Connected Equipment Handover: Build an Inventory That Stays Current

Buying connected equipment creates a continuing need to know what is installed, who maintains it and which software or firmware it uses. A delivery list is a useful start, but it can become outdated as components are replaced or configurations change. An equipment inventory gives operations and security teams a shared record for maintenance, support and incident response.

Define the scope before collecting details

Decide whether the inventory covers one machine, a production cell or an entire site. Include the equipment needed to understand that scope: controllers, operator interfaces, network devices, sensors and associated software where relevant. Identify a responsible owner for each record and decide who can update it. An inventory is more useful when the people maintaining the equipment can correct it as work occurs.

The NIST Guide to Operational Technology Security discusses asset management for operational technology, including unique identifiers, hardware, software, firmware and vendor information. The guide's examples help frame a record; the right scope and detail depend on the organization's equipment and risk management needs.

Record an identifiable asset, not just a product family

For each physical device, record the manufacturer, model, serial number where available, location and role in the process. Link the device to the machine or cell it supports. If a component is replaced, preserve the history of the old and new identifiers and the date of the change. A model name alone may refer to many units with different configurations and service histories.

Ask the supplier for a delivery inventory and reconcile it with what is installed. Distinguish confirmed observations from seller-provided information and mark unknown fields. A missing serial number or unclear location should remain an open item until someone verifies it; it should not be filled with an assumed value.

Keep versions and support records current

Record the operating software and firmware versions where they can be safely obtained, together with the date and source of the observation. Link the equipment to relevant manuals, support contacts, warranty information and agreed update responsibilities. A version recorded on delivery may no longer reflect the machine after maintenance or a component swap.

Do not publish a detailed inventory or expose credentials in a general purchasing file. The record may contain information useful to an attacker as well as to an engineer. Define access permissions and an approved method for sharing only the information needed by a service provider.

Map relationships without disrupting production

Where appropriate, record how equipment connects to controllers, operator stations and external services. Note whether a connection is confirmed or only proposed. The NIST operational technology asset management practice guide describes an example solution for energy organizations that inventories and monitors assets. Its example does not mean that every site should deploy the same tools or settings.

The OT security guide cautions that some collection methods, including active scanning, can negatively affect operational systems. A production network should not be probed simply to fill in a spreadsheet. The responsible operations and security teams should choose an approved method, assess its effect and use manual records where appropriate.

Use the inventory during a purchase handover

Before acceptance, agree which information the supplier will provide, the format, the date it reflects and who will verify it. Ask for the hardware and software included in the delivered configuration, relevant version information, support contacts and documentation. If a component or license is supplied by a third party, make that relationship clear rather than assuming the main equipment vendor supports everything.

Record unresolved questions, such as an unidentified controller module or a missing firmware version, with an owner and a follow-up date. Do not delay a safety assessment until an inventory is perfect, and do not treat a completed inventory as proof that the equipment is secure or safe to operate. It is an input to those decisions.

For each document supplied at handover, record its edition and the equipment model it covers. A manual for a related product may still provide useful context, but it should not be listed as the verified manual for the installed unit without checking. Keep a contact for resolving documentation gaps and record when a replacement document is received.

Maintain the record throughout the lifecycle

Update the inventory when equipment is added, patched, repaired, relocated, replaced or removed. Periodically compare records with authorized observations and document discrepancies. Keep change history so an investigation can distinguish the configuration at delivery from the configuration at a later incident or service visit.

For a related procurement topic, read our remote support access guide and browse the smart equipment archive. A maintained inventory helps teams find the right information when a machine needs support, without relying on an outdated delivery list.