# OT asset inventory and process context

Move from an IP list to an inventory with process, ownership, dependencies and evidence provenance. Investigate why a Harbor plant asset is absent from observations.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Understand the process before the device

OT includes systems that observe or affect the physical world. In fictional Harbor filling operations, enterprise planning, operator displays, engineering stations and controllers have different roles. Record the supported process, responsible shift and interruption consequence first. A server count cannot describe production dependencies. Identical device models can have different criticality when their functions differ. The process owner evaluates consequences for people, environment, quality and production with appropriate specialists. This exercise neither operates equipment nor invents a procedure for reaching a safe process state.

## Evidence behind an inventory row

An asset row includes a stable identifier, function, zone, owner, manufacturer/model, known software and firmware revision, support status and last validation date. Project files, drawings, approved records and passive observations are different evidence sources; they do not automatically verify one another. Mark unknown fields and assign a follow-up owner instead of guessing. IP-only identity becomes ambiguous after address changes or reuse across isolated networks. Sensitive architecture and credentials do not belong in a public learning file; every name in this package is synthetic.

## Passive visibility and blind spots

Passive records represent only traffic and time visible to the sensor. Offline devices, serial links, other segments and maintenance-only components can be absent. Reconcile drawings, procurement records and confirmation from the site owner, recording gaps. Even installing passive monitoring can involve a physical change; this exercise does not install sensors. Active queries or scans may affect timing and availability on sensitive equipment. Real discovery methods require site engineering, manufacturer knowledge and change review. Absence from an inventory observation does not establish that the asset is absent.

## Keep the inventory usable

Connect inventory records to changes, remote access, vulnerability review and recovery packages. A Harbor firmware change updates the asset row, related project revision and rollback evidence together. When sources conflict, the newest timestamp is not automatically correct; record reconciliation by the authorized owner. Use change triggers alongside periodic verification rather than relying on a monthly count alone. The 2025 joint inventory guide concerns cyber asset visibility and does not replace analysis of human, environmental or plant safety. As checked on 21 October 2026, NIST SP 800-82 Rev.3 is final and Rev.4 is an initial public draft, not final requirements. The result is a versioned record with explicit gaps, not a claim of completeness.

## Working sequence

1. Record process scope and responsible team.
2. Map known assets to their sources.
3. Mark passive coverage and blind spots.
4. Reconcile conflicts with owners.
5. Record revision, gaps and next verification.

## 1. Ownerless record

Being listed does not establish accountability. Without a process link, confirming source and named owner, responsibility for a change or response decision remains unresolved.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.listed === true
```

### Corrected implementation
```js
s => s.listed === true &&
  s.processMapped === true &&
  s.ownerNamed === true &&
  s.sourceRecorded === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": true,
        "sourceRecorded": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-ownerNamed",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": false,
        "sourceRecorded": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-sourceRecorded",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": true,
        "sourceRecorded": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": true,
        "sourceRecorded": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-ownerNamed",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": false,
        "sourceRecorded": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-sourceRecorded",
      "input": {
        "listed": true,
        "processMapped": true,
        "ownerNamed": true,
        "sourceRecorded": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Unseen device

Passive observation alone cannot establish complete coverage. Removing an unseen device without blind-spot records and manual reconciliation creates unjustified confidence.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.passiveSeen === true
```

### Corrected implementation
```js
s => s.passiveSeen === true &&
  s.blindSpotsRecorded === true &&
  s.manualReconciled === true &&
  s.reviewDated === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": true,
        "manualReconciled": true,
        "reviewDated": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-blindSpotsRecorded",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": false,
        "manualReconciled": true,
        "reviewDated": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-manualReconciled",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": true,
        "manualReconciled": false,
        "reviewDated": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": true,
        "manualReconciled": true,
        "reviewDated": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-blindSpotsRecorded",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": false,
        "manualReconciled": true,
        "reviewDated": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-manualReconciled",
      "input": {
        "passiveSeen": true,
        "blindSpotsRecorded": true,
        "manualReconciled": false,
        "reviewDated": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Label and physical consequence

A critical label is not a decision rationale. Document physical consequences, dependencies and process-owner review; this model supplies neither a safety classification nor operating approval.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.criticalLabel === true
```

### Corrected implementation
```js
s => s.criticalLabel === true &&
  s.physicalImpactReviewed === true &&
  s.dependenciesMapped === true &&
  s.processOwnerReviewed === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": true,
        "dependenciesMapped": true,
        "processOwnerReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-physicalImpactReviewed",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": false,
        "dependenciesMapped": true,
        "processOwnerReviewed": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-dependenciesMapped",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": true,
        "dependenciesMapped": false,
        "processOwnerReviewed": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": true,
        "dependenciesMapped": true,
        "processOwnerReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-physicalImpactReviewed",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": false,
        "dependenciesMapped": true,
        "processOwnerReviewed": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-dependenciesMapped",
      "input": {
        "criticalLabel": true,
        "physicalImpactReviewed": true,
        "dependenciesMapped": false,
        "processOwnerReviewed": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Synthetic inventory with stable IDs, process, owner and source.
- Blind-spot/conflict record with owner and due date.

## References

- [NIST SP 800-82 Rev.3 · Final September 2023](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [CISA and partners · OT asset inventory guidance · August 2025 (EPA copy)](https://www.epa.gov/system/files/documents/2025-09/joint-guide-foundations-for-ot-cybersecurity-asset-inventory-guidance_508c.pdf)
- [NIST SP 800-82 Rev.4 · Initial public draft, NOT final · September 2026](https://csrc.nist.gov/pubs/sp/800/82/r4/ipd)