A PC used to operate a machine needs replacing. IT knows the computer. The maintenance team knows its place in the plant. Preparing the replacement also requires details of the software used to operate the machine, the controller and the connected server. In my it-sa talk “What Do We Actually Have? Building an IT/OT Asset Inventory from Reality”, I show how this scattered information becomes a shared inventory.
Here, IT covers the server and support for the PC. OT is the technology used to operate and control the plant. The operator PC, with its human-machine interface, or HMI, connects these perspectives. The computer is both an IT-managed device and part of a plant function. The inventory therefore needs to connect devices, software and their relationships.
Start with a practical task
Start with a manageable area. Here, that is the operator workstation, its controller and the server it needs. Agree which information will help prepare the replacement. Record the location, device identifiers and software versions, together with the responsible people and plant documentation.
Much of this already exists. IT holds device lists and server details. Maintenance uses circuit diagrams and service records. Check the nameplate and installation location at the device. Bring the information together, noting where each detail came from and when it was collected or checked.
Automated discovery can show which devices communicate on a monitored network. It does not, on its own, establish their role. Passive discovery misses devices with no observed traffic. Documents and on-site checks are therefore still needed. Agree the discovery method with those responsible and check that it is suitable for live operations.
Assign information to the right device
Now assign the information to the correct device. An IP address alone is not a sufficient identifier. It can change or appear in more than one network. Record the relevant network and the time of observation as well.
If a plant reference designation, known as an AKZ, uniquely identifies a functional position, it can link the entry to circuit diagrams and the controller project. During replacement, that position remains while the installed device changes. Record them separately. Manufacturer, serial number and software version belong to the individual device. This preserves the history of what was installed.
IT confirms the PC details and connected server. Automation and operations staff check which controller the PC works with and what the connection is used for. Together, the teams document the connection and its role in plant operations.
Keep a missing software version visibly unresolved. If a list contradicts the nameplate, investigate the difference. An unconfirmed assumption should not appear as a verified fact.
Use the inventory and keep it current
The team can now find the operator PC, its software, the server and the machine controller. It knows who can assess the effects of replacement and which documents are needed. Connected workstations can also be reviewed before server maintenance. The inventory supports preparation, while the responsible specialists give technical approval.
When a manufacturer issues a security advisory, device and version details help identify potentially affected systems. Their functions and connections show which other areas may need attention. Suitable protective measures still require assessment.
When building the inventory, agree who will record changes. Update the entry when a device is replaced, software is updated or a connection is altered. Keeping the inventory current becomes part of commissioning and maintenance.
secnostic sensor can collect technical details from approved sources. secnostic inventory combines them with software, documents and the teams' knowledge in a shared IT and OT model. secnostic platform manages sign-in and access to the applications.
The first useful inventory can cover a small area. What matters is that it helps the team prepare a real task with reliable information. The next operator workstation can then be added in the same way.
Technical references
- CISA, BSI and partner authorities, 13 August 2025. Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators.
- NIST SP 800-82 Rev. 3, September 2023. Guide to Operational Technology (OT) Security.
- IEC, Edition 2.0, 30 March 2022. IEC 81346-1:2022 Structuring principles and reference designations.
