ASD Essentials: Where to start

Your first 90 days with ASD Essentials 

So you've read about the launch of the ASD Essentials, maybe skimmed our transition guidance, and now you're staring at a framework with eight domains, three chapters, a stack of supporting guides and a rating system that wants evidence for everything.

Where do you actually begin?

The good news is that the Australian Signals Directorate has thought about this. The framework comes with a built-in order of work, and you're not expected to do everything at once. Here's how we'd approach your first few months.

First, find your starting point

Where you begin depends on where you're coming from:

Step 1: Take a breath

There's no transition deadline yet. ASD is working with regulators on timeframes and will advise in due course. Any obligation that names the Essential Eight still stands, so keep meeting it.

This gives you time to do ASD Essentials properly. Use it.

Step 2: Pick your chapter, or chapters

Many organisations will need more than one chapter. ASD's Which chapter should I start with?  suggests working through four questions:

1. What do you operate? List your technology environments and how they connect, because a compromise in one often leads into another.
2. What are you required to do? If a regulation or contract applies to one environment, that's a logical place to start. Just remember an obligation sets a minimum, not your order of priority.
3. Where's your biggest gap? OT systems often carry the most technical debt, because they stay in service for decades.
4. Where's your greatest risk? Start where a compromise would be both likely and costly.

One rule applies to every chapter: outsourcing a service doesn't outsource the accountability. If a provider delivers part of an action, you still need evidence that it's happening.

Step 3: Get your executives on board early

ASD Essentials puts executive accountability front and centre, in its own Governance and culture domain. This isn't something IT can sort out in the background on its own.

ASD has written The Essentials for senior executives for exactly this conversation. A few questions worth putting to your leadership team:

• What did our Essential Eight or ISO 27001 investment buy us under ASD Essentials, and what's genuinely new work?
• Which of our most important functions and assets sit in each domain?
• Who is accountable at executive level, and are they resourced to deliver?
• How often do we want to see progress, and in what format?

Getting these answers early saves a lot of awkward conversations later.

Step 4: Work out what you've actually got

You can't rate an action in a domain until you know what's in the domain. ASD has published asset scoping guides for enterprise IT and cloud to help.

Start with your existing asset register, then map assets and business functions into domains. Don't forget the less obvious ones:

• Suppliers and cloud providers that deliver parts of your services
• AI tools and services, including the models, data, connectors and the non-human identities AI agents use. ASD's AI considerations within the Essentials treats these as assets like any other
• Legacy systems that everyone's afraid to touch 

A domain is a logical grouping, so one system can sit in more than one. That's fine, and you only implement each action on it once.

Step 5: Start with phase 1

For enterprise IT and cloud, phase 1 covers Boundary Services and Identity Services, plus the two capability domains, Governance and Culture and Visibility and Response. (OT swaps Identity services for Critical processes and services in phase 1.)

Boundary and identity come first because they're how most attackers get in. Strong identity also underpins everything that comes after.

Resist the urge to work on every domain at once. ASD specifically warns against it, and it's the fastest route to a program that's half-finished everywhere.

Step 6: Check for the common traps

Advisory firms reviewing ASD's implementation guidance have pointed out a few practices that score badly whatever else you've done. Some quick checks for your phase 1 work:

• Multi-factor authentication that relies on SMS, voice or push-only approvals is reported to rate as not effective. Phishing-resistant methods are the goal.
• Standing privileged access, where admins have permanent high-level rights, rates as not effective too (break-glass accounts aside).
• Shared local administrator credentials are another not-effective practice.
• An incident response plan you haven't tested is partially effective at best.
• Backups that share your production identity platform are capped at partially effective.

If any of these sound familiar, you've found your first priorities.

Step 7: Plan your evidence from day one

Under ASD Essentials, no evidence means not assessed. Assessors look at four things:

• Coverage: does the control apply to everything in scope?
• Consistency: does it work the same way every time?
• Currency: is the evidence recent?
• Quality: is it a system-generated record, or a screenshot someone took last March?

Think about what evidence each action needs before you implement it, and set up a regular schedule to collect it. It's much easier than hunting for proof the week before an assessment.

Step 8: Report by domain and keep going

ASD recommends reporting progress by domain, so your executives can see where you're strong and where you need work. Set a reassessment cycle, move into phase 2 when phase 1 is in good shape, and keep your evidence fresh as you go.

Remember, "we've reached phase 2" tells people where you're working. Your effectiveness ratings tell them how well it's going.

How de.iterate can help

de.iterate gives you one place to plan, run and prove your ASD Essentials program:

• Scope with confidence. Keep your assets, suppliers and AI tools in connected registers, ready to map into domains.
• Work in phase order. Turn ASD Essentials actions into scheduled Assurance Tasks with clear owners and due dates, starting with phase 1.
• Collect evidence as you go. The Evidence Store links each piece of evidence to the action it supports, so coverage, consistency and currency are easy to show.
• Bring your executives along. Custom dashboards show progress by domain, in a format your board can read in minutes.
• Cover the governance domain. Policies, supplier assurance and AI governance all sit in the same platform, with nothing extra to bolt on.
• Talk to real people. Our Aussie GRC experts can help you choose your chapter, scope your assets and plan your first 90 days.

Book a demo and let's get your ASD Essentials ducks in a row.