An enterprise OT inventory needs more than a merged list of sensor exports. Different plants use different naming conventions, collection points and operating cycles. Without that context, headquarters may compare a well-observed facility with a poorly observed one and mistake better visibility for greater risk.
Define the minimum evidence behind an inventory row
Record the site, process area, asset identifier, observed address, collection source and validation date. Add vendor, model, firmware and function only to the confidence supported by the evidence. Keep uncertain fingerprints labeled rather than promoting them to confirmed equipment specifications.
Distinguish network interfaces from physical assets. One engineering station may have several addresses, while a gateway may represent equipment that the sensor never observes directly. Preserve relationships between records when combining inventories so deduplication does not erase a real asset or inflate the count.
Report visibility alongside asset counts
Document where traffic was collected, the operating modes observed and known blind spots. A maintenance window, batch cycle or failover can reveal communication absent during ordinary production. Dormant devices and isolated segments need another evidence source; an empty capture is not evidence that nothing exists.
- Compare passive observations with engineering projects and drawings.
- Reconcile switch, firewall and maintenance records with local owners.
- Track conflicting names, addresses and equipment details until resolved.
- Record unsupported systems and recovery dependencies separately from visibility gaps.
Make validation safe and repeatable
Passive-first work still needs operator planning. Sensor installation and network configuration changes can affect operations. Life safety, environmental protection and process stability govern the plan. Any active follow-up requires operator-designated authority, risk review, approved process conditions, explicit stop points and recovery arrangements. Do not use a uniform scanning recipe across dissimilar plants.
Choose a validation cycle tied to maintenance and architecture changes. The final inventory should let the owner decide where to improve monitoring, restrict remote access, plan replacements or verify recovery. Report uncertain coverage as unfinished work rather than a favorable asset count.
Our OT network assessments use that evidence to define scope. OT vulnerability management addresses the resulting operational priorities. NIST SP 800-82 Revision 3 provides the underlying OT safety and security context.