Essentials for cloud
PRO-01 Secure system lifecycle
Use a controlled process to start, configure and leave cloud services. Check that your data is retrieved and deleted and that access is removed. Lock down development pipelines and their credentials, limit who can approve and deploy to production, and find and fix vulnerable third-party code before and after deployment.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Develop and use a controlled process to onboard, configure and exit services, verifying data retrieval, deletion and access revocation.
In plain English: Create and use a controlled process to start using, configure and exit services. It must check that data is retrieved and deleted and access is removed.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Valid Accounts
- Trusted Relationship
Action 2 of 3
Harden development pipelines and their credentials, restricting who can approve and deploy changes to production.
In plain English: Lock down your development pipelines (the tools that build and release code) and their credentials. Limit who can approve and deploy changes to production.
- Domains
- Identity services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Supply Chain Compromise
- Valid Accounts
- Account Manipulation
Action 3 of 3
Identify and remediate vulnerable third-party libraries and dependencies before deployment and on an ongoing basis.
In plain English: Find and fix vulnerable third-party libraries and dependencies (outside code your apps rely on). Do this before deployment and on an ongoing basis.
- Domains
- Boundary services
- Critical processes and services
- Business systems
- Who does it
- PaaSCustomer
- SaaSProvider-inherited
- MITRE ATT&CK
- Supply Chain Compromise
- Exploit Public-Facing Application
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.