---
title: "ASD Essentials for OT: What does it mean for me? How do I get started?"
description: ASD's new Essentials framework drops Essential Eight maturity levels and adds an OT chapter. What changed, what didn't, and what OT sites should do first.
---

[NetSeg Blog: Practical OT Cybersecurity for Australian Industry](https://www.netseg.io/netseg-blog)

# [ASD Essentials for OT: What does it mean for me? How do I get started?](https://www.netseg.io/netseg-blog/asd-essentials-for-ot-essential-eight-changes)

 Written by [Leon Poggioli - NetSeg.io](https://www.netseg.io/netseg-blog/author/leon-poggioli-netseg-io) | Oct 22, 2026, 3:39:58 AM

**Short answer:** On 15 October 2026 ASD published the ASD Essentials, the successor to the Essential Eight, with a [dedicated chapter for operational technology](https://www.cyber.gov.au/publication/essentials-for-ot). For OT sites, the big changes are that maturity levels are gone, each action is rated on whether it actually works in each domain, and the OT chapter puts boundaries and critical processes first. Nothing changes overnight: the Essential Eight stays live during the transition and existing regulatory obligations still apply. The sensible first move is a baseline and a plan, not a new project.

## What actually changed

For a decade the Essential Eight has been the default cyber baseline in Australia. It was written for enterprise IT: Windows desktops, Microsoft Office macros, user applications and patching cycles that assume you can reboot on a Tuesday night. OT teams have long had to explain why parts of it did not fit a running plant.

ASD's new Essentials series replaces that single model with chapters for different environments. The first three are:

- **Essentials for enterprise IT**, the direct evolution of the Essential Eight
- **Essentials for operational technology (OT)**, aimed at critical infrastructure operators protecting their OT
- **Essentials for cloud**, for organisations running entirely on SaaS and PaaS

Each chapter uses the same structure. Principles describe the security outcome. Actions describe what must be done to achieve it. Domains describe where that work applies. The principles are drawn from ASD's Information Security Manual, and in the technical matrix actions are mapped to the MITRE ATT&CK techniques they address.

## No more maturity levels

This is the change most people will notice first. Under the Essentials there is no Maturity Level One, Two or Three, and you no longer pick a target level. Instead, each action is assessed in each domain it applies to, using four ratings: not assessed, not effective, partially effective and fully effective.

Two practical consequences:

- **Your old rating does not carry over.** ASD is clear that Essential Eight maturity levels do not automatically convert into Essentials ratings, because the two measure different things. Your existing evidence is the starting point for a gap analysis, not the answer.
- **Evidence has to show the control working, not just switched on.** A policy on a shelf or a setting in a console is not the same as an outcome on the plant floor.

Priority phases replace maturity levels as the way to decide what to do first. They are a recommended sequence, not a score.

## What is different for OT

The OT chapter uses the same domains as enterprise IT but puts them in a different order. ASD says the order reflects the safety requirements of OT, where the priority is the safe and continuous running of physical processes.

- **Phase 1:** Boundary services, and Critical processes and services
- **Phase 2:** Privileged environments and Identity services
- **Phase 3:** Business systems
- **Across all phases:** Governance and culture, and Visibility and response

A few other points will feel familiar to anyone who has worked on a plant:

- **Every device in OT is privileged.** The User devices domain is left out of the OT matrix because all devices in the OT system are treated as privileged. That engineering laptop is an admin device, not a staff endpoint.
- **Patching is risk-based, with compensating controls.** Where an asset cannot or will not be patched, or is critical but out of support, ASD expects compensating protections rather than pretending the patch happened.
- **Isolation is a designed capability.** The chapter calls for demilitarised zones that isolate OT from networks not under the organisation's sole control, and for being able to isolate vital OT and keep it running safely.
- **Remote access is tightened.** Phishing-resistant MFA is expected for users authenticating across a perimeter into OT, and remote access users should be approved, tracked and reviewed.
- **Admin access comes from hardened places.** Engineering and troubleshooting access should only start from dedicated, hardened environments in a segment of equal or greater trust.
- **Isolation has to survive real life.** Third-party dependencies that would fail under isolation, such as licensing, activation, updates and supplier support, need to be identified and tested. Break-glass accounts need to work when other authentication is unavailable.

In short, the OT chapter reads much more like an OT security program than the Essential Eight ever did. For many sites, it describes work they already know they need.

