Essentials for cloud
PRO-04 Secure configuration management
Decide on approved secure settings (baselines) for your cloud services and tenants (your own instances of a service), using vendor and industry advice on locking them down (hardening). Apply them, ideally with automated guardrails that block settings that break them. Check for drift and respond to it.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Define approved configuration baselines for cloud services and tenant-level settings, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings and unsupported or weak protocols.
In plain English: Use vendor and industry hardening advice to set approved baselines for cloud and tenant settings. These disable or remove unneeded services, insecure settings and weak or unsupported protocols.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Exploitation of Public-Facing Application
- External Remote Services
- Valid Accounts
- Server Software Component
Action 2 of 3
Deploy approved configuration baselines across cloud services, preferring policy-as-code and preventative guardrails that block non-compliant configurations at deployment.
In plain English: Apply approved baselines across cloud services. Prefer policy-as-code (rules written as code) and guardrails that block settings that break the baseline at deployment.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSProvider-inherited
- SaaSProvider-inherited
- MITRE ATT&CK
- Exploit Public-Facing Application
- External Remote Services
- Valid Accounts
- Account Manipulation
- Create Account
Action 3 of 3
Detect and respond to configuration drift from approved configuration baselines using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.
In plain English: Spot and respond to settings drifting from approved baselines. Use scheduled technical checks and, where supported, automated monitoring, based on system criticality and rate of change.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Impair Defenses
- Modify Cloud Compute Infrastructure
- Modify Cloud Resource Hierarchy
- Account Manipulation
- Create Account
- Modify Authentication Process
- External Remote Services
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.