Across the Asia-Pacific region, the rules for operational technology (OT) security are changing fast, and not all at once. A new Asia-Pacific policy report from OT-ISAC, the information sharing and analysis center for operational technology owners in the region (summarized by Industrial Cyber on 26 October 2026, with information current as of 20 October), lays out which changes are already in force, which have a start date coming up, and which are still drafts or voluntary guidance. For anyone who runs plants, utilities, ports or pipelines in the region, or builds equipment that goes into them, that difference matters a great deal.
What changed, country by country:
Japan. The Unified Standards for Cybersecurity Measures for Critical Infrastructure took effect on 1 October 2026, according to Japan's National Cybersecurity Office. They were adopted on 31 July, with sector guidelines following on 11 September. They set a cross-sector baseline built around management involvement, organization-wide risk management and supply chain resilience. They do not add new technical controls for programmable logic controllers (PLCs) or supervisory control and data acquisition (SCADA) systems. Japan also has two proposals out for public comment until 31 October 2026: a draft change to how critical infrastructure operators report cyber intrusions, and draft economic security rules for critical infrastructure equipment and suppliers in land transport, maritime and aviation. Neither is law yet.
India. The Central Electricity Authority notified the Cyber Security in Power Sector Regulations, 2026 on 31 July. They generally take effect on 1 April 2027. They apply to organizations that manage OT tied to the interconnected power system, and to IT systems connected to that OT, with some scope exceptions and capacity thresholds. OT-ISAC expects real effects on network segmentation, audits, monitoring, incident handling, vendor management and recovery.
Australia. The Australian Signals Directorate released ASD Essentials on 15 October 2026, extending its well-known Essential Eight guidance with a dedicated OT chapter. It covers eight areas in priority phases and defines "vital OT" as the systems whose long outage would be unacceptable for safe minimum service. It is guidance, not a mandate, and ASD says existing regulatory obligations still apply. Separately, a Protective Security Policy Framework direction issued on 29 September requires covered federal government entities to take stock of legacy technology by 31 March 2027, with earlier stocktakes due by 31 December 2026 for systems of government significance.
Singapore. The Cyber Security Agency issued its 2026 Cybersecurity Code of Practice for critical information infrastructure on 29 July. It covers board oversight, oversight of interconnected systems, network visibility and detection, and exercises, which makes it directly relevant to OT networks that depend on corporate identity, remote maintenance and the buffer network between IT and OT. Parliament also passed the Digital Infrastructure Bill on 7 October for large data centers and cloud providers, with staged start expected in 2027. Quantum-safe guidance asks critical information infrastructure owners to submit encryption migration plans by 31 March 2027.
Taiwan. The Ministry of Digital Affairs issued a control system security baseline for critical infrastructure providers in the communications and broadcasting sectors on 16 September 2026, effective 1 January 2027. Operators with legacy or technical limits can ask the ministry to approve alternative controls backed by evidence.
China, South Korea, Vietnam and Malaysia. China's revised cyberspace security inspection measures took effect on 1 October 2026 and change how inspections are carried out, not the technical rules. South Korea proposed changes to its vulnerability assessment criteria for major information infrastructure. Vietnam issued a national cybersecurity architecture framework and an assurance index, and consulted on a draft security standard for internet-connected devices. Sarawak in Malaysia launched a cybersecurity strategy to 2030. OT-ISAC treats these as signals to watch rather than new OT mandates.
Who this affects:
Asset owners running OT in these countries, especially power companies in India, communications providers in Taiwan, and designated critical infrastructure owners in Japan and Singapore. Equipment manufacturers and vendors selling into the region, who will see more supplier questions and, in Japan, possible new procurement rules. System integrators and service providers, whose remote access and support arrangements are named directly in several of these documents. Multinational companies with plants in the region, who should not assume one country's rules carry over to another.
Where this shows up from the plant floor to the cloud:
Field devices and controllers are mostly outside these rules directly, but the buffer network between IT and OT, remote vendor access, engineering workstations, identity systems, monitoring, and the cloud and data center services that host historians and support tools are all called out in at least one of them. Several rules also reach into supplier contracts and recovery planning.
What the Red Tiger team recommends:
1. Decide where each rule applies to you. OT-ISAC is clear that coverage depends on legal designation, asset role and the final text, not just the industry you are in, so write down the decision for each site.
2. Run a clause-by-clause gap check of your current OT controls against the rules that are in force or have a date, starting with India's power-sector regulations and Japan's unified standards, and build a plan that respects patch testing, safety limits and outage windows.
3. Review vendor and remote access arrangements now, since supplier oversight and interconnected systems show up in almost every one of these documents.
4. If Japan's draft reporting or supplier rules could affect you, review them and comment before 31 October 2026, and set a calendar check for 31 December 2026, 1 January 2027, 31 March 2027 and 1 April 2027.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Source: https://industrialcyber.co/regulation-standards-and-compliance/ot-isac-tracks-2026-asia-pacific-cybersecurity-policy-shifts-affecting-critical-infrastructure-ot-and-industrial-operations/
Check out our resources and book a follow-up call with our team.
