Essentials for OT
PRO-05 Secure administration
Keep OT admin work separate and locked down. Manage site infrastructure from its own management network, and allow admin, engineering and troubleshooting access only from dedicated, hardened setups. These must sit in a segment trusted at least as much as the system they manage.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner.
The two actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 2
Manage supporting site infrastructure from a dedicated management network within the most critical network to which it is connected.
In plain English: Manage supporting site infrastructure from a dedicated management network. Put that network inside the most critical network the infrastructure connects to.
- Domains
- Identity services
- Privileged environments
- MITRE ATT&CK
- Lateral tool transfer
- Remote services
Action 2 of 2
Ensure administrative, engineering and troubleshooting access to OT can only be initiated from dedicated and hardened environments that are isolated from unprivileged workloads and located in a segment of equal or greater trust than the system being administered.
In plain English: Allow admin, engineering and troubleshooting access to OT only from dedicated, hardened environments isolated from non-admin work. Place them in segments at least as trusted as the target.
- Domains
- Critical processes and services
- Privileged environments
- MITRE ATT&CK
- Lateral tool transfer
- Valid accounts
- Remote services
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.