Imagine the main production line stops in the middle of a shift. The maintenance team knows the machines but is unsure which control device connects to the rest of the line. IT has a list of networked equipment but does not know which stoppage could affect safety or delivery commitments. Finance sees a repair quote but cannot compare which asset should receive funding first.
A useful operational technology (OT) asset inventory gives those teams a shared starting point. It does not prevent an incident or guarantee a recovery time. It helps people see what each asset does, what it depends on, and who needs to make a decision when something goes wrong.
On September 21, 2026, NIST published the initial public draft of SP 800-82 Revision 4 for comment. The comment period runs through November 30, 2026. The draft is not final. NIST says OT security guidance must account for the performance, reliability and safety requirements of operational processes. Its publication page notes expanded discussion of asset management and alignment between OT and enterprise risk management.
This is U.S. guidance, not a Thai legal requirement, and Revision 4 is still a draft. Manufacturers in Thailand can use it as a prompt to review their practices, but creating an inventory does not mean an organization complies with a law or standard.
An inventory should describe business impact
Recording the names of PLCs, HMIs, servers or network devices is not enough to answer the questions that arise during an outage. Teams need to understand how an asset relates to production: if it stops, does one machine or a whole line stop? Could the loss affect safety, product quality or delivery? What else must be restored before production can resume?
CISA and partner agencies’ OT asset inventory guidance presents inventory as an ongoing practice: define its scope and objectives, identify assets and relevant attributes, classify their importance, and maintain information across the asset lifecycle. The value is not the number of rows in a spreadsheet. It is whether the information helps the organization prioritize risk and maintenance.
A manufacturer could start with assets that support critical processes and add information that allows people to make decisions together:
- Operations and maintenance describe the asset’s function, the consequence of an outage, the accountable owner, and checks required before restarting.
- IT/OT teams record the system owner and location, software or firmware version, vendor, support status, remote access path, and connected systems.
- Finance and leadership see lifecycle stage, documented maintenance costs, support end dates, and the rationale for recovery or replacement priorities.
This is a practical way to structure a cross-functional discussion, not a mandatory list endorsed for every factory by NIST or CISA. Each organization should select information that fits its processes, risks and obligations.
Make recovery a shared decision
During an incident, teams may have several competing tasks. An inventory that records criticality and dependencies can help the discussion start with questions such as “Which process must return first?” and “What safety conditions must be met?” instead of “Does anyone remember this machine?”
Operations can explain production and safety impacts. IT/OT can confirm system relationships, versions and external access paths. Business leaders can prioritize work based on delivery commitments and operational risk. These decisions still need to be tested and reviewed by the people responsible for the plant. An inventory by itself is not a recovery plan and does not replace machine-safety procedures.
The records can also reveal gaps worth addressing in advance: an asset with no clear owner, an unsupported model, missing evidence about backups, or an unknown connection to another system. Reviewing those gaps gives people across teams a way to share knowledge that might otherwise sit with one experienced individual.
Connect records to budgets and evidence
OT lifecycle spending can include repairs, maintenance, replacement and recovery. When an inventory connects an asset with its service history, vendor agreement and prioritization rationale, leaders can see more context for a budget decision than they would from isolated purchase requests.
From an accounting perspective, maintenance records, quotations, approvals and purchasing rationale may help trace expenditure and monitor an asset’s lifecycle budget. Whether a particular cost is capitalized or expensed, how depreciation is calculated, and how it is presented in financial statements depend on the facts and the organization’s accounting policy. Those decisions belong with the accountant or auditor; an OT inventory alone cannot determine them.
Start with the assets that matter most to production, then assign an owner and a review cycle the team can sustain. Update the record when equipment, vendors, versions or connections change. Do not scan networks or test changes to control systems without assessing operational impact and following plant safety procedures.
A draft is not Thai law
NIST SP 800-82 Rev. 3 is the final edition published in September 2023. Revision 4, opened for comment in September 2026, is still a draft. The Rev. 3 publication page confirms the status of the previous edition and links to the new draft. Manufacturers applying its recommendations should separately check applicable Thai requirements, customer contracts and industry standards.
An inventory is not a magic tool that prevents a production stoppage. It is a common reference that helps operations, engineering, IT/OT and finance discuss the same facts. If no one can yet say which asset is a bottleneck, who owns its record, or what must be checked before it returns to service, that may be the first gap to clarify.
Talk with Enersys about business systems and organizational workflows
References
