secnostic inventory
models assets, services, zones, dependencies, lifecycle, maintenance windows, and evidence.
Critical services in view
secnostic® shows which facilities, ITIT comprises systems, networks, and software that process, store, transmit, or provide information./OTOT covers hardware and software that monitor and control physical devices, plants, processes, or infrastructure. systems, networks, and suppliers keep your critical services running. Operations and security see dependencies, maintenance risks, vulnerabilitiesA vulnerability is an exploitable weakness in software, hardware, configuration, process, or architecture., and response paths in one shared picture.
For energy, water, wastewater, and municipal utilities.
See distributed sites, and prove it
Distributed sites and long-lived control systems turn visibility itself into the security task. NIS2Consolidated text of EU Directive 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union. requires registration and risk management, the national critical-infrastructure actGerman Federal Government article on the KRITIS umbrella act and cross-sector resilience requirements. adds physical resilience, and proving attack detectionBSI guidance on systems for attack detection (SzA) for critical infrastructure operators. depends on a current picture of every assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. and conduit.
What this covers
In operations, the important question is not only whether an assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. exists, but also which facility, service, remote access path, and change depend on it. OT asset inventory guidanceJoint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. and OT security guidanceNIST guide to operational technology and industrial control system security. put that operational view of assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., network paths, and responsibilities at the center. For NIS2Consolidated text of EU Directive 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union. and national critical-infrastructure legislationGerman Federal Government article on the KRITIS umbrella act and cross-sector resilience requirements., it also becomes reliable evidence from operations.
Utilities manage distributed sites, long-lived OTOT covers hardware and software that monitor and control physical devices, plants, processes, or infrastructure., supplier access, and narrow maintenance windows. Without a shared picture, incidents, patches, and vendor advisories become slow, expensive, and risky.
Outcomes
- faster root-cause work during incidents and advisories
- maintenance and patches planned by affected service and zoneZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits.
- a clear order for vulnerabilitiesA vulnerability is an exploitable weakness in software, hardware, configuration, process, or architecture., EOL/EOSEOL/EOS describes lifecycle states in which a vendor no longer regularly maintains, sells, or supports a product, firmware, or system., and spare parts
- traceable records for NIS2NIS is the European legal framework for a higher level of cybersecurity in network and information systems. and critical-infrastructureKRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society. duties
What a blind spot in critical services costs
In an incidentAn IT security incident is an event in which the confidentiality, integrity, availability, or authenticity of IT or OT systems may be impacted., what counts is how fast you know what is affected, who owns it, and what must be proven.
Unattended remote maintenance
Supplier and maintenance access is a main entry point when purpose, owner, and approval are not recorded.
Unknown dependencies
Which assetAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. carries which service, and across which zoneZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., often becomes clear only when it fails.
Missing attack detection
Without dependable logging and detection, the required attack-detection maturitySzA stands for systems for attack detection: technically supported and organizationally embedded processes to detect attacks on IT systems. for the proof is missing.
Evidence by hand
Otherwise the proof for section 8a, NIS2NIS is the European legal framework for a higher level of cybersecurity in network and information systems., and auditors is assembled from spreadsheets just before the deadline.
From signal to evidence
Four steps that turn day-to-day operations into dependable evidence, instead of hunting for it before the audit.
See
What runs at which site?
The sensor and existing sources deliver assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., networks, and conduits across every site, passive-first with approval for active queries.
Understand
What does the critical service depend on?
The graph links assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., zonesZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., owners, and remote access, so dependencies and operational impact become visible.
Detect
Would an attack be noticed in time?
Logging, detection, and response bring attack detectionSzA stands for systems for attack detection: technically supported and organizationally embedded processes to detect attacks on IT systems. to the required maturity level, tied to real assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security..
Prove
Is the proof ready for the auditor?
The section 8a proof, the 24h and 72h reports, and the conduit register all come from the same current data.
In practice, following the obligations
Recurring critical-infrastructure obligationsKRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society. become clear workflows that meet the real deadlines.
