Device inventories in IT and OT

What distinguishes ITAM and OTAM in operations?

The distinction below is a working model for security and operations, not a normative definition. ITAMITAM stands for IT asset management and describes the structured collection and maintenance of IT assets across their operational lifecycle. consolidates the technical and organisational context of IT assets. OTAM extends that context into the physical process. For OT, CISAJoint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. therefore calls for an inventory plus a taxonomy based on function or criticality, with documented communication paths and dependencies.

Which data belongs in a dependable OT asset inventory?

CISAJoint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. prioritises 14 attributes for each OT assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., including criticality, role or type, manufacturer, model, operating system, hostname, IP and MAC address, physical location, protocols, ports and services, user accounts, and logging. These fields form the technical core. Operations also need provenance, relationships, and accountability.

• Identity: unique assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. number, manufacturer, model, hostname, IP address, and MAC address
• Technical state: operating system, firmware or software, active protocols, ports, and services
• Operating context: role or type, physical location, zoneZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., communication paths, and process dependencies
• Security context: criticality, logging, user accounts, and existing technical controls
• Accountability: responsible person, technical operator, maintenance, and participating service providers
• Evidence: data source, collection time, change history, and validation status

For relevant critical infrastructureKRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society. assets, the BSI catalogueBSI catalogue published on 10 September 2024 specifying criteria under Section 8a(1) and (1a) BSIG, including asset inventory, classification, network topology, and change management. adds clear accountability throughout the lifecycle and a uniform, risk-based classification. A shared ITIT comprises systems, networks, and software that process, store, transmit, or provide information./OT model should therefore treat these organisational fields as rigorously as technical attributes.

How is an OT asset inventory built according to CISA?

CISAJoint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. describes a five-stage process from defined scope through lifecycle management. The outcome is not a one-off scan but a maintained inventory with a validated taxonomy.

1. 01Define scopeZones, sites and accountable roles
2. 02Collect assetsPhysical and digital sources
3. 03Map relationshipsFunction, criticality and communication
4. 04Validate dataAccuracy and completeness
5. 05Maintain changeCommissioning, maintenance and decommissioning

The five CISA stages at a glance. Changes throughout the lifecycle continue to update the inventory.

1. Define scope and objectives

   Set governance, roles, and programme boundaries. ZonesZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., facilities, and systems belong in scope, together with a clear definition of what counts as an asset.

2. Identify assets and collect attributes

   Combine physical inspection and logical survey with digital and network-based information. Include documented assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. and infrastructure dependencies.

3. Build the taxonomy and relationships

   Classify assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. by function or criticality. Document communication paths, zones, process dependencies, naming conventions, and the roles of operators and service providers.

4. Validate and manage the data

   Check inventory data for accuracy and completeness, visualise relationships, and add vendor documentation, maintenance data, configurations, and operational records.

5. Integrate lifecycle management

   Link acquisition, deployment, commissioning, maintenance, and decommissioning to the inventory. The introduction or removal of devices must trigger an inventory updateJoint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance., including under emergency change authority.

What does the BSI catalogue add for critical infrastructure?

The BSI catalogueBSI catalogue published on 10 September 2024 specifying criteria under Section 8a(1) and (1a) BSIG, including asset inventory, classification, network topology, and change management. specifies criteria under Section 8a(1) and (1a) BSIG for German critical infrastructure operatorsKRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society. and provides orientation for selecting suitable audit criteria. BSI also states that individual criteria are not automatically binding. Their appropriateness must be assessed in the operator's specific context.

• Inventory quality (AM-01): keep records complete, accurate, current, and consistent, maintain traceable change history and use regular manual reviews where effective automation is absent
• Accountability (AM-02): assign every relevant assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. to a responsible person on the operator side and maintain correct inventory and classification throughout its lifecycle
• Classification (AM-05): classify information and assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. consistently on the basis of risk analysis and impact assessment
• Network topology (KOS-06): maintain current and traceable architecture documentation, including different environments, network segments, and data flows
• Change management (BEI-03 to BEI-10): assess risk, categorise and prioritise change, document testing and approval, provide rollback, and maintain evidence for emergency changes

What this means outside German critical infrastructure

The BSIThe BSI is Germany's central federal authority for cyber and information security. catalogue is not a blanket list of obligations here. Its quality characteristics are still useful as testable operating questions: Is the inventory complete and current, is accountability clear, is classification traceable, and does change management update the inventory?

How are ITAM and OTAM combined in practice?

A shared model standardises identity, evidence, and quality rules. ITIT comprises systems, networks, and software that process, store, transmit, or provide information. and OT still retain their own collection paths, approvals, and operational boundaries.

1. Start with a dependable scope

   Select one critical service, site, zoneZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., or production line, define what counts as an asset, and name accountable people.

2. Collect sources separately

   ITIT comprises systems, networks, and software that process, store, transmit, or provide information. system sources, physical surveys, network data, engineering records, and maintenance data provide observations with provenance and timestamps.

3. Reconcile identities and relationships

   Resolve duplicates and conflicts while preserving zonesZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., communication paths, services, and process dependencies as relationships.

4. Add accountability and classification

   Assign each relevant assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. a responsible person, an operating role, and a traceable criticality or risk classification.

5. Turn change into inventory events

   Commissioning, maintenance, replacement, and decommissioning update the inventory. Regular validation checks completeness, accuracy, currency, and consistency.