{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "item": { "id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "slug": "ot-asset-inventory-taxonomy-cisa-2025-building-security-systems", "url": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems.md", "json": "https://update.dsesecurity.com/api/v1/posts/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/" }, "title": "Build an OT asset inventory and taxonomy for building security systems using CISA’s 2025 joint guidance", "summary": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "access-control", "name": "Access Control", "url": "https://update.dsesecurity.com/topic/access-control/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-18T21:01:08+00:00", "modified_at": "2026-10-18T22:22:08+00:00", "reviewed_on": "2026-10-18", "reading_minutes": 2, "word_count": 392, "potentially_affected": "Owners of operational technology, including physical access control, video, intrusion, fire and building automation systems, and the integrators and managed service providers who maintain them.", "dse_recommendation": "DSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality.", "primary_source": { "name": "CISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025)", "url": "https://www.cisa.gov/sites/default/files/2025-08/joint-guide-foundations-for-OT-cybersecurity-asset-inventory-guidance_508c.pdf", "published_on": null, "authority": "Cybersecurity and Infrastructure Security Agency" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.

\n

Source facts

\n

The joint OT asset inventory guidance, published August 13, 2025 by CISA with the EPA, NSA, FBI and international partners, defines an asset inventory as an organized, regularly updated list of an organization’s systems, hardware and software, and pairs it with an OT taxonomy that classifies assets by function and criticality. Its process covers defining scope and objectives, identifying assets and collecting attributes, creating a taxonomy, managing data and implementing life cycle management.

\n

To identify assets, the guidance calls for a physical inspection and logical survey and a comprehensive list of OT assets and network infrastructure dependencies. High priority attributes include active or supported communication protocols, asset criticality, asset number, role or type, hostname, IP address, logging, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.

\n

Criticality-based classification groups assets by their importance to operations, safety and mission, while function-based classification groups them by role, such as control systems, communication devices or monitoring tools. The guidance says to periodically review and update the taxonomy and to explore security controls for vulnerable systems that cannot be patched immediately or are end of life. Its sector taxonomies are not authoritative.

\n

Applicability

\n

The guidance targets critical infrastructure OT, but its process applies to any organization whose physical security or building systems run on networks. Its example taxonomies cover oil and gas, electricity and water sectors and are illustrations only.

\n

DSE recommendation

\n

DSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality. Walk each site to find controllers, recorders, panels and gateways that network scans miss, record who can log in to each device, and flag unpatchable or end-of-life items for compensating controls such as segmentation and restricted remote access.

\n

Verification

\n

Reconcile the inventory against a site walk and network data at least annually and after any installation, and confirm each asset has an owner, criticality rating and current firmware record. Track end-of-life items on a replacement plan.

\n

Official reference

\n

CISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025). Reviewed October 18, 2026.

