OT Asset Inventory: The Unglamorous First Step to Industrial Security

Ask any plant how many PLCs, drives, and HMIs are on the network and you will get a confident answer - then an audit reveals more devices than anyone listed. An accurate OT asset inventory is the foundation of every other security and reliability program.

What an Asset Record Needs

• Vendor, model, serial number, firmware version
• Network address and which zone or segment it lives in
• Owner and maintenance contact
• Criticality (what production impact if it fails or is compromised)
• Communications: what it talks to, on which ports, with what protocol

Discovery Methods

Passive network monitoring is the safest first pass: listen to switch mirror ports or use network taps and learn devices from real traffic without sending anything to production equipment. Active scanning (ping sweeps, SNMP, vendor discovery tools) finds silent devices but must be used carefully - some legacy controllers respond poorly to scans. Physical walk-downs catch everything the network cannot see: serial-only devices, spares, and forgotten test rigs.

Keeping It Alive

The inventory decays the day after it is built. Assign ownership, tie changes to the change-management process, and re-discover quarterly. If the CMMS or maintenance system already tracks equipment, integrate the OT inventory with it instead of maintaining a second, conflicting list.

An inventory nobody trusts is worse than none - it gives false confidence. Make accuracy the goal, not completeness theater.