Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

GOV-03 Security risk management assurance

one actionAlso in ASD Essentials for enterprise IT

Use an approved method and plan for assessing and treating risk, and keep it current. It must cover cyber security risks and the risks of sharing security work with your providers.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.

ASD, Information Security Manual (ISM), Principle GOV-03

The action

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 1

    Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security and shared responsibility risks.

    In plain English: Keep an approved, current risk management method and plan. Use it to assess and treat cyber security risks and the risks of sharing security work with providers.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.