Operational Technology
Pages
Page 29 of 37
Principle 1. Understand and manage your RF assets
A prerequisite for applying this guidance is maintaining an accurate understanding of your RF assets. Operators should know:
- what RF devices and links exist within their environment
- where they are deployed
- how they are configured
- how they are managed throughout their lifecycle
To achieve this, organisations should follow the NCSC’s guidance creating and maintaining a definitive view of your OT architecture.
Defining and maintaining a central record of your RF estate is essential for the effective implementation of the principles in this guidance. This can be achieved in different ways depending on the bandwidth and connectivity characteristics of the system.
-
In low bandwidth systems, centralisation may be achieved through periodic synchronisation, offline planning, and controlled maintenance activities.
-
In higher‑bandwidth systems, centralisation may be achieved through continuous or near‑real‑time connectivity to RF devices, enabling centralised visibility of asset state, configuration, firmware, and cryptographic posture. This can support more timely detection of misconfiguration or unauthorised change, provided management communications are appropriately secured.
By providing a single, authoritative view of RF assets and their intended configuration, centralised management supports consistent deployment, reduces the risk of misconfiguration, and improves assurance that security controls are applied uniformly across the radio estate.
As a minimum, centralised management should support:
- accurate asset management, including device identity, location, role, and RF parameters
- secure lifecycle control, including secure commissioning, controlled changes during operation, and assured decommissioning of RF devices and links.
- visibility of firmware version, cryptographic state, and keying material allocation
- verification that security policies (such as encryption, segregation, and access controls) are correctly applied
- continued ability of the radio network to transmit data if the management system is unavailable