ASD's eight prioritised mitigation strategies, at three maturity levels.
152 requirements
The Australian Government's Information Security Manual, guideline by guideline.
1,143 controls
Understand
ASD's Essentials for OT applies the ASD Essentials to operational technology: the systems that monitor or control physical equipment and processes. It puts the safe, continuous running of those processes first.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
User devices is not in the OT chapter's technical matrix, so ASD maps the technical actions across five technical domains.
The priority phases put safety and continuous operation first, starting with Boundary services, and Critical processes and services.
ASD has not published an assessment evidence guide or machine-readable data for this chapter, so its actions have no IDs.
OT systems are those that detect or cause a direct change to the physical environment through the monitoring or control of devices, processes and events.
In other words, OT watches or runs physical equipment, such as the pumps at a water plant or a production line.
ASD says its principles apply to all OT, from simple automation to large critical infrastructure systems. Its target audience includes operators responsible for complex control, automation and safety systems in these critical service sectors:
Smaller organisations can use it where relevant. ASD says the outcomes matter as much for them; what differs is how they achieve them, and how much sits with service providers and vendors.
Key term
The critical systems you cannot accept having offline for long, if you are to keep delivering a minimum service safely.
ASD's definition takes into account what you can keep running by hand and through your business continuity plans.
Like every chapter, it is built from principles, actions and domains, as our overview of the ASD Essentials explains. If you also run enterprise IT or cloud, see which chapter applies to you.
The OT chapter uses the same eight domains as enterprise IT, but ASD describes several of them differently for OT. The two capability domains (Governance and culture, and Visibility and response) apply across all technical domains.
Technical domains (6)
Capability domains (2)
Priority phase 1
Priority phase 2
Priority phase 3
Across all phases
Governance and cultureVisibility and responseOur chapter guide compares this order with enterprise IT and explains why it differs.
Development, test and staging systems are in scope too. If one holds production trust or admin access, or can change or deploy to production, protect it to the same level as the production system it can affect.
Domains and risk context, quoted
| Domain | Description | Risk context |
|---|---|---|
| Governance and culture | Policies, risk management processes, roles and security culture that underpin cyber security program. | Unclear ownership and accountability can lead to inconsistent security decisions and outcomes degrading over time. |
| Visibility and response | Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents. In OT, visibility often has a second use in engineering fault analysis. | Limited visibility and response can delay the detection, analysis and containment of intrusions. In OT, this could lead to potentially catastrophic system failure. |
| Critical processes and services | Core systems and networks which are essential to safely deliver the product or service for which an organisation exists. | Compromise or loss of these systems can disrupt the organisation’s ability to deliver critical outcomes or services. |
| Boundary services | Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services, edge devices and points of connection to other OT systems. | Internet-facing and boundary services may be routinely exposed to adversary scanning and exploitation making them common targets for initial access. |
| Identity services | Identity, credential and access management services such as directories, authentication and authorisation services or credential stores. | Compromise of identity services can enable an adversary to gain persistent or privileged access across the enterprise. |
| Privileged environments | Systems, services and devices that support privileged activities, management services and high-impact administrative functions. Within OT, this includes items which, in an enterprise IT context, would be considered user or endpoint devices. | Compromise of privileged systems can give an adversary extensive control over systems, services and security controls. Within OT, any device with connectivity within a privileged environment must be considered a privileged device. |
| Business systems | Supporting enterprise functions that collectively enable organisational operations. | Compromise can disrupt day-to-day operations and provide pathways to more sensitive or critical systems. Business systems may exist within the IT systems of an organisation, with their OT process support possibly making them considered part of the OT systems. |
| User devices | Endpoints issued to the workforce, including desktops and laptops. | The critical nature of OT systems, coupled with the high-risk cyber security possibilities present in many environments, should prohibit the use of typically configured end-user or endpoint devices within OT environments. Use of such devices risks the unintended introduction of cyber threats directly into the privileged OT environment. All devices within the OT system must be considered as privileged and treated accordingly. |
ASD, Essentials for OT, Table 1
Each principle is a security objective drawn from ASD's Information Security Manual (ISM), with a matching code such as GOV-01. The codes help you trace a principle; they do not set an order. Under each one, ASD gives one or more actions, described without naming particular technologies.
The intent of a principle remains the same between chapters, while the actions used to achieve that outcome may differ.
Govern7
Identify5
Protect14
Detect3
Respond4
Recover1
In enterprise IT, not in OT
ASD lists the principles in three matrices: one for each capability domain, and one that maps actions across the five technical domains it includes. PRO-20 and IDE-01 each appear in two matrices. Counting each once, the chapter has 34 principles.
