![\"Conceptual](\"https://wiki.aspotomasyon.com/assets/diagrams/industrial-cybersecurity-context.svg\")
OT asset inventory — knowing exactly what hardware and software is running on the industrial network — is the foundation of OT security and maintenance. You cannot protect, patch, or even reliably operate systems you do not know exist. Yet many plants have incomplete asset lists assembled from spreadsheets, memory, and chance discoveries during outages. This article explains why a complete, current OT asset inventory is essential, how to build one, and how to keep it accurate over time.
A useful OT asset record goes beyond \"IP address and hostname\":
\n\n| Category | Attributes |
|---|---|
| Identity | Hostname, IP/MAC address, asset tag, location (area, cabinet) |
| Hardware | Vendor, model, serial number, hardware revision |
| Software | Operating system, version, installed applications, firmware version |
| Function | Role (PLC, HMI, historian, gateway, switch), process area served, criticality |
| Ownership | Responsible team, vendor support contract, service schedule |
| Lifecycle | Installation date, warranty/end-of-life dates, patch status |
| Network | VLAN/zone, connections, open ports/services (where known) |
Passive sensors tap network traffic (via SPAN ports or network taps) and build a picture of devices, protocols, and conversations without sending a single packet to production devices. This is the safest method: it cannot disrupt a PLC. Passive tools identify devices from their traffic signatures and are the recommended baseline for OT.
\n\nActive scanning (ping sweeps, SNMP queries, port scans) probes devices directly. It is faster and reveals more detail (open ports, SNMP OIDs), but it can disturb fragile legacy devices and increase network load. Rules:
\n\nImport data from the sources that already exist: switch MAC tables, DHCP leases, DNS, the PLC engineering databases, maintenance records, and the previous spreadsheets. This fills in what network discovery cannot see (e.g., devices on serial links or isolated segments).
\n\nThe hard part is not the first inventory; it is keeping it true:
\n\nA current, complete OT asset inventory is the prerequisite for security, patching, and reliable operations. Build it with continuous passive discovery, supplement with carefully managed active discovery and existing data sources, store it in a tool with change history, and keep it alive through alerting, audits, and change control. Treat every unknown device as either a forgotten asset or a potential intruder — and resolve it either way.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
![\"Engineering](\"https://wiki.aspotomasyon.com/assets/diagrams/industrial-cybersecurity-review.svg\")
Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.
","markdown":"# OT Asset Inventory and Network Discovery\n\n> OT asset inventory — knowing exactly what hardware and software is running on the industrial network — is the foundation of OT security and maintenance.\n\n- Canonical URL: https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery\n- Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki)\n- Category: Industrial Cybersecurity\n- Published: 2026-08-06 · Updated: 2026-09-13\n- Reading time: 5 min · Language: English\n\n**OT asset inventory** — knowing exactly what hardware and software is running on the industrial network — is the foundation of OT security and maintenance. You cannot protect, patch, or even reliably operate systems you do not know exist. Yet many plants have incomplete asset lists assembled from spreadsheets, memory, and chance discoveries during outages. This article explains why a complete, current OT asset inventory is essential, how to build one, and how to keep it accurate over time.\n\n\n\n*Conceptual access controls around an OT service. Actual zones, conduits, protections, and response actions require a site-specific assessment.*\n\n## Why Asset Inventory Matters\n\n- **Security:** unmanaged devices are how attackers enter and move laterally (see [IEC 62443](https://wiki.aspotomasyon.com/article/iec-62443-industrial-cybersecurity-standards) ); you can only defend what you can see.\n- **Patch management:** you cannot plan patching without knowing what software and firmware versions exist (see [ICS Patch Management](https://wiki.aspotomasyon.com/article/ics-patch-management) ).\n- **Risk assessment:** vulnerabilities only matter if the asset is actually present.\n- **Maintenance and lifecycle:** end-of-life equipment, spare parts, and obsolescence planning all start from the inventory.\n- **Compliance:** many standards (IEC 62443, NIST SP 800-82, and sector regulations) require an asset inventory.