PRO-20 · Protect

Remote access to operational technology

Operational technology actions

• Action 1

  Notify local operators of authorised remote maintenance or supplier activity, so that unexpected changes are not normalised or ignored.

  • Every phaseGovernance and culture
  Rate this action in the Navigator →
• Action 2

  Ensure remote access is not routed directly into OT, terminating all traffic in the OT demilitarised zone before the next hop.

  • Phase 1Boundary services
  Rate this action in the Navigator →
• Action 3

  Enforce explicit session establishment controls before remote access is permitted, including time-bound grants, no permanent connections, and disconnection after a defined period of inactivity.

  • Phase 1Boundary services
  • Phase 2Identity services
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation

Source: ASD Essentials for operational technology, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.