Skip to content
OT principles
ASD Essentials

Essentials for OT

RES-03 Cyber security incident response

one actionAlso in ASD Essentials for enterprise IT

Be able to contain an intrusion quickly by cutting off remote access. Write a plan to disconnect remote access rapidly when malicious activity is identified, keep the plan up to date, and practise it.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Cyber security incidents are contained, eradicated and recovered from in a timely manner.

ASD, Information Security Manual (ISM), Principle RES-03

The action

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 1

    Establish, maintain and exercise a plan to rapidly disconnect remote access when malicious activity is identified.

    In plain English: Set up, keep and practise a plan to quickly cut off remote access when you spot malicious activity.

    Domains
    Visibility and response

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.