PRO-01 Secure system lifecycle
2 actions under this Protect principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices.
Quoted as published. Everything else on this page is written by Control Stack.
The two actions
- IT.PRO-01.1Design Systems with Telemetry, Least Privilege, Data Protection and Minimal Attack Surface
Designs systems securely so they log security events by default, enforce authorised access, protect data, and keep privileges, services and features minimal.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-01.2Use Secure Build and Deployment Processes to Enforce Security Controls Consistently
Builds, deploys and changes systems through secure, controlled processes with testing and approval, so security controls are applied consistently across systems.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices)
Back to the full Essentials for enterprise IT action list, or browse the complete control library.