Asset Management

What is Asset Management?

Asset management is the coordinated activity of an organisation to realise value from its assets, by balancing performance, cost and risk across the entire lifecycle, from acquisition and operation to maintenance and decommissioning. In an industrial environment it covers everything that keeps production running: machines, installations, control systems, networks, and the software and data that belong to them. The term is used in two worlds. Maintenance and engineering mean the management of physical assets in line with ISO 55000, while security teams mostly think of an up-to-date overview of every device. In IT/OT convergence the two come together.

🧠 Which assets does asset management cover?

In an industrial environment this typically includes:

• Production equipment - machines, pumps, compressors, and ventilation, pumping or cooling installations
• Field equipment - sensors, valves and transmitters, often read via IO-Link or HART
• Control systems - PLCs, SCADA servers and HMI systems
• Network equipment - switches, routers, firewalls and wireless gateways
• Software and data - firmware, engineering projects, configurations, licences and process data

ISO 55000 defines an asset broadly as an item, thing or entity that has potential or actual value to an organisation. That means a PLC program or a recipe in an MES falls under asset management too, not just the hardware.

🔄 Which forms of asset management exist?

In finance, asset management means investment management, which this knowledge base does not cover. Within engineering and IT, “asset management” can still mean four different things. They overlap, but each has its own core question and its own systems.

An EAM (Enterprise Asset Management) suite combines an asset register with the functions of a CMMS and adds procurement, inventory and financial lifecycle data, among other things. An asset inventory records what you have. Asset management is about the decisions you take on that basis.

🎯 What are the goals of asset management?

• Insight into the location, status, performance and owner of every asset
• Planned maintenance - predictive maintenance and condition-based maintenance rather than only reacting to failures
• Less downtime and longer equipment life, measurable with KPIs such as MTBF, MTTR and OEE
• Safety - critical assets, such as safety systems and pressure equipment, are demonstrably monitored and maintained
• Security - unknown or outdated devices are found before an attacker finds them
• Compliance - demonstrable management for ISO 55001, ISO 27001, IEC 62443, the BIO and the Dutch Cybersecurity Act
• Better investment decisions - replace, overhaul or keep running based on risk and total lifecycle cost instead of age alone

🔄 What does the lifecycle of an asset look like?

1. Specification and procurement - define requirements, including security requirements and the supplier’s support period
2. Inventory and commissioning - what is present, where, and with which baseline configuration?
3. Monitoring - what is its status, condition or service life? This is tracked through monitoring and condition monitoring
4. Maintenance - periodic, corrective or predictive
5. Upgrades or replacement - based on condition, performance, risk and the supplier’s lifecycle status
6. Decommissioning and disposal - safely, documented, and with configurations and data wiped

In OT, these lifecycles vary widely. That is why lifecycle management belongs in every asset management programme.

🧰 How does asset management work in OT environments?

Asset management in OT is not a standalone system, but a chain of links between production and business systems.

A common mistake is that maintenance, IT and security each keep their own list. The CMMS knows the pump, the CMDB knows the server, and the OT monitoring tool knows the PLC’s IP address, but nobody sees the whole picture. A shared key, such as a unique asset number or the tag number from the plant documentation, makes it possible to connect these sources.

Sector standards also exist for reliability data. ISO 14224 (latest edition 2016), for example, describes how oil, gas and petrochemical companies record failure and maintenance data per equipment class, so that FMEA and reliability analyses become comparable.

🔐 Why is asset management the foundation of OT security?

You can only protect what you know. Effective asset management is essential for:

• Risk analysis and classification - which assets are business-critical? This follows from a risk assessment or Business Impact Analysis
• Defense in Depth - knowing what you need to protect and which zone it belongs in
• Vulnerability management - matching firmware versions to known vulnerabilities and prioritising patch management
• Detection - SIEM and IDS systems get context: an alert about a safety PLC weighs more than one about a test system
• Change control - change management and configuration management keep the overview current

In August 2025, CISA, the NSA, the FBI and the EPA published, together with partners including the Dutch NCSC and the German BSI, the guidance Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators. It describes five steps: define scope, identify assets and collect attributes, create a taxonomy with zones and conduits, manage the data, and implement lifecycle management.

