OT Asset Inventory
CISA and eight partner agencies’ guidance for building an OT asset inventory and taxonomy (August 2025), with its example sector taxonomies mapped to the 18 ATT&CK for ICS assets.
Crosswalk is this site’s curation
editorialThe guide carries no ATT&CK identifier. The steps, fields and taxonomy rows below are CISA’s; the link from each row to an ATT&CK ICS asset is ours, with the reason beside it. direct means the row names the device class ATT&CK models; partial means ATT&CK models part of it; none means physical process, power or facility equipment that ATT&CK for ICS does not model — listed anyway, because hiding it would overstate the coverage. CISA itself calls these taxonomies examples, not authoritative.
- Oil and natural gas24 rows · 10 direct · 3 partial · 11 none · 10 of 18 assets
- Electricity26 rows · 12 direct · 4 partial · 10 none · 12 of 18 assets
- Water and wastewater25 rows · 11 direct · 1 partial · 13 none · 11 of 18 assets
Five steps
- 1Define scope and objectivesGovernance over asset management, roles for collecting and validating data, and the boundary of the programme: zones, facilities, systems, and what counts as an asset.
- 2Identify assets and collect attributesPhysical inspection plus a logical survey, then the attributes for each asset, high-priority fields first.
- 3Create a taxonomy to categorize assetsClassify by criticality and function, group functions into zones, organise communication pathways, then validate and visualise.
- 4Manage and collect dataKeep the inventory current as assets and their attributes change.
- 5Implement life cycle managementTrack each asset from procurement to decommissioning, including support status and obsolescence.
Inventory fields (Appendix A)
Collect the high-priority fields first. Where a field drives something on this site, the last column says where.
| Field | Priority | Why | On this site |
|---|---|---|---|
| Active/supported communication protocols | high | Network-traffic analysis; start with assets that talk across the IT/OT perimeter or to SCADA over a WAN. | — |
| Asset criticality | high | Manage assets by operational role, safety impact and exposure. | — |
| Asset number | high | Unique organisational identifier. | — |
| Asset role/type | high | Context and function on the network (engineering workstation, PLC, historian, switch/router, hypervisor host). | crosswalk below |
| Hostname | high | Context, if naming conventions encode function. | — |
| IP address | high | Network-traffic analysis. | — |
| Logging | high | How the asset’s logs are collected, for detection and investigation. | data sources |
| MAC address | high | Manufacturer when not otherwise known (may only identify the network card). | — |
| Manufacturer | high | Known vulnerabilities. | applications / CVEs |
| Model | high | Known vulnerabilities. | applications / CVEs |
| Operating system | high | Known vulnerabilities, where applicable. | — |
| Physical location/address | high | Where to find the asset. | — |
| Ports/services | high | Verify role and attack surface; costly to maintain, so start at the perimeter. | — |
| User accounts | high | Which accounts are expected to use the asset. | — |
| Backup frequency/type | medium | How often and how (full, incremental, differential). | — |
| Baseline image | medium | Known-good image for post-incident recovery. | — |
| Department/owner | medium | Who is responsible for the asset. | — |
| Distributor | medium | Where the asset came from, if not the manufacturer. | — |
| Firmware/software version | medium | Known vulnerabilities, where applicable. | — |
| OS version | medium | Known vulnerabilities, where applicable. | — |
| Physical or virtual | medium | Whether the asset is a physical device or a VM. | — |
| VLAN | medium | The asset’s place in the network structure. | — |
| Antivirus/endpoint protection | The asset’s ability to protect itself. | — | |
| Date of manufacture | Obsolescence. | — | |
| Hypervisor | Which hypervisor runs the VM, if applicable. | — | |
| Local time zone | Timelines in behaviour analysis. | — | |
| Location within hypervisor | Where the VM resides, if applicable. | — | |
| Network monitoring | How well communications to the asset are monitored. | data sources | |
| Notes/description | Free-text context and history. | — | |
| Primary communication method | Wired, wireless, cellular, RF, satellite — scope of an incident and of the attack surface. | — | |
| Serial number | Unique identifier; some vendors require it for patches and support. | — | |
| Time source | NTP, GPS, atomic or local clock — losing it causes drift with real impact. | — |
Sector taxonomies → ATT&CK ICS assets
Oil and natural gas
Appendix B, Tables 3–5High criticalityRank ICS techniques for these 4 assets →
Primary Production Systems
- Drilling rigsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- WellheadsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- Subsea equipmentPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Safety Systems
- Emergency shutdown systems (ESD)directA0010ATT&CK lists "Emergency Shutdown Systems (ESD) controller" as a related asset of Safety Controller.
- Fire and gas detection systemspartialA0010A0013A safety function: its logic runs on a safety controller (A0010) and its detectors are Field I/O (A0013). The alarm panels and suppression hardware are not modelled.
- Blowout preventers (BOP)Mechanical well-control equipment. Its control panel is not a distinct ATT&CK asset; if it is driven by a safety controller, that controller is the ESD/safety row.
Control Systems
Power Systems
- Backup generatorsPower supply equipment. Not modelled as an ATT&CK for ICS asset.
- Uninterruptible power supplies (UPS)Power supply equipment. Not modelled as an ATT&CK for ICS asset.
Medium criticalityRank ICS techniques for these 6 assets →
Processing Equipment
- Separators (oil, gas, water)Physical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- CompressorsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- Heat exchangersPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Monitoring Systems
Communications Systems
Low criticalityRank ICS techniques for these 3 assets →
Auxiliary Systems
- Heating, ventilation, and air conditioning (HVAC) systemsFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
- Lighting systemsFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
Non-Critical Monitoring
- Environmental monitoring (e.g., emissions tracking)partialA0013The analyzers and sensors are Field I/O; the reporting software around them is not distinguished.
