The 's Essentials series, which replaces the , includes a chapter for operational technology: the industrial control systems, building management systems and connected equipment that run physical processes rather than office IT. Anyone who has tried to apply the Essential Eight to a plant already knows why that chapter exists. The Essential Eight was written for enterprise IT. It never fit OT.
Why OT could never fit the Essential Eight
The Essential Eight assumes you can patch quickly, reboot, and run modern endpoint controls. Operational technology often cannot do any of the three.
A control system running a production line, a water treatment plant or a building's services may be running software a decade old. Patching it can risk a safety-critical process. Taking it offline on a normal maintenance cycle may not be an option at all. "Patch within 48 hours" applied to a system that runs continuously and was never designed to be touched is impractical at best. On a safety-critical process it is dangerous. OT security is a different discipline, and it needed a different framework.
What Essentials for OT is likely to cover
The chapter is confirmed but not yet detailed, so this is informed expectation. OT security does have well-established principles, so the direction is not hard to read.
Segmentation between OT and IT networks is almost certainly the centrepiece, so that a compromise on the office side cannot reach the plant. Expect tight control over who and what connects to OT systems. Expect monitoring built for OT protocols rather than standard IT tooling bolted on. And expect something realistic about legacy systems that genuinely cannot be patched, isolating them rather than pretending they can be brought up to date.
As with the rest of the series, the framing will be outcomes and intent rather than a prescriptive checklist.
Who this is for
Manufacturing, utilities, logistics, mining, large-scale agriculture, building management, healthcare with connected medical devices: if that is your business, you have OT and this chapter is aimed at you.
Plenty of organisations carry more OT than they realise. Heating and cooling controls. Access and lift systems. Warehouse automation. Process equipment. The moment any of it touches a network, it is in scope.
What to do now
- Map your OT. Know what connected equipment and control systems you run, and what they talk to. Most OT incidents start with something nobody knew was on the network.
- Segment OT from IT. This is the highest-value control you can implement, and the one Essentials for OT will centre on. An office should never be able to reach a control system.
- Stop forcing the Essential Eight onto OT. If you have been struggling to apply IT controls to industrial systems, this chapter is the ASD acknowledging that was never the right approach.
If you run OT and are not certain where the boundaries sit, start with a and OT exposure review. We map what is connected, find the paths between your IT and OT, and give you an ordered plan to close them.
General guidance based on ASD material current at July 2026. Essentials for Operational Technology is confirmed as a chapter but not yet published in detail, and specifics may change.
