Assets

What are assets?

An asset is anything that has value to an organisation and whose availability, integrity or confidentiality must be protected: hardware, software, data and also people and processes. In the context of IT and OT (Operational Technology), assets are the physical, digital and logical components that play a role in production, process control or information processing, from a PLC in the field to a configuration file on an engineering station. Assets are the starting point of every risk analysis and of almost every security standard, because you can only protect what you know you have.

🧠 What does the term asset cover?

The asset management standard ISO 55000 defines an asset as an item, thing or entity that has potential or actual value to an organisation. That value can be financial or non-financial. In information security (ISO 27001 and ISO 27002, control 5.9) the emphasis is on information and the “other associated assets” that store, process or transport it.

Risk assessments based on standards such as ISO 27005 often distinguish two kinds:

• Primary assets — the business processes and information that represent real value, such as a production process, a recipe or the supply of drinking water
• Supporting assets — the components those primary assets depend on: controllers, servers, networks, software, sites and people

That distinction stops an asset list from becoming a purely technical inventory. A historian is not valuable because it is a server, but because the process relies on it.

🧱 What types of assets exist in IT and OT?

In practice an OT asset inventory focuses mainly on the first two rows. Information, network configuration and knowledge are linked to those technical assets as attributes or dependencies.

🏭 Which OT assets do you find at each Purdue level?

The Purdue Model helps you organise OT assets by function and position in the network:

The lower the level, the more direct the influence on the physical process and on safety. Lower levels also more often contain legacy systems that cannot be patched for years.

🎯 Why is an asset overview so important?

Without an up-to-date overview of your assets, no other security measure works properly:

• Risk analysis — a risk assessment or business impact analysis starts with which assets exist and what they are worth
• Vulnerabilities — only with manufacturer, model and firmware version can you match new CVEs to your installation (vulnerability management and patch management)
• Detection — Monitoring with a SIEM or an IDS only recognises anomalies once you know what normal looks like
• Configuration and change — configuration management and change management rely on a trustworthy baseline
• Incident response — a CSIRT or CERT needs to know quickly which systems are affected and who owns them (incident response)
• Recovery — business continuity requires a backup and a recovery plan for every critical asset

🔍 Without insight into your assets, you cannot know what to protect.

🔐 Which standards and laws require an asset inventory?

Almost every relevant framework starts with assets:

🔧 Which data do you record for each asset?

In August 2025 CISA and partners, including the Dutch NCSC and the German BSI, published Foundations for OT Cybersecurity: Asset Inventory Guidance. It names fourteen high-priority attributes:

• Identification — asset number, hostname, role/type and physical location
• Network — IP address, MAC address, active communication protocols and open ports/services
• Vulnerability — manufacturer, model and operating system
• Management and detection — criticality, user accounts and how logging for the asset is set up

Medium-priority attributes include backup frequency, a known-good baseline image and the department or owner. In practice you should add firmware version, lifecycle status (such as the vendor’s end of support) and the supplier holding the maintenance contract.

🔄 How do you discover assets: passively or actively?

Asset Discovery fills the inventory using three complementary methods:

• Passive — a sensor listens through a SPAN port or network TAP and identifies devices from the traffic using deep packet inspection (passive monitoring). Safe, but it only sees what communicates.
• Active — targeted queries to devices in their own protocol, for example an S7 or Modbus TCP read of type and firmware. More complete, but an aggressive network scan can make fragile older controllers hang.
• Physical and documentary — walking the plant, checking cabinets and drawings. Indispensable for serial and non-networked equipment.

Specialised OT platforms such as Claroty, Dragos and Tenable OT combine passive detection with safe active querying.

🛡️ How do you build an asset management process in practice?

The CISA guidance describes five steps that work well in European OT environments too:

1. Define scope and objectives — which sites, zones and systems are included, and who is responsible
2. Identify assets and collect attributes — passively, actively and physically, using the fourteen core attributes
3. Create a taxonomy — classify assets by function and criticality (high, medium, low) and group them into zones and conduits following the zones and conduits model
4. Manage the data — store it centrally and securely, for example in a CMDB or an asset inventory system
5. Lifecycle management — record changes, replacement and decommissioning, and validate the inventory periodically

Criticality then drives the measures: high-criticality assets get the most stringent measures, such as network segmentation and role-based access management (RBAC) within a layered defence-in-depth approach. Medium-criticality assets get robust monitoring and regular updates, and low-criticality assets get baseline measures; they are included in the inventory mainly for completeness.

❓ Frequently asked questions

What is the difference between an asset and a configuration item?

An asset is something of value to the organisation, such as a PLC or a historian. A configuration item is any component under configuration management, including its relationships, and is usually recorded in a CMDB. Many assets are also configuration items, but a CMDB focuses on relationships and changes.

What is the difference between assets, asset inventory and asset management?

Assets are the valuable components themselves. An asset inventory is the up-to-date overview of those assets and their attributes. Asset Management is the wider process of managing assets across their whole lifecycle, from procurement and maintenance to decommissioning.

Is passive asset discovery safe for OT networks?

Passive asset discovery is safe because no traffic is sent to the devices; the sensor only listens through a SPAN port or TAP. The drawback is that devices that rarely or never communicate stay out of view. Most organisations therefore combine passive detection with safe, protocol-specific active querying and a physical walkdown.

How often should an OT asset inventory be updated?

An OT asset inventory should be updated with every change to the installation and fully validated periodically, for example once a year. NIS2 requires asset management, and Implementing Regulation (EU) 2024/2690 specifies this as an up-to-date inventory in which changes are traceable. Continuous passive monitoring helps you spot new or missing devices immediately.

How do you determine the criticality of an asset?

The criticality of an asset follows from the consequences of failure or manipulation for safety, production, the environment and service delivery. A business impact analysis or a risk assessment according to IEC 62443-3-2 scores those consequences. CISA recommends a simple high, medium and low classification, with the strictest measures for high.

Do people and knowledge count as assets?

People and knowledge count as assets in the broad, risk-based sense used by ISO 55000 and ISO 27005. The departure of the only engineer who understands an old controller is a real continuity risk. A technical asset inventory usually does not record people as items, but it does record them as owners, administrators or contacts.

📌 In summary

An asset is anything of value that needs to be protected, from a physical PLC to a digital configuration file. An up-to-date asset inventory with the right attributes and criticality is the foundation for risk analysis, vulnerability management, detection, business continuity and Compliance with IEC 62443, NIS2 and ISO 27001.