Essentials for OT
DET-01 Centralised event logging
Record what happens on OT systems and keep that record usable when outside systems fail. Keep logs on operator, engineering and server systems in OT. Make sure you can still collect, search and investigate logs when systems outside OT are unavailable.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation.
The action
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 1
Perform host-based logging on operator, engineering and server systems within the OT environment, and maintain log collection, query and investigation capability that remains available when systems outside the OT environment are unavailable.
In plain English: Log activity on each operator, engineering and server system in OT. Make sure you can still collect, search and investigate logs when systems outside OT are down.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
- MITRE ATT&CK
- Indicator removal on host
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.