Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

IDE-04 Security risk identification

one actionAlso in ASD Essentials for enterprise IT

Base your risk assessments on the relevant weaknesses, the techniques attackers use and how cyber threats behave. Keep reviewing these inputs so your view of risk stays current.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions.

ASD, Information Security Manual (ISM), Principle IDE-04

The action

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 1

    Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.

    In plain English: When you assess risk, identify the weaknesses, attacker techniques and cyber threat behaviours that apply. Keep reviewing these inputs all the time.

    Domains
    Visibility and response
    Who does it
    PaaSCustomer
    SaaSCustomer

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.