What is an Asset Inventory?
An Asset Inventory is an organised, regularly updated list of all systems, devices, software and components in an organisation, recording for each asset the attributes needed for management, risk analysis and security. It covers both IT assets (servers, laptops, switches) and OT assets (PLCs, SCADA servers, HMIs, sensors and actuators). The principle is simple: you can only secure what you know about. That is why the inventory sits at the start of almost every cybersecurity programme and every industrial security standard.
🎯 Why is an Asset Inventory important?
Without an inventory you do not know which devices are vulnerable, which connections exist or what happens when a system fails. A good inventory gives you:
- Insight into vulnerabilities - matching firmware and software versions against CVEs and the CISA KEV catalogue for vulnerability management
- Detection of unknown equipment - a rogue device only stands out when you know what should be there
- A foundation for segmentation and access management - zones and rules can only be designed once you know which assets talk to each other
- Compliance - NIS2, IEC 62443, ISO 27001 and NIST CSF all require an inventory
- Visibility of the attack surface - every unknown or forgotten device is a potential entry point for an attacker
- Faster recovery - during incident response, forensic investigation and recovery you know straight away which backups, spare parts and suppliers you need
- More efficient maintenance - replacement planning for legacy systems approaching end of life
- Better collaboration - IT, OT, maintenance and security work from one shared picture of the installation
📜 Which standards and guidelines require an Asset Inventory?
| Framework | Requirement | Essence |
|---|---|---|
| IEC 62443-3-3 | SR 7.8 Control system component inventory | Required from Security Level 2; the system must support an up-to-date component inventory |
| NIS2 | Art. 21(2)(i): asset management | Duty of care; in the Netherlands in force via the Cyberbeveiligingswet since 15 August 2026 |
| Implementing Regulation (EU) 2024/2690 | Annex, point 12.4 | Complete, up-to-date inventory for, among others, cloud, data centre and managed service providers |
| ISO 27001:2022 | Annex A 5.9 | Inventory of information and other associated assets, each with an owner |
| CIS Controls v8.1 | Control 1 (hardware) and 2 (software) | Review the inventory at least every six months; active and passive discovery |
| NIST CSF 2.0 | ID.AM-01 to ID.AM-08 | Inventories of hardware (including OT), software, data flows and life cycle |
In August 2025, CISA, the NSA, the FBI and the EPA, together with partners from Australia, Canada, Germany (BSI), New Zealand and the Netherlands (NCSC), published the joint guide Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators. It describes five steps: define scope and objectives, identify assets and collect attributes, create an OT taxonomy, manage the data and implement life cycle management. The guide includes example taxonomies for oil and gas, electricity, and water and wastewater.
📦 What should you record for each asset?
The joint guide lists fourteen high-priority attributes. In practice an OT record looks like this:
| Attribute | Example |
|---|---|
| Asset number and hostname | A-10234 / PLC_Bottling_Line3 |
| Role / type | PLC, engineering station, switch, HMI |
| Manufacturer and model | Siemens S7-1500 CPU 1516-3 PN/DP |
| Firmware / OS | Firmware V3.1, Windows 10 IoT Enterprise LTSC |
| IP and MAC address | 192.168.1.22 / 00:0C:29:3E:2A:5F |
| Protocols and ports | ProfiNET, S7comm (TCP 102), Modbus TCP (502) |
| Location | Hall A, cabinet K-12, rack 2 |
| Network segment / zone | OT-VLAN-03, zone Production line 3 |
| Criticality | High / medium / low, based on a risk assessment |
| User accounts and logging | Local accounts, syslog on or off |
| Owner and status | Process owner, active / under maintenance / decommissioned |
| Serial number and life cycle | 12345-PLCB-XY99, end of support 2030 |
Where possible, add an SBOM for software with many components. Also record which assets communicate with each other: those communication paths later become the conduits in the zones and conduits model.
🔍 How do you map OT assets safely?
