context.; In ASD's words: Before mapping assets, record the organisation's operating context, including regulatory obligations, international partnerships, stakeholder expectations, risk tolerance and appetite and the resources and funds available for cyber uplift. ASD, Implementation planning guide; See also: Scoping, Risk appetite, Scoping assets into domains.
Operational evidence: Evidence that a control keeps working over time, not just that it was installed. It comes from regular validation, sized to the action and your resources.; In ASD's words: Deployment evidence alone is insufficient to support or maintain an effective rating. ASD, Implementation planning guide; See also: Evidence, Active testing, Tools and active testing.
Operational technology(OT): Technology that watches or controls physical equipment and processes, such as industrial control systems.; Example: The systems that run the pumps at a water treatment plant, or a production line.; ASD's definition: Operational technology (OT) includes a broad set of technologies that covers process automation, instrumentation, cyber-physical operations, and industrial control systems (ICS). ASD, Essentials glossary; See also: Vital OT, Chapter, Which Essentials chapter applies to you?
OT self-reliance: Being able to keep critical services running using only what is inside the OT environment at the local site.; ASD's definition: The capability to operate critical services using localised, independent facility capabilities solely within the OT environment. ASD, Essentials glossary; See also: Independent OT authentication, Offline licensing.

P

Partially effective: The action is in place and gives a real benefit, but gaps in coverage, consistency or enforcement hold it back. Starting work or having a plan does not count.; Example: Phishing-resistant MFA protects some systems in scope, but not all of them.; In ASD's words: The action is in place and achieves the intended security outcome in part, but gaps in coverage, consistency or enforcement, limit its effectiveness across the domain. Partial activity alone, such as work commencing or a plan existing, is not partial effectiveness. ASD, Assessment process guide; See also: Action rating, Assessment dimensions.
Platform-as-a-service(PaaS): A cloud service where the provider runs the servers, platform and runtime, and you deploy and manage your own apps, data and settings on top.; ASD's definition: A cloud service model in which the provider operates the underlying infrastructure, platform and runtime capabilities, while the customer deploys and manages applications, data and service configurations. ASD, Essentials glossary; See also: Software-as-a-service.
Principle(cyber security principle): A security outcome your organisation should achieve, put into practice through its actions. Its aim stays the same in every chapter that uses it, though the actions can differ.; Example: The enterprise IT chapter has 28 principles. One is PRO-13 Identity, credential and access management.; ASD's definition: An enduring cyber security objective drawn from the ASD information security manual. ASD, Essentials glossary; See also: Action, Principle rating, PRO-13 and its actions.
Principle rating: A principle's rating in one domain: the lowest rating among its applicable actions there (ASD's weakest link rule). If too few actions have been assessed to decide, it is not assessed.; Example: Four actions are fully effective and two are partially effective, so the principle is partially effective.; In ASD's words: The principle rating is determined by the lowest applicable action rating. ASD, Assessment process guide; In ASD's words: Where the applicable actions for a principle have not been sufficiently assessed to determine a principle rating, the principle is recorded as not assessed for that domain. ASD, Assessment process guide; See also: Action rating, Domain score.
Principle-focus approach: Delivering the work one principle at a time, across several domains in priority phase order. It gives more even coverage and better value from organisation-wide tools.; Example: Apply PRO-13 Identity, credential and access management in the phase 1 domains first, then the phase 2 and phase 3 domains.; ASD's definition: A method of implementing the framework in which the organisation selects a cyber security principle and applies it across multiple domains. ASD, Essentials glossary; See also: Domain-focus approach, Reusable pattern.
Priority phase: A group of technical domains that ASD recommends you work on together, in order. Phases order domains, not single actions, and they do not measure how secure you are. Each chapter sets its own order. The OT chapter, for example, puts Critical processes and services in phase 1 and Identity services in phase 2, the reverse of enterprise IT.; Example: In enterprise IT, phase 1 is Boundary services and Identity services. Phase 2 is Critical processes and services and Privileged environments. Phase 3 is Business systems and User devices.; ASD's definition: A sequencing tier that groups domains to assist in prioritisation ASD, Essentials glossary; See also: Action sequencing, The enterprise IT phases, Implementing the Essentials.
Privileged environments (domain): The systems and tools used for admin work: where admins work from, and the tools that grant and control high-level access. In enterprise IT, ASD places it in priority phase 2.; Example: Admin workstations, jump servers (locked-down servers that admins must go through) and the console that manages your virtual servers.; ASD's definition: Systems and services that support privileged activities, management services, control planes and high-impact administrative functions. ASD, Essentials glossary; ASD's placement question: Does it enable, broker or govern elevated control over other systems? ASD, Implementation planning guide; See also: Break-glass account, Control plane, Privileged environments actions.
Project tranche: A stage of funding in the business case. ASD suggests tranches that mirror the priority phases, so leaders can see what each stage buys.; Example: In enterprise IT, tranche 1 might fund Boundary services and Identity services, and set up the two capability domains.; In ASD's words: ASD suggests structuring the investment ask in project tranches that mirror the priority phases. ASD, Implementation planning guide; See also: Priority phase, The ASD Essentials for boards and executives.
Provider-inherited responsibility: A security duty the cloud provider carries out and runs. You do not run it, but you check it through assurance, such as the provider's audit reports.; ASD's definition: A cyber security responsibility implemented and operated by the cloud service provider that the customer verifies through assurance. ASD, Essentials glossary; See also: Shared responsibility model, Who does what in the cloud.
Provider-supplied capability: A security feature the provider offers, but that you must turn on, set up and run.; Example: Audit logging that stays off until you enable it and send the logs somewhere useful.; ASD's definition: A security capability supplied by the cloud service provider that the customer must enable, configure and operate. ASD, Essentials glossary; See also: Shared responsibility model, Who does what in the cloud.

