ASD Essentials for Operational Technology

ASD Essentials for operational technology is the chapter of the Australian Signals Directorate's new ASD Essentials series for systems that run physical processes, from water treatment and power networks to rail signalling and production lines. The OT chapter, published on 15 October 2026, sets 61 actions under 34 principles and asks operators to secure boundary services and critical processes first, before identity and privileged access. ASD's OT landing page calls it "baseline cyber security guidance".

For the series as a whole, start with our launch post and our ASD Essentials page.

What is ASD Essentials for operational technology?

ASD's news release calls ASD Essentials "an evolution of Australia's widely adopted Essential Eight framework", launched with three chapters: enterprise IT, operational technology (OT) and cloud. The OT chapter says "OT systems are those that detect or cause a direct change to the physical environment through the monitoring or control of devices, processes and events." In practice that means industrial control systems (ICS), the software and devices that monitor and run a plant or network, down to programmable logic controllers (PLCs), small rugged computers that open a valve or start a pump on their own logic.

Like every chapter, the OT chapter has three layers: principles (the outcomes, drawn from ASD's Information Security Manual (ISM)), actions (what to do) and domains (where the work applies).

The idea running through the chapter is vital OT, "the subset of critical systems that it is unacceptable to have offline for an extended period, from the perspective of the safe provision of a minimum viable product", and many of its actions aim to keep vital OT safe and running when it is cut off from every other network, which ASD calls isolation.

Who is the OT chapter for?

ASD's OT chapter is written for "operators of OT responsible for complex systems control, automation and safety across critical service sectors", which it lists as "public transit systems, critical supply chain logistics, power generation, transmission and distribution, water and wastewater, medical services provision and large-scale industry." Its first governance action, under GOV-01 in the chapter, is to "Formally define and establish executive and board-level accountabilities for OT cyber security", so boards are in the audience too. The office network has its own chapter, covered in our enterprise IT chapter post.

What about smaller operators?

The chapter says "Small and medium sized businesses that do not operate at the scale of critical infrastructure can still use this chapter where relevant", adding: "What differs is how those outcomes are achieved and how much responsibility sits with service providers and vendors."

Where an integrator or equipment vendor provides support, ASD's Which chapter should I start with? guidance is clear that "outsourcing a service does not transfer accountability for the security outcomes that service is expected to achieve."

How is the OT chapter different from enterprise IT?

The framework is shared but, as ASD's FAQ puts it, "the specific principles, actions, and priority phases differ between the chapters." Counted from its three action matrices, the OT chapter has 61 actions under 34 principles, against 58 actions under 28 principles in the enterprise IT chapter.

Eleven principles in the OT chapter appear in neither the enterprise IT nor the cloud chapter:

• GOV-07 Continuous cyber security improvement (isolation exercises)
• GOV-10 System exposure minimisation
• IDE-02 Business criticality rating identification (naming vital OT)
• IDE-05 Asset interdependencies
• IDE-06 Resilience requirement identification
• PRO-15 Physical access control
• PRO-19 Operational technology isolation
• PRO-20 Remote access to operational technology
• REC-02 System recovery assurance (recovery without supplier support)
• RES-01 Cyber security incident planning
• RES-02 Cyber security incident reporting

The order changes too. The OT chapter puts Boundary services and Critical processes and services in phase 1, Privileged environments and Identity services in phase 2 and Business systems in phase 3, where the enterprise IT chapter starts with Boundary services and Identity services. The chapter explains: "The technical domains are sequenced differently in this chapter to reflect the operational safety requirements of OT environments."

User devices drop out: the chapter leaves that domain out of its action matrix because "all devices within the OT system must be considered as privileged and treated accordingly". In practice an engineering laptop is a privileged device, not a user device.

What does the OT chapter ask operators to do first?

The chapter prioritises Boundary services "because they provide pathways between OT systems and external or less trusted environments", and Critical processes and services "because their compromise or disruption could have significant safety, operational, environmental or service-delivery consequences", with the two capability domains, Governance and culture, and Visibility and response, applying "across all phases".

