OT Asset Inventory Worksheet
You cannot protect, patch or isolate plant floor equipment you do not know about. This worksheet gives IT security and controls engineers a shared inventory of PLCs, HMIs, CNC controllers and servers with a simple risk score to guide priorities.
| Asset ID | Description | Type | Location | Purdue level | Vendor and model | Firmware or OS version | Vendor supported | Remote access | Criticality (1 to 5) | Exposure (1 to 5) | Risk score | Last reviewed | Owner | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
10 | ||||||||||||||
12 | ||||||||||||||
12 | ||||||||||||||
16 | ||||||||||||||
15 | ||||||||||||||
20 |
Sample rows are illustrative. Fill the inventory from walkdowns, network scans (passive tools are safer in OT than active scans) and maintenance records. Do not run active scans on live controllers without the plant owner's agreement. Sort by risk score, then by supported status, to choose where to start. The Purdue levels are the common reference model for separating enterprise, supervisory and control layers.
Optional asset-to-ERP reconciliation
Ask how plant equipment records in your ERP or CMMS can seed and maintain this inventory.
Optional. The tool and every export work without this. No spam.
How to build the inventory
Start with a walkdown of each production area and record every device with an IP address or a network port: controllers, HMIs, switches, gateways, historian and engineering workstations. Add maintenance records and drawings, then compare against passive network monitoring where available. Record the vendor, model, firmware, support status, how it is reached remotely and who owns it. Rate criticality by the impact of loss (line stops, safety, quality) and exposure by how reachable it is from the corporate network or the internet.
- Walk the floor and use maintenance records
- Prefer passive discovery in OT
- Name an owner for every asset
- Review at least twice a year
Reading the risk score
The score is criticality times exposure, from 1 to 25. It is not a formal risk calculation, only a way to sort. A critical controller with low exposure may be less urgent than a modest HMI that sits on a flat network with unsupported Windows. Use the highest scores to decide where to add segmentation, remove direct remote access, replace unsupported platforms or add compensating controls. Standards such as IEC 62443 and NIST SP 800-82 describe fuller approaches with zones, conduits and security levels.
Common mistakes
Inventories fail when they are done once and not kept up, when they cover only the IT side, or when engineers keep their own lists that never merge. Another mistake is running aggressive scans that crash old controllers. Finally, an inventory without owners and review dates turns stale in months. Agree who updates it when equipment is added, changed or retired.
- Include network gear and engineering laptops
- Never run active scans on live controllers without approval
- Record support status for operating systems
- Tie updates to the change process
Frequently Asked Questions
What belongs in an OT asset inventory?
Any device that monitors or controls physical processes or supports them: PLCs, HMIs, CNC and robot controllers, drives, SCADA and historian servers, switches, firewalls, gateways and engineering workstations. Record version, location, owner and connections.
Is it safe to scan an OT network?
Active scanning can disrupt fragile devices. Prefer passive monitoring or vendor-approved methods, schedule any active checks during planned downtime and get the plant owner's consent. Start with walkdowns and records.
How does this relate to IEC 62443?
An inventory is a first step toward IEC 62443 style zones and conduits. You need to know the assets to group them, set security levels and define allowed traffic. The worksheet does not replace a formal assessment.
How often should the inventory be reviewed?
At least twice a year and whenever equipment is added, replaced or changed. Link updates to your management of change process so the inventory reflects the plant as it is.
If you want OT assets reconciled with ERP equipment records and maintenance data so the inventory stays current, Netray can discuss a private, on-premises approach. The worksheet works on its own.
Related Tools
Manufacturer Ransomware Readiness Assessment
A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery.
Industry TemplatesManufacturing Cyber Incident Response Plan Template
A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.
Compliance & ContractsCyber Insurance Readiness Checklist for Manufacturers
A checklist of the controls and documents underwriters commonly ask manufacturers about, so you can fix gaps before the application or renewal.
Safety & WorkforcePhishing Simulation Results Tracking Worksheet
Log each phishing simulation with sent, clicked, reported and credential counts. Click, report and compromise rates are calculated per campaign and overall.
More Industry Templates tools
See all- OEE Improvement A3 Charter Template
- Customer Order Change Request Form Template
- Plant Network Segmentation Checklist (Purdue Model)
- Server Room UPS Runtime and Sizing Calculator
- Server Room Cooling Load BTU Calculator
- Ransomware Downtime Cost Calculator for Manufacturers
- Plant Switch Port Budget Worksheet
- Industrial Protocol and Plant IT TCP/UDP Ports Reference
- Plant Network VLAN and IP Addressing Plan Worksheet