Essentials for OT
PRO-04 Secure configuration management
Set approved baselines (standard secure settings) for OT and keep them enforced. Switch off what is not needed where systems allow. Harden new control software where feasible and it will not reduce availability or safety, and detect and respond to configuration changes.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.
The three actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 3
Detect and respond to configuration changes within OT and its demilitarised zones, including changes to name resolution records, through automation or continuous technical assessment.
In plain English: Use automation or constant technical checks to detect and respond to configuration changes in OT and its buffer networks (DMZs). Include changes to name resolution (DNS) records.
- Domains
- Boundary services
- MITRE ATT&CK
- Modify parameter
Action 2 of 3
Define and deploy approved configuration baselines that disable or remove unnecessary physical ports, communications ports, services, insecure settings and weak protocols where systems support it, prevent unauthorised changes to name resolution records, monitor for access attempts against exposed services, and bring critical OT elements that can be updated to the same baseline as their IT equivalents.
In plain English: Deploy approved baselines. Where supported, disable or remove unneeded ports, services, insecure settings and weak protocols. Block unauthorised DNS changes, monitor exposed services for access attempts, and hold updatable critical OT to IT baselines.
- Domains
- Critical processes and services
- Boundary services
- Privileged environments
- MITRE ATT&CK
- Default credentials
- Exploitation of remote services
- Adversary in the middle
- Remote system discovery
- Internet accessible device
Action 3 of 3
Harden new instances of control software, including modelling, forecasting and automated decision support systems that provide input to control, where feasible, and where doing so does not degrade the availability or safety of the OT system.
In plain English: Harden new control software where feasible, if it will not reduce OT availability or safety. This includes modelling, forecasting and automated decision support systems that feed control.
- Domains
- Critical processes and services
- MITRE ATT&CK
- Exploitation of remote services
- Modify program
- Manipulation of control
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.