ASD Essentials
Chapter catalogue
ASD Essentials for operational technology: principles and actions.
Every principle and action in ASD's Essentials for OT, quoted as published, with what each one means in plain English. Open a principle to see its actions.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
At a glance
- principles
- 34
- actions
- 61
- principles not in enterprise IT
- 11
- domains
- 8
The 34 principles
Each principle is a security outcome from ASD's Information Security Manual (ISM). Under it, the chapter sets out the actions that achieve it for operational technology. Our OT guide explains the chapter as a whole.
- Not in enterprise IT
- Also in enterprise IT
Govern7
- GOV-01 Executive cyber security accountability1 action
- GOV-04 Cyber security resourcing1 action
- GOV-07 Continuous cyber security improvement1 action (not in enterprise it)
- GOV-08 Executive artificial intelligence accountability1 action
- GOV-10 System exposure minimisation1 action (not in enterprise it)
- GOV-11 Supplier cyber security assurance2 actions
- GOV-14 Legacy system management1 action
Identify5
Protect14
- PRO-01 Secure system lifecycle2 actions
- PRO-04 Secure configuration management3 actions
- PRO-05 Secure administration2 actions
- PRO-06 Vulnerability management3 actions
- PRO-07 Trustworthy software1 action
- PRO-10 Regular and proven backups2 actions
- PRO-12 Least privilege access2 actions
- PRO-13 Identity, credential and access management3 actions
- PRO-14 Cyber security awareness training1 action
- PRO-15 Physical access control2 actions (not in enterprise it)
- PRO-16 Cyber supply chain security2 actions
- PRO-18 Network segmentation and segregation4 actions
- PRO-19 Operational technology isolation5 actions (not in enterprise it)
- PRO-20 Remote access to operational technology3 actions (not in enterprise it)
Detect3
Respond4
Recover1
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
Everything else on this page is written by Control Stack.