GOV-09 · Govern

Security risk management responsibilities

Cloud actions

• Action 1

  Adoption of high-risk SaaS or PaaS services that store sensitive data or support critical business functions requires executive approval.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 2

  SaaS or PaaS platforms that organisations configure, monitor, assure or operate, express security requirements as a condition of use.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 3

  Shared responsibility arrangements for cloud services are understood, documented and incorporated into security risk management activities

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Govern principles

• GOV-01Executive cyber security accountability
• GOV-03Security risk management assurance
• GOV-04Cyber security resourcing
• GOV-07Continuous cyber security improvement
• GOV-08Executive artificial intelligence accountability
• GOV-10System exposure minimisation
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Source: ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.