Essentials for cloud
PRO-05 Secure administration
Keep admin work on your cloud services secure and traceable. Do it only from managed, compliant, locked-down devices. Require explicit session controls and time-limited privilege before privileged actions. Record which identity changed what, and when.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Ensure administrative activities against cloud management planes are performed only from managed, compliant, hardened devices.
In plain English: Do admin work on cloud management planes only from managed, compliant, locked-down devices. Management planes are the consoles and tools that manage your services.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Valid Accounts
- Steal Web Session Cookie
- Steal Application Access Token
Action 2 of 3
Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants, with secured, monitored and tested response arrangements.
In plain English: Before allowing privileged actions, enforce explicit controls on starting the session, including time-limited privilege grants. Back this with secured, monitored and tested response arrangements.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- OS Credential Dumping
- Valid Accounts
- Account Manipulation
- Steal Web Session Cookie
- Steal Application Access Token
- Adversary-in-the-Middle
Action 3 of 3
Record all administrative or management actions that modify cloud services, configurations or controls with the details of the identity, timestamp and target.
In plain English: Record every admin or management action that changes cloud services, settings or controls. Include the identity that did it, the time and what it changed.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Impair Defenses
- Modify Authentication Process
- Create Account
- Account Manipulation
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.