New Guidance Calls on OT Operators to Create Continually Updated System Inventory

SecurityWeek reports that cyber agencies from the United States, Canada, Australia, New Zealand, the Netherlands, and Germany, with the United Kingdom, have published updated guidance for OT operators on building and maintaining a definitive view of their architecture, including asset inventories and SBOMs. The guidance advocates creating a collection of continually updated records that reflect an accurate, up-to-date view of OT systems, and emphasises a holistic approach to risk and control deployment.

It outlines five principles, starting with defining processes for establishing and maintaining the definitive record, including data sources, validation, and maintenance, followed by establishing an OT information security management programme and classifying assets by criticality, exposure and availability.

It also covers documenting connectivity and third-party risks, and stresses that up-to-date OT records are vital for effective cybersecurity protection, since without them security teams cannot detect vulnerabilities or respond effectively to incidents. The article notes claims by Joshua Roback of Swimlane about the importance of coordinating OT and IT teams and the potential threats from insider activity and ransomware groups like ShinyHunters and Scattered Spider, according to SecurityWeek. The background piece was published on 30 September 2025.