Essentials for OT
PRO-07 Trustworthy software
Control what software can run in OT. Where systems support it, allow only approved software whose integrity has been checked. Keep any exceptions few, time-limited, regularly reviewed and covered by an accepted risk decision.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.
The action
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 1
Ensure only approved and integrity-verified software is permitted to execute on systems that support it, with exceptions minimised, risk-accepted, time-bound and regularly reviewed.
In plain English: On systems that support it, allow only approved software, checked as unaltered, to run. Keep exceptions to a minimum, risk-accepted, time-limited and regularly reviewed.
- Domains
- Critical processes and services
- Privileged environments
- MITRE ATT&CK
- User execution
- Scripting
- Command line interface
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.