The ACSC champions six fundamental cybersecurity principles that specifically address operational technology (OT) environments. These core directives enable government bodies and industrial sectors to implement robust security measures and develop strategic risk management approaches within their critical infrastructure systems.

1. Safety is paramount

OT cybersecurity prioritises the protection of human life, environmental integrity, and essential infrastructure above all other considerations. Cyberthreats pose direct risks to physical safety, potentially disrupting crucial public services and damaging vital facilities. Australian digital government entities must focus intensively on safeguarding control systems that manage critical infrastructure, including electricity distribution, water purification, and transport operations. Security teams must respond immediately to any cyber incidents that threaten public welfare, treating these situations as highest-priority emergencies.

2. Knowledge of the business is crucial

Organisations must develop comprehensive knowledge of their OT infrastructure to establish effective cybersecurity measures. Security teams should map all critical assets, analyse data movement patterns, and identify system vulnerabilities. Government departments must maintain detailed, current inventories that document both OT components and their operational roles. This systematic understanding enables teams to effectively allocate security resources, deploy targeted protective measures, and coordinate rapid incident responses.

3. OT data is extremely valuable and needs to be protected

Malicious actors actively target sensitive OT data streams, including operational measurements, system controls, and process analytics, to conduct sabotage, gather intelligence, or demand ransoms. Government agencies must deploy comprehensive data security protocols across their OT environments to protect these critical assets. Teams should implement strict access limitations, robust encryption systems, and thorough data protection strategies to safeguard the confidentiality and operational integrity of essential infrastructure systems.

4. Segment and segregate OT from all other networks

Organisations must implement strict network segmentation to separate OT networks from IT infrastructure and internet connections, thereby blocking potential attack pathways. This critical security approach requires robust architectural design and comprehensive access management protocols. Government agencies must establish clear network boundaries to shield essential OT systems from both external cyber threats and internal security risks. Security teams should deploy advanced firewalls, sophisticated intrusion detection systems, and secure remote access mechanisms to enforce this separation.

5. The Supply chain must be secure

Supply chain integrity directly influences OT system security through all hardware components, software elements, and service delivery channels. Government agencies must implement comprehensive vendor risk assessment protocols and strict procurement security standards. Procurement teams must thoroughly evaluate OT vendors’ security capabilities, scrutinise their cybersecurity practices, and incorporate detailed security requirements into contractual agreements. This systematic approach ensures organisations maintain complete control over their supply chain security framework.

6. People are essential for OT cyber security

Personnel expertise and behaviour fundamentally drive OT cybersecurity effectiveness within organisations. Government agencies must develop comprehensive staff training programmes and foster a robust security-focused culture. OT teams must undertake regular cybersecurity education to understand their specific security responsibilities and obligations. Organisations should establish clear protocols for security practice implementation, threat identification reporting, and incident response procedures to strengthen their human security framework.

Cybersecurity for digital government

The ACSC’s Principles of Operational Technology Cyber Security provide essential guidance for protecting Australia’s critical digital infrastructure. Government agencies must implement these principles to safeguard essential services and maintain operational integrity. Security teams must harden systems by eliminating vulnerabilities and enforcing strict administrative controls. The ACSC emphasises that “system hardening is critical to protect against cyber threats by minimising potential attack vectors.”‘

Teams should maintain current software updates, manage patches systematically, and disable all non-essential services. Organisations must implement network segmentation to contain potential security breaches. The ACSC notes that ‘Segmentation actively prevents breach expansion by isolating critical systems from vulnerable networks.’ This strategy ensures that security compromises remain contained within affected segments. Security teams must develop and maintain comprehensive incident response plans. 

These plans should include regular emergency drills, detailed communication protocols, and clearly defined team responsibilities. Procurement teams must select and monitor vendors who demonstrate robust cybersecurity practices. This process requires thorough security assessments and continuous compliance monitoring of all vendor activities. The Australian government strengthens its digital infrastructure resilience through rigorous application of these security principles. The ACSC’s comprehensive framework enables organisations to embed robust cybersecurity measures throughout their operational technology environments, thereby fostering a secure digital government ecosystem.

The Principles in Action framework empowers public sector agencies to strengthen their digital government security through systematic cybersecurity enhancement. Organisations enhance their cyber threat resilience by implementing six key strategies: embedding security in system architecture, deploying strategic network segregation, performing systematic security evaluations, maintaining comprehensive incident response protocols, securing supply chain operations, and developing strong security awareness among staff.

Justin Lance Marcel Lavadia

+ posts

Justin Lavadia is a content producer and editor at Public Spectrum with a diverse writing background spanning various niches and formats. With a wealth of experience, he brings clarity and concise communication to digital content. His expertise lies in crafting engaging content and delivering impactful narratives that resonate with readers.

• Safeguarding data privacy in national infrastructure
• Businesses to drive data privacy’s security standards
• Government on boosting data analytics workforce
• Australia to strengthen data sharing protections