## What has not changed

It is just as important to be clear on what stays the same:

- **Existing obligations still apply.** ASD says organisations should keep meeting current regulatory obligations until regulators communicate changes. If your SOCI Act CIRMP, a contract or an insurer names the Essential Eight, keep meeting it.
- **Both frameworks stay live during the transition.** ASD has not published a fixed retirement date for the Essential Eight. It has said it is talking to regulators and will advise on timeframes.
- **Uplift work should continue.** ASD does not recommend slowing or stopping approved uplift programs. Its transition guidance does say not to start new work solely to reach a superseded Essential Eight target, unless an obligation still requires it or it addresses real risk.
- **Other frameworks still matter.** The OT chapter does not replace IEC 62443 or AESCSF, and ASD has not published a mapping to them. IEC 62443 remains the engineering backbone for zones, conduits and supplier requirements. The Essentials gives a prioritised, outcome-based checklist that sits well alongside it.

## What to do in the next 90 days

### Step 1: Record a transition baseline

Write down where you are today: current Essential Eight maturity, the OT controls you already have, recent risk assessment results and the critical functions each site supports. ASD recommends this as the first step, and it protects the investment you have already made.

### Step 2: Scope the OT domains

For each site, identify what falls into Critical processes and services and Boundary services. These are phase 1 in the OT chapter. Include development and test systems if they hold production trust or can change production.

### Step 3: Check your boundary and remote access

Look at the IT/OT boundary, the DMZ and every remote access path, including vendors. These are phase 1 priorities, common gaps, and usually fixable without stopping production.

### Step 4: Register what you cannot patch

List the legacy and unpatchable assets, the compensating controls protecting them and who accepted the remaining risk. This turns a long-running argument into a managed register.

### Step 5: Rate a few actions honestly

Pick a handful of phase 1 actions at one site and rate them using the four-tier scale. It quickly shows how much evidence you actually hold and what a full assessment will take.

### Step 6: Keep compliance and priorities separate

Keep meeting any Essential Eight obligation in your CIRMP or contracts, but plan new OT work around the Essentials sequence. As ASD puts it, an obligation sets a floor, not a priority order.

### What does this mean in practical terms?

Essentials for OT simplifies protecting these systems especially well for organisations with limited resources who can't fund a long and complex program.  It also recognises the importance of Governance and Culture - which is priority #1 to driving an effective program.

How do you kick off Governance and Culture?  Connect with a stakeholder who owns your OT assets and understanding their priorities. 

The other 7 key elements can also be approached in similar ways, as outlined below:

Visibility and Response: Deploy an OT visibility tool (such as Claroty, Nozomi, Dragos or Armis) to gather asset inventory and map assets against known risks such as EOL and KEVs.

Critical Processes and Services: This is a "crown jewels" analysis of your critical processes and systems - and MUST be done in partnership with an OT stakeholder, so that any cyber controls can be deployed with full awareness of cybersecurity constraints.  

Boundary Services: Deploy IT/OT boundary protection, an IT/OT DMZ, and audit your OT remote access methods (using your visibility tooling) to understand how porous our OT boundary is.  *Do NOT take an air gap strategy unless it has been verified by your visibility tool, which can map any external connectivity!*

Identity Services: Your lowest hanging fruit is default credentials, so start there.  Your visibility tool should alert on that.

Privileged Environments: Understand which critical subsystems exist within each OT site.  This forms planning for future Network Segmentation strategy using the Zones and Conduits approach in AS/IEC 62443.

Business Systems: Understand where OT needs to speak to IT, and route traffic through your IT/OT Boundary DMZ layer. 

User Devices: Ensure mobile devices operating within OT are monitored, patched, and checked for Malware.  Your asset inventory tooling will be able to 

**How can NetSeg or PICSEL help?**

NetSeg has an Essentials for OT readiness assessment available - [more information is here.](https://www.netseg.io/hubfs/NetSeg-ASD-Essentials-for-OT.pdf)

 

[Book a time with Leon to discuss pricing and when he can start](https://calendar.app.google/q1gp4ZNqm2CiHL1L9)

[View full post](https://www.netseg.io/netseg-blog/asd-essentials-for-ot-essential-eight-changes)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Leon Poggioli - NetSeg.io"
  },
  "dateModified" : "2026-10-22T03:39:58.438Z",
  "datePublished" : "2026-10-22T03:39:58Z",
  "headline" : "ASD Essentials for OT: What does it mean for me? How do I get started?",
  "image" : {
    "@type" : "ImageObject",
    "height" : 816,
    "url" : "https://442598819.fs1.hubspotusercontent-ap1.net/hubfs/442598819/PLC-Panel-Explained-7.webp",
    "width" : 1456
  },
  "mainEntityOfPage" : "https://www.netseg.io/netseg-blog/asd-essentials-for-ot-essential-eight-changes",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "NetSeg Blog: Practical OT Cybersecurity for Australian Industry"
  }
}
```