Essentials for OT
PRO-06 Vulnerability management
Patch OT within set, risk-based timeframes, and manage the assets you cannot or will not patch. Protect those assets in other ways and keep a reviewed register of them and the risk accepted. Bring updatable critical OT up to the hardening level of IT.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.
The three actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 3
Apply security patches or updates within defined risk-based timeframes, record each asset that cannot or will not be patched along with the reason, and bring critical OT elements that can be updated to the same hardening baseline as equivalent critical elements in IT.
In plain English: Patch within set, risk-based timeframes, and record each asset that cannot or will not be patched and why. Harden updatable critical OT to match equivalent critical IT.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
- MITRE ATT&CK
- Exploitation of remote services
- Exploit public-facing application
- Internet accessible device
Action 2 of 3
Apply compensating protections where assets cannot or will not be patched, or where they remain operationally critical but are no longer supported by security patch release.
In plain English: Apply compensating controls (other safeguards that reduce the same risk) where assets cannot or will not be patched. Also apply them to critical assets without security patch support.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
- MITRE ATT&CK
- Exploitation of remote services
- Exploit public-facing application
- Internet accessible device
Action 3 of 3
Establish and maintain a register of assets that cannot be patched, or that will not be patched, recording for each the reason, the compensating protections applied, the residual risk accepted and the authority accepting it, and review each entry at defined cadence whenever the asset's exposure changes.
In plain English: Register assets that cannot or will not be patched: reason, compensating controls, accepted residual risk and its approver. Review each on a set schedule and when exposure changes.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.