ASD Essentials for cloud

For organisations whose technology environment runs entirely on software-as-a-service and platform-as-a-service.

Domains and priority phases

Priority phases set ASD’s recommended order of work.

Every phase

• Governance and culture

  Policies, risk management processes, roles and security culture that underpin cyber security program.

  Unclear ownership and accountability can lead to inconsistent security decisions and outcomes degrading over time.

• Visibility and response

  Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents.

  Limited visibility and response can delay the detection, analysis and containment of intrusions.

Phase 1

• Identity services

  Identity, credential and access management services such as identity providers, authentication and authorisation enforcement solutions or credential stores.

  Compromise of identity services can enable an adversary to gain persistent or privileged access to cloud services and organisational data.

• Boundary services

  Systems and services that broker connectivity and data flows between SaaS and PaaS services and external or cross-domain environments, including integrations, APIs, gateways, internet-facing services and remote access.

  Boundary services expose cloud services, APIs and integrations to external environments, making them frequent targets for scanning, exploitation and initial access.

Phase 2

• Critical processes and services

  Core processes and services that are critical to delivering primary organisational outcomes.

  Compromise or loss of these systems can disrupt the organisation's ability to deliver critical outcomes or services.

• Privileged environments

  Systems and services that support privileged activities, management services and high-impact administrative functions. Including SaaS administration interfaces, PaaS management and deployment services and cloud control-plane capabilities used to configure, monitor and manage services.

  Compromise of privileged systems can give an adversary extensive control over systems, services and security controls.

Phase 3

• Business systems

  SaaS and PaaS services that support enterprise functions and collectively enable organisational operations, including business applications, workflow platforms, data services and custom applications hosted on managed platform services.

  Business systems support day-to-day operations and can provide malicious actors with pathways to high-value services, identities and data.

• User devices

  Endpoints used by the workforce to access SaaS and PaaS services, including desktops, laptops and mobile devices.

  User devices are widely distributed and frequently provide malicious actors with an initial foothold into more critical systems.

Principles

Govern

• GOV-01Executive cyber security accountability
• GOV-08Executive artificial intelligence accountability
• GOV-04Cyber security resourcing
• GOV-09Security risk management responsibilities
• GOV-03Security risk management assurance
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Identify

• IDE-01Asset identification
• IDE-04Security risk identification

Protect

• PRO-14Cyber security awareness training
• PRO-06Vulnerability management
• PRO-13Identity, credential and access management
• PRO-01Secure system lifecycle
• PRO-16Cyber supply chain security
• PRO-12Least privilege access
• PRO-05Secure administration
• PRO-04Secure configuration management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-10Regular and proven backups
• PRO-18Network segmentation and segregation
• PRO-09Content filtering

Detect

• DET-01Centralised event logging
• DET-02Cyber security event detection
• DET-03Cyber security incident identification
• DET-05Detection capability efficacy
• DET-04Baseline high-risk access activities

Respond

• RES-05Cyber security incident coordination
• RES-03Cyber security incident response
• RES-04Cyber security incident insights

Open the Navigator →

Source: ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.