--- sourceDocument: Australia Operational Technology Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/operational-technology Release : - australia ft:locale : - en-US ft:publication_title : - Australia Operational Technology Management ft:clusterId : - optm bundleId : - optm workflow : - Technology --- # Enhanced Access Control # Enhanced Access Control for Operational Technology {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Enhanced Access Control for Operational Technology Enhanced Access Control for Operational Technology (OT) in ServiceNow Australia release introduces advanced security measures to safeguard OT data. It extends granular access control down to the Equipment Model Entity (EME) level, allowing restrictions from broad site access to specific plants, lines, and ISA 95 hierarchy nodes. This feature helps prevent misconfigurations and security breaches by applying fine-tuned access rules. Show full answer Show less ## Key Features * **Data Filters:** Control access at the query level to limit data exposure. * **Deny Unless ACLs:** Enforce conditions that must be met to access data, supporting strict IT and OT separation. * **ACL Query Rules:** Use exact and range query operations for precise query privilege control. * **IT and OT Separation:** Non-OT users cannot view OT devices in the CMDB. Access to OT Configuration Items (CIs) is restricted to users with specific roles. * **OT Roles:** * **OT Viewer (cmdbotviewer):** Read-only access to OT device records. * **OT Editor (cmdboteditor):** Can create, read, update, and delete OT extension class records but cannot modify IT CIs or certain related lists. * **Site-Based Access:** Defines which users can view or edit OT devices based on site assignment using Can Read and Can Edit user criteria. * Users with **cmdbotviewer** role and Can Read access can only view OT devices for assigned sites. * Users with **cmdboteditor** role require Can Edit access to modify OT devices at designated sites; otherwise, they only have view permissions. ## Important Considerations * Records in the `isaentityusercriteriaaccess` table cannot be created directly via the UI or inserts; existing records can be read and updated according to ACLs. * OT Editors are restricted from editing or deleting IT CIs and specific related list items to maintain IT/OT boundary integrity. ## Practical Impact for ServiceNow Customers This enhanced access control framework empowers customers to securely manage OT assets by: * Restricting OT data visibility and modification rights to authorized personnel only. * Providing clear role definitions to separate IT and OT responsibilities. * Allowing site-level access controls that can be finely tuned for operational needs. * Reducing risk of unauthorized changes and data exposure in critical OT environments. By implementing these controls, organizations can better align with security best practices and compliance requirements for operational technology management within ServiceNow. Enhanced Access Control for OT implements data filters, deny unless access control rules (ACLs), and ACL query rules to help promote system security. Granular access control extends these protections to the Equipment Model Entity (EME) level, so you can restrict access from the site level to individual plants, lines, areas, and other ISA 95 hierarchy nodes. ## Enhanced Access Control overview {#ot-enhanced-access-control__section_lhc_b5s_dgc} Enhanced Access Control provides the following components to provide access control configurations for your data to help avoid misconfiguration and security issues. Data filers : Ability to control access at the query level. Deny Unless ACLs : Ability to deny access to data unless the specific conditions are met. ACL Query Rules : Exact query and range query ACL operations to control query privileges. ## Enhanced Access Control for OT {#ot-enhanced-access-control__section_zjc_w5s_dgc} Deny Unless ACLs help enforce IT and OT separation and site-based access. IT and OT separation Non-OT users can't view OT devices in Configuration Management Database (CMDB) tables. If a device is classified as an OT CI, only users assigned the cmdb_ot_viewer role, or the cmdb_ot_editor role can access it. The following table describes each role.{#ot-enhanced-access-control__table_lgz_3w2_fgc__entry__2} | Role | Description | |-|-| | OT Viewer \[cmdb_ot_viewer\] | Read-only access to OT device records. | | OT Editor \[cmdb_ot_editor\] | Create, read, update, and delete access for [Operation Technology (OT) extension classes](https://www.servicenow.com/docs/access?context=cmdb-ci-class-models-operation-technology&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). Note: Users assigned the cmdb_ot_editor role can edit and delete only OT configuration items (CIs) and can't edit IT CIs. | [Table 1. OT roles to view OT CIs] {#ot-enhanced-access-control__table_lgz_3w2_fgc} There are also restrictions on OT users who can edit or delete IT configuration items (CIs). Users assigned the cmdb_ot_editor role, or the cmdb_ot_admin role can't edit or delete IT CIs in the following related lists: * IP Address * Network Adapter * Storage Device * File System * Memory Module * Patch = CI Field * Package = CI Field * Managed Network {#ot-enhanced-access-control__ul_ed2_ncf_fgc} Site-based access Site-based access specifies which users can view, edit, and delete OT devices for a designated site. You can assign site-based access to users by using Can Read or Can Edit user criteria. For more information about assigned Can Read access, see [Assign user criteria for Can Read access to a site](https://www.servicenow.com/docs/rMaPhN4dNxpPcclozBDYAA "Assign the user criteria to a site to define which users can read or view the equipment model entities that belong to the selected site."). For more information about assigning Can Edit access, see [Assign user criteria for Can Edit access to a site](https://www.servicenow.com/docs/B4LPVIQoIUvFk17qRu~5ZQ "Assign the user criteria to a site to define which users can edit the equipment model entities that belong to the selected site."). The following table describes the site-based access for users assigned the cmdb_ot_viewer role or the cmdb_ot_editor role. {#ot-enhanced-access-control__table_td2_jy2_fgc__entry__2} | Role | Site-based permission | |-|-| | cmdb_ot_viewer | With Can Read access, users assigned the cmdb_ot_viewer role can only view OT devices for a designated site. For example, if you're assigned the cmdb_ot_viewer role and have Can Read access to the Atlanta site, then you can only view the site's OT devices. You can't edit or delete the OT devices associated with Atlanta. | | cmdb_ot_editor | To edit OT devices, users with the cmdb_ot_editor role should be assigned Can Edit access for the site, or sites they belong to. For example, if you're assigned the cmdb_ot_editor role but only have Can Read access to the Atlanta site, you can only view the devices associated with Atlanta. If you're assigned the cmdb_ot_editor role and have Can Edit access to the San Diego site, you can edit or delete the devices associated with San Diego. | [Table 2. Site-based access for OT roles] {#ot-enhanced-access-control__table_td2_jy2_fgc} Important: New records can't be created directly on the `isa_entity_user_criteria_access` table through the UI or any insert path. Existing records on this table remain readable and can be updated per the applicable ACL.