PRO-13 Identity, credential and access management

eight actionsAlso in ASD Essentials for enterprise IT

Control how people and software prove identity. Use phishing-resistant multi-factor authentication. Keep secrets in approved stores and scan for exposed ones. Disable or remove default and unused accounts. Turn off legacy sign-in methods. Keep credentials unique, limit non-person identities to their intended use and watch for supply chain compromise.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.

ASD, Information Security Manual (ISM), Principle PRO-13

The eight actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

C: Customer
S: Supplied
P: Provider-inherited

Action 1 of 8
Regularly scan codebases, configuration files, file shares and user collaboration platforms to identify unsecured keys, secrets credentials and tokens.
In plain English: Regularly scan your code, configuration files, file shares and collaboration platforms. Look for keys, secrets, credentials and tokens that are not secured.
Domains
Visibility and response
Who does it
PaaSSupplied
SaaSSupplied
Action 2 of 8
Identify and disable or remove default and unused accounts on a regular basis, permitting exceptions only where the account is documented, justified, hardened and monitored.
In plain English: Regularly find and disable or remove default and unused accounts. Allow an exception only where the account is documented, justified, locked down and monitored.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Valid Accounts
Brute Force
Action 3 of 8
Monitor services for supply chain compromise, including provider advisories and changes to security commitments, and respond in a timely manner.
In plain English: Watch your services for supply chain compromise (attacks through a supplier), including provider advisories and changes to security commitments. Respond promptly.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Supply Chain Compromise
Server Software Component
Action 4 of 8
Store credentials, keys, secrets and tokens in approved secure access controlled repositories, and rotate, expire or replace non-person credentials with managed identities.
In plain English: Store credentials, keys, secrets and tokens in approved, secure, access-controlled stores. Rotate or expire non-person (software) credentials, or replace them with managed identities.
Domains
Identity services
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Unsecured Credentials
Credentials from Password Stores
Steal Application Access Token
Steal or Forge Authentication Certificates
Action 5 of 8
Use phishing-resistant MFA for users authenticating to systems.
In plain English: Use phishing-resistant multi-factor authentication (MFA) when users sign in to systems. This type is built to resist fake sign-in pages.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Valid Accounts
Brute Force
Phishing
Adversary-in-the-Middle
Action 6 of 8
Non-person identities are authorised and constrained to their intended context, with use bound to trusted workload, issuer or service conditions.
In plain English: Authorise non-person identities and limit them to their intended context. Allow their use only under trusted workload, issuer or service conditions.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Valid Accounts
Steal Application Access Token
Action 7 of 8
Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.
In plain English: Turn off legacy sign-in protocols. If that is not feasible, restrict and monitor their use, add compensating controls (other safeguards) and set a dated plan to retire them.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSSupplied
SaaSSupplied
MITRE ATT&CK
Brute Force
Valid Accounts
Account Manipulation
Action 8 of 8
Ensure that user and non-person credentials are unique per system or account, particularly in high-privilege contexts.
In plain English: Do not reuse user or non-person credentials across systems or accounts. This matters most where they carry high privileges.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Brute Force
Valid Accounts