A maintenance contractor opens a control cabinet and finds a small network switch that is not on the drawing. Nobody is sure when it was installed. The production line is running, so this is the wrong moment to unplug a cable and see what stops.
It is also a useful reminder: an OT asset inventory has to match the physical process, not just the purchasing system or an old network diagram.
For a small manufacturer, the job can feel too large. The plant may have decades of controls, specialty machines, vendor laptops, serial links, spare controllers, building systems, and devices that were added during a rushed repair. Trying to capture the whole facility at once often produces a spreadsheet that is broad, thin, and quickly abandoned.
Start with one production line instead. The aim is to create a record that operations, engineering, maintenance, and IT can recognize and use without disturbing production.
CISA’s 2025 OT asset-inventory guidance says that records may need a physical inspection because owners and operators need to understand how components monitor or control the process.[1] It recommends combining that inspection with a logical survey rather than relying on either view alone.[1]
This is an inventory exercise, not permission to scan, connect to, open, or change equipment. NIST’s OT security guidance treats performance, reliability, and safety as distinct requirements.[3] The plant’s operations and engineering authority should set the method, timing, protective-equipment requirements, electrical boundaries, production restrictions, and stop conditions before the walk begins.
Pick a line and define the boundary
Choose a line that matters but can be studied during an approved maintenance window or quiet period. Name the process owner and the person with authority to decide what can be observed. Include the IT or security lead, but do not make IT the sole owner of the exercise.
Write the boundary in operating terms. For example:
From the raw-material infeed through the case packer, including the local control panels, operator stations, safety interfaces, quality-inspection equipment, line network equipment, and the connections used for recipes, reporting, maintenance, or remote support.
That statement prevents two common mistakes. The team will not stop at devices with IP addresses, and it will not wander into unrelated plant systems without approval.
Define what counts as an asset for this pass. Include equipment that controls, monitors, protects, configures, communicates with, or supplies essential information to the line. Also note dependencies outside the boundary, such as an identity service, historian, engineering repository, time source, remote-access gateway, or vendor-managed connection. Record the dependency without expanding the walk into another project.
Begin with the records you already have
Gather the current line drawing, electrical and panel schedules, controller and HMI project records, maintenance history, vendor manuals, spare-parts list, change tickets, switch configurations, and any existing IT inventory. Mark each source with its date and owner.
Do not merge the records silently. Put uncertain items on a reconciliation list:
- a controller shown on the drawing but not seen in the maintenance record;
- a network address in a switch table with no equipment name;
- a vendor modem listed in a service agreement but not in the line documentation;
- two different firmware or model entries for the same asset number.
An inconsistency is a finding, not an invitation to guess. Leave the field unknown and assign someone who can resolve it safely.
CISA’s guidance gives high priority to attributes such as asset criticality, role or type, hostname, IP and MAC addresses, communication protocols, logging, manufacturer, model, operating system, physical location, ports or services, and user accounts.[1] A small plant can use that list as a reference while collecting only what it can verify during the approved pass.
Walk the line with operations leading
The process owner should lead the route. A controls or maintenance specialist can identify field devices and cabinets. IT can document approved network information. One person records; another checks the physical label against the source record.
Stay within the walk plan. Do not attach an unfamiliar laptop, insert removable media, run an active discovery tool, select controls on an HMI, open an energized enclosure, or disconnect a cable merely to identify its purpose. If safe identification requires a shutdown, a qualified electrician, a vendor, or a separate diagnostic plan, record that next step and move on.
For each verified asset, capture a modest minimum record:
- a unique plant asset number;
- plain-language name and role in the process;
- physical location and cabinet or panel reference;
- manufacturer, model, and serial number when available;
- controller, workstation, network, or field-device type;
- approved network identifiers and communication protocols, if applicable;
- upstream and downstream process or system dependencies;
- operations, maintenance, engineering, IT, and vendor ownership;
- backup, configuration, software, and spare-part location;
- evidence source, last-verified date, and unresolved questions.
Add consequence, not a vague priority score
A long inventory is not automatically useful. The record needs enough process context to help people make decisions.
CISA describes criticality-based classification in terms of importance to operations, safety, and mission.[1] For each asset, ask the process owner what the plant would observe if it failed, became unavailable, or produced untrusted data. Keep the answers concrete:
- Does the line stop safely, continue in a degraded mode, or lose visibility?
- Is there a tested manual method, bypass, redundant component, or spare?
- Could a failure affect product quality, worker safety, environmental controls, or downstream equipment?
- Who has authority to isolate, replace, restore, or return the asset to service?
Do not let a cybersecurity label overrule engineering judgment. A small switch can be operationally important if several controllers depend on it. A visible workstation may be less important if the process can continue safely without it. Record the reason for the classification so a responder does not have to reconstruct it under pressure.
Reconcile the physical and logical views
After the walk, compare what the team saw with approved network, configuration, and maintenance records. The result should show the asset and its relationships, not just a row of identifiers.
CISA’s later OT architecture guidance describes a continually updated definitive record built from the asset inventory and other data sources.[2] For one production line, that can be a controlled table linked to a simple diagram. Show the line’s main assets, approved communication paths, external dependencies, and responsible owners. Mark unknowns clearly.
Bring the draft back to the people who operate and maintain the line. Ask whether the picture explains how the process actually works, which connections cross the line boundary, and what information they would need during a failed controller, suspicious connection, or vendor service call.
Make updates part of the work
The inventory will age unless normal work changes it. CISA recommends requiring inventory updates when devices are introduced or removed, including under emergency change authority.[1]
Add an inventory step to equipment commissioning, maintenance replacement, emergency repair, vendor connection approval, controller or HMI change, and decommissioning. The step can be short: identify what changed, who approved it, which record was updated, and whether the drawing, backup, spare, owner, or recovery procedure also changed.
Give the production-line record one named owner and a review date. That person coordinates updates; they do not have to know every device. Operations validates process role and consequence. Engineering or maintenance validates control details. IT validates the network facts it manages. Procurement or vendor management helps with support status and contracts.
Finish the first pass with three outputs: a reviewed inventory, a simple relationship diagram, and an exception list with owners and dates. Do not hide missing labels, unsupported components, absent backups, unknown connections, or unclear authority to make the table look complete. Those gaps are the useful part.
One well-documented line gives the plant a method it can repeat. More importantly, it gives the people responsible for safe production a shared record of what is there, what it does, what it depends on, and who can act when something changes.
For practical guidance on cyber risk and safer AI use, subscribe to Cyber & AI Insights.
If your plant wants a neutral facilitator for an operations-led OT asset-inventory workshop, schedule a conversation with Your Data Guardian.