When a critical vulnerability affecting a control system is published, the first question on the plant floor is almost never technical: do we have that asset? Where is it? What firmware version is it running? Who is responsible for it? In many industrial organizations, answering this requires an arduous search. Not due to a lack of information, but because it is scattered across different tools, lists, and teams.
As discussed previously on this blog in the series on NIS2, an inventory is not an architecture. But without a reliable inventory, building one is impossible: you can only manage vulnerabilities, dependencies, and risks for assets you actually know about.
Why OT assets get left out
The industrial attack surface extends far beyond servers and workstations. Machines and control systems, sensors, production facilities, building automation, industrial networks, and third-party remote maintenance accesses are all part of it. And it is precisely these assets that most frequently remain excluded from central inventories.
The reasons are always the same: rigid data models in many CMDBs were not designed for them, systems stay in service longer than initially planned, external vendors gain access, and, above all, many OT assets cannot be detected automatically.
The result is unassigned components without a clear owner, legacy systems, and unknown network devices: exactly the kind of assets attackers exploit.
This issue is not unique to manufacturing. According to Verizon’s “2025 Data Breach Investigations Report,” 46% of systems compromised using corporate credentials across an analyzed dataset were not integrated into the organization’s central management.
Three discovery pathways, not just one
An effective inventory in industrial environments does not come from a single tool, but from combining methods depending on the asset type:
-
Automated discovery for IT infrastructure: Active Directory, network scanners, and cloud platform APIs.
-
Manual registration for physical and mobile assets via QR or barcodes, importing existing spreadsheets, and on-site walkthroughs. Validation by local plant operators is what guarantees data quality.
-
A dedicated process for OT and legacy systems: passive network analysis, SCADA inventories, and coordination with plant supervisors. Where automated detection is not feasible, an independent coordination procedure is required.
Fewer data fields, but with context
Many inventories become unnecessarily complex because too many attributes are defined that are later neglected in day-to-day operations. To get started, a minimum viable dataset per asset is sufficient: unique identifier, asset type, physical or logical location, responsible role, criticality, security status, and lifecycle state. Depending on the environment, additional details such as vendor, serial number, or firmware version can be incorporated over time.
Criticality requires special attention. A simple three-tier model (high criticality, relevant, and supporting) is usually enough to prioritize effectively. Furthermore, it depends not just on the hardware type, but on its operational role: two technically identical devices can carry completely different ratings if one supports a critical process.
From inventory to prioritization
The true value of an asset inventory becomes apparent during decision-making. Faced with a critical vulnerability, a well-maintained register allows filtering affected systems by version, location, criticality, or owner, providing immediate clarity on what to remediate first and who needs to act.
Consider a multi-plant manufacturing company where critical facilities are undocumented, parallel inventories contradict each other, and firmware versions remain largely unknown. For scenarios like this, the white paper “Cybersecurity Asset Management and Compliance,” published by Timly, proposes a deliberately phased approach: start strictly with production-critical assets, use network discovery as a technical foundation, manually supplement OT-specific parameters (firmware, vendor, operational area), and assign ownership and criticality integrated into the maintenance management system. With that baseline, affected systems can be identified and prioritized promptly whenever a vulnerability is disclosed.
What regulations require
This approach is not merely an operational best practice. ISO/IEC 27001, in Annex A 5.9, requires systematic inventory management of information and associated assets, with clearly assigned owners. NIS2, for its part, mandates “appropriate technical and organizational measures” to manage cybersecurity risks, which in practice presupposes the ability to rapidly identify affected assets, their criticality, relevant sites, and interdependencies.
Final thoughts
Your initial inventory does not need to be flawless. A register achieving around 80% coverage with accurate, well-maintained core data is far more valuable than pursuing 100% and stalling the initiative for months. What matters most is clear accountability and embedding ongoing updates into standard workflows, such as maintenance schedules or change requests.
In OT environments, the underlying issue is rarely technology: it is the lack of a shared understanding of which systems are truly critical. An inventory enriched with context is the essential first step toward achieving it.
Source: White paper “Cybersecurity Asset Management and Compliance”
Angela Pohl
Senior Content Marketing Manager at Timly Software AG / Cloud-based software provider for asset inventory and maintenance management
