This week, CISA and eight international cybersecurity agencies released a joint publication: Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators
The document provides timely, practical direction for organizations looking to strengthen their OT cybersecurity foundations—starting with asset inventory and taxonomy. It reflects a growing global consensus that effective asset visibility is a prerequisite for reducing risk, managing vulnerabilities, and supporting defensible architecture.
The guide was developed in collaboration with:
CISA, NSA, FBI, EPA (U.S.); ACSC (Australia); Cyber Centre (Canada); BSI (Germany); NCSC-NL (Netherlands); and NCSC-NZ (New Zealand).
OT asset inventory is far more than a list of connected devices. Done well, it captures the context, configuration, and criticality of each asset—enabling better decision-making across cybersecurity, operations, and compliance. The guidance reaffirms that an asset inventory:
The guidance also emphasizes the important of OT taxonomy—a structured way to categorize assets based on function or criticality (e.g., using zones and conduits, per ISA/IEC 62443).
The guide walks through a five-step process for developing and using an OT asset inventory and taxonomy:
1. Define Scope and Objectives
Set clear boundaries, assign roles, and identify stakeholders who rely on asset data.
2. Identify Assets and Collect Attributes
Use both physical and logical methods. Prioritize fields like asset role/type, communication protocols, OS and firmware, network location, and criticality.
3. Create an OT Taxonomy
Group and classify assets using criticality- or function-based approaches. Visualize zones, conduits, and interdependencies (examples provided for electricity, oil & gas, and water/wastewater sectors).
4. Manage and Collect Data
Centralize data, validate accuracy, and align with lifecycle and change management practices.
5. Implement Lifecycle Management
Ensure inventory stays current through all stages of each asset’s lifecycle—from commissioning to decommissioning.
These steps align closely with how Industrial Defender enables deep, structured OT asset visibility, with data collection methods that are proven safe for control system environments.
Once inventory and taxonomy are in place, the guide outlines next steps to put them to use:
For organizations already working toward NERC CIP, TSA Pipeline Security, IEC 62443, or other frameworks, this guidance helps bring structure to a process that’s often approached informally or reactively.
This joint guidance is a clear signal: governments are aligning on foundational expectations for OT cybersecurity.
Access the full guidance from CISA here:
Foundations for OT Cybersecurity: Asset Inventory Guidance
At Industrial Defender, we’ve always believed that a strong OT asset inventory is the foundation for cybersecurity, compliance, and operational integrity. This guidance reinforces what we see in the field every day: organizations need more than a list—they need accurate, detailed, and actionable asset data to make informed decisions.
Our platform is purpose-built for OT environments and supports:
If you’re looking to build or mature your OT asset inventory in alignment with the new CISA guidance, our team is ready to help.
