PRO-19 Protect

Operational technology isolation

Operational technology actions

Action 1

Establish and maintain demilitarised zones that isolate OT at its perimeters from all networks not under the organisation's sole administrative control.
- Phase 1Boundary services
Rate this action in the Navigator
Action 2

Document the procedures used to enact isolation, including clear physical identification of the cables and equipment involved.
- Phase 1Boundary services, Critical processes and services
Rate this action in the Navigator
Action 3

Ensure isolation points can only be managed from within vital OT, so that enacted isolation cannot be reversed externally.
- Phase 1Boundary services
Rate this action in the Navigator
Action 4

Maintain the capability to isolate vital OT and sustain safe operation for a defined period aligned to critical service continuity requirements, and verify the effectiveness of isolation mechanisms on enactment and throughout the isolation period.
- Phase 1Boundary services, Critical processes and services
Rate this action in the Navigator
Action 5

Ensure the services on which vital OT depends operate independently of systems outside the OT environment, using separate software, credentials, storage, policy and servers, so that those services remain available throughout isolation.
- Phase 1Boundary services, Critical processes and services
- Phase 2Identity services
- Phase 3Business systems
Rate this action in the Navigator

More Protect principles

Source: ASD Essentials for operational technology, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.