How to Conduct an Airport OT Asset Inventory

An airport can have a detailed IT register and still lack a clear view of the systems that keep its operations moving. An airport OT asset inventory identifies operational technology, records where assets sit and how they communicate, and links them to the functions they support. CISA’s guidance prioritises 14 high-priority attributes, including asset criticality, communication protocols, IP addresses and physical locations.

That information matters because an airport OT asset inventory is more than a device list: it helps teams understand dependencies, assess exposure and plan changes with operational continuity in mind. At an airport, it should cover systems such as baggage handling, surveillance and access control, along with the networks that connect them.

This guide explains what counts as an OT asset, how to build and maintain an inventory, and how passive visibility can reveal communication patterns without active probing. It also explains how regulatory frameworks relate to inventory work, helping you distinguish useful security guidance from obligations that depend on your operating context.

What are the key steps involved in conducting an OT asset inventory?

Build the inventory in a controlled sequence, from setting its boundaries to validating records. Classifying assets by function and criticality helps an airport organisation focus security efforts where the operational impact could be greatest.

1. Define the inventory scope

   Include airport operational technology and connected devices that monitor or control physical processes. For example, scope baggage handling, video surveillance and access control, then trace the controllers, network equipment and interfaces supporting each function. Record each asset’s hostname, IP address, manufacturer, model, operating system, physical location, ports, services and communication protocols. Do not limit the inventory to devices owned directly by the airport: connected systems can also affect operations.

2. Classify assets by function and criticality

   Group assets by the operational function they support, then assess their criticality to safety, service continuity and the airport’s mission. A baggage system controller and an access control device perform different functions, even if both connect to operational networks. Record those distinctions alongside asset criticality, so security decisions reflect both purpose and potential impact. Use ISA/IEC 62443 Zones and Conduits to organise assets and their communication pathways.

3. Discover and document OT assets

   Use passive OT discovery tools to observe network traffic and record assets without sending requests that could affect operations. A sensor connected through a network TAP or SPAN port can capture communication patterns; suitable platforms can interpret protocols such as Modbus, EtherNet/IP, PROFINET, DNP3, OPC UA and BACnet. For legacy, undocumented or vendor-managed equipment, reconcile observed traffic with available diagrams, configuration records and operational knowledge. CISA prioritises 14 high-priority attributes, including IP addresses and physical locations.

4. Validate and update inventory records

   Assign operational and engineering roles to collect and validate records, including changes following acquisition, deployment, commissioning, maintenance or decommissioning. Review the taxonomy periodically and after changes to technology or airport operations; these are the practical triggers for updates, rather than a single universal timetable. Compare recorded communication pathways with observed activity, resolve discrepancies, and set policy coverage targets approaching 100% for critical assets. This keeps the inventory useful during an incident.

Do Regulatory Requirements Specify an OT Asset Inventory?

Requirements depend on the airport’s jurisdiction, sector and applicable frameworks. An inventory supports cybersecurity risk management but does not, on its own, establish compliance. Active scanning can add network traffic or interact with industrial equipment, so assess operational and safety risks before using it. Passive monitoring, by contrast, observes communications without sending requests.

1. Use inventories for cybersecurity and risk management

   Map each recorded asset to its operational role, network connections and responsible team, then use that information to assess vulnerabilities and prioritise controls. An accurate register helps cybersecurity teams understand where detection, incident response and recovery depend on particular hardware or communication pathways. It also gives risk reviews a practical basis: a controller supporting a physical process has different operational consequences from an office device.

   Use frameworks as guidance, not as a substitute for determining which obligations apply to the airport. The National Institute of Standards and Technology (NIST) cites NIST 800-82 Revision 3 as a guide to operational technology security. Keep inventory records within a controlled system, restrict editing rights to authorised roles, and retain change history so that updates remain traceable.

2. Maintain visibility across airport environments

   Organise records by terminal, airfield, system and owner while maintaining a central view of connected assets. Include third-party and vendor-managed equipment within the relevant operational boundary, and assign airport roles to validate changes with the people responsible for each system. This helps prevent local records from becoming disconnected from the wider network picture.

   Separate OT records from IT asset management where their operational needs differ: industrial technology can affect physical processes, while IT registers commonly centre on computing hardware and data. Link the records through shared identifiers and controlled access, rather than merging unlike systems into one undifferentiated list. Review changes after maintenance, commissioning or network redesign, and use passive monitoring to compare documented communication with observed activity. For projects that alter control-system boundaries, operational control-system design can help align asset records with the intended architecture.

Airport OT asset inventory and visibility

An airport OT asset inventory gives teams a working view of operational technology, not merely a catalogue of machines. Use it to connect infrastructure, communications and function, then keep that picture aligned with airport operations.

1. Map operational boundaries. Divide the environment into practical areas, such as terminals, airfields and baggage operations. Record how each OT environment connects to adjacent networks and which operational function it supports. This helps distinguish equipment controlling a physical process from equipment that only exchanges data. A clear boundary map also shows where visibility ends, including connections managed by third parties.
2. Observe communications passively. Use passive collection to identify communicating assets and map traffic without sending discovery requests to operational devices. A network TAP or SPAN port can give a sensor access to existing traffic. This supports visibility while reducing the chance that discovery activity affects airport infrastructure. Treat observed communication as evidence of a connection, not proof that every legacy device has been found.
3. Connect assets to operational context. Link each observed address or machine to its location, owner, system and function. For example, map a controller’s communications to the baggage process it supports, then record dependencies on connected equipment. This helps operational teams understand which systems a change or incident may affect. Keep observations separate from verified asset details so uncertainty is not mistaken for fact.
4. Maintain a usable view. Assign responsibility for reconciling inventory records with engineering changes, maintenance and third-party updates. Compare recorded connections with passive observations, then investigate unexpected changes through established operational processes. Keep legacy equipment visible even when details are incomplete, recording what is observed and its known function. Review regulatory and security needs alongside operational changes to keep the inventory useful for planning, monitoring and response.

