The 's Essentials series, which is replacing the , includes a chapter for operational technology: the industrial control systems, building management systems and connected equipment that run physical processes rather than office IT. It is one of the clearest signals that the Essential Eight is being retired for a good reason. It was written for enterprise IT, and it was never a sensible fit for OT.
Why OT could never fit the Essential Eight
The Essential Eight assumes you can patch quickly, reboot, and run modern endpoint controls. Operational technology often cannot. A control system running a production line, a water treatment plant or a building's services may run software a decade old, cannot be patched without risking a safety-critical process, and cannot be taken offline on a normal maintenance cycle. Applying patch within 48 hours to a system that runs continuously and was never designed to be touched is impractical, and on a safety-critical process it can be dangerous. OT security is a different discipline, and it needed a different framework.
What Essentials for OT is likely to cover
The chapter is confirmed but not yet detailed, so this is informed expectation. OT security has well-established principles, so the direction is reasonably clear. Strong segmentation between OT and IT networks, so a compromise on the office side cannot reach the plant. Tight control over who and what can connect to OT systems. Monitoring designed for OT protocols rather than standard IT tools. And a realistic approach to legacy systems that cannot be patched, isolating them rather than pretending they can be brought up to date. Like the rest of the series, expect outcomes and intent rather than a prescriptive checklist.
Who this is for
If your business runs manufacturing, utilities, logistics, mining, large-scale agriculture, building management, or healthcare with connected medical devices, you have OT, and this chapter is aimed at you. Many organisations do not realise how much OT they carry. Heating and cooling controls, access and lift systems, warehouse automation and process equipment all count. The moment any of it is connected to a network, it is in scope.
What to do now
- Map your OT. Know what connected equipment and control systems you run, and what they are connected to. Most OT incidents start with something nobody knew was on the network.
- Segment OT from IT. This is the single highest-value control, and the one Essentials for OT will centre on. An office should never be able to reach a control system.
- Stop forcing the Essential Eight onto OT. If you have been struggling to apply IT controls to industrial systems, the new chapter is the ASD acknowledging that was never the right approach.
If you run OT and are not certain where the boundaries sit, a and OT exposure review is the sensible first step. We map what is connected, find the paths between your IT and OT, and give you an ordered plan to close them.
General guidance based on ASD material current at July 2026. Essentials for Operational Technology is confirmed as a chapter but not yet published in detail, and specifics may change.
