Passive OT Asset Discovery, Inventory Reconciliation, and Remote Access Mapping
Find the Controllers Your Inventory Forgot
Every OT assessment, vulnerability decision and recovery plan starts from an asset list, and lists often miss the controller added at the last turnaround, the commissioning gateway nobody removed and the workstation with a foot in both networks. Global Digital Forensics reconciles observed traffic with drawings, controller projects and operator knowledge to prove what is actually connected and how confident each entry is. We start passive, from collection points your engineers approve, and any tap or SPAN change goes into a window they choose.
The engagement
An Inventory Built From Traffic, Drawings and Operators
Discovery begins with passive evidence. We combine traffic observed at agreed taps and span ports with switch and firewall tables, engineering project files, maintenance exports, purchase records and the knowledge of the technicians who keep the plant running, then compare all of it with the register you hold today. The discrepancies surface without unnecessary interaction with fragile controllers or legacy protocols.
Collection points decide coverage, so isolated cells, serial gateways, maintenance laptops, cellular modems and dormant equipment may need sources other than the trunk we can see. We document every collection point, observation period, inaccessible segment and operating state, which turns a snapshot into a baseline your team can reconcile as the plant changes.
Scope
Passive network observation
Traffic recorded at agreed industrial collection points, with the period, operating states and unseen segments stated plainly.
Device reconciliation
PLCs, HMIs, historians, engineering workstations, gateways and safety systems matched across traffic, projects, drawings and registers.
Remote access across zones
Vendor gateways, cellular modems, jump hosts and unmanaged remote connections identified and flagged for review.
Recovery context for critical assets
Process function, zone, normal peers, backup location, vendor support and recovery owner recorded for each critical device.
An Asset Record Built for Recovery Day
An inventory filed for an audit and forgotten does nothing when a controller fails at two in the morning. We connect each supported device identity to its function, its access, its dependencies and what it takes to restore it, so operations, engineering, security and leadership work from one record instead of four spreadsheets.
Planning a recovery exercise or a control system upgrade that needs a trustworthy device list first? The OT assessment planning library shows how to organize the existing records before the first call.
Resolve the Differences Between the Drawings and the Plant
Drawings show the intended design. Traffic shows what talked during the capture window. Engineering files show what was configured, and the technicians know the equipment that only appears during maintenance. Using all four resolves what any single source misses.
The comparison regularly turns up equipment added during a turnaround, a temporary connection that quietly became permanent, unsupported firmware or a cellular route around the firewall. Each discrepancy records where it came from and what remains to confirm, which hands the plant a work list rather than a suspicion.
Bring the drawings you have, however old, and call (800) 868-8189 to hear what the traffic can add to them.
Passive Capture, Record Review or Approved Active Checks
Passive capture from a tap or SPAN port is the default, scheduled across representative operating periods so idle equipment has a chance to speak. Where a network cannot be tapped, a record review built from switch tables, controller projects and maintenance exports reaches much of the same answer.
Where passive evidence leaves a gap, we review the options with your process owner, including targeted active queries, vendor tools or specialist hardware. The owner approves the method, the operating conditions and the stop point before any active step touches a controller, and the decision is written into the collection plan.
Confirmed, Inferred and Unresolved Assets
Observed traffic matched to a drawing supports a stronger identification than a vendor MAC prefix alone, and a drawing with no observed traffic needs another check. We label every entry confirmed, inferred or unresolved and keep conflicts visible, so your team weighs an advisory against the real confidence in the record.
A maintenance laptop may never appear during a capture window. The engineering records and the technician who uses it can still identify its connections, and those sources are recorded separately so nobody mistakes an inference for an observation. To see how confidence ratings change what you do with an advisory, read how OT vulnerability management builds on a reconciled inventory.
Methodology
How the Asset Record Gets Built
-
Plan: placement and existing records
Sensor placement, observation windows and collection methods are agreed with operations, and the current drawings and registers become the baseline.
-
Observe: representative operating states
Traffic is recorded at the agreed points across normal, maintenance and peak states, with coverage gaps logged as they appear.
-
Reconcile: devices against every source
Observed devices are matched to engineering records, registers and operator knowledge, and each conflict is preserved for its owner to resolve.
-
Enrich: process, support and recovery
Critical assets gain process, safety, backup, support and recovery ownership detail, and the agreed record is exported to your governance system.