🧭 How do you set up asset management step by step?

1. Define scope and ownership - which sites, installations and asset types are included, and who is responsible for each asset? Under ISO 55001 this includes an asset management policy and a strategic asset management plan (SAMP).
2. Map the assets - combine a physical walk-down of cabinets and panels with passive network monitoring, for example with tools from Claroty, Nozomi or Dragos. Only use active scans in OT under controlled conditions, because older PLCs can respond badly to them.
3. Record fixed attributes - asset number, type, manufacturer, model, firmware, IP and MAC address, protocols, location, zone, owner and criticality. Add an SBOM where available.
4. Classify by criticality - determine for each asset the impact of a failure on safety, production, the environment and legal obligations.
5. Choose a maintenance strategy per class - reactive for cheap and redundant parts, preventive or condition-based for important assets, predictive for critical and expensive installations.
6. Connect the sources - link the CMMS, CMDB, historian and OT inventory through a shared asset number, so that one change is visible everywhere.
7. Watch for obsolescence - follow the suppliers’ lifecycle status and plan migrations of legacy systems well before end of support.
8. Measure and improve - report availability, MTBF, MTTR, maintenance costs and the percentage of assets with a known owner and firmware version.

In the Netherlands, physical asset management has long been common practice among operators of critical infrastructure. Electricity and gas grid operators certify against NTA 8120, which is derived from the British specification PAS 55. Rijkswaterstaat and ProRail align with ISO 55000. At water boards and drinking water companies both worlds meet: the asset register for pumping stations and treatment plants, and the OT inventory that the Cybersecurity Act requires.

❓ Frequently asked questions

What is the difference between asset management and an asset inventory?

An asset inventory is an up-to-date list of all devices, software and components with their attributes. Asset management goes further: it uses that data to make decisions about maintenance, replacement, investment and security. The inventory is therefore a building block of asset management, not the whole of it.

Is ISO 55001 mandatory?

ISO 55001 is a voluntary, certifiable standard for an asset management system; the second edition has applied since July 2024. No law prescribes it in general, but clients and regulators do ask for it. Dutch grid operators are legally required to have a quality management system and certify against NTA 8120 for that purpose.

What is the difference between a CMMS and an EAM system?

A CMMS focuses on maintenance: work orders, faults, inspections and spare parts. An EAM (Enterprise Asset Management) system includes those functions and adds the full lifecycle, with procurement, financial data and investment planning. Smaller manufacturers usually start with a CMMS and expand later.

Does NIS2 require asset management?

Yes, NIS2 explicitly lists asset management in Article 21(2)(i) as one of the mandatory cybersecurity risk-management measures. In the Netherlands this is implemented in the Cybersecurity Act (Cyberbeveiligingswet), which has been in force since 15 August 2026. Essential and important entities must therefore be able to show which IT and OT assets they have and how critical they are.

How do you find unknown OT assets without disrupting production?

The safest way to find unknown OT assets is passive network monitoring, which only listens on a mirror port and sends no traffic to devices. Complement it with a physical walk-down and the plant documentation, because serial and non-networked devices are not visible in network traffic. Active scans are only used under control and in agreement with the process owner.

Who is responsible for asset management in IT/OT?

Asset management is a shared responsibility of maintenance, operations, IT and security, with one designated owner per asset. Usually the maintenance department owns the physical assets, while IT and the OT security function manage the digital overview. A joint asset register with a single asset number prevents each department from keeping its own outdated list.

📌 In summary

Asset management provides insight into and control over all physical and digital assets in an industrial environment, and steers decisions on maintenance, replacement and security based on performance, cost and risk. With ISO 55000 as the management framework, an up-to-date inventory as the basis for NIS2 and IEC 62443, and connected systems such as the CMMS, historian and OT monitoring, asset management is the foundation for reliability, safety and long-term optimisation.