For Australian Government
ASD Essentials for cloud: how Quant supports your implementation
An action-by-action mapping of the ASD Essentials for cloud chapter against the Quant platform, using the ASD's own shared responsibility markers. With an honest split of what Quant does and what your organisation still owns.
Scope: This page covers the actions in the cloud chapter where Quant has a role. Actions with no platform role, such as training and executive accountability, are left out. Last reviewed: October 2026.
Who this is for
In October 2026 the ASD released the Essentials series, which evolves the Essential Eight into a principles-based framework with chapters for enterprise IT, operational technology and cloud. The Essentials for cloud chapter applies to organisations whose technology is delivered through software-as-a-service (SaaS) and platform-as-a-service (PaaS).
If you run websites and applications on Quant, the chapter applies to you. Static hosting on the Quant edge behaves much like SaaS, and applications on Quant Cloud are PaaS: we run the platform and runtimes, and you write the code, choose the dependencies and deploy the workloads.
How the chapter splits responsibility
Every action in the chapter carries a marker for each service model. The ASD defines them as follows, and we use the same markers in the tables below.
C: Customer
Your organisation delivers and operates the control. Quant may help, but the control and the evidence are yours.
S: Supplied
Quant supplies the capability, and you enable, configure and operate it. The assessment looks at whether you have turned it on and set it up for your context.
P: Provider-inherited
Quant delivers the outcome. You stay accountable for confirming it is in place, using independent assurance such as our IRAP assessment.
The ASD describes the markers as "indicative rather than determinative", and says organisations should confirm the actual split for each service. The tables below show both markers as PaaS / SaaS. Where Quant's role is the same under both, we describe it once.
Governance and culture
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| GOV-11 Supplier cyber security assurance: Select suppliers on the basis of a cyber supply chain risk assessment, and keep current assurance that they meet their commitments. | C / C | The QuantGov Cloud platform is IRAP assessed at OFFICIAL:Sensitive. The assessment summary and responses to standard security questionnaires are available on request. | Run the supplier risk assessment, record the decision, and keep your register of inherited and retained responsibilities current. |
| GOV-14 Legacy system management: Treat risks from legacy and unsupported technologies through compensating controls, enhanced monitoring and assurance until they are replaced. | C / C | Static publishing keeps an older CMS on the authoring side, so its runtime is not part of the public request path. Static failover can switch a dynamic site to a static copy at the edge. | Own the process, the risk acceptance, and the plan to upgrade or replace the legacy system. |
| PRO-06 Vulnerability management: Prioritise cloud services that maximise provider-managed security responsibilities and minimise customer-managed components. | C / C | A static front end on a managed edge leaves very little on the public side for you to manage. For applications on Quant Cloud, we publish patched base images for the runtimes we build. | Choose the service model that fits each system, and record why. |
Visibility and response
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| DET-01 Centralised event logging: Enable provider audit logging at sufficient tiers and retention, and forward security-relevant logs and configuration changes to a central capability. | S / S | WAF logs, filterable by rule, domain, URL, IP and location, and an audit log of user and organisation actions. Both are available in the dashboard and through the API. | Pull the logs into your central logging capability through the API, and protect them there from modification or deletion. |
| DET-02 Cyber security event detection: Detect unauthorised changes, anomalous authentication and anomalous control-plane activity, and baseline resource utilisation. | S / P | We monitor the platform itself for security events. The audit log records who changed what in your organisation, so you can build detection on it. | Write and run the detection logic for your organisation, and triage what it finds. |
| RES-05 Cyber security incident coordination: Build provider notification arrangements, escalation contacts and the division of investigative responsibilities into incident response. | C / C | A security contact at security@quantcdn.io, and public advisories when an issue affects customers, such as our php2shell response. | Add Quant to your incident response plan, with contacts and the split of investigative work agreed in advance. |
Identity and privileged access
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| PRO-13 Identity, credential and access management: Use phishing-resistant MFA for users authenticating to systems. | S / S | Two-factor authentication with passkeys or TOTP, which an organisation can require for every member. SAML single sign-on is available, configured with our team. | Turn on the requirement. Passkeys are phishing-resistant and TOTP codes are not, so ask members to register passkeys. |
| PRO-13 Identity, credential and access management: Identify and disable or remove default and unused accounts on a regular basis. | S / S | Team membership is managed in the dashboard, where you can see and remove members. | Review membership on a schedule and remove accounts that are no longer needed. |
| PRO-12 Least privilege access: Provision user, administrative and non-person accounts with only the minimum access required, and review it periodically. | S / S | Role-based access in the portal. | Assign the narrowest role for each person and integration, and review the assignments. |
