---
title: "Asset inventory for OT"
canonical: https://www.secnostic.com/en/blog/ot-asset-management-whitepaper
language: en
dateModified: 2026-10-12
alternate-de: https://www.secnostic.com/de/blog/ot-asset-management-whitepaper
---

# Asset inventory for OT

- URL: https://www.secnostic.com/en/blog/ot-asset-management-whitepaper
- Type: Whitepaper
- Published: 2026-10-07
- Updated: 2026-10-12
- Topics: OT asset inventory, OT security, machine building, NIS2, Cyber Resilience Act, Machinery Regulation

The secnostic whitepaper is written for machine builders and operators of automated plants. It describes which data an asset inventory needs for controllers, HMIs, engineering PCs, and network components, how documentation, passive network observation, approved device queries, and on-site checks work together, and how upkeep is tied to commissioning, device replacement, and decommissioning. It shows how the inventory supports network segmentation, access restriction, vulnerability assessment, and recovery, places NIS2, the Cyber Resilience Act, and the EU Machinery Regulation in context, and closes with a maintenance example and an approach for a first pilot plant.

## Who is the whitepaper for?

When a line stops or a security advisory arrives, your team needs quick answers: what is installed, what is affected, and who can act? The whitepaper is written for machine builders, operators of automated plants, and maintenance teams. It focuses on controllers (PLCs), HMIs, drives, engineering PCs, servers, and network components.

## What's inside

* **Which data you need:** a core record of identifier, technical state, installation location, communication, ownership, and impact on production.
* **Collecting the installed base:** documentation, passive observation of network traffic, approved device queries, and on-site checks complement each other, as [NIST SP 800-82](https://csrc.nist.gov/pubs/sp/800/82/r3/final) also describes.
* **Handover and upkeep:** who updates what in the inventory at commissioning, device replacement, and decommissioning.
* **Preparing security measures:** planning network segments, access, vulnerabilities, and recovery with data from the inventory.
* **A maintenance example:** a vendor advisory affects a packaging line, step by step to a confirmed new state.
* **Starting with one plant:** four steps for a pilot area, from an operational question to routine upkeep.

## Why it matters now

The [NIS2 directive](https://eur-lex.europa.eu/eli/dir/2022/2555) requires affected entities to manage risk and handle vulnerabilities. The [Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847) applies to manufacturers of products with digital elements; its main obligations apply from 11 December 2027. The [EU Machinery Regulation](https://eur-lex.europa.eu/eli/reg/2023/1230) applies from 20 January 2027 and requires, among other things, that safety-relevant software is identifiable and protected against corruption.

A maintained inventory provides the data for these tasks. It does not replace risk assessment or conformity assessment. The [CISA guidance](https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators) describes the inventory as the foundation for further protective measures.

## Download the whitepaper

The whitepaper is 14 pages long, written in British English, and free of charge. Enter your email address and we will send you the link to the PDF. Would you rather talk about a specific plant? [Contact us](/en/contact).

## Sources

- [NIST SP 800-82 Rev. 3](https://csrc.nist.gov/pubs/sp/800/82/r3/final): NIST guide to operational technology and industrial control system security.
- [CISA OT asset inventory guidance](https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators): Joint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance.
- [EU NIS2 directive](https://eur-lex.europa.eu/eli/dir/2022/2555): Consolidated text of EU Directive 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union.
- [EU Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847): Official EUR-Lex text of Regulation (EU) 2024/2847 covering manufacturer obligations, essential cybersecurity requirements, technical documentation, conformity assessment, SBOMs, and CE marking.
- [EU Machinery Regulation 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230): Official EUR-Lex text of the EU Machinery Regulation covering conformity, CE marking, protection of compliance-relevant software and data, and the safety of control systems.