Ask a security team which control matters most and the answers will vary: multi-factor authentication, patch management, backups, segmentation. Each of them depends on something more fundamental. A device that is not known cannot be protected, patched, backed up or segmented. The asset inventory is the control on which every other control relies, which is why it appears first in most frameworks, including the CIS Critical Security Controls and IEC 62443.
Why inventories fall short
Most organisations hold several partial records: a spreadsheet from a past project, a configuration management database covering IT servers, vendor drawings for the control system, and knowledge held by experienced engineers. None of them reconcile and none is complete. Meanwhile, new devices arrive with every project, temporary connections become permanent and decommissioned equipment remains on the network long after its planned removal.
What to record
An inventory does not need hundreds of attributes to be effective. For each asset, begin with:
- a unique tag and a clear description
- asset type, vendor, model and firmware or software version
- location, site and network zone (in OT, the Purdue level)
- criticality: the business consequence if it fails or is manipulated
- an accountable owner
- local and remote access methods
Criticality is the attribute that turns a list into a security tool. It determines which assets warrant the strongest controls, the fastest patching and the closest monitoring.
How to build it
- Start from existing records. Gather drawings, project documentation, procurement data and existing lists, then reconcile them.
- Conduct a site walkdown. In industrial environments, a physical walkdown still identifies equipment that no document records.
- Use passive discovery. Passive network monitoring identifies devices and the protocols they use without sending traffic to sensitive equipment.
- Apply active scanning with care. Routine in IT, active scanning in OT should be used only where the vendor and operations team confirm it is safe.
Keeping it current
An inventory begins to degrade the day it is completed unless maintenance is embedded in normal operations. Integrate it with management of change: no device is commissioned or decommissioned without the inventory being updated. Reconcile it regularly against network monitoring, and treat any device observed on the network but absent from the inventory as an event to investigate.
What it enables
With a reliable inventory in place, the rest of the security program becomes achievable. Vulnerability advisories can be matched to the devices they affect. Risks can be linked to the assets they threaten. Segmentation can be designed around observed traffic. Backup coverage can be verified against the controllers that require it. And when an incident occurs, responders know exactly what they are dealing with.
It is not the most visible control, but it is among the first that auditors, insurers and adversaries will test. It is far better to identify the gaps first.