ASD's Matrix 1. Principles whose actions apply in the Governance and culture capability domain.
| Code | Principle | In enterprise IT |
|---|---|---|
| GOV-01 | Executive cyber security accountability | Yes, see GOV-01 in the enterprise IT chapter |
| GOV-08 | Executive artificial intelligence accountability | Yes, see GOV-08 in the enterprise IT chapter |
| GOV-04 | Cyber security resourcing | Yes, see GOV-04 in the enterprise IT chapter |
| GOV-10 | System exposure minimisation | No |
| GOV-11 | Supplier cyber security assurance | Yes, see GOV-11 in the enterprise IT chapter |
| GOV-14 | Legacy system management | Yes, see GOV-14 in the enterprise IT chapter |
| GOV-07 | Continuous cyber security improvement | No |
| PRO-20 | Remote access to operational technologyAlso in the Technical domains matrix | No |
| PRO-14 | Cyber security awareness training | Yes, see PRO-14 in the enterprise IT chapter |
ASD's Matrix 2. Principles whose actions apply in the Visibility and response capability domain.
| Code | Principle | In enterprise IT |
|---|---|---|
| IDE-01 | Asset identificationAlso in the Technical domains matrix | Yes, see IDE-01 in the enterprise IT chapter |
| IDE-02 | Business criticality rating identification | No |
| IDE-04 | Security risk identification | Yes, see IDE-04 in the enterprise IT chapter |
| RES-01 | Cyber security incident planning | No |
| RES-05 | Cyber security incident coordination | Yes, see RES-05 in the enterprise IT chapter |
| RES-03 | Cyber security incident response | Yes, see RES-03 in the enterprise IT chapter |
| RES-02 | Cyber security incident reporting | No |
| REC-02 | System recovery assurance | No |
ASD's Matrix 3. Principles whose actions ASD maps across the five technical domains it includes.
| Code | Principle | In enterprise IT |
|---|---|---|
| IDE-01 | Asset identificationAlso in the Visibility and response matrix | Yes, see IDE-01 in the enterprise IT chapter |
| IDE-05 | Asset interdependencies | No |
| IDE-06 | Resilience requirement identification | No |
| PRO-01 | Secure system lifecycle | Yes, see PRO-01 in the enterprise IT chapter |
| PRO-16 | Cyber supply chain security | Yes, see PRO-16 in the enterprise IT chapter |
| PRO-13 | Identity, credential and access management | Yes, see PRO-13 in the enterprise IT chapter |
| PRO-12 | Least privilege access | Yes, see PRO-12 in the enterprise IT chapter |
| PRO-05 | Secure administration | Yes, see PRO-05 in the enterprise IT chapter |
| PRO-04 | Secure configuration management | Yes, see PRO-04 in the enterprise IT chapter |
| PRO-06 | Vulnerability management | Yes, see PRO-06 in the enterprise IT chapter |
| PRO-07 | Trustworthy software | Yes, see PRO-07 in the enterprise IT chapter |
| PRO-10 | Regular and proven backups | Yes, see PRO-10 in the enterprise IT chapter |
| PRO-18 | Network segmentation and segregation | Yes, see PRO-18 in the enterprise IT chapter |
| PRO-19 | Operational technology isolation | No |
| PRO-20 | Remote access to operational technologyAlso in the Governance and culture matrix | No |
| PRO-15 | Physical access control | No |
| DET-01 | Centralised event logging | Yes, see DET-01 in the enterprise IT chapter |
| DET-04 | Baselined high-risk access activities | Yes, see DET-04 in the enterprise IT chapter |
| DET-02 | Cyber security event detection | Yes, see DET-02 in the enterprise IT chapter |
The OT chapter orders the domains differently, and its actions are written for OT. ASD says the order reflects the safety needs of OT environments:
OT cyber security prioritises the safe and continuous operation of physical processes. This can require greater emphasis on protecting critical processes, controlling connectivity and administrative access, and using compensating controls where changes such as patching or replacing legacy equipment cannot be made without affecting operations.
PRO-06 Vulnerability managementGOV-14 Legacy system managementPRO-04 Secure configuration management
PRO-19 Operational technology isolationPRO-16 Cyber supply chain securityGOV-07 Continuous cyber security improvement
PRO-20 Remote access to operational technologyPRO-13 Identity, credential and access managementDET-04 Baselined high-risk access activitiesRES-03 Cyber security incident responseGOV-11 Supplier cyber security assuranceGOV-10 System exposure minimisation
IDE-05 Asset interdependenciesIDE-06 Resilience requirement identificationPRO-18 Network segmentation and segregationPRO-15 Physical access control
RES-01 Cyber security incident planningRES-05 Cyber security incident coordinationDET-01 Centralised event loggingPRO-10 Regular and proven backupsREC-02 System recovery assurance
Grouped by us, in plain words. The codes are the principles behind each group.
