← Home
Asset Inventory
An IACS asset inventory is the maintained list or database of Industrial
Automation and Control System and SCADA hardware (physical and virtual) and software. You
cannot patch, harden, segment or assess risk what you do not know exists. In ISA/IEC 62443,
inventory is a Security Program expectation under
Part 2-1 CM 1.1
and a practical prerequisite for
Part 3-2 risk assessment.
Teaching note: Paraphrased for learning from IACS cybersecurity course
material and industry practice. Not a substitute for the normative text of ISA/IEC 62443
or site CMDB policy.
Related:
IEC 62443-2-1 SPE 2
|
Change Management
|
Prepare for an Assessment
|
Patch Management
|
System Hardening
|
Network Discovery and Scanning
What to inventory
Hardware
- Computers — servers and workstations
- Network equipment — switches, routers, firewalls
- Automation devices — PLCs, DCS, VFDs, RTUs, IEDs, and similar
- Every device with an Ethernet / IP address, plus devices using routable serial protocols
(for example ControlNet, PROFIBUS, Modbus TCP where applicable)
Record attributes such as ownership, manufacturer, model, serial number, versions, network
addresses, location, criticality and change history.
Virtual machines
Document VMs with the same discipline as physical hosts — hypervisor, guest OS, function,
addresses and owners.
Software
- Operating systems, applications (including SaaS where in scope), databases and firmware
- Attributes: name and type, function, vendor, version, licence information and support status
How to build and maintain it
- Start from documentation and site survey; expect significant effort on brownfield sites
- Automated discovery tools help but must be tested so they do not harm availability or
integrity, and must not introduce new vulnerabilities
- Tool categories: network management, software asset management (SAM), and configuration
management platforms
- Tie inventory updates to
change management
so the live plant and the record stay aligned
Key takeaways
- Inventory covers hardware, VMs and software with enough attributes to support security work.
- CM 1.1 expects a verified, lifecycle-maintained baseline.
- Safe discovery + change-linked updates beat one-off spreadsheets that rot.