- AnnounceA supplier requests a maintenance window for a facility at one site.
- Check conduitPurpose, owner, approval, and permitted paths of the access are in the model.
- WatchThe sensor observes which devices and connections appear during the window.
- ProveActivity and changes stay traceable after the window closes.
- DetectAttack detectionSzA stands for systems for attack detection: technically supported and organizationally embedded processes to detect attacks on IT systems. fires and an event becomes security-relevant.
- Scope itThe graph shows affected assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., services, sites, and dependencies at once.
- Report in 24hThe early warning goes out on time, with a dependable scope instead of a guess.
- Follow in 72hThe detailed report uses the same context, without gathering everything again.
- ScopeEssential systems, processes, roles, and people are named in the model.
- MeasuresRisks, measures, and exceptions are anchored to real assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security. and zonesZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits..
- MaturityThe state of attack detectionSzA stands for systems for attack detection: technically supported and organizationally embedded processes to detect attacks on IT systems. is backed by logging and response.
- PackageThe proof is produced as one coherent record for the auditor.
- CaptureCritical facilities, services, and operator data are maintained in one place.
- ReconcileThe same data carries the NIS2NIS is the European legal framework for a higher level of cybersecurity in network and information systems. registration with the BSIThe BSI is Germany's central federal authority for cyber and information security. and the critical-infrastructureKRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society. registration with the BBK.
- Keep currentChanges to facilities and sites flow in continuously, not once a year.
- ProveRegistration rests on dependable operating data instead of a snapshot.
Which product modules are involved
The modules play different roles in the deployment: observation, inventory, platform governance, and handover to the right people.
secnostic sensor
provides observations from networks, endpoints, and existing data sources.
focusAlert
routes events through an optional configured connection to accountable people and keeps responses and escalations traceable.
secnostic platform
governs tenants, roles and access to connected secnostic® applications.
FAQ
Key questions before a first scoping conversation.
How does asset transparency help daily operations?
Operations teams see faster which facility, system, supplier, and communication path belongs to a critical service. Incidents, maintenance work, vendor advisories, and handovers require less searching and fewer assumptions.
Why is a classic asset list not enough?
A list shows individual systems, but rarely service context, communication paths, operational impact, maintenance windows, remote access, and ownership. Control room, ITIT comprises systems, networks, and software that process, store, transmit, or provide information., OTOT covers hardware and software that monitor and control physical devices, plants, processes, or infrastructure., and suppliers need that context.
How does secnostic reduce outage and response time?
secnostic® connects observations, assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., zonesZones & Conduits is an IEC 62443 concept that groups systems with similar protection needs into security zones and describes permitted communication paths between these zones as conduits., risks, owners, and measures. During an incidentAn IT security incident is an event in which the confidentiality, integrity, availability, or authenticity of IT or OT systems may be impacted. or advisory, teams can see which services are affected, who must decide, and which next steps are sensible.
How does secnostic support NIS2 and critical-infrastructure evidence?
Operational context creates evidence from daily work instead of from a separate text collection: scope, assetsAn asset is a physical or digital element that is relevant to operations, control, monitoring, or security., risks, measures, exceptions, owners, and review dates stay traceably connected. The required evidence depends on the applicable framework and your deployment.
What is a sensible starting point?
Start small and close to operations: one critical service, one site, one recurring maintenance topic, or one concrete vulnerabilityA vulnerability is an exploitable weakness in software, hardware, configuration, process, or architecture. situation. Data sources, gaps, and prioritized measures can then expand in a structured way.
Which integrations need to be configured?
Passing sensor data to inventory requires a configured integration. A configured webhook/API connection can pass events to focusAlert. This integration is optional. Users sign in through the configured external identity providerAn IdP creates and manages identity information and provides authentication services for applications.. platform manages tenants and access to connected applications.
Clarify the critical-infrastructure scope together
We start with one critical service, one site, or one concrete vulnerability situation and make the first data gaps visible.