- Non-essential data loggingpartialA0006Data logging is a historian function (A0006); a standalone data logger may instead be Field I/O or a gateway.
Electricity
Appendix C, Tables 7–9High criticalityRank ICS techniques for these 4 assets →
Primary Equipment
- Power transformersPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- Circuit breakersSwitching equipment. The relays and IEDs that trip it are the Protection Systems rows.
- SwitchgearPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- BusbarsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Protection Systems
- Protection relays (over/under current), distance type (impedance, reactance), differential (current, voltage)directA0005ATT&CK lists "Protection Relay" as a related asset of Intelligent Electronic Device.
- Fault detection and isolation mechanismspartialA0005A function rather than a device; in substations it runs in relays and other IEDs.
- Voltage regulatorspartialA0005The regulator is physical equipment; its controller is an IED.
Control Systems
- DCSdirectA0017ATT&CK’s DCS Controller is the core of a DCS. The HMIs and servers in a DCS are CISA rows of their own (HMIs, operator workstations, SCADA), so only the controller is mapped here.
- PLCs managing critical functionsdirectA0003Same device class.
- SCADA systemsdirectA0007ATT&CK lists "Supervisory Control And Data Acquisition (SCADA) Server" as a related asset of Control Server.
Power Supply Systems
- Backup generatorsPower supply equipment. Not modelled as an ATT&CK for ICS asset.
- UPS for critical equipmentPower supply equipment. Not modelled as an ATT&CK for ICS asset.
Medium criticalityRank ICS techniques for these 7 assets →
Monitoring and Measurement Devices
- Current and voltage sensorsdirectA0013Sensors are Field I/O; ATT&CK lists "Smart Sensors" as a related asset.
- Metering devices for energy and power qualitypartialA0005Power-quality and substation meters are IEDs; simple revenue meters may be closer to Field I/O.
- Data historians for operational insightsdirectA0006Same device class.
Communications Systems
Environmental Control Systems
- Cooling systems for transformers or control roomsFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
- HVACFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
Low criticalityRank ICS techniques for these 3 assets →
Facility Support Systems
- Lighting systems for indoor and outdoor facilitiesFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
- Building security systems (non-critical zones)Physical security systems are not modelled as ATT&CK for ICS assets.
Peripheral and Non-Critical Devices
Non-Critical Monitoring
Water and wastewater
Appendix D, Tables 11–13High criticalityRank ICS techniques for these 6 assets →
Primary Treatment Systems
- Pumps (e.g., intake, discharge, high-pressure)Physical process equipment. A pump’s variable frequency drive is Field I/O in ATT&CK (VFD is a related asset of A0013) and belongs in its own inventory row.
- Screens, clarifiers, and grit removal systemsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Secondary Treatment Systems
- Aeration systemsA process system, not a device. Its controllers, sensors and HMIs are separate rows in CISA’s own tables, so mapping it again would double count.
- Biological treatment reactorsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Safety and Environmental Systems
- Emergency shutdown systemsdirectA0010ATT&CK lists "Emergency Shutdown Systems (ESD) controller" as a related asset of Safety Controller.
- Chemical dosing systems for pH control or disinfectionA process system, not a device. Its controllers, sensors and HMIs are separate rows in CISA’s own tables, so mapping it again would double count.
- Spill containment systemsPhysical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Control Systems
- SCADA systemsdirectA0007ATT&CK lists "Supervisory Control And Data Acquisition (SCADA) Server" as a related asset of Control Server.
- DCS for core processesdirectA0017ATT&CK’s DCS Controller is the core of a DCS. The HMIs and servers in a DCS are CISA rows of their own (HMIs, operator workstations, SCADA), so only the controller is mapped here.
- OT communications infrastructurepartialA0015A0014A0009A category, not a device: switches, routers and gateways are the parts ATT&CK models; radio and cellular links are not.
Power Systems
- Backup generatorsPower supply equipment. Not modelled as an ATT&CK for ICS asset.
- UPSPower supply equipment. Not modelled as an ATT&CK for ICS asset.
Medium criticalityRank ICS techniques for these 5 assets →
Water Quality Monitoring
- Online analyzers for turbidity, chlorine, or dissolved oxygendirectA0013Sensors are Field I/O; ATT&CK lists "Smart Sensors" as a related asset.
- Sampling stationsA physical sampling point; any online analyzer at it is the row above.
Communications Systems
Networking Equipment
Auxiliary Systems
- Sludge management equipment (e.g., pumps, centrifuges)Physical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
- Non-essential pumping systems (e.g., irrigation or utility water)Physical process equipment. ATT&CK for ICS models the devices that control and monitor it, not the equipment itself.
Low criticalityRank ICS techniques for these 2 assets →
Facility Support Systems
- HVACFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
- Lighting systems for buildingsFacility equipment. Not modelled as an ATT&CK for ICS asset; if a building automation system runs it, that system’s server is a Control Server (ATT&CK lists BMS/BAS among A0007’s related assets) and belongs in its own inventory row.
Peripheral Devices
Non-Critical Monitoring
- Sensors for ambient temperature, facility water usage, or general alarmsdirectA0013Sensors are Field I/O; ATT&CK lists "Smart Sensors" as a related asset.
Source
CISA with EPA, NSA, FBI, ASD's ACSC, Cyber Centre, BSI, NCSC-NL, NCSC-NZ, Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 2025, TLP:CLEAR; PDF). Field benefits are paraphrased; taxonomy rows are quoted. The ATT&CK asset mapping is this project’s, as are the Purdue placements it lands on (Purdue model). Not affiliated with or endorsed by CISA or its co-authors.