Essentials for cloud
IDE-01 Asset identification
Keep an up-to-date record of your cloud services, tenants (your own instances of a service), integrations, identities, data and regions, including short-lived assets. Use an approved inventory with automated discovery to spot new and changed items. Promptly bring all approved and unapproved services, tenants and integrations under your governance.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Use an approved asset inventory mechanism that supports automated discovery to detect new and changed non-physical assets including short-lived containers and virtual machines.
In plain English: Use an approved asset inventory tool that supports automated discovery. Use it to spot new and changed non-physical assets, including short-lived containers and virtual machines.
- Domains
- Visibility and response
- Who does it
- PaaSCustomer
- SaaSSupplied
Action 2 of 3
Identify sanctioned and unsanctioned services, tenants and integrations and promptly bring them under organisational governance.
In plain English: Find approved and unapproved services, tenants and integrations. Promptly bring them under your organisation's governance.
- Domains
- Visibility and response
- Who does it
- PaaSCustomer
- SaaSSupplied
Action 3 of 3
Maintain current records of identities, non-person identities, integrations, data and cloud regions, using automated discovery where available to detect new and changed assets.
In plain English: Keep current records of human and non-person (software) identities, integrations, data and cloud regions. Use automated discovery where available to spot new and changed assets.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Cloud Service Dashboard
- Cloud Service Discovery
- Unused/Unsupported Cloud Regions
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.