PRO-16 Protect

Cyber supply chain security

Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.

Enterprise IT actions

IT.PRO-16.1

Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- No verification of software, component or update integrity or authenticity is performed before introduction into systems.
- Verification outcomes are not recorded or available for review.
- Where verification cannot be performed, no compensating control or remediation paths are documented.
Partially effective
- Verification is performed for some categories of software but not consistently across operating systems, applications, firmware and dependencies.
- Integrity or provenance checks are performed, but they do not provide sufficient assurance for all software, components or updates.
- Verification outcomes are recorded for some software, components or updates prior to being introduced into systems, but not consistently.
- Compensating controls exist for some unverifiable components but are not formally approved or time-bound.
Fully effective
- Verification of integrity and provenance is performed for software, components and updates across all relevant categories, and provenance is verified where suitable supplier evidence is available.
- Verification uses one or more mechanisms appropriate to the software, component, update and source to provide reliable assurance of integrity and provenance.
- Verification outcomes are recorded and available for review.
- Where verification cannot be performed, compensating controls are applied, exceptions are time-bound and remediation paths are documented.
Related frameworks

ISM
ISM-1790, ISM-1791, ISM-1792, ISM-2027, ISM-2055
NIST CSF 2.0
GV.SC-06, PR.PS-02
NIST SP 800-171r3
03.17.03, 03.04.08
AESCSF v2
ARCHITECTURE-4g, THIRD-PARTIES-2j, ARCHITECTURE-4e, ASSET-4e
MITRE ATT&CK
T1195 Supply Chain Compromise, T1505 Server Software Component

Rate this action in the Navigator
IT.PRO-16.2

Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
ASD’s indicators

Not effective
- No monitoring is performed for indicators of supply chain compromise affecting software, components or services in use.
- Vendor security notifications and threat advisories are not reviewed or actioned.
- When supply chain compromise is identified, neither containment nor investigation is performed.
- Supply chain compromise events are integrated into neither incident response nor risk management.
Partially effective
- Monitoring occurs but does not draw on relevant threat intelligence sources or does not cover all in-scope systems.
- Notifications and advisories are reviewed but exposure assessment and response are not conducted in a timely manner.
- Containment occurs but investigation for evidence of exploitation is not consistently undertaken.
- Some integration exists but findings are not reflected in the risk register or incident response procedures.
Fully effective
- Monitoring covers software, components and services in use, drawing on relevant threat intelligence sources.
- Vendor security notifications and threat advisories are reviewed, exposure is assessed and response actions are initiated within defined timeframes.
- Identified supply chain compromises are responded to in timeframes defined by the organisation.
- Supply chain compromise events are integrated with incident response and reflected in the risk register.
Related frameworks

ISM
ISM-2116
NIST CSF 2.0
ID.RA-02, DE.CM-09, DE.CM-06
NIST SP 800-171r3
03.17.03
AESCSF v2
THIRD-PARTIES-2f
MITRE ATT&CK
T1195 Supply Chain Compromise, T1505 Server Software Component

Rate this action in the Navigator

Operational technology actions

Action 1

Identify, test and resolve third-party dependencies that would fail under isolation, including licensing, activation, updates, supplier support, and licences coupled to physical hardware identifiers.
- Phase 1Boundary services, Critical processes and services
- Phase 2Privileged environments, Identity services
Rate this action in the Navigator
Action 2

Verify the integrity and provenance of assets, software, components and updates before they are introduced into the OT environment, and record the origin and handling history of new, repaired and serviced assets.
- Phase 1Boundary services, Critical processes and services
- Phase 2Privileged environments, Identity services
- Phase 3Business systems
Rate this action in the Navigator

Cloud actions

Action 1

Assess and approve applications, integrations and consent grants before permitting access, and review them on a regular basis.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 2

Assess the integrity and authenticity of images, components and artefacts before they are deployed into services, and verify provenance where suitable supplier evidence is available.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
- ResponsibilityPaaS: Supplied, SaaS: Provider
Rate this action in the Navigator
Action 3

Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Supplied, SaaS: Supplied
Rate this action in the Navigator
Action 4

Identify and mitigate single points of dependency created by OAuth and federated identity providers.
- Phase 1Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator

Open the Navigator

More Protect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.