How to Build an OT Asset Inventory That Actually Holds Up

Ask most plant managers how many PLCs, gateways, and HMIs are talking on their factory network right now, and the honest answer is a guess. That guess is no longer good enough. A February 2024 Ponemon Institute survey of 1,056 security professionals, commissioned by OT access-security vendor Cyolo, found that 73% of organisations running OT environments lack an authoritative asset inventory, and 69% reported having either no inventory at all or one that is inaccurate or outdated. Those numbers predate a wave of regulation that now makes "we don't fully know" a compliance failure, not just an operational risk.

Under the EU's NIS2 Directive, asset management is one of the ten minimum cybersecurity measures every covered entity must implement, listed explicitly in Article 21(2)(i) of Directive (EU) 2022/2555. The Cyber Resilience Act's vulnerability-reporting clock — live since 11 September 2026, as covered in our CRA explainer — assumes you can tell whether an affected device is even on your network. And NIST's National Cybersecurity Center of Excellence made the dependency explicit itself: on 25 June 2026 it published a draft project description, Asset Management as a Foundation for Operational Technology Cybersecurity, open for public comment until 31 July 2026, arguing that asset discovery, configuration management, and change management are the base layer everything else in OT security sits on. Segmentation, covered in our IEC 62443 zones and conduits guide, only works if you know what belongs in each zone in the first place.

This post is about the part that guide only had room to state in one line — how you actually build the inventory, and how you keep it from going stale the week after you finish it.

What Belongs in an OT Asset Inventory

An OT inventory isn't a spreadsheet of IT-style software licences. At minimum, each entry needs:

• Asset type and function — PLC, HMI, drive, gateway, sensor, historian node, engineering workstation
• Manufacturer, model, and firmware/OS version — the detail CVE advisories and CRA vulnerability reports are written against
• Network identifiers — IP, MAC, and the protocol it speaks (Modbus, PROFINET, EtherNet/IP, OPC UA — see our industrial Ethernet protocols guide if those are unfamiliar)
• Physical location and zone — which production line, cabinet, and which IEC 62443 zone or Purdue/ISA-95 level it sits in (our Purdue Model and ISA-95 guide is a useful reference here)
• Criticality — what happens to production, safety, or quality if this asset fails or is compromised
• Owner and last-verified date — who is accountable for it, and how stale the entry is allowed to get before it's suspect

Terms like OT, ICS, and IACS are defined in the Software Defined Factory glossary if you want the precise definitions before going further.

Why This Is Harder Than an IT Inventory

IT asset discovery tools routinely probe devices to identify them — that's safe on a laptop fleet and reckless on a factory floor. A twenty-year-old PLC can lock up or drop its control loop if it receives a network scan it was never designed to handle; several documented OT outages trace back to exactly that mistake. Air-gapped cells, by design, won't show up on any network scan at all. And then there's shadow OT: the maintenance engineer's own Raspberry Pi quietly polling a filler's PLC to feed a personal dashboard, or a contractor's laptop left plugged into a spare switch port after a commissioning visit. None of that is malicious, and none of it appears in an inventory built from purchase orders.

Passive Discovery, Active Discovery, and the Manual Walk-Down

The NCCoE's draft project frames OT asset management as a combination of automated and manual methods, and that combination is the right mental model for most plants:

1. Passive network monitoring. A span or mirror port feeding a monitoring tool listens to existing traffic without sending anything — the safest way to discover what's actually talking on a segment, including devices nobody remembers installing.
2. Light active discovery, used selectively. Protocol-aware polling can fill gaps passive monitoring misses, but only on segments you've already confirmed can tolerate it — never on fragile legacy control loops.
3. Manual walk-downs. For air-gapped cells and isolated equipment, someone still has to physically check cabinets, read nameplates, and scan labels. This is slow, but it's the only method that works where there's no network traffic to observe.

No single method gets you a complete inventory on its own. Plants that rely only on passive monitoring miss the air-gapped press line; plants that rely only on a purchasing spreadsheet miss everything installed since the last capital project.

A Practical Step-by-Step Approach

1. Start from your zones, not the whole plant. If you've already mapped IEC 62443 zones and conduits, inventory one zone at a time — it's a bounded, finishable unit of work instead of an open-ended plant-wide project.
2. Get a span port into a passive monitoring tool first. This is the lowest-risk, highest-yield step, and it usually surfaces devices within days.
3. Schedule manual walk-downs for anything air-gapped or isolated. Treat these as their own checklist item — they won't get done opportunistically.
4. Capture the minimum field set above for every asset, consistently. A partial record for half your devices is worse than it looks, because it hides exactly where your blind spots are.
5. Rank by criticality, not alphabetically. Feed that ranking into where you focus condition monitoring — our OEE calculator is a quick way to quantify what an hour of downtime on a given asset actually costs, which makes criticality ranking a numbers exercise instead of a guess.
6. Store it somewhere built for structured asset metadata, not a one-off spreadsheet that one person maintains. If you're already exploring machine-readable asset metadata, the Asset Administration Shell is the emerging standard for carrying exactly this information with the asset itself.

Worked Example: What a Bottling Line Found

A three-line bottling plant ran a two-week passive-monitoring pilot on span ports feeding its packaging and filling cells, as the first phase of a wider segmentation project. It found two things the plant's own documentation didn't show: an older labeller still communicating over Modbus RTU through a serial-to-Ethernet gateway nobody had logged since a contractor installed it years earlier, and a maintenance engineer's Raspberry Pi polling the filler's PLC every few seconds to feed a personal Grafana dashboard on his desk. Neither device was malicious. Both were unmanaged attack surface sitting inside what the plant had assumed was a well-understood network — precisely the blind spot NIS2's asset-management clause and the CRA's reporting obligations are designed to force into the open.

Keeping the Inventory Alive

An inventory built once and never revisited degrades the moment the next change order ships. Treat these as update triggers, not annual-review items: any new vendor remote-access connection, any device swap or firmware update, any new line commissioned. Tie inventory updates into whatever change-management process already governs production changes, so updating the record is a step in an existing workflow rather than a separate chore someone has to remember. This is also the layer that predictive maintenance and digital twin programmes quietly depend on — you can't build a reliable model of an asset you haven't consistently identified.

Where to Start This Week

• Pick one IEC 62443 zone — ideally the one with the highest criticality assets you're least confident about
• Get a span or mirror port routed to a passive monitoring tool for that zone
• Schedule a manual walk-down for anything in it that's air-gapped or isolated
• Capture the minimum field set for every asset found, including the ones nobody remembered
• Set a recurring review cadence and wire inventory updates into your existing change-management process

None of this requires a finished, perfect inventory before your next NIS2 or CRA audit. It requires a defensible, current answer to "what's connected to this network and what does it run" — and right now, per Ponemon's numbers, most manufacturers can't give one. If your team needs the underlying standards covered in more depth, our courses catalogue has material on IT/OT fundamentals to build from.

Sources:

• Ponemon Institute / Cyolo — New Research Identifies Significant Gaps in Securing Access to Connected OT Environments
• IndustrialCyber — New Cyolo and Ponemon Institute Research Identifies Significant Gaps in Securing Access to Connected OT Environments
• NIST NCCoE — New NCCoE Project: Asset Management and Visibility for Operational Technology (OT)
• NIST CSRC — Asset Management as a Foundation for OT Cybersecurity (Initial Public Draft)
• EUR-Lex — Directive (EU) 2022/2555 (NIS2), Article 21