\n\n## What to Record\n\nA useful OT asset record goes beyond \"IP address and hostname\":\n\n| Category | Attributes |\n| --- | --- |\n| Identity | Hostname, IP/MAC address, asset tag, location (area, cabinet) |\n| Hardware | Vendor, model, serial number, hardware revision |\n| Software | Operating system, version, installed applications, firmware version |\n| Function | Role (PLC, HMI, historian, gateway, switch), process area served, criticality |\n| Ownership | Responsible team, vendor support contract, service schedule |\n| Lifecycle | Installation date, warranty/end-of-life dates, patch status |\n| Network | VLAN/zone, connections, open ports/services (where known) |\n\n## Discovery Methods\n\n### 1. Passive discovery (safe, continuous)\n\nPassive sensors tap network traffic (via SPAN ports or network taps) and build a picture of devices, protocols, and conversations without sending a single packet to production devices. This is the safest method: it cannot disrupt a PLC. Passive tools identify devices from their traffic signatures and are the recommended baseline for OT.\n\n### 2. Active discovery (use with care)\n\nActive scanning (ping sweeps, SNMP queries, port scans) probes devices directly. It is faster and reveals more detail (open ports, SNMP OIDs), but it can disturb fragile legacy devices and increase network load. Rules:\n\n- Scan only during approved windows, in a test or low-risk segment first.\n- Exclude known-critical and safety devices, or scan them only with the vendor's blessing.\n- Use read-only credentials (SNMP read community/version 3) and avoid aggressive scans.\n- Never run vulnerability scanners (which send exploit payloads) against production OT without explicit approval.\n\n### 3. Manual / source-based inventory\n\nImport data from the sources that already exist: switch MAC tables, DHCP leases, DNS, the PLC engineering databases, maintenance records, and the previous spreadsheets. This fills in what network discovery cannot see (e.g., devices on serial links or isolated segments).\n\n## Building the Process\n\n1. **Start with the critical systems.** Prioritize: safety systems, DCS/PLC controllers, historians, and gateways first.\n2. **Deploy passive discovery** at the network core and at key segments; let it run for weeks to catch intermittent devices.\n3. **Reconcile** discovered devices against existing lists; investigate every unknown device — unknowns are either forgotten assets or intruders.\n4. **Store in a CMDB or asset tool** that supports custom attributes and change history; a spreadsheet is a starting point, not a destination.\n5. **Connect to change control:** every new device or network change updates the inventory as part of the MOC process.\n\n## Keeping the Inventory Current\n\nThe hard part is not the first inventory; it is keeping it true:\n\n- **Continuous discovery:** passive sensors run permanently and flag new devices automatically.\n- **Alerting:** new or changed devices generate a review task (\"is this device authorized?\").\n- **Periodic audits:** reconcile quarterly against switch tables and engineering databases.\n- **Lifecycle hooks:** update firmware/software versions in the inventory when patching or commissioning changes them.\n- **Ownership:** assign an owner for each asset; ownerless assets decay into stale records.\n\n## Common Pitfalls\n\n- **Relying on active scanning only.** The gaps — unmanaged switches, serial devices, temporary laptops — are exactly what passive monitoring sees and active scanning misses or disturbs.\n- **Inventory as a one-off project.** A stale inventory is worse than none: it creates false confidence.\n- **Ignoring the human element.** Contractors and engineers plug in laptops and test rigs; the inventory process must include their devices.\n- **No criticality field.** Without criticality, you cannot prioritize patching and protection.\n- **Storing incomplete data.** An IP-only list does not support patching, risk, or lifecycle decisions.\n\n## Summary\n\nA current, complete OT asset inventory is the prerequisite for security, patching, and reliable operations. Build it with continuous passive discovery, supplement with carefully managed active discovery and existing data sources, store it in a tool with change history, and keep it alive through alerting, audits, and change control. Treat every unknown device as either a forgotten asset or a potential intruder — and resolve it either way.\n\n## Apply this to your project\n\n- Identify asset owners, permitted communications, operational dependencies, and consequences of losing the function.\n- Test access restrictions and visibility without disrupting plant operations; agree the activity with the OT owner.\n- Validate an offline recovery path and document who can authorize isolation, restoration, and return to service.\n\n[Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance.\n\n\n\n*Engineering review sequence: Inventory → Restrict → Observe → Recover. Keep the recorded evidence with the accepted configuration.