| PRO-05 Secure administration: Record all administrative actions that modify cloud services, configurations or controls, with identity, timestamp and target. | S / S | The audit log records user and organisation actions, available in the dashboard and through the API. | Retain those records centrally for as long as your obligations require. |
Boundary services and configuration
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| PRO-04 Secure configuration management: Define approved configuration baselines that disable unnecessary services, insecure settings and weak protocols. | S / P | The edge accepts TLS 1.2 or later only. The WAF runs the OWASP Core Rule Set with adjustable paranoia levels, custom rules, IP, user agent and ASN blocking, geographic conditions and rate limiting. | Turn the WAF on for each route and move it from report to block mode. The ASD notes that a capability left at an insecure default is not yet effective. |
| PRO-09 Content filtering: Inspect inbound content from external or untrusted sources to prevent delivery of malicious content. | S / P | The WAF inspects inbound requests at the edge, and we can update rules across the platform when a new exploit appears. | Tune the rules for your application and review blocked requests in the WAF logs. |
| PRO-18 Network segmentation and segregation: Isolate workloads and limit lateral movement to explicitly approved pathways. | C / P | Origin protection for Quant Cloud applications requires a secret header that only our edge sends, so the application cannot be reached around the edge. You can add an IP allow-list. | Turn on origin protection, and for origins hosted elsewhere, restrict them to traffic from our edge. |
Applications, patching and supply chain
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| PRO-06 Vulnerability management: Apply security patches to customer-managed components within risk-based timeframes, and remediate vulnerabilities in applications you introduce. | C / C | Static sites have no public runtime to patch. For dynamic sites, the WAF and static failover reduce exposure while a patch rolls out. Quant Sentinel runs AI-driven penetration tests against your applications. | Patch the applications and dependencies you deploy, inside the timeframes the ASD sets. |
| PRO-01 Secure system lifecycle: Harden development pipelines and their credentials, and restrict who can approve and deploy changes to production. | S / P | Deployment through our GitHub Actions, CLI and API, using API tokens that you hold. | Store tokens as pipeline secrets, pin the actions you use, and control who can approve a production deploy. |
| PRO-16 Cyber supply chain security: Assess the integrity and authenticity of images and components before deployment, and verify provenance where evidence exists. | S / P | Quant Cloud runs the container images you build and push. | Scan and verify your images and dependencies before you deploy them. |
Cryptography and backups
| ASD action | PaaS / SaaS | What Quant provides | What your organisation owns |
|---|---|---|---|
| PRO-08 Cryptographic protection: Protect data in transit and at rest with best practice algorithms and protocols, with weak or deprecated options disabled. | S / S | The edge negotiates hybrid post-quantum key exchange (X25519MLKEM768) by default with clients that support it, and TLS 1.2 or later with forward secrecy for older clients. Traffic between the edge and Quant Cloud applications uses TLS 1.2 or later with forward secrecy, and data at rest uses AES-256 encryption. Certificates still use classical signatures, as they do across the web, and we will move to post-quantum signatures as public certificate authorities support them, ahead of the ASD target of the end of 2030. | Inventory your own use of asymmetric cryptography and plan its replacement. |
| PRO-10 Regular and proven backups: Back up important data and settings to immutable storage on a defined schedule. | S / S | Quant Cloud databases are backed up daily, weekly and monthly, and volumes daily and monthly, with monthly copies kept for three years in a locked, immutable vault. You can also create, download and restore backups on demand. | Decide whether you need a customer-controlled copy as well, and take it by downloading backups. |
| PRO-10 Regular and proven backups: Test backup data and restoration procedures regularly against your recovery time and recovery point objectives. | C / C | On-demand restore to any environment, so you can test a restore without touching production. | Run and record restore tests on a schedule. |
| PRO-10 Regular and proven backups: Vital cloud capabilities can be quickly rebuilt on another provider if needed. | S / S | A static site is a set of files that any web host can serve, and Quant Cloud applications run from standard container images and compose files. | Keep your source, build pipeline and a recent copy of your data where you can reach them without us. |
Transition from the Essential Eight
The ASD has not set a mandatory changeover date. Keep meeting your existing obligations until your regulator or policy owner announces a change. The ASD says investment in the Essential Eight carries forward into the Essentials, and it is consulting on transition arrangements into 2027. We will update this page as the supplemental guides and the assessment process are finalised.
Evidence Quant can provide on request
- The current IRAP assessment summary for QuantGov Cloud.
- A description of the shared responsibility split for the services you use, for your responsibility register.
- Backup schedules and retention for your Quant Cloud environments.
- Responses to standard agency procurement and security questionnaires.
Requests go to security@quantcdn.io.
Related: The ASD says you now have hours to patch · DTA AI Policy mapping · Questions: security@quantcdn.io