", "content_text": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.\nSource facts\nThe joint OT asset inventory guidance, published August 13, 2025 by CISA with the EPA, NSA, FBI and international partners, defines an asset inventory as an organized, regularly updated list of an organization’s systems, hardware and software, and pairs it with an OT taxonomy that classifies assets by function and criticality. Its process covers defining scope and objectives, identifying assets and collecting attributes, creating a taxonomy, managing data and implementing life cycle management.\nTo identify assets, the guidance calls for a physical inspection and logical survey and a comprehensive list of OT assets and network infrastructure dependencies. High priority attributes include active or supported communication protocols, asset criticality, asset number, role or type, hostname, IP address, logging, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.\nCriticality-based classification groups assets by their importance to operations, safety and mission, while function-based classification groups them by role, such as control systems, communication devices or monitoring tools. The guidance says to periodically review and update the taxonomy and to explore security controls for vulnerable systems that cannot be patched immediately or are end of life. Its sector taxonomies are not authoritative.\nApplicability\nThe guidance targets critical infrastructure OT, but its process applies to any organization whose physical security or building systems run on networks. Its example taxonomies cover oil and gas, electricity and water sectors and are illustrations only.\nDSE recommendation\nDSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality. Walk each site to find controllers, recorders, panels and gateways that network scans miss, record who can log in to each device, and flag unpatchable or end-of-life items for compensating controls such as segmentation and restricted remote access.\nVerification\nReconcile the inventory against a site walk and network data at least annually and after any installation, and confirm each asset has an owner, criticality rating and current firmware record. Track end-of-life items on a replacement plan.\nOfficial reference\nCISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025). Reviewed October 18, 2026.", "content_markdown": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.\n\n## Source facts\n\nThe [joint OT asset inventory guidance](https://www.cisa.gov/sites/default/files/2025-08/joint-guide-foundations-for-OT-cybersecurity-asset-inventory-guidance_508c.pdf), published August 13, 2025 by CISA with the EPA, NSA, FBI and international partners, defines an asset inventory as an organized, regularly updated list of an organization’s systems, hardware and software, and pairs it with an OT taxonomy that classifies assets by function and criticality. Its process covers defining scope and objectives, identifying assets and collecting attributes, creating a taxonomy, managing data and implementing life cycle management.\n\nTo identify assets, the guidance calls for a physical inspection and logical survey and a comprehensive list of OT assets and network infrastructure dependencies. High priority attributes include active or supported communication protocols, asset criticality, asset number, role or type, hostname, IP address, logging, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.\n\nCriticality-based classification groups assets by their importance to operations, safety and mission, while function-based classification groups them by role, such as control systems, communication devices or monitoring tools. The guidance says to periodically review and update the taxonomy and to explore security controls for vulnerable systems that cannot be patched immediately or are end of life. Its sector taxonomies are not authoritative.\n\n## Applicability\n\nThe guidance targets critical infrastructure OT, but its process applies to any organization whose physical security or building systems run on networks. Its example taxonomies cover oil and gas, electricity and water sectors and are illustrations only.\n\n## DSE recommendation\n\nDSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality. Walk each site to find controllers, recorders, panels and gateways that network scans miss, record who can log in to each device, and flag unpatchable or end-of-life items for compensating controls such as segmentation and restricted remote access.\n\n## Verification\n\nReconcile the inventory against a site walk and network data at least annually and after any installation, and confirm each asset has an owner, criticality rating and current firmware record. Track end-of-life items on a replacement plan.\n\n## Official reference\n\n[CISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025)](https://www.cisa.gov/sites/default/files/2025-08/joint-guide-foundations-for-OT-cybersecurity-asset-inventory-guidance_508c.pdf). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "url": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Build an OT asset inventory and taxonomy for building security systems using CISA’s 2025 joint guidance", "item": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/#article", "identifier": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "url": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/", "headline": "Build an OT asset inventory and taxonomy for building security systems using CISA’s 2025 joint guidance", "description": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically…", "abstract": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.", "articleBody": "CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.\nSource facts\nThe joint OT asset inventory guidance, published August 13, 2025 by CISA with the EPA, NSA, FBI and international partners, defines an asset inventory as an organized, regularly updated list of an organization’s systems, hardware and software, and pairs it with an OT taxonomy that classifies assets by function and criticality. Its process covers defining scope and objectives, identifying assets and collecting attributes, creating a taxonomy, managing data and implementing life cycle management.\nTo identify assets, the guidance calls for a physical inspection and logical survey and a comprehensive list of OT assets and network infrastructure dependencies. High priority attributes include active or supported communication protocols, asset criticality, asset number, role or type, hostname, IP address, logging, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.\nCriticality-based classification groups assets by their importance to operations, safety and mission, while function-based classification groups them by role, such as control systems, communication devices or monitoring tools. The guidance says to periodically review and update the taxonomy and to explore security controls for vulnerable systems that cannot be patched immediately or are end of life. Its sector taxonomies are not authoritative.\nApplicability\nThe guidance targets critical infrastructure OT, but its process applies to any organization whose physical security or building systems run on networks. Its example taxonomies cover oil and gas, electricity and water sectors and are illustrations only.\nDSE recommendation\nDSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality. Walk each site to find controllers, recorders, panels and gateways that network scans miss, record who can log in to each device, and flag unpatchable or end-of-life items for compensating controls such as segmentation and restricted remote access.\nVerification\nReconcile the inventory against a site walk and network data at least annually and after any installation, and confirm each asset has an owner, criticality rating and current firmware record. Track end-of-life items on a replacement plan.\nOfficial reference\nCISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:08+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/ot-asset-inventory-taxonomy-cisa-2025-building-security-systems/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Build an OT asset inventory and taxonomy for building security systems using CISA’s 2025 joint guidance" }, "articleSection": [ "Access Control", "Networks & Infrastructure" ], "keywords": [ "Access Control", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Access Control", "url": "https://update.dsesecurity.com/topic/access-control/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 392, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025)", "url": "https://www.cisa.gov/sites/default/files/2025-08/joint-guide-foundations-for-OT-cybersecurity-asset-inventory-guidance_508c.pdf" } } ] } }