# OT Asset Inventory Worksheet > Source: https://netray.co/tools/ot-asset-inventory-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score. ## Category industry-templates ## Industry Discrete Manufacturing ## Audience - IT security lead - OT engineer - Plant IT manager ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Asset ID **Key:** asset_id **Type:** text #### Description **Key:** description **Type:** text #### Type **Key:** type **Type:** select **Options:** - PLC - HMI - CNC controller - SCADA server - Historian - Engineering workstation - Switch - Firewall - Robot controller - Sensor gateway - Other #### Location **Key:** location **Type:** text #### Purdue level **Key:** level **Type:** select **Options:** - 0 - 1 - 2 - 3 - 3.5 DMZ - 4 #### Vendor and model **Key:** vendor **Type:** text #### Firmware or OS version **Key:** firmware **Type:** text #### Vendor supported **Key:** supported **Type:** select **Options:** - Yes - No - Unknown #### Remote access **Key:** remote **Type:** select **Options:** - None - VPN only - Vendor session - Direct #### Criticality (1 to 5) **Key:** criticality **Type:** number **Help:** 5 = line stops or safety impact #### Exposure (1 to 5) **Key:** exposure **Type:** number **Help:** 5 = reachable from corporate network or internet #### Risk score **Key:** risk **Type:** number **Expr:** criticality * exposure **Format:** integer #### Last reviewed **Key:** last_review **Type:** date #### Owner **Key:** owner **Type:** text **Rows:** **Asset id:** PLC-L1-001 **Description:** Line 1 packaging PLC **Type:** PLC **Location:** Line 1 cabinet **Level:** 1 **Vendor:** Allen-Bradley CompactLogix **Firmware:** v32.011 **Supported:** Yes **Remote:** VPN only **Criticality:** 5 **Exposure:** 2 **Last review:** 2026-08-14 **Owner:** Controls engineer **Asset id:** CNC-M04 **Description:** Machining cell 4 controller **Type:** CNC controller **Location:** Cell 4 **Level:** 2 **Vendor:** Fanuc 31i **Firmware:** Series version on tag **Supported:** Yes **Remote:** Vendor session **Criticality:** 4 **Exposure:** 3 **Last review:** 2026-07-30 **Owner:** CNC lead **Asset id:** HMI-P2-003 **Description:** Press 2 operator HMI **Type:** HMI **Location:** Press 2 **Level:** 2 **Vendor:** Windows 7 embedded panel **Firmware:** Windows 7 **Supported:** No **Remote:** None **Criticality:** 3 **Exposure:** 4 **Last review:** 2026-06-10 **Owner:** Maintenance **Asset id:** SRV-HIST-01 **Description:** Plant historian server **Type:** Historian **Location:** Server room **Level:** 3 **Vendor:** Virtualized Windows Server **Firmware:** Windows Server 2019 **Supported:** Yes **Remote:** VPN only **Criticality:** 4 **Exposure:** 4 **Last review:** 2026-09-02 **Owner:** Plant IT **Asset id:** FW-OT-01 **Description:** IT to OT firewall **Type:** Firewall **Location:** Server room **Level:** 3.5 DMZ **Vendor:** Vendor firewall pair **Firmware:** Current release **Supported:** Yes **Remote:** None **Criticality:** 5 **Exposure:** 3 **Last review:** 2026-09-02 **Owner:** Network team **Asset id:** EWS-02 **Description:** Engineering laptop, controls team **Type:** Engineering workstation **Location:** Controls office **Level:** 3 **Vendor:** Standard laptop **Firmware:** Windows 11 **Supported:** Yes **Remote:** Direct **Criticality:** 4 **Exposure:** 5 **Last review:** 2026-08-20 **Owner:** Controls engineer **Totals:** #### Highest risk score **Key:** risk **Agg:** max **Format:** integer #### Average risk score **Key:** risk **Agg:** avg **Format:** decimal #### Assets listed **Key:** asset_id **Agg:** count **Format:** integer **Summary:** #### Gap from top score to average **Key:** high_gap **Expr:** max_risk - avg_risk **Format:** decimal **Description:** A large gap means a few assets carry most of the risk. **Notes:** Sample rows are illustrative. Fill the inventory from walkdowns, network scans (passive tools are safer in OT than active scans) and maintenance records. Do not run active scans on live controllers without the plant owner's agreement. Sort by risk score, then by supported status, to choose where to start. The Purdue levels are the common reference model for separating enterprise, supervisory and control layers. ## Content **Intro:** You cannot protect, patch or isolate plant floor equipment you do not know about. This worksheet gives IT security and controls engineers a shared inventory of PLCs, HMIs, CNC controllers and servers with a simple risk score to guide priorities. **Sections:** #### How to build the inventory **Body:** Start with a walkdown of each production area and record every device with an IP address or a network port: controllers, HMIs, switches, gateways, historian and engineering workstations. Add maintenance records and drawings, then compare against passive network monitoring where available. Record the vendor, model, firmware, support status, how it is reached remotely and who owns it. Rate criticality by the impact of loss (line stops, safety, quality) and exposure by how reachable it is from the corporate network or the internet. **Bullets:** - Walk the floor and use maintenance records - Prefer passive discovery in OT - Name an owner for every asset - Review at least twice a year #### Reading the risk score **Body:** The score is criticality times exposure, from 1 to 25. It is not a formal risk calculation, only a way to sort. A critical controller with low exposure may be less urgent than a modest HMI that sits on a flat network with unsupported Windows. Use the highest scores to decide where to add segmentation, remove direct remote access, replace unsupported platforms or add compensating controls. Standards such as IEC 62443 and NIST SP 800-82 describe fuller approaches with zones, conduits and security levels. #### Common mistakes **Body:** Inventories fail when they are done once and not kept up, when they cover only the IT side, or when engineers keep their own lists that never merge. Another mistake is running aggressive scans that crash old controllers. Finally, an inventory without owners and review dates turns stale in months. Agree who updates it when equipment is added, changed or retired. **Bullets:** - Include network gear and engineering laptops - Never run active scans on live controllers without approval - Record support status for operating systems - Tie updates to the change process **Cta:** If you want OT assets reconciled with ERP equipment records and maintenance data so the inventory stays current, Netray can discuss a private, on-premises approach. The worksheet works on its own. **Faq:** #### What belongs in an OT asset inventory? **Answer:** Any device that monitors or controls physical processes or supports them: PLCs, HMIs, CNC and robot controllers, drives, SCADA and historian servers, switches, firewalls, gateways and engineering workstations. Record version, location, owner and connections. #### Is it safe to scan an OT network? **Answer:** Active scanning can disrupt fragile devices. Prefer passive monitoring or vendor-approved methods, schedule any active checks during planned downtime and get the plant owner's consent. Start with walkdowns and records. #### How does this relate to IEC 62443? **Answer:** An inventory is a first step toward IEC 62443 style zones and conduits. You need to know the assets to group them, set security levels and define allowed traffic. The worksheet does not replace a formal assessment. #### How often should the inventory be reviewed? **Answer:** At least twice a year and whenever equipment is added, replaced or changed. Link updates to your management of change process so the inventory reflects the plant as it is. ## Search terms OT asset inventory template, OT asset inventory excel, ICS asset inventory spreadsheet, industrial control system asset list, PLC inventory template, OT cybersecurity asset register, manufacturing network asset inventory --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json