It should identify more than IP addresses. Useful records connect controllers, sensors, actuators, safety systems, engineering workstations, network equipment, firmware, and applications to their owners, locations, criticality, supported processes, and expected communication paths.
Inventory creation is a continuing operational process, not a one-time scan. Evidence may come from engineering documents, configuration systems, network traffic, device logs, physical inspection, and approved discovery tools. Passive monitoring is usually less disruptive but can miss dormant, serial, isolated, or rarely communicating assets. Active probing may provide richer results but can overload networks or trigger unsafe behavior in fragile or legacy equipment, so OT operators should approve and test it before use.
Key points
Useful attributesAsset type, manufacturer, model, serial number, hardware and software versions, address, protocol, location, owner, criticality, safety function, lifecycle state, and dependencies.
Safe discoveryBegin with existing records and passive sources, validate findings with engineering personnel, and use active methods only with defined scope, rate limits, rollback, and operational approval.
Ongoing controlReconcile changes from maintenance, projects, and incidents; record confidence and last-seen dates; protect the inventory because it is sensitive operational information.
Important limitationNo discovery method is complete. Passive collection may not see silent equipment, while active scanning can disrupt sensitive processes; an inventory must combine methods and acknowledge uncertainty.