Essentials for OT
PRO-16 Cyber supply chain security
Keep your supply chain from failing OT or bringing threats in. Find and fix third-party dependencies that would fail when OT is isolated. Check the integrity and origin of what enters OT, and record the history of new, repaired and serviced assets.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.
The two actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 2
Identify, test and resolve third-party dependencies that would fail under isolation, including licensing, activation, updates, supplier support, and licences coupled to physical hardware identifiers.
In plain English: Find, test and fix third-party dependencies that would fail if OT were isolated. These include licensing, activation, updates, supplier support and licences tied to physical hardware IDs.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- MITRE ATT&CK
- Loss of availability
Action 2 of 2
Verify the integrity and provenance of assets, software, components and updates before they are introduced into the OT environment, and record the origin and handling history of new, repaired and serviced assets.
In plain English: Verify the integrity and origin of assets, software, components and updates before they enter OT. Record the origin and handling history of new, repaired and serviced assets.
- Domains
- Critical processes and services
- Boundary services
- Identity services
- Privileged environments
- Business systems
- MITRE ATT&CK
- Supply chain compromise
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.