PRO-08 · Protect

Cryptographic protection

Cloud actions

• Action 1

  Ensure data in transit and at rest is protected using best practice cryptographic algorithms and protocols, with weak or deprecated options disabled.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 2

  Manage cryptographic keys securely throughout their lifecycle, including generation, validation, storage, rotations and revocation.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Supplied, SaaS: Provider
  Rate this action in the Navigator →
• Action 3

  Retain customer control over the keys protecting the organisations most sensitive data, including the ability to revoke provider access.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.