R

Reassessment cadence: How often you reassess each domain, on a regular schedule based on risk. Bring a reassessment forward after a major change or a relevant cyber security incident.; In ASD's words: Establish a regular, risk-based cadence for reassessing domains against the applicable principles and actions. ASD, Implementation planning guide; See also: Sustainment, Independent assessment.
Residual risk (cyber): The risk that is left after your controls are in place.; Example: Even with strong MFA, a small risk of account takeover remains. That leftover is residual risk.; ASD's definition: The cyber security risk that remains after controls have been applied. ASD, Essentials glossary; See also: Risk appetite, Exception.
Reusable pattern: A capability you design and document once, then reuse in each domain that needs it, in priority phase order.; Example: MFA, central logging and backups are among ASD's best candidates, because they apply in several domains.; In ASD's words: Organisations are encouraged to build cross-cutting capabilities as documented, repeatable patterns rather than as domain-specific projects. ASD, Implementation planning guide; See also: Cross-cutting, Principle-focus approach, Designing patterns.
Risk appetite: How much cyber security risk your organisation is willing to accept to reach its goals. Under the Essentials, your board or executive committee is accountable for setting, monitoring and adjusting it.; ASD's definition: The level of cyber security risk an organisation is willing to accept in pursuit of its objectives. ASD, Essentials glossary; See also: Risk assessment, Residual risk, The ASD Essentials for boards and executives.
Risk assessment (cyber): Finding your cyber risks, judging how likely and how serious each one is, and comparing them with your risk appetite.; ASD's definition: The process of identifying cyber security risks, analysing their likelihood and consequence, and evaluating them against the organisation’s risk appetite. ASD, Essentials glossary; See also: Risk appetite, Risk management.
Risk management (cyber): The ongoing cycle of finding, assessing, treating and monitoring cyber risks.; ASD's definition: The coordinated set of activities through which an organisation identifies, assesses, treats and monitors cyber security risks. ASD, Essentials glossary; See also: Risk assessment, Risk profile.
Risk profile: A snapshot of all the cyber risks your organisation faces at one point in time.; ASD's definition: A combined picture of cyber security risks an organisation is exposed to at a given point in time. ASD, Essentials glossary; See also: Risk management.

