How to Prepare for an OT Security Assessment With an Incomplete Asset Inventory
Begin with an agreed assessment boundary and an honest record of what is known, missing or conflicting. Use the records you have to frame the scoping conversation, and agree which conclusions need more evidence. Treat any unanswered question that could change the boundary or the permitted methods as an explicit scoping decision.
By Zeroday Cybersecurity
Prepared 1 November 2026. This article and its worksheet are an original preparation aid; the worked example is fictional.
Start with one decision and a provisional boundary
Write down the decision the assessment should inform. For example: which evidence gaps must be resolved before a named process can be assessed against agreed security criteria? Name the process or system, the technical owner, and any supporting services or provider interfaces whose inclusion still needs agreement.
NIST SP 800-82 Rev. 3 includes identifying system stakeholders and determining the system authorization boundary in its preparation activities. These are useful scoping principles; they do not establish the boundary of your particular engagement. See Table 6, tasks P-9 and P-11.
Zeroday’s assessment page asks customers to identify missing documentation at the outset and agree whether the review uses existing evidence or includes further information gathering. That makes the missing inventory an issue to scope explicitly. It does not promise that every assessment objective can be answered from incomplete records.
Separate the record from the assertion
For each useful record, state what it actually supports and who can explain it. A dated equipment list can be a starting record without proving that every listed device remains installed. If a drawing and a maintenance entry disagree, preserve both references and the disagreement until an authorized owner reconciles them.
The joint OT asset-inventory guidance recommends setting inventory boundaries, assigning collection and validation responsibilities, and cross-checking the inventory for accuracy and completeness. See its scope and taxonomy-validation steps.
The Canadian Cyber Centre’s toolkit recommends regularly updating IT and OT inventories and documenting network topology accurately. An assessment preparation worksheet is a way to expose gaps in those records; it is not a replacement for the inventory. See goal 1.0.
Use these working labels: known means the named record is available and its stated contents can be reviewed; missing means the required input has not been supplied; conflicting means available records disagree. Add “outdated” as a qualifier when relevant. These labels describe evidence, not a control’s pass or fail status.
Use the assessment evidence-gap worksheet
This original worksheet is a suggested discussion aid, not an official NIST or government form. Copy the eight fields below for each record or unanswered assertion. Start with one usable record, one contradiction and one missing input. Use record references rather than copying sensitive plant information into an inquiry form.
| Field | Your entry |
|---|---|
| Process/system boundary | Name the process/system; mark unconfirmed inclusions. |
| Record or assertion | State one assertion or identify one record. |
| Source and date | Record the document reference, revision and date; write unknown if unavailable. |
| Known / missing / conflicting | Choose an evidence state; qualify outdated records. |
| Custodian | Name the role that can supply or explain it. |
| Decision affected | Name the assessment conclusion or boundary decision it affects. |
| Next evidence request | Ask for the specific record or clarification needed. |
| Scope limitation | State what cannot yet be concluded or included. |
A conveyor-area example with three evidence states
Fictional example—not a client result. A Canadian mineral-processing site is preparing to scope an assessment of one conveyor area. Its handover equipment list, older drawing and maintenance record give different accounts of workstation WS-17. All records, identifiers, dates and roles below are invented. No present topology, connectivity or exposure is inferred.
| Process/system boundary | Record or assertion | Source and date | Known / missing / conflicting | Custodian | Decision affected | Next evidence request | Scope limitation |
|---|---|---|---|---|---|---|---|
| Conveyor area; boundary provisional | Handover list records WS-17 as retired; the record is available. | Handover list H-01, 2026-04-12 (fictional) | Known record; retirement assertion unverified | Handover custodian | Whether WS-17 belongs in the assessment boundary | Ask for the approved retirement/change record and its link to WS-17. | A handover entry alone does not establish current installation or connection. |
| Same conveyor area | Older drawing shows WS-17; maintenance entry later calls it retained as a spare, contrary to the handover list. | Drawing D-02, 2024-08-03; maintenance M-03, 2026-04-18 (fictional) | Conflicting; drawing is older | Engineering and maintenance custodians | Which record can support the agreed boundary | Ask both custodians to reconcile these references against approved change records. | Neither the drawing nor “spare” wording proves network exposure. |
| Same conveyor area | No approved reconciliation record or current owner confirmation has been supplied. | Requested reconciliation record; date unknown (fictional) | Missing | System owner | Whether conclusions about WS-17 must remain excluded or qualified | Request the reconciliation result, accountable owner and evidence date. | Keep WS-17 status unresolved; any further collection needs an agreed method and authorization. |
The next step in this example is a targeted request for reconciliation, with responsibility assigned to the system owner and relevant record custodians. Keep the three evidence states visible until the answer is supported. Do not silently remove WS-17 from the proposed boundary or label it exposed because one record is more convenient.
Turn each gap into a scope decision
For each unresolved row, agree one of three next steps: obtain the named evidence; retain a clearly stated limitation in the assessment; or define separate, authorized information-gathering work. Record who can accept the limitation. If the missing input prevents an agreed conclusion, leave that conclusion open rather than turning an unknown into a finding of success or failure.
Do not use this worksheet as authority to scan networks, change controllers or test live systems. Zeroday’s published assessment scope requires explicit scope and site authorization for discovery, scanning, testing or live-system activity. The authorized owner and provider must agree appropriate methods and operating constraints.
Bring these questions to the scoping conversation
- Which decision must the assessment support, and which process or system is included?
- Which available record is usable, which records conflict, and which input is missing?
- Who can reconcile the contradiction, and what specific evidence should they supply?
- Which conclusion must stay open if the evidence does not arrive?
- Does the proposed work review existing records, or does it include separately agreed information gathering?
Use the OT cybersecurity engagement guide for the wider discussion of scope, evidence, responsibilities and acceptance.
Sources and version notes
Sources were retrieved on 1 November 2026 UTC. NIST’s publication page identifies SP 800-82 Rev. 3 as final, published September 2023, and points to an initial public draft of Rev. 4. This article uses the final Rev. 3 preparation guidance. It does not treat the draft as a final replacement.
- NIST SP 800-82 Rev. 3: section 4.3.1, Table 6, tasks P-9 and P-11 (printed pages 57–58).
- Joint OT asset-inventory guidance: scope and validation steps; Australian host published and reviewed 14 August 2025.
- Canadian Cyber Centre readiness toolkit: goal 1.0; page modified 29 October 2024.
The worksheet fields and worked example are editorial suggestions. Apply the cited guidance to the agreed site context; this article does not assess a live environment or establish an organization’s legal obligations.
Discuss the evidence and the decision together
Bring a nonconfidential summary of the process, decision and evidence gaps to an assessment scoping conversation. You do not need to turn the unknowns into claims before discussing them.