FromPRO-06 Vulnerability managementGOV-14 Legacy system managementPRO-04 Secure configuration management
FromPRO-19 Operational technology isolationPRO-16 Cyber supply chain securityGOV-07 Continuous cyber security improvement
FromPRO-20 Remote access to operational technologyPRO-13 Identity, credential and access managementDET-04 Baselined high-risk access activitiesRES-03 Cyber security incident responseGOV-11 Supplier cyber security assuranceGOV-10 System exposure minimisation
FromIDE-05 Asset interdependenciesIDE-06 Resilience requirement identificationPRO-18 Network segmentation and segregationPRO-15 Physical access control
FromRES-01 Cyber security incident planningRES-05 Cyber security incident coordinationDET-01 Centralised event loggingPRO-10 Regular and proven backupsREC-02 System recovery assurance
Using a supplier does not hand over your accountability for these outcomes, as the outsourced services section of our chapter guide explains.
As in enterprise IT, ASD maps technical actions to MITRE ATT&CK techniques (the methods attackers use) where they apply. Some of the OT chapter's techniques do not appear in the enterprise IT chapter, such as Loss of safety, Loss of view and Manipulation of control.
Our suggestion, not ASD's list, built from actions in ASD's chapter.
Name who is accountable
Put in writing who on the board and executive team is accountable for OT cyber security.
Find your vital OT
List the OT you cannot have offline for long, and everything it depends on.
Build your OT asset list
Record every OT asset and place each one in its domains.
Map every way into OT
Map your attack surface, boundaries, connections and isolation points, and keep the map current.
Write down what you cannot patch
Start your register of assets you cannot or will not patch.
Plan the work
Use ASD's Implementation planning guide, and set up the two capability domains early.
Our guide to implementing the Essentials explains ASD's planning guide.
Put in writing who on the board and executive team is accountable for OT cyber security, including who sets, monitors and adjusts your risk appetite. Review this on a set schedule.
Builds onGOV-01 Executive cyber security accountability
List the OT you cannot have offline for long. Then list everything it depends on, including systems outside the OT environment.
Builds onIDE-02 Business criticality rating identification
Record each asset's physical and logical location, role, criticality, dependencies, known weaknesses and compensating controls. ASD asks for an approved inventory tool with automated discovery, to catch new and changed assets. Then place each asset in its domains, including development, test and staging systems.
Builds onIDE-01 Asset identification
Map your attack surface, security boundaries and connections, including the points where you could fully isolate OT, and keep the map current. This helps with priority phase 1, which covers Boundary services, and Critical processes and services.
Builds onIDE-04 Security risk identification
Start your register of assets you cannot or will not patch.
Builds onPRO-06 Vulnerability managementGOV-14 Legacy system management
ASD points to its Implementation planning guide for detailed planning. Set up the two capability domains early: ASD says they apply across all phases and expand as the work progresses.
Answers drawn from ASD's Essentials for OT and its overview publications.
It is the chapter of the ASD Essentials series for operational technology (OT): systems that monitor or control physical devices, processes and events. ASD published it on 15 October 2026. It has eight domains and 34 principles, and it orders the domains to put safe, continuous operation first.
ASD says its principles apply to all OT. Its target audience includes operators of complex control, automation and safety systems in critical service sectors. Smaller organisations can use it where relevant.
It is ASD's term for the critical systems you cannot accept having offline for an extended period, if you are to keep delivering a minimum service safely.
ASD says bringing endpoint-type devices into OT is extremely high risk, so every device in the OT system counts as privileged. Privileged environments covers the devices enterprise IT would call user devices. User devices is still one of the six technical domains, but ASD leaves it out of the matrix that maps OT actions to technical domains.
It orders the domains differently, to put safety and the continuous running of physical processes first. 11 of its 34 principles are not in the enterprise IT chapter, including Operational technology isolation and Remote access to operational technology. Many of its actions are about isolating OT, running safely while cut off and recovering without supplier help.
ASD expects you to patch within set, risk-based timeframes, and to record each asset that cannot or will not be patched, with the reason. For those assets, apply compensating controls and keep a register of the reason, the controls, the risk accepted and who accepted it. Review each entry on a set schedule and whenever its exposure changes. Legacy systems that are still critical need a process to manage their risk until you can remove or replace them.
The ASD publications this page explains.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.
