Industrial equipment, including the control systems on oil and gas sites, runs firmware and embedded libraries that most owners cannot list. An SBOM for each device turns "what is inside this controller?" into a lookup, which helps when a new vulnerability is announced. The standards that frame the work are IEC 62443 and NIST SP 800-82.
This is a general explainer. It describes no incident at any site, and it makes no claim about specific operators. Safety and uptime decisions on a live facility belong to engineers who know the plant.
Why is operational technology different?
NIST SP 800-82 Revision 3, published in September 2023, is NIST's guide to operational technology security. NIST describes OT as a broad range of programmable systems and devices that interact with the physical environment, and notes their unique performance, reliability and safety requirements. Covered systems include industrial control systems, building automation and others.
Those requirements change how you handle a vulnerability. You cannot reboot a controller in the middle of a process because a patch exists. Updates need testing and a maintenance window. So knowing what you have, and ranking what matters, comes before patching.
What does IEC 62443 add?
The ISA/IEC 62443 series sets requirements and processes for securing industrial automation and control systems. ISA describes four stakeholder groups: asset owners, automation product suppliers, integrators and service suppliers, and treats shared responsibility as a founding principle.
Two parts bear on software inventory. ISA lists ISA 62443-2-3 on patch management, and ISA 62443-4-1 on secure product development lifecycle requirements for suppliers. In practice that suggests a split: suppliers should know and disclose what is in their products, and owners should record it and act on advisories.
What goes in a machine SBOM?
For a PLC, gateway or remote terminal unit, ask the supplier for:
- Firmware version and the operating system or real time kernel
- Open source and third party libraries, with versions
- Any bundled web server, protocol stack or update agent
- How and how often the supplier publishes security advisories
CISA's SBOM page covers SBOM concepts, sharing and VEX, but it contains no OT specific guidance in the part we read, so do not assume a ready made profile for devices. Ask your supplier what format they can provide. SPDX and CycloneDX are common, and Safeguard's CLI accepts both.
What to do with the data
- Inventory first. One record per device: model, location, firmware, owner, SBOM reference.
- Match to advisories. When a library vulnerability is announced, find devices that contain it.
- Rank by exposure. A device on an isolated network differs from one reachable from the corporate network. Reachability analysis on your own software helps, but for third party firmware you will rely mostly on supplier statements.
- Plan the fix. Patch, mitigate with network controls, or accept with a record. Choose with operations and safety staff.
- Put it in contracts. Ask for SBOMs and advisory commitments when you buy or renew.
Where Safeguard fits
Safeguard ingests SBOMs, validates them and scans them against vulnerability data, and the same CLI scans directories, repositories and container images, which suits gateways and edge software you build or configure. It does not run on controllers, and it does not manage operational networks.
What to do
- Pick one site or line and list its programmable devices.
- Request SBOMs and advisory contacts from each supplier.
- Store them in one place and keep device records current.
- Check new advisories against that store weekly.
- Add SBOM requirements to your next purchase and renewal cycle.
- Read NIST SP 800-82 and the IEC 62443 overview with your engineering team.
Quick check
Can we patch OT devices the way we patch servers?
Usually not. NIST notes OT has distinct performance, reliability and safety requirements, so updates need testing and planned windows.
Do suppliers have to give us an SBOM?
Not automatically. Make it a contract requirement. IEC 62443 treats security as a shared responsibility between owners and suppliers.
Sources
- NIST SP 800-82 Rev. 3, fetched 18 October 2026
- ISA: ISA/IEC 62443 series of standards, fetched 18 October 2026
- CISA: Software Bill of Materials, fetched 18 October 2026
- Safeguard CLI documentation, fetched 18 October 2026
Last reviewed: 18 October 2026.