What is an airport OT asset inventory, and which systems and devices should it include?

1. Define what the inventory records. Treat it as a structured register of operational technology, connected devices and their relationships to airport processes. Record more than equipment names: include each asset’s function, location, owner, model, operating system, network address and communication pathways. For example, link a baggage handling controller to the process it controls and the systems that exchange data with it. This gives engineering and security teams a shared operational reference.
2. Include systems that control airport functions. Start with systems supporting baggage handling, video surveillance and access control. Add the controllers, programmable devices, operator interfaces, servers and network equipment that monitor or manage those functions. Include connected building automation equipment when it monitors or controls airport facilities. Trace interfaces between systems: a register listing only central platforms can miss the devices and connections their operation depends on.
3. Capture supporting devices and connections. Add sensors, actuators, communication gateways and remote access points when they form part of an OT process. Record network switches and other infrastructure carrying communications between operational devices. Identify vendor-managed assets and equipment in shared environments by system, location and responsible party. This helps distinguish an airport-owned controller from a connected device maintained through a third-party arrangement, while keeping both in the operational picture.
4. Connect the register to operational use. For each entry, document how the asset supports a process, what it communicates with, and which team maintains its record. A camera, for instance, belongs in the inventory because it supports surveillance, while its network connection helps explain dependencies. Keep legacy devices in scope even when records are incomplete; capture observed details and known function for later validation. To align system boundaries with operational requirements, explore mission-critical control systems.

AAC LTD | All About Control

AAC LTD | All About Control can help airport teams address control-system questions highlighted by an inventory, from how assets connect to operational processes to how legacy equipment fits into the wider architecture. Its automation engineering consultancy, SCADA Integration and Mission Critical Control Systems work can support planning when system boundaries, dependencies or existing controls need attention.

Where an inventory highlights ageing Siemens S5 equipment, Siemens S5 to S7 Migration provides a relevant route for considering a modernised control system. The appropriate next step depends on the systems involved and the operational requirements they support. Contact AAC LTD | All About Control to discuss your airport control-system requirements.

Make inventory part of operational change

An airport OT asset inventory has lasting value when it informs decisions beyond the initial discovery exercise. Treat it as a living input to engineering change: when a system is modified, commissioned or retired, update its relationships and operational context alongside the technical records. This gives teams a clearer basis for assessing dependencies before changes affect connected systems.

Use the inventory to connect engineering, operations and security discussions. For example, assess a proposed network change against the documented functions and communication pathways it may affect. Over time, this discipline helps teams make informed decisions about maintenance, risk treatment and future control-system planning instead of relying on fragmented records.

If you’re considering how to make asset visibility support airport operations and engineering decisions, start a conversation with AAC LTD | All About Control. A focused discussion can help identify the control-system questions that should shape your next step, giving your team a practical foundation for continued improvement.

Frequently Asked Questions

What are OT assets?

OT assets are devices and systems that monitor or control physical processes. At an airport, examples include a programmable controller operating a conveyor, a controller managing airfield lighting, or equipment regulating building ventilation. The key distinction from ordinary office IT is function: OT interacts with physical operations. Some assets exchange information with IT networks, but their operational role still determines how teams should manage them.

Why Do You Need a Robust OT Asset Management Strategy?

A robust strategy gives airport teams a consistent way to manage assets throughout their lifecycle, from procurement and commissioning through maintenance and retirement. For example, replacing a controller should prompt a review of its connections, operational owner and supporting documentation. Clear ownership also helps engineering and security teams resolve discrepancies in records. Without these processes, changes can leave the organisation relying on outdated diagrams or incomplete information.

Why is an OT Asset Inventory a Foundational Element of OT Cyber Security?

An inventory gives cybersecurity teams the context to assess which equipment may be exposed and what an incident could affect. If a vulnerability is identified in a controller, knowing its operational role and dependencies helps teams decide how to respond without treating every device alike. Records also support decisions about segmentation, access and compensating controls when equipment cannot be patched.

How do airports discover and inventory OT assets without disrupting operations?

Airports can begin with passive observation, recording existing network communications rather than sending discovery requests to control devices. Develop an airport OT asset inventory by piloting collection on a small network segment with controls engineering, then reviewing any latency or load effects before expanding. Active techniques such as device fingerprinting require particular care because probes may interact with sensitive equipment.

What information should an airport OT asset inventory record for each asset?

Each record should make an asset identifiable and useful for operational decisions. Alongside technical details, capture who owns or maintains the record, how the information was obtained and when it was last validated. Include lifecycle status, such as commissioned, under maintenance or decommissioned, so retired equipment is not mistaken for a live connection. Keep observed details distinguishable from information validated by engineering teams.

How can airports prioritise OT assets by criticality and operational risk?

Assess each asset by the consequences of failure or compromise, including effects on safety, airport services and dependent systems. Consider whether operations could continue if the asset were unavailable, and how quickly its function could be restored. Then apply proportionate controls: equipment supporting essential physical processes may warrant tighter access and network boundaries than assets with limited operational impact.