OT Asset Inventory FAQ’s

What do I get with an Operational Technology (OT) Asset Inventory?

Asset Identification and Profiling, Network Profile, Network Architecture and Drawings, OT Asset Repository and Change Management Solution.

Does an OT Asset Inventory satisfy any CSA's?

Yes. Completing the mandatory OT Asset Inventory by June 30, 2019 will satisfy inventory and change management CSA’s.

Why can’t I use scan tools I already have?

The existing tools are not designed to produce information required by the new asset repository (OTIP). The OTBox is the only approved scanning solution that has been tested and certified by CETL.

Why is this different than what GBS is doing?

GBS targets IT, while this project is targeting OT.

Are you doing PCAP scans?

No, we are not capturing any packets. We are performing NMAP scans only.

Are you doing network performance monitoring?

No, OT Asset Inventory does not include network performance monitoring.

Which devices are included in the network scan?

The devices included in this scan are all OT devices below the firewall. It will also include devices above the firewall that interact directly with manufacturing. The OTBox used to perform the inventory scan is a custom built device that is specifically designed for OT inventory scans.

Is this more than Windows PC’s?

Yes, it gathers information on all devices connected to the network including servers, laptops, cameras, PLCs, HMIs, HVAC, controllers and more.

Why is it important to scan for drives / IO / utilities / HVAC?

Part of P&G’s Cyber Security Incident Response compliance requires a thorough inventory of all OT devices that includes physical location, primary and secondary owners, device make and model, as well as other information that will aid in the response to a Cyber Security Attack.  This information can also be used for the device life cycle and ease change management.