*\n\n## Primary references and further reading\n\nUse the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.\n\n- [NIST SP 800-82 Rev. 3 — Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)\n- [ISA — ISA/IEC 62443 series](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards)\n\n---\n\nCite the canonical article: https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery (OT Asset Inventory and Network Discovery, ASP OTOMASYON, updated 2026-09-13).\n","headings":[{"id":"why-asset-inventory-matters","title":"Why Asset Inventory Matters"},{"id":"what-to-record","title":"What to Record"},{"id":"discovery-methods","title":"Discovery Methods"},{"id":"building-the-process","title":"Building the Process"},{"id":"keeping-the-inventory-current","title":"Keeping the Inventory Current"},{"id":"common-pitfalls","title":"Common Pitfalls"},{"id":"summary","title":"Summary"},{"id":"apply-this-to-your-project","title":"Apply this to your project"},{"id":"primary-references-and-further-reading","title":"Primary references and further reading"}],"faq":[],"references":[{"name":"NIST SP 800-82 Rev. 3 — Guide to Operational Technology Security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"},{"name":"ISA — ISA/IEC 62443 series","url":"https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards"}],"related":[{"slug":"mitre-attack-for-ics-threat-informed-defense","title":"MITRE ATT&CK for ICS: Using the Matrix for Threat-Informed OT Defense","summary":"ATT&CK for ICS gives OT teams a shared catalog of adversary behavior, so detection and control gaps can be tested against plausible scenarios instead of…","category":{"slug":"industrial-cybersecurity","name":"Industrial Cybersecurity"},"url":"https://wiki.aspotomasyon.com/article/mitre-attack-for-ics-threat-informed-defense","markdown_url":"https://wiki.aspotomasyon.com/article/mitre-attack-for-ics-threat-informed-defense.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/mitre-attack-for-ics-threat-informed-defense","published":"2026-10-11T11:46:21+00:00","modified":"2026-10-11T11:46:21+00:00","reading_minutes":8,"word_count":1676,"image":"https://wiki.aspotomasyon.com/assets/social/mitre-attack-for-ics-threat-informed-defense-dd88cfe7cb9b.png"},{"slug":"iec-62443-zones-conduits-workflow","title":"IEC 62443 Zones and Conduits: A Practical Partitioning Workflow","summary":"A zone groups assets with shared security needs, a conduit carries the controlled communication between zones, and together they give the IEC 62443 workflow…","category":{"slug":"industrial-cybersecurity","name":"Industrial Cybersecurity"},"url":"https://wiki.aspotomasyon.com/article/iec-62443-zones-conduits-workflow","markdown_url":"https://wiki.aspotomasyon.com/article/iec-62443-zones-conduits-workflow.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/iec-62443-zones-conduits-workflow","published":"2026-10-11T11:46:21+00:00","modified":"2026-10-11T11:46:21+00:00","reading_minutes":8,"word_count":1705,"image":"https://wiki.aspotomasyon.com/assets/social/iec-62443-zones-conduits-workflow-9cab65877d4a.png"},{"slug":"opc-da-to-ua-migration-guide","title":"Migrating from OPC DA to OPC UA","summary":"Migrating from OPC DA to OPC UA is one of the most common infrastructure projects in industrial IT. OPC DA (Data Access) has served industry for more than two…","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-da-to-ua-migration-guide","markdown_url":"https://wiki.aspotomasyon.com/article/opc-da-to-ua-migration-guide.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-da-to-ua-migration-guide","published":"2026-08-06T12:26:37+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":5,"word_count":999,"image":"https://wiki.aspotomasyon.com/assets/social/opc-da-to-ua-migration-guide-4dc7a9d57cd5.png"},{"slug":"ot-security-architecture-defense-in-depth","title":"OT Security Architecture: Defense in Depth for Industrial Networks","summary":"Operational Technology (OT) environments — including industrial control systems (ICS), SCADA, DCS, and safety instrumented systems (SIS) — present unique…","category":{"slug":"industrial-cybersecurity","name":"Industrial Cybersecurity"},"url":"https://wiki.aspotomasyon.com/article/ot-security-architecture-defense-in-depth","markdown_url":"https://wiki.aspotomasyon.com/article/ot-security-architecture-defense-in-depth.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/ot-security-architecture-defense-in-depth","published":"2026-05-13T12:07:53+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":10,"word_count":2092,"image":"https://wiki.aspotomasyon.com/assets/social/ot-security-architecture-defense-in-depth-427478438d17.png"}],"citation":"ASP OTOMASYON. OT Asset Inventory and Network Discovery. Updated 2026-09-13. https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery"}}