Foundations
OT Asset Inventory
Maintain a current, accurate record of every OT asset, its function, and its criticality.
Defensive guide
Why should I care?
Every other control depends on knowing what exists. Unknown assets cannot be segmented, patched or monitored.
How to implement it
- Start with existing engineering documentation: P&IDs, network drawings, panel schedules
- Add passive network discovery rather than active scanning in production
- Capture function, Purdue level, zone, protocols, criticality and owner — not just IP addresses
- Reconcile against physical walkdowns for field devices and serial equipment
What good looks like
- Inventory updated as part of change management
- Criticality tied to process consequence
- Coverage includes serial and field devices
Common failure modes
- A one-off spreadsheet that ages immediately
- IP-only records with no process context
- Ignoring building systems and vendor equipment
How to verify it
- Sample a zone and compare inventory to observed devices
- Test whether a recent project's assets are recorded