Essentials for OT
DET-04 Baselined high-risk access activities
Know what normal remote access to OT looks like, so you can spot what is not. Record every remote session, including who connected, when and to what. Monitor sessions for anything that strays from validated patterns.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.
The action
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 1
Record all remote access sessions with the details of the user, timestamp and target, and monitor them for deviations from validated patterns.
In plain English: Record every remote access session with the user, time and target. Watch the sessions for anything that differs from validated normal patterns.
- Domains
- Boundary services
- MITRE ATT&CK
- Remote services
- External remote services
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.