ASD Essentials for OT

Scope. ASD launched ASD Essentials on 15 October 2026 as a principles-based framework that will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments, techpartner.news reported. In its initial version the Essentials covers cloud and operational technology as well as enterprise IT (iTnews). This page covers the OT chapter.

Principles, actions and domains

The series introduces three core concepts: principles that describe the cyber security outcomes an organisation should achieve, actions that describe what needs to be done to achieve those outcomes, and domains that define the business functions and assets to which actions apply (techpartner.news). Effectiveness is rated per action and domain as 'not effective', 'partially effective' or 'fully effective', and a principle's overall rating is determined by its lowest-rated applicable action (techpartner.news).

Priority phases

Across the series, priority phases replace maturity levels, sequencing effort toward the highest-risk assets first, and ASD recommends organisations begin scoping work in the phase one domains: boundary services, identity services, governance and culture, and visibility and response (techpartner.news). ASD said priority phases are not maturity ratings, and that reaching a phase 'describes implementation scope, not how secure the organisation is', according to iTnews.

Chapter detail

Neither iTnews nor techpartner.news reported this chapter's specific contents. For the chapter's domains, actions and wording, read the ASD publication listed under further reading; this page does not summarise it.

CyberStack guidance (our own advice, not ASD's)

This section is CyberStack's own general hardening advice for operational technology. It is not ASD's guidance and does not describe what the ASD chapter contains.

Segment OT from IT. Keep control networks separate from corporate networks, and allow only the specific connections that operations need, through a controlled boundary.

Control and log remote access. Route vendor and staff remote access through a single managed entry point, require multi-factor authentication, grant access only when it is needed, and record who connected, when and to what.

Keep an asset inventory. Know which controllers, workstations, servers and network devices are in your OT environment, who owns them and what they connect to.

Back up and test recovery. Keep offline copies of controller logic, configurations and engineering files, and regularly test that you can restore them.

Monitor. Collect logs and network traffic from OT boundaries and key systems, and have someone look at the alerts.

We'll summarise this chapter from ASD's own text once we can retrieve it.