Skip to content
OT principles
ASD Essentials

Essentials for OT

PRO-15 Physical access control

two actionsNot in enterprise IT

Control who can physically reach OT, even when things go wrong. Keep site access controls, and plans for a safe site environment for operators, working in a degraded or isolated state. Secure higher-risk devices and sites, and turn off unused physical ports and removable media where continuity allows.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Physical access to facilities and systems (infrastructure and data) is restricted to authorised personnel and monitored for unusual activities.

ASD, Information Security Manual (ISM), Principle PRO-15

The two actions

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 2

    Maintain physical site access controls, and plan for a safe site environment for operators to work in, that continue to function in a degraded or isolated state.

    In plain English: Keep physical site access controls, and plan for a safe site environment for operators, that still work when the site is degraded or isolated.

    Domains
    Critical processes and services

  2. Action 2 of 2

    Implement physical security controls at devices and sites where physical access poses heightened cyber security risk, and disable unused physical ports and removable media interfaces where business continuity allows.

    In plain English: Physically secure devices and sites where physical access is a higher cyber security risk. If business continuity allows, turn off unused physical ports and removable media interfaces.

    Domains
    Critical processes and services
    MITRE ATT&CK
    Replication through removable media
    Transient cyber asset

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.

Everything else on this page is written by Control Stack.