S

Sampling: Checking a representative selection of a domain's assets instead of every one. The plan must allow it, and the assessor records the sample and why it was chosen.; Example: A council checks 20 of its 400 laptops, picked from different sites and teams. ASD does not set a sample size.; In ASD's words: Where the assessment plan allows sampling, the assessor conducts the assessment on a representative selection of the domain’s assets rather than every asset in scope. ASD, Assessment process guide; See also: Assessment plan.
Scope statement: A versioned record of one domain's scope: assets by category, what you left out and why, assets shared with other domains, and gaps in what you can see.; In ASD's words: Issue a version-controlled scope statement for each domain that lists in-scope assets by category, exclusions with rationale, multi-domain assets and identified visibility gaps. ASD, Implementation planning guide; See also: Scoping, Asset categories.
Scoping: Deciding which of your real systems and assets belong in each domain.; Example: For Identity services, a council lists its two directory servers, its sign-in service and its certificate authority.; In ASD's words: Scoping translates the applicable chapter’s broad domains into named systems and assets that engineers can harden and assessors can examine. ASD, Implementation planning guide; See also: Scope statement, Multi-domain asset, Scoping assets into domains.
Self-assessment: An assessment your organisation does of its own environment. ASD's Assessment process guide is written for this, not for assessing suppliers or third parties, and does not replace your regulatory or compliance requirements.; In ASD's words: This guide supports organisations assessing their own cyber security environment. ASD, Assessment process guide; See also: Independent assessment, Evidence register, How the Essentials is assessed.
Sessions and tokens: What keeps you signed in to a cloud service after you log in. If an attacker steals one, they may get in without your password.; ASD's definition: Mechanisms used to maintain authenticated access to cloud services after a user, application or non-person identity has successfully authenticated. ASD, Essentials glossary; See also: Identity services, Non-person identity.
Shared responsibility model: The split of security duties between a cloud provider and you, its customer.; Example: With hosted email, the provider patches the servers. You manage who has an account and how they sign in.; ASD's definition: A model that defines how cyber security responsibilities are allocated between a cloud service provider and its customer. ASD, Essentials glossary; See also: Customer responsibility, Provider-inherited responsibility, Provider-supplied capability, Who does what in the cloud.
Software-as-a-service(SaaS): Cloud software the provider runs for you from top to bottom. You manage your users, data, access, links to other systems and settings.; Example: Hosted email, payroll or customer contact apps.; ASD's definition: A cloud service model in which the provider operates the application, platform and underlying infrastructure, while the customer manages its users, data, access, integrations and service configurations. ASD, Essentials glossary; See also: Platform-as-a-service, Tenant.
Summary view and detailed view: The two parts every assessment report must include. The summary view shows progress across the domains at a glance, but on its own it may hide risk.; Detailed view: names the principles and actions behind each result, and the fixes under way.; In ASD's words: The assessment report must include both a summary view and a detailed view. The summary view demonstrates progression over time, while the detailed view identifies the principles and actions driving each rating and any remediation activity in progress. ASD, Assessment process guide; See also: Domain score, Reporting an assessment.
Sustainment: Maintaining, reassessing and refining controls as threats, your organisation and the framework change. ASD makes it a planned part of the program, not something for after it ends.; In ASD's words: Sustainment is therefore a planned deliverable of the program, not what happens after it. ASD, Implementation planning guide; See also: Reassessment cadence, Exception.