In OT you combine several methods, because no single method sees everything:
| Method | How it works | Strength | Risk / limitation |
|---|---|---|---|
| Passive monitoring | Listening via a SPAN port or TAP with protocol analysis | No extra traffic on the network | Only sees devices that communicate |
| Active safe queries | Native protocol requests, such as Modbus Read Device Identification or EtherNet/IP ListIdentity | Exact firmware versions and serial numbers | Use sparingly and only after consulting the vendor |
| Configuration files | Projects from engineering software, switch and firewall configurations | Complete picture, including silent assets | Files often lag behind reality |
| Physical walkdown | Walking past cabinets and installations on site | Finds serial and standalone equipment | Labour-intensive, a snapshot in time |
Classic network scans with Nmap or IT scanners are risky in OT. NIST SP 800-82 Rev. 3 warns that active scans can overload older controllers. So start with passive monitoring and asset discovery, add targeted queries during a maintenance window, and verify the result with a walkdown.
🛠️ Which tools do you use for an Asset Inventory?
| Category | Examples | Use |
|---|---|---|
| OT visibility platforms | Claroty, Nozomi, Dragos, Tenable OT | Passive discovery, safe active queries, vulnerabilities per asset |
| IT asset and scanning tools | Lansweeper, Qualys, Tenable | Active scans and agents in office IT and the DMZ |
| CMDB and EAM / CMMS | ServiceNow, SAP PM, Maximo | Central registration, ownership, maintenance |
| SIEM / OT SOC | Splunk, Microsoft Sentinel, IBM QRadar | Correlating logs with asset context and prioritising alerts by criticality |
| Spreadsheet | Excel or a shared list | Starting point for small installations |
🔄 How does an Asset Inventory relate to a CMDB and Asset Discovery?
- Asset Discovery is the process that finds assets. The inventory is the result that you validate, enrich and maintain.
- CMDB is the configuration database from IT service management. It can hold the inventory, but mainly records relationships and configurations for configuration management.
- Asset Management is the broader discipline that steers value, maintenance and replacement over the entire life cycle. The inventory is its data foundation.
🔐 How do you keep the inventory up to date?
An inventory goes stale quickly. These arrangements keep it current:
- Link it to MOC and change management - every installation, replacement or removal updates the inventory, including emergency changes.
- Appoint owners - one person per zone or installation who validates the data.
- Keep passive monitoring running continuously - new devices and firmware changes then trigger an immediate alert.
- Review periodically - at least every six months, as CIS Control 1 prescribes, and after every major shutdown.
- Secure the inventory itself - the list is a roadmap for attackers; restrict access and keep an offline copy.
Then put the inventory to work: for patch management, network segmentation, assigning security levels (SL) in line with IEC 62443, and managing remote access, VPN and jump servers.
❓ Frequently asked questions
What is the difference between an asset inventory and asset discovery?
Asset discovery is the process of finding devices and software on a network, either passively or actively. An asset inventory is the validated and enriched list that results from it, supplemented with data such as owner, criticality and location. Discovery supplies the raw material; the inventory is the managed end product.
Is an asset inventory mandatory under NIS2?
NIS2 explicitly names asset management in Article 21 as part of the cybersecurity risk-management measures. In the Netherlands this duty of care has applied to essential and important entities through the Cyberbeveiligingswet since 15 August 2026. Without an asset inventory it is practically impossible to meet that duty.
Can I scan an OT network with Nmap?
Scanning an OT network with Nmap or other IT scanners can disrupt older PLCs and RTUs or cause them to hang. For an OT asset inventory, prefer passive monitoring and, only where necessary, safe native protocol queries during a maintenance window. Consult the vendor and the process owner beforehand.
How often should an asset inventory be updated?
An asset inventory should be updated with every change, linked to the change management process. CIS Control 1 additionally requires a full review at least every six months. Continuous passive monitoring helps you spot differences between the inventory and reality immediately.
Which data matter most in an OT asset inventory?
The joint guide from CISA and its partners lists, among others, asset number, role, manufacturer, model, operating system or firmware, IP and MAC address, protocols, ports, user accounts, logging, location and criticality. Start with that core and extend it with owner, serial number and end-of-support date.
Can a CMDB serve as an asset inventory?
A CMDB can act as the central store for the asset inventory, provided OT-specific fields such as firmware, protocols and zone fit into it. Many organisations connect an OT visibility platform to the CMDB so that discovered assets are updated automatically. A CMDB without current OT data, however, gives a false sense of visibility.
📌 In summary
An Asset Inventory is the current, validated list of all IT and OT assets and their attributes, and forms the foundation for vulnerability management, segmentation, compliance and incident response. In OT you build it safely with passive monitoring, targeted queries, configuration files and walkdowns, and keep it current through change management and named owners. Without reliable asset data you cannot deliver effective security, monitoring or risk management.