Build an OT asset inventory in five steps: define scope, identify assets and collect attributes, create a taxonomy, manage the data in one secured place, and plan for the life cycle. CISA's August 2025 guidance, written with international partners, also lists 14 high-priority attributes such as IP address, model and protocols.
Why an inventory comes first
You cannot patch, segment or monitor what you do not know exists. Most other OT controls depend on a list. The CISA guidance was led through its Joint Cyber Defense Collaborative with the Department of Energy, and co-authored by agencies including EPA, NSA, FBI and counterparts in Australia, Canada, Germany, the Netherlands and New Zealand.
The five steps
1. Define scope and objectives. Name the governing authority, assign people to collect and validate data, and agree what counts as an asset.
2. Identify assets and collect attributes. Combine physical inspection with logical and network based surveys. Walking the floor finds devices that never touch the network.
3. Create a taxonomy. Classify by criticality or function. Group assets into zones that share security requirements and conduits that carry controlled communication. Map process dependencies and standardize names.
4. Manage the data. Pull in vendor manuals and maintenance records, and keep everything in a central, secured database or asset management system.
5. Manage the life cycle. Define stages from acquisition to decommissioning, and require an inventory update whenever a device is added or removed, including during emergency changes.
Attributes worth collecting
The guidance lists these as high priority: supported communication protocols, criticality, asset number, role or type, hostname, IP address, logging status, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.
If that feels like a lot, begin with the five you can get fastest, such as manufacturer, model, location, IP address and criticality. Add the rest as you revisit each zone.
Practical tips
- Treat the inventory as a living record. A spreadsheet that is updated at every change beats a perfect scan from last year.
- Prefer passive discovery on live networks and agree any active scanning with operations first. Check the vendor guidance for your devices.
- Record who owns each asset. Ownership gaps are where default passwords survive.
- Capture the emergency change path, because that is when records go stale.
Inventories also help in a crisis. During an advisory, the first question is whether you run the affected product. Our post on legacy software visibility covers that angle in more depth.
Quick check
Is an IT asset inventory enough for OT?
Not on its own. The CISA guidance adds OT specific attributes such as protocols, criticality and process dependencies, and recommends physical inspection alongside network surveys.
What are zones and conduits?
In the guidance, zones are groups of assets with shared security requirements, and conduits are controlled communication paths between them.
Safeguard offers asset discovery and SBOM and dependency scanning for the software side of your estate, such as engineering and business applications. It does not replace passive OT network discovery tools.
Sources
Last reviewed: 19 October 2026.
