Essentials for OT
PRO-13 Identity, credential and access management
Control who can sign in to OT. Use phishing-resistant multi-factor authentication for sign-ins across the OT perimeter, and from networks not solely under your OT admin control. Give each device or account its own credentials, and check that break-glass accounts work during isolation.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.
The three actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 3
Confirm the functionality of break-glass accounts, and the availability of their secrets, for administrative access during isolation from other authentication mechanisms.
In plain English: Check that break-glass (emergency) accounts work, and their secrets are available, for admin access while OT is isolated from other sign-in systems.
- Domains
- Identity services
Action 2 of 3
Use phishing-resistant MFA for users authenticating across a perimeter into OT, and from any network not under the organisation's sole OT administrative control.
In plain English: Users signing in to OT across a perimeter must use phishing-resistant multi-factor authentication. So must users signing in from any network not solely under your OT admin control.
- Domains
- Boundary services
- Identity services
- MITRE ATT&CK
- Valid accounts
- Remote services
Action 3 of 3
Ensure that credentials are unique per device or account, changing default, supplier and simple passwords before a device is commissioned or replaced, and where unique credentials are not supported, apply a compensating control that protects the device.
In plain English: Use unique credentials per device or account, or where unsupported, compensating controls (other safeguards) protecting the device. Change default, supplier and simple passwords before commissioning or replacing devices.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
- MITRE ATT&CK
- Default credentials
- Valid accounts
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.