Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

GOV-09 Security risk management responsibilities

three actionsNot in enterprise IT

Executives must approve high-risk software-as-a-service (SaaS) or platform-as-a-service (PaaS) holding sensitive data and business functions before adoption. Where you can configure, monitor, assure and operate a platform, make security requirements a condition of use. Record which security work you and each provider do. Build that into security risk management.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Security risk management responsibilities for an organisation and their suppliers, partners and customers, including any shared responsibilities, are documented and communicated to all relevant parties with accountability arrangements in place to ensure their effective implementation.

ASD, Information Security Manual (ISM), Principle GOV-09

The three actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 3

    Adoption of high-risk SaaS or PaaS that stores sensitive data and business functions require executive approval before adoption.

    In plain English: Some high-risk SaaS or PaaS services hold sensitive data and business functions. Get executive approval before adopting them.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  2. Action 2 of 3

    SaaS or PaaS platforms where organisations can configure, monitor, assure and operate ensure security requirements are expressed as a condition of use.

    In plain English: Some SaaS or PaaS platforms let you configure, monitor, assure and operate them. For these, state your security requirements as a condition of use.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  3. Action 3 of 3

    Shared responsibility arrangements for cloud services are understood, documented and incorporated into security risk management activities.

    In plain English: Understand and write down which security work you do and which the provider does for your cloud services. Build this into your security risk management.

    Domains
    Governance and culture
    Who does it
    PaaSSupplied
    SaaSSupplied

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.