At a glance
This guidance supports organisations and cyber security practitioners with asset scoping for the six technical domains in ASD Essentials for cloud. The guidance provides additional context for each domain, example assets and questions organisations can use when scoping their cloud environment.
Key actions
Understand the technical domains in ASD Essentials for cloud.
Determine which organisational assets are in scope for each technical domain.
Purpose
This publication provides supplementary guidance intended to complement the ASD Essentials for cloud. It includes further descriptions and context on the two capability domains and six technical domains outlined within the ASD Essentials for cloud chapter, as well as some prompting questions to assist organisations as they undertake their own scoping activities.
The questions and examples included below are prompts rather than an exhaustive list. An asset or function may be included in more than one domain, where it performs multiple roles or presents different consequences of compromise.
Asset scoping
The following sections describe each technical domain, the consequences of compromise and questions that can help organisations determine which assets are in scope.
Organisation should assess each asset against every domain description. An asset is in scope for each domain that describes it, and all actions applicable to those domains apply. Where the same actions applied to an asset through more than one domain, it is implemented once. Multi-domain memberships widen the set of actions that apply to an asset, it does not multiply the work for actions already in that set.
Governance and culture
What this domain involves
Governance and culture represent the administrative foundations that give the cyber security program its authority and longevity, including the policies, risk management processes, roles, responsibilities and security culture that underpin every other control. This domain is primarily people focused and process-driven rather than technology-driven.
Consequence of compromise
Weak governance and cyber security culture can result in inconsistent security decisions, unclear accountability, delayed remediation activity and reduced organisational ability to manage cyber security risk across cloud services over time. Deficiencies in this domain may undermine the effectiveness and sustainability of controls implemented across all other domains.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Visibility and response
What this domain involves
Visibility and response represent the organisation’s ability to detect, analyse and respond to cyber security events and incidents. This domain encompasses the procedures, platforms and capabilities that collect security telemetry then convert it into actionable insight to enable coordinated response and recovery activities when incidents occur.
Consequence of compromise
Without effective visibility, malicious actors can maintain persistence, escalate privileges within SaaS and PaaS services and cause impact without opposition. This can delay incident identification and response, prolong impacts, increase the resources required for resolution and cause greater organisational harm.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Boundary services
What this domain involves
Boundary services represent the systems and services that control or broker connectivity, trust, control or data flows between SaaS and PaaS services and external or cross-domain environments, including internet facing services, APIs, gateways, federation relationships, cross-tenant connections and integrations. This domain is often the organisation’s front door and the most visible target for external malicious actors.
Consequence of compromise
Malicious actors routinely scan internet-facing services, APIs and cloud service integrations to enable initial access. Web applications, application programming interface endpoints, SaaS and PaaS integrations and remote access portals are frequently targeted assets. A compromised boundary service can enable unauthorised access to cloud services, expose data, disrupt service disruption visible to customers and partners, or provide a staging point for attacks against connected third parties.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Assets commonly shared with other domains
An asset that brokers external connectivity is often in scope for other domains as well, including the following examples:
- An internet-facing application that delivers a primary organisational outcome is also a critical process and service.
- A cloud service boundary that authenticates external users is also an identity service.
- A remote access solution used by administrators is also part of a privileged environment.
Identity services
What this domain involves
Identity services represent the functions responsible for authentication, authorisation, identity lifecycle management and access control policy enforcement. This domain is the trust anchor for every other technical domain. If malicious actors control identity, they typically control access to everything.
Consequence of compromise
Compromise of identity services enables broad, cascading access across SaaS and PaaS services. Malicious actors who gain control of identity providers, federation platforms or credential stores can impersonate any user, escalate to any privilege level and move between cloud services without triggering controls that rely on identity as a trust signal. Compromise of identity services can occur at multiple stages of an attack chain, from initial credential theft to the establishment of persistent attacker-controlled access that persists across SaaS sessions, tokens and federated access.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Critical processes and services
What this domain involves
Critical processes and services represent the process and services essential to delivering primary organisational outcomes or contributing to personnel health and safety. They include the cloud applications, platform services, workflows and data on which those outcomes depend. This is the domain where compromise is most likely to translate directly into mission or business objective failure.
Consequence of compromise
Malicious actors targeting this domain typically pursue disruption, unauthorised access and theft or manipulation. Because these services and data they process represent the high value targets, they attract capable and deliberate malicious actor activity.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Privileged environments
What this domain involves
Privileged environments represent the platforms, tooling, accounts and controls interfaces that enable and govern privileged activities and high-impact administrative functions. This domain encompasses the environments from which administrative actions are performed, the platforms and control planes that broker and enforce privileged access, and the policies and mechanisms that constrain how elevated permissions are granted, used and recorded.
Consequence of compromise
Malicious actors who obtain privileged access can modify configurations, weaken or disable controls, create persistence mechanisms and access or expose data within scope of those privileges. Techniques such as credential theft, token manipulation and exploitation of misconfigured delegation or control plane settings are standard components of post-compromise activity. Once privileged environments are compromised, malicious actors operate with the same authority as the organisation’s own privileged users, enabling them to reshape SaaS and PaaS services, abuse integrations, establish persistence and undermine detection and recovery.
| Scoping questions to consider | Example assets |
|---|---|
|
|
Business systems
What this domain involves
Business systems represent supporting enterprise functions that enable day-to-day operations, but have not been classified as critical processes and services. Their individual or collective compromise can degrade organisational effectiveness and provide pathways to more sensitive services, identities and data.
Consequence of compromise
Malicious actors frequently use business systems as staging points to access additional cloud services, identities, data and business functions. The disruption or compromise of multiple business systems in parallel can render the organisation unable to perform coordination, communication and operational activities.
| Scoping questions to consider | Example assets |
|---|---|
|
|
User devices
What this domain involves
User devices represent the endpoints issued to, or used by, the workforce to access SaaS and PaaS services, together with the endpoint applications and locally stored data that enable that access. This domain is highly distributed and exposed to user-initiated risk.
Consequence of compromise
User devices are a common vector through which phishing, social engineering and drive-by compromises reach organisations. A compromised user device can expose credentials, browser sessions or tokens used to access SaaS and PaaS services. User devices are a common point from which data leaves the organisation through exfiltration, accidental exposure or unsanctioned cloud services. Their volume and diversity make consistent security challenging.
User devices are also the most common point from which data leaves the organisation, whether through exfiltration, accidental exposure or unsanctioned SaaS cloud services. The volume and diversity of user devices make this domain the most challenging to secure consistently.
| Scoping questions to consider | Example assets |
|---|---|
|
|