T

Technical domain: One of the six domains that sort your technology by the job it does: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices. In enterprise IT, each one sits in a priority phase. Other chapters can order them differently.; Example: A firewall at the internet edge does a boundary job, so it goes in Boundary services.; In ASD's words: The six technical domains divide an organisation’s technology environment according to the functions it performs, rather than according to specific technologies or organisational structures. ASD, Implementation planning guide; See also: Capability domain, Priority phase, Scoping assets into domains.
Techniques (MITRE ATT&CK): The specific methods attackers use to reach a goal, as listed in MITRE ATT&CK.; Example: Guessing passwords is one way to get into an account.; ASD's definition: A representation of how an adversary achieves a tactical goal by performing an action ASD, Essentials glossary; See also: MITRE ATT&CK, ATT&CK mapping.
Technology-agnostic: Describing what must be done without requiring a particular vendor, product or architecture. You choose the tools that suit your environment.; Example: An action can ask for phishing-resistant sign-in without saying which brand of security key to buy.; ASD's definition: A description of what must be done without mandating a specific vendor, product or architecture ASD, Essentials glossary; See also: Action.
Tenant: Your organisation's own walled-off space inside a cloud service. It holds your users, data, settings and links to other systems.; ASD's definition: A logically separated instance or administrative boundary of a cloud service that contains an organisation’s users, data, configurations and integrations. ASD, Essentials glossary; See also: Control plane, Software-as-a-service.
Threat intelligence (cyber): Information about threats, attackers and their methods that has been gathered, analysed and put in context, so you can make decisions.; Example: An advisory that a group targeting councils is exploiting a common remote access product.; ASD's definition: Information about cyber threats, threat actors and adversary techniques that have been collected, analysed and contextualised to support decision making. ASD, Essentials glossary; See also: Cyber threat, ATT&CK mapping.
Threat modelling: A structured way to work out which threats matter for a system, a function or your whole organisation.; Example: Before launching an online payments portal, you list who might attack it, how, and what they would want.; ASD's definition: A structured activity to identify the threats relevant to a system, function, or organisation. ASD, Essentials glossary; See also: Cyber threat, Risk assessment.

U

User devices (domain): The devices staff use to reach your systems and data, such as desktops and laptops. In enterprise IT, ASD places it in priority phase 3.; Example: A laptop used for normal work is a user device. If someone also does admin work on it, it belongs in Privileged environments too.; ASD's definition: Endpoints used by personnel to access organisational systems, cloud services and data, including desktops and laptops. ASD, Essentials glossary; ASD's placement question: Does it provide the general workforce with direct access to the environment? ASD, Implementation planning guide; See also: Endpoint, User devices actions.

V

Visibility and response (domain): How you spot, look into and respond to cyber security events and incidents. It is a capability domain and, in enterprise IT, spans every priority phase.; Example: Your asset register, your logging and detection tools, and your incident response plan.; ASD's definition: The procedures and capabilities to detect, analyse and respond to cyber security events and incidents. ASD, Essentials glossary; What ASD says it includes: Visibility and response includes asset registers, incident response plans and procedures, and detection and response platforms. ASD, Implementation planning guide; See also: Capability domain, Visibility and response actions.
Vital OT: The OT systems you cannot afford to have offline for long, because you need them to keep a safe, minimum service running.; ASD's definition: Vital OT are the subset of critical systems that are unacceptable to have offline for an extended period, from the perspective of the safe provision of a minimum viable product. ASD, Essentials glossary; See also: Operational technology, OT self-reliance.

W

Weakest link rule: ASD's name for how a principle is rated: one weak action holds back the whole principle.; In ASD's words: A material gap in one action can therefore limit the effectiveness of the principle within that domain. ASD, Assessment process guide; See also: Principle rating.

Frequently asked questions

Are priority phases the same as maturity levels?

No. Priority phases set the order for tackling the technical domains, and ASD says Essential Eight maturity levels do not correspond directly to them. Our guide Transitioning from the Essential Eight covers this in full.

Sources

The ASD publications this page explains.

Everything else on this page is written by Control Stack.

ASD Essentials glossary.

A to Z

A

B

C

D

E

F

G

H

I

L

M

N

O

P

R

S

T

U

V

W

Frequently asked questions

Sources

Control status

New task