Essentials for OT
PRO-20 Remote access to operational technology
Control remote access into OT. Tell local operators about approved remote maintenance and supplier work. End remote traffic in the OT buffer network (DMZ) rather than going straight into OT, and allow only explicit, time-limited sessions that end after a set idle time.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Access to operational technology systems (infrastructure, operating systems, applications and data) over untrusted infrastructure is authorised, controlled and monitored.
The three actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 3
Notify local operators of authorised remote maintenance or supplier activity, so that unexpected changes are not normalised or ignored.
In plain English: Tell local operators about approved remote maintenance or supplier work. Then unexpected changes are not treated as normal or ignored.
- Domains
- Governance and culture
Action 2 of 3
Ensure remote access is not routed directly into OT, terminating all traffic in the OT demilitarised zone before the next hop.
In plain English: Never route remote access straight into OT. End all of its traffic in the OT buffer network (DMZ) before it goes further.
- Domains
- Boundary services
- MITRE ATT&CK
- External remote services
- Remote services
- Exploitation of remote services
- Internet accessible device
Action 3 of 3
Enforce explicit session establishment controls before remote access is permitted, including time-bound grants, no permanent connections, and disconnection after a defined period of inactivity.
In plain English: Require each remote access session to be set up explicitly before access is allowed. Keep access time-limited, with no permanent connections, and disconnect after a set idle time.
- Domains
- Boundary services
- Identity services
- MITRE ATT&CK
- External remote services
- Remote services
- Valid accounts
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.