ASD Essentials for enterprise IT actions

Defines and regularly reviews formal executive and board accountability for cyber security, including setting, monitoring and adjusting how much risk to accept.

Gives a named executive ongoing accountability for how the organisation uses, governs and manages the risks of artificial intelligence (AI).

Assigns enough skilled staff and resources to introduce, run, watch, maintain and retire security controls, and writes security duties into role descriptions.

Checks on a set cycle that security staff, skills, tools and funding still match threat trends, lessons from incidents and organisational changes.

Maintains an approved method and plan, and uses them to rate each cyber security risk, choose a response and carry it out.

Checks each supplier's cyber security risk before taking them on, looks harder at riskier suppliers, and keeps evidence supporting the decision.

Keeps up-to-date proof that suppliers still meet their security promises, and acts when that proof lapses or a supplier's risk changes.

Finds old and unsupported technology, judges its risk, and adds extra safeguards, closer monitoring and checks until it is removed or replaced.

Uses an approved inventory tool that automatically discovers new and changed assets, physical and non-physical, such as devices, software and cloud services.

Keeps current, accurate records of infrastructure, operating systems, applications, user and system accounts, credentials (such as keys and certificates) and data.

Factors the weak spots, attacker methods and behaviours relevant to the organisation into every risk assessment, and reviews them continually.

Designs systems securely so they log security events by default, enforce authorised access, protect data, and keep privileges, services and features minimal.

Builds, deploys and changes systems through secure, controlled processes with testing and approval, so security controls are applied consistently across systems.

Confirms software, components and updates are genuine and unchanged before use, and checks where they came from when suppliers give proof.

Watches vendor warnings and threat reports for suppliers, products or components exposed to compromise, and acts as fast as the risk requires.

Finds and switches off or deletes built-in and unused accounts regularly, keeping any only if documented, justified, locked down and monitored.

Keeps passwords, keys, tokens and other secrets in an approved secure store, with tight access controls and multi-factor sign-in.

Scans code, settings files, shared drives and collaboration tools regularly for exposed passwords, keys and other secrets, then changes or cancels them.

Requires users to sign in to systems with multi-factor authentication that fake sites cannot trick, including from untrusted, external or high-risk locations.

Switches off older, weaker sign-in methods, and puts limits, monitoring, extra safeguards and a removal date on any that must stay.

Gives every account its own password or key on each system, never shared or reused, especially for accounts with admin rights.

Reviews each account's access on a set cycle and updates it to match current roles, duties and business needs.

Lets only authorised admin roles create, change or delete accounts and roles, or use admin functions and applications.

Gives every account, whether used by staff, admins, apps or systems, only the minimum access its defined tasks need.

Restricts admin work to dedicated, locked-down computers or environments kept apart from everyday email, web browsing and other user tasks.

Switches on admin access only when needed, after a fresh identity check, and switches it off automatically after a set time.

Records every admin or management change to systems, settings and security controls, showing who made it, when and what it changed.

Defines approved settings per system type that switch off unneeded services, risky options and weak protocols, based on vendor and industry advice.

Puts the approved secure settings on every system, including infrastructure, operating systems and applications, and confirms this with technical checks.

Finds and fixes drift from approved settings with scheduled checks and, where supported, automated monitoring, checking critical or fast-changing systems more often.

Finds known software flaws and weak settings on all systems through ongoing, repeatable checks, including vulnerability scans and reviews of security advisories.

Applies security patches and updates within set deadlines based on risk, or automatically where the impact on operations is low.

Fixes security weaknesses rated above the organisation's risk limit, or adds safeguards, by risk-based deadlines, then checks the risk really dropped.

Lets only supported, checked and approved software run on systems, keeping exceptions rare, signed off, time-limited, watched and regularly reviewed.

Lets only approved admin and management tools run, and only from authorised places such as a dedicated admin computer or protected folder.

Backs up important data, apps and settings on a set schedule to encrypted storage that attackers cannot change or delete.

Keeps backups separate from staff computers and live systems, so anyone who breaks into those cannot reach, change or delete them.

Tests backups and restore steps regularly to prove backups work and can meet defined targets for downtime and data loss.

Isolates systems in network zones by importance and trust, and watches traffic in and out, allowing only explicitly approved routes and services.

Limits connections between and within network segments to explicitly approved routes and services matching business need and trust, stopping intruders roaming freely.

Checks what leaves the organisation, by email, web upload or other routes, to spot sensitive or high-value data sent without approval.

Blocks systems from connecting out to websites and servers known to be dangerous or untrusted.

Checks content coming in from outside or untrusted sources, and stops anything harmful before it is delivered.

Gives everyone cyber security training suited to their role before they get access to the organisation's systems and data.

Keeps cyber security training up to date with current threats and how people work, and keeps everyone trained.

Keeps event logs safe from being read, changed or deleted without approval, with encryption and locked-down logging systems and accounts.

Sends key security logs and setting changes from network gear, servers, computers and apps to one central store.

Keeps event logs in one central store only approved staff can open and no one can tamper with.

Keeps watching and analysing how software runs on systems, to catch attackers misusing legitimate tools and utilities, such as built-in admin tools.

Puts logs in one format and on one trusted clock, adding details like account type, so events can be matched across systems.

Sets rules to alert on unapproved changes, odd sign-ins and suspicious programs, and keeps them tested and tuned.

Checks each security alert and event quickly to decide whether it meets the organisation's threshold for a cyber security incident.

Spots cyber security incidents by linking clues from accounts, apps, data and systems, rather than relying on one alert alone.

Reviews security monitoring coverage regularly to find blind spots left by new systems, new services or changes to system design.

Builds every duty to tell or work with outside parties into the steps people follow in an incident.

Handles incidents with written, tested and approved response procedures, rather than steps made up under pressure.

Reviews each incident that meets the organisation's severity threshold to find the security gaps that let each stage of the incident happen.

Checks monitoring coverage and incident response procedures after each incident, and improves them where they fell short.