Each step can cover one unit or a whole site, and the first scoping conversation is free.
A senior specialist can map this to your systems on a free first call. Schedule the free consultation or call (800) 868-8189.
Evidence we reconcile
Industrial Asset Evidence We Review
Passive captures supply device and communication evidence at documented collection points. Switch, firewall and router configurations with their MAC and IP tables map interfaces and connections. Engineering project files and HMI configurations identify equipment and its role in the process, while registers, purchase records and maintenance exports supply its history. Operator interviews and walkdown notes resolve the discrepancies, and vendor support and remote access agreements show which outside relationships the plant expects.
What you receive
Your Reconciled Inventory and Visibility Map
A reconciled inventory with the evidence and reasoning behind each entry, a coverage map showing what was visible and what needs another source, findings on communication between zones and unmanaged remote access, recovery and support detail for critical assets, and a maintenance plan for change review and periodic reconciliation.
Need to show an auditor or an insurer what the inventory rests on? An OT network assessment extends the same evidence to the paths between zones.
Describe the plant and the constraints your operators set and the first call plans the work around them.
An Inventory Someone Can Defend Later
An asset register gets quoted in insurance claims, audits and incident reports long after the walkdown, so every entry keeps the capture, file or interview it came from. That habit comes from forensic work: GDF examiners have testified in federal and state courts. Meet the team.
Put the Inventory to Work
A reconciled inventory is the foundation for the next decision. OT vulnerability management uses it to decide which advisories apply to your equipment, an OT network assessment shows how those assets talk across zones, and the handoff can define how new devices and vendor connections are recorded as they arrive rather than at the next audit.
Send us the systems and the deadline, and the first call will set the scope, the approvals and the schedule.
Free planning guide
Download the OT Asset Discovery Plan
The discovery plan shows how to choose collection points, schedule observation around operating states and prepare the drawings, registers and controller projects the reconciliation will use. Arrive with it filled in and the first call can go straight to collection points and timing.
Passive First OT Asset Discovery Plan
Collection points, observation windows, source records and confidence labels for a plant wide inventory.
Format: PDF, also readable online.
OT Readiness Pack
An editable workbook for inventory owners, network boundaries and the rules any later testing will follow.
Format: ZIP with a CSV workbook and a printable checklist.
OT Planning Library and Worksheet
Sector planning packs and a project workbook, plus a CSV worksheet for scope, owners and permissions.
Format: ZIP library with PDFs, XLSX and CSV; separate CSV worksheet.
Download the OT Planning Library (ZIP)
OT Security Review Checklist
The process scope, system inventory and access records an assessment team asks for first.
Format: PDF.
Browse every package by subject in the GDF preparation package library.
Frequently asked
Incomplete Diagrams, Shutdowns and Passive Coverage
Can we start with incomplete diagrams?
Yes. Incomplete diagrams sit alongside traffic, device records and operator knowledge, and the gaps in the drawing become findings with owners rather than obstacles to starting.
Will discovery require a shutdown?
Not for passive collection, which runs alongside normal operations and adds no probe traffic. Where a network tap or a SPAN port change is needed, it goes into a window your engineers choose, and any active follow up is approved with the process owner and its operating conditions first.
How much of the plant will passive discovery see?
As much as the collection points and the operating activity during the window allow. The visibility map shows exactly what was seen, and isolated cells, serial gateways and dormant devices are covered from engineering records, operator knowledge or approved checks.
How is the output used after the engagement?
The reconciled inventory is exported to your CMDB or governance system with a change review and reconciliation routine, so operators record new devices and vendor connections as they arrive.
What is the first step in engaging GDF?
Tell us about your sites, the principal control systems, the inventory and drawings you hold and the decision the inventory has to support. The first consultation is free and ends with a proposed scope.
Talk with an examiner
Build the Inventory Your Next Security Decision Depends On
Bring your network maps, control system details and current asset record to a free initial consultation. We will discuss coverage, operator authority and the inventory scope.
GDF has operated since 1992, and the hotline reaches a practice that includes court tested examiners 24/7.
Talk with an OT specialist
Start With the Plant You Actually Have
On the first call we look at what you run, where visibility is weakest and which drawings and registers exist, then propose collection points, an observation window, the deliverables and the price. The consultation is free.
24/7 hotline: (800) 868-8189
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .