ASD Essentials for operational technology

For organisations monitoring or controlling physical processes, such as in factories, pipelines or power plants.

Domains and priority phases

Priority phases set ASD’s recommended order of work.

Every phase

Governance and culture
Policies, risk management processes, roles and security culture that underpin cyber security program.
Unclear ownership and accountability can lead to inconsistent security decisions and outcomes degrading over time.
Visibility and response
Procedures and capabilities for detecting, analysing and responding to cyber security events and incidents. In OT, visibility often has a second use in engineering fault analysis.
Limited visibility and response can delay the detection, analysis and containment of intrusions. In OT, this could lead to potentially catastrophic system failure.

Phase 1

Boundary services
Assets at network boundaries that broker connectivity between environments of different trust levels, including internet-facing services, edge devices and points of connection to other OT systems.
Internet-facing and boundary services may be routinely exposed to adversary scanning and exploitation making them common targets for initial access.
Critical processes and services
Core systems and networks which are essential to safely deliver the product or service for which an organisation exists.
Compromise or loss of these systems can disrupt the organisation's ability to deliver critical outcomes or services.

Phase 2

Privileged environments
Systems, services and devices that support privileged activities, management services and high-impact administrative functions. Within OT, this includes items which, in an enterprise IT context, would be considered user or endpoint devices.
Compromise of privileged systems can give an adversary extensive control over systems, services and security controls. Within OT, any device with connectivity within a privileged environment must be considered a privileged device.
Identity services
Identity, credential and access management services such as directories, authentication and authorisation services or credential stores.
Compromise of identity services can enable an adversary to gain persistent or privileged access across the enterprise.

Phase 3

Business systems
Supporting enterprise functions that collectively enable organisational operations.
Compromise can disrupt day-to-day operations and provide pathways to more sensitive or critical systems. Business systems may exist within the IT systems of an organisation, with their OT process support possibly making them considered part of the OT systems.

Principles

Govern

Identify

Protect

Detect

Respond

Recover

REC-02System recovery assurance

Open the Navigator

Source: ASD Essentials for operational technology, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.