ASD Essentials
Chapter catalogue
ASD Essentials for cloud: principles and actions.
Every principle and action in ASD's Essentials for cloud, quoted as published, with what each one means in plain English. Open a principle to see its actions.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
At a glance
- principles
- 30
- actions
- 78
- principles not in enterprise IT
- 2
- domains
- 8
The 30 principles
Each principle is a security outcome from ASD's Information Security Manual (ISM). Under it, the chapter sets out the actions that achieve it for cloud services. Our cloud guide explains the chapter as a whole.
- Not in enterprise IT
- Also in enterprise IT
Govern7
- GOV-01 Executive cyber security accountability1 action
- GOV-03 Security risk management assurance1 action
- GOV-04 Cyber security resourcing2 actions
- GOV-08 Executive artificial intelligence accountability2 actions
- GOV-09 Security risk management responsibilities3 actions (not in enterprise it)
- GOV-11 Supplier cyber security assurance5 actions
- GOV-14 Legacy system management1 action
Identify2
Protect13
- PRO-01 Secure system lifecycle3 actions
- PRO-04 Secure configuration management3 actions
- PRO-05 Secure administration3 actions
- PRO-06 Vulnerability management5 actions
- PRO-07 Trustworthy software3 actions
- PRO-08 Cryptographic protection3 actions (not in enterprise it)
- PRO-09 Content filtering3 actions
- PRO-10 Regular and proven backups5 actions
- PRO-12 Least privilege access3 actions
- PRO-13 Identity, credential and access management8 actions
- PRO-14 Cyber security awareness training2 actions
- PRO-16 Cyber supply chain security4 actions
- PRO-18 Network segmentation and segregation1 action
Detect5
Respond3
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
Everything else on this page is written by Control Stack.