Essentials for cloud
PRO-07 Trustworthy software
Allow only supported, verified and organisation-authorised software to run. Keep any exceptions few, risk-accepted, time-limited, monitored and regularly reviewed. Use only approved admin tools, and run them only from authorised privileged systems (set up for admin work). Review proposed and approved software and app integrations regularly.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Restrict administrative and management tooling to approved software sets and executed only from authorised privileged systems.
In plain English: Allow only an approved set of admin and management tools. Run them only from authorised privileged systems.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Impair Defenses
- Command and Scripting Interpreter
- Masquerading
- Remote Access Tools
Action 2 of 3
Regularly review proposed and approved software and application integrations in the organisational environment
In plain English: Regularly review software and app integrations for your organisation's environment. Cover both proposed and approved ones.
- Domains
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Supply Chain Compromise
- Trusted Relationship
Action 3 of 3
Permit only supported, verified and organisation-authorised software to execute, with exceptions minimised risk-accepted, time-bound, monitored and regularly reviewed.
In plain English: Allow only software that is supported, verified and authorised by your organisation to run. Keep exceptions few, and make each one risk-accepted, time-limited, monitored and regularly reviewed.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Supply Chain Compromise
- Implant Internal Image
- Masquerading
- User Execution
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.