Understanding the Different Types of Assets in a Manufacturing Plant

A factory has more than machines

When people describe factory assets, they often think first of robots, pumps, conveyors or production equipment. For cybersecurity, the asset landscape is broader. An industrial environment includes physical devices, software, controllers, communication networks, engineering tools and information systems that collectively help the plant operate. Some devices act directly on the production process; others supervise, configure, record or protect that process.

NIST’s Guide to Operational Technology Security (SP 800-82 Rev. 3) explains that OT covers programmable systems or devices that interact with the physical environment or manage devices that do so. That definition helps explain why a factory’s asset inventory must go beyond the machines visible on the shop floor.

Field devices: sensing and acting

Sensors measure temperature, pressure, position, flow, vibration and other process conditions. They supply the information that control systems use for automated decisions. Actuators, motors, valves and drives perform physical actions when instructed. A compromised or malfunctioning signal in this layer can affect the physical process, even if no ordinary computer screen displays an error.

Industrial field devices may communicate over electrical I/O, serial links, industrial Ethernet or wireless networks. Inventory records should identify their type, manufacturer, relevant firmware where available, physical location and controller relationship.

Controllers: making local decisions

Programmable logic controllers (PLCs) execute programmed control logic for machinery and automation sequences. A remote terminal unit (RTU) typically collects field information and may carry out control functions at distributed or remote sites. Distributed control systems (DCS) are common in process industries, where coordinated control of multiple loops and units is important.

Controllers are not interchangeable simply because they share a network. Their roles, response requirements and vendor-specific management methods differ. The security consequence of losing a redundant monitoring controller can be very different from losing the controller for a production-critical interlock.

Operator and supervisory systems

A human-machine interface (HMI) allows operators to view equipment status and interact with the process. SCADA systems collect information and provide supervisory visibility or control across multiple assets or sites. Historians store time-series information about production and process events, while engineering workstations are used to configure or maintain controllers and automation projects.

Engineering workstations deserve special attention because they may hold project files, vendor software and communication pathways to controllers. Historians also matter because their interfaces and network connections can bridge areas of the plant with enterprise reporting systems.

Networks and supporting infrastructure

Switches, routers, industrial gateways, firewalls, wireless access points and remote-access systems carry or regulate communication. A poorly documented gateway can create an unexpected connection between network zones. Asset information should therefore record not only each device, but also relevant interfaces, dependencies and approved communication paths.

Manufacturing execution systems (MES), quality systems, scheduling platforms and enterprise IT services may exchange data with OT. Their role is different from that of a PLC, but a dependency on authentication, file transfer or an engineering service can still influence operational security.

Safety and physical protection systems

Safety instrumented systems, dedicated safety controllers, protective relays, emergency shutdown systems and other safeguards deserve separate consideration. Security and safety are related, but they are not the same discipline. Cybersecurity work must respect independent safety requirements, engineering approvals and the design of protective functions.

How to build an inventory that is useful for security

Begin by documenting each asset’s identity, role, owner, location, manufacturer, model, software or firmware version, network zone, communication relationships and lifecycle status where known. Add the production function and whether loss of confidentiality, integrity or availability could affect operations or safety. Record uncertainty rather than guessing at versions or vulnerabilities.

For example, an HMI may be important because it gives operators visibility, while an engineering laptop is important because it can change PLC programs. A vulnerability list without these roles may lead to poor prioritization. Where discovery techniques are used, consider the risk of active network queries on older OT equipment and coordinate methods with plant engineers.

Practical help is available: in August 2025, CISA published joint guidance with other U.S. agencies and international partners, including Germany’s BSI, on building an OT asset inventory and a taxonomy for grouping assets.

A useful OT asset inventory is therefore a living model of how the factory operates. It supports maintenance, troubleshooting, incident response, vulnerability mapping and decisions about where additional protection is needed.

Official sources and further reading

The resources below support the technical information discussed. Review current vendor advisories and applicable national law before making operational or compliance decisions.

• NIST — Guide to Operational Technology Security, SP 800-82 Rev. 3https://csrc.nist.gov/pubs/sp/800/82/r3/final
• MITRE ATT&CK for ICS — assets, threats and technique contexthttps://attack.mitre.org/matrices/ics/
• CISA and partners (incl. BSI) — Foundations for OT Cybersecurity: Asset Inventory Guidance (Aug 2025)https://www.cisa.gov/sites/default/files/2025-08/joint-guide-foundations-for-OT-cybersecurity-asset-inventory-guidance_508c.pdf
• ISA — ISA/IEC 62443 Series of Standardshttps://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards