PRO-01 Protect

Secure system lifecycle

Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices.

Enterprise IT actions

IT.PRO-01.1

Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- Systems are deployed with default configurations and no evidence of security design considerations.
- Unnecessary services, protocols or functionality remain enabled with no documented rationale.
- Security telemetry is not enabled or is not considered as part of system design.
Partially effective
- Security is considered during system design but not consistently applied across all assets.
- Some unnecessary services have been disabled but a systematic review has not been completed.
- Security telemetry is partially enabled but gaps in coverage exist.
Fully effective
- Systems are designed and deployed with exposed services limited, required and default permissions minimised, data protections in place, authorised access enforced, and only required functionality enabled.
- Security telemetry is enabled by default.
- Evidence exists that security design decisions are recorded and reviewed during system changes.
Related frameworks

ISM
ISM-0041, ISM-0380, ISM-1409, ISM-2021
NIST CSF 2.0
PR.AA-05, PR.DS-01, PR.DS-02, PR.PS-01, PR.IR-01
NIST SP 800-171r3
03.16.01, 03.01.05, 03.04.06, 03.13.01, 03.13.08
AESCSF v2
ARCHITECTURE-1c, ARCHITECTURE-3c, ARCHITECTURE-3d, ARCHITECTURE-1g
Essential Eight
Restrict administrative privileges
MITRE ATT&CK
T1190 Exploit Public-Facing Application, T1078 Valid Accounts, T1021 Remote Services, T1068 Exploitation for Privilege Escalation

Rate this action in the Navigator
IT.PRO-01.2

Secure build and deployment processes to enforce controls consistently across systems.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- No controlled build or deployment process exists for applicable assets.
- Changes to systems are applied ad hoc, without any version control, testing or approval.
Partially effective
- A controlled deployment process exists but is not consistently followed for all changes.
- Version control is in place but pre-deployment security verification is not performed.
Fully effective
- A controlled build and deployment process is in place and consistently followed.
- Configuration changes are subject to version control, testing and approval before deployment.
- Security controls are confirmed to be implemented consistently across systems following deployment processes.
Related frameworks

ISM
ISM-1211, ISM-1409, ISM-1635, ISM-1914
NIST CSF 2.0
PR.PS-01, PR.PS-02, PR.PS-03, DE.CM-09
NIST SP 800-171r3
03.04.01, 03.04.02, 03.04.03, 03.16.01
AESCSF v2
ASSET-3b, ASSET-3c, ARCHITECTURE-3e, ASSET-4e

Rate this action in the Navigator

Operational technology actions

Action 1

Design, size and configure new network devices so that network traffic capture can be enabled without a subsequent configuration change.
- Phase 1Boundary services, Critical processes and services
- Phase 2Privileged environments, Identity services
Rate this action in the Navigator
Action 2

Sanitise and securely dispose of hardware, including devices returned to a supplier for maintenance, using trusted onsite or domestic disposal services.
- Phase 1Boundary services, Critical processes and services
- Phase 2Privileged environments, Identity services
- Phase 3Business systems
Rate this action in the Navigator

Cloud actions

Action 1

Develop and use a controlled process to onboard, configure and exit services, verifying data retrieval, deletion and access revocation.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Supplied, SaaS: Supplied
Rate this action in the Navigator
Action 2

Harden development pipelines and their credentials, restricting who can approve and deploy changes to production.
- Phase 1Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
- ResponsibilityPaaS: Supplied, SaaS: Provider
Rate this action in the Navigator
Action 3

Identify and remediate vulnerable third-party libraries and dependencies before deployment and on an ongoing basis.
- Phase 1Boundary services
- Phase 2Critical processes and services
- Phase 3Business systems
- ResponsibilityPaaS: Customer, SaaS: Provider
Rate this action in the Navigator

Open the Navigator

More Protect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.