A demilitarised zone (DMZ) is a buffer network where outside connections stop before they reach the control system. Actions the chapter maps to phase 1 domains include, in ASD's words:

• Remote access ends in the DMZ. "Ensure remote access is not routed directly into OT, terminating all traffic in the OT demilitarised zone before the next hop." (PRO-20)
• Isolation that works. "Maintain the capability to isolate vital OT and sustain safe operation for a defined period aligned to critical service continuity requirements" (PRO-19, in part)
• Hidden dependencies. "Identify, test and resolve third-party dependencies that would fail under isolation, including licensing, activation, updates, supplier support" (PRO-16, in part)
• Safety systems kept apart. "Segment safety systems from non-safety parts of the OT environment, enforced at a network boundary rather than by device configuration alone" (PRO-18, in part)
• Rebuild files on site. "Backup the firmware, configuration, licence, calibration, project and logic files and supplier images required to rebuild OT, held per site and isolated from network access" (PRO-10, in part)
• An honest patch register. "a register of assets that cannot be patched, or that will not be patched", recording "the residual risk accepted and the authority accepting it" (PRO-06, in part)

Isolation is tested, not assumed: GOV-07 in the chapter asks for "regular exercises of isolation and sustained isolated operation".

How does it fit with the frameworks OT teams already use?

ASD's OT chapter cites only two frameworks: the ISM, from which its principles are drawn, and MITRE ATT&CK, whose attack techniques (mostly from ATT&CK for ICS) it maps to its technical actions. The chapter does not mention IEC 62443, the Australian Energy Sector Cyber Security Framework (AESCSF) or the Security of Critical Infrastructure Act 2018 (SOCI Act), and ASD has not published a mapping to them. ASD's FAQ says the series lets organisations "leverage additional frameworks that are relevant to their operational context", and that Essential Eight maturity level ratings "do not automatically convert into effectiveness outcomes under the Essentials series".

Where a regulatory program already names the Essential Eight, ASD's news release is explicit: "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations." ASD's Which chapter should I start with? guidance adds that "an obligation establishes a floor, not a priority order."

How is OT assessed?

ASD has not published an assessment method or evidence guide specific to OT: the OT chapter has no assessment section, and enterprise IT is so far the only chapter with an Assessment evidence guide. The general Assessment process guide "describes an assessment process that can be applied to an Essentials series chapter", rating each action in each domain on "a four-tier, outcome-based rating scale: not assessed, not effective, partially effective and fully effective." The same guide says "The principle rating is determined by the lowest applicable action rating" and "Deployment is not effectiveness", and the Implementation planning guide says organisations "may choose to engage an independent assessor, but this is not required."

What should operators do now?

1. Name your vital OT. List the systems that cannot be offline for long and what they depend on outside OT, as IDE-02 in the chapter asks; ASD's glossary defines the term.
2. Walk every remote access path. List each vendor and integrator connection, confirm it ends in the DMZ, and agree how you would cut it fast: the chapter asks for "a plan to rapidly disconnect remote access when malicious activity is identified."
3. Exercise isolation. Run the isolation exercises GOV-07 asks for, and resolve the third-party dependencies that fail, as PRO-16 asks.
4. Keep current uplift going. ASD's FAQ says "Organisations should continue their current uplift programs, while assessing alignment with the new framework."
5. Report to the board by domain, not by phase. ASD's guide for senior executives warns that "A statement such as 'we have reached priority phase 2' describes implementation scope, not how secure the organisation is."

Our ASD Essentials page covers the series and the move from the Essential Eight. For the enterprise IT side, the free coverage check shows which ISM and Essential Eight controls the products you already pay for can reach, in about three minutes.

Sources

• ASD, ASD Essentials for operational technology: the OT landing page.
• ASD, Essentials for OT (PDF): the chapter, with its domains, priority phases and all 61 actions.
• ASD, ASD Essentials: evolving our approach to cyber security resilience, news release, 15 October 2026.
• ASD, ASD Essentials for enterprise IT: the chapter compared above.
• ASD, Frequently asked questions.
• ASD, Which chapter should I start with?
• ASD, ASD Essentials glossary.
• ASD, Assessment process guide and Assessment evidence guide for enterprise IT.
• ASD, Implementation planning guide.
• ASD, The Essentials for senior executives.

ASD Essentials content © Commonwealth of Australia, CC BY 4.0, via cyber.gov.au.