“We don't have a reliable picture of what's on our OT networks.”
Incomplete asset information makes it harder to understand dependencies, ownership, security exposure and assessment scope. This use case describes a practical way to consolidate what you already have and be honest about what is still unknown.
You cannot agree the scope of an assessment without knowing what is in it.
Advisories only matter if you know whether affected versions are present.
Responders need to know what a compromised asset connects to and who owns it.
Unowned assets tend to be unpatched, unmonitored and undocumented.
A sequence that can be adapted to your environment and scope.
Gather drawings, exports, maintenance records and surveys into one structure.
Apply consistent asset classes, vendor names and location references.
Flag duplicates, conflicts, missing attributes and stale records.
Assign zone, owner, function and criticality to each asset.
Record what remains unknown and how it will be resolved.
A plant holds asset information in three places: an engineering drawing set, a maintenance system and a spreadsheet kept by the controls team. Merging them reveals duplicates, controllers missing firmware versions and network switches that appear in no record at all. The gaps are listed with owners, and the controls team verifies the most critical area first.
Yes. Documentation, exports, surveys and engineering knowledge can produce a useful inventory. Discovery or monitoring tools add verification and change detection if you have them.
Accurate enough for the decisions it supports. Recording the source and verification status of each record is more useful than claiming completeness.
From the blog
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the articleManufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the articleSegmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.