Essentials for cloud
PRO-16 Cyber supply chain security
Check what connects to and runs in your cloud services. Approve apps, integrations and the permissions given to apps before they get access. Confirm software components are genuine before deploying them, act on supplier advisories, and reduce reliance on any single sign-in provider.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.
The four actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 4
Assess and approve applications, integrations and consent grants before permitting access, and review them on a regular basis.
In plain English: Assess and approve apps, integrations and consent grants (permissions users or admins give apps) before they get access. Review them regularly.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Trusted Relationship
- Account Manipulation
- Valid Accounts
- Steal Application Access Token
Action 2 of 4
Assess the integrity and authenticity of images, components and artefacts before they are deployed into services, and verify provenance where suitable supplier evidence is available.
In plain English: Before you deploy images, components and artefacts into services, check they are genuine and unchanged. Where the supplier gives suitable evidence, confirm where they came from.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Supply Chain Compromise
- Server Software Component
- Command and Scripting Interpreter
- Implant Internal Image
Action 3 of 4
Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.
In plain English: Use vendor advisories and threat intelligence to stay aware of which suppliers, products and components are exposed to compromise. Act within timeframes that match the risk.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Supply Chain Compromise
- Server Software Component
- Trusted Relationship
Action 4 of 4
Identify and mitigate single points of dependency created by OAuth and federated identity providers.
In plain English: Find and reduce single points of dependency created by OAuth and federated identity providers (shared sign-in services). An example is many services relying on one provider.
- Domains
- Identity services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSCustomer
- SaaSCustomer
- MITRE ATT&CK
- Trusted Relationship
- Steal Application Access Token
- Forge Web Credentials
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.