Essentials for OT
PRO-12 Least privilege access
Give people only the access their OT work needs. Approve, track and periodically review every remote access user. Split admin and privileged functions into separate roles, each with its own account holding only the minimum access required.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.
The two actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 2
Establish and maintain a process to grant, track and periodically review approval of all remote access users, using secure protocols and restricting access to the minimum level required for the work being performed.
In plain English: Set up and keep a process to approve, track and periodically review every remote access user. Use secure protocols and limit access to the minimum the work needs.
- Domains
- Boundary services
- Identity services
- MITRE ATT&CK
- Remote services
Action 2 of 2
Provision administrative and privileged functions in OT as distinct roles, each assigned to a unique account with only the minimum access and privileges required to perform defined operational functions.
In plain English: Make admin and privileged functions in OT separate roles, each on its own account. Give each only the minimum access and privileges its defined operational tasks need.
- Domains
- Identity services
- Privileged environments
- MITRE ATT&CK
- Valid accounts
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.