Build an OT asset inventory and taxonomy for building security systems using CISA’s 2025 joint guidance

CISA and eight partner agencies published OT asset inventory guidance on August 13, 2025. It describes defining scope, physically and logically surveying assets, collecting 14 high-priority attributes, classifying by criticality or function, and managing the inventory through each asset’s life cycle.

Source facts

The joint OT asset inventory guidance, published August 13, 2025 by CISA with the EPA, NSA, FBI and international partners, defines an asset inventory as an organized, regularly updated list of an organization’s systems, hardware and software, and pairs it with an OT taxonomy that classifies assets by function and criticality. Its process covers defining scope and objectives, identifying assets and collecting attributes, creating a taxonomy, managing data and implementing life cycle management.

To identify assets, the guidance calls for a physical inspection and logical survey and a comprehensive list of OT assets and network infrastructure dependencies. High priority attributes include active or supported communication protocols, asset criticality, asset number, role or type, hostname, IP address, logging, MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.

Criticality-based classification groups assets by their importance to operations, safety and mission, while function-based classification groups them by role, such as control systems, communication devices or monitoring tools. The guidance says to periodically review and update the taxonomy and to explore security controls for vulnerable systems that cannot be patched immediately or are end of life. Its sector taxonomies are not authoritative.

Applicability

The guidance targets critical infrastructure OT, but its process applies to any organization whose physical security or building systems run on networks. Its example taxonomies cover oil and gas, electricity and water sectors and are illustrations only.

DSE recommendation

DSE recommends building an inventory of every networked security and building system using CISA’s high-priority attribute list, then ranking each asset by criticality. Walk each site to find controllers, recorders, panels and gateways that network scans miss, record who can log in to each device, and flag unpatchable or end-of-life items for compensating controls such as segmentation and restricted remote access.

Verification

Reconcile the inventory against a site walk and network data at least annually and after any installation, and confirm each asset has an owner, criticality rating and current firmware record. Track end-of-life items on a replacement plan.

Official reference

CISA and partners — Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 13, 2025). Reviewed October 18, 2026.