Essentials for cloud
PRO-08 Cryptographic protection
Use strong, current cryptography to protect data while it moves and while it is stored, and switch off weak options. Look after keys through their whole life. Keep control of the keys for your most sensitive data, including the power to revoke the provider's access.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Data is encrypted and authenticated at rest and in transit using ASD-approved cryptography to protect its confidentiality and integrity.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Ensure data in transit and at rest is protected using best practice cryptographic algorithms and protocols, with weak or deprecated options disabled.
In plain English: Protect data while it moves and while it is stored, using best-practice cryptographic algorithms and protocols. Turn off weak or outdated options.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Network Sniffing
- Adversary-in-the-Middle
- Data from Cloud Storage
Action 2 of 3
Manage cryptographic keys securely throughout their lifecycle, including generation, validation, storage, rotations and revocation.
In plain English: Manage cryptographic keys securely throughout their life. This includes how they are created, validated, stored, rotated (regularly replaced) and revoked (cancelled).
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Unsecured Credentials
- Steal or Forge Authentication Certificates
- Steal Application Access Token
Action 3 of 3
Retain customer control over the keys protecting the organisations most sensitive data, including the ability to revoke provider access.
In plain English: Keep your own control over the keys that protect your most sensitive data, including the power to cut off the provider's access.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Data from Cloud Storage
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.