The OT Asset Inventory Your Security Team Needs Requires Two Different Data Models

In October 2026, the US Department of Defense published new guidance on hardening operational technology (OT) with zero-trust principles. The opening requirement: "Maintain an accurate OT asset inventory as a foundational step in building a defensible architecture." CISA's joint guidance issued in 2025 said the same. The NIST NCCoE launched a reference design project in mid-2026 specifically to address OT asset management as the bedrock of cybersecurity compliance.

For asset-intensive operators running mixed portfolios—a utility that owns both a high-pressure gas pipeline network and a compressor station complex, or a transit authority managing rail infrastructure alongside maintenance depots—this guidance creates an immediate, concrete problem. Not because the importance of an asset inventory is disputed. Because the type of inventory each framework demands is architecturally different for linear assets than for discrete assets. And most operators are trying to build one with two separate EAM systems that neither understands the other.

The Criticality Problem Is Not Uniform

CISA's OT asset inventory guidance specifies that each asset should be assigned a criticality tier, with high-criticality assets receiving the strictest security controls: network segmentation, role-based access, real-time monitoring. This sounds straightforward until you try to apply it consistently across a mixed portfolio.

For a manufacturing plant or a facility, criticality is a function of the asset's position in an equipment hierarchy. A turbine driving production is more critical than a secondary cooling loop, which is more critical than a non-production HVAC circuit. The logic runs top-down through parent-child relationships, with failure modes inherited and compounded along the hierarchy.

For a pipeline or a water network, criticality is a function of the asset's position in a graph. A valve controlling flow to a trunk main serves a different risk profile than a valve on a lateral. A compressor station at a major confluence point sits at the intersection of multiple flow paths. The criticality calculation requires topology—not hierarchy. Cascade exposure, downstream impact, network redundancy, and isolation options all depend on understanding how assets connect at the network level.

Applying a single criticality-tiering logic to both fails. It either over-weights linear assets that sit in topologically critical positions but have low individual component complexity, or under-weights discrete assets whose failure modes propagate through an equipment tree that a network model cannot see.

Why the Split-System Architecture Makes This Harder

Most mixed-portfolio operators today run linear and discrete assets on separate EAM platforms. In a typical configuration, GIS-native linear asset management tools handle pipelines, rail, or grid infrastructure, while a separate CMMS or EAM system manages plant and facility equipment under discrete asset hierarchies.

The NIST NCCoE project description is candid about why OT asset inventories are difficult to build in practice: "OT environments often lack comprehensive asset inventories due to a lack of resourcing, limitations of legacy systems, geographically distributed assets, diverse communication protocols, and operational constraints."

Each of those failure modes is amplified in a split-system architecture. Geographically distributed assets—the core characteristic of linear infrastructure—are handled by one system. Complex, multi-level equipment hierarchies—the core characteristic of discrete infrastructure—are handled by another. When a security team asks for a single, criticality-tiered inventory that can feed a segmentation model, the answer is two exports from two systems, with no shared criticality logic, no shared taxonomy, and no mechanism to model cross-domain failure propagation.

This is not a data quality problem that integration alone can fix. A pipeline that feeds a compressor station that feeds a plant creates a failure chain that runs from network-topology logic into equipment-hierarchy logic. Knowing the criticality of the compressor station in isolation—without knowing where it sits in the pipeline graph or how its failure propagates through the plant hierarchy—produces an incomplete picture.

What a Unified Inventory Enables

When OT asset inventory is built on a platform that holds both network-aware models for linear infrastructure and hierarchy-aware models for discrete equipment, the criticality tier for any asset can be calculated with full context: network position, redundancy paths, parent-equipment relationships, and downstream exposure.

For security and compliance teams, this matters in three concrete ways. First, segmentation decisions become defensible—you can demonstrate that the boundary between a high-criticality pipeline valve cluster and a lower-criticality lateral was drawn based on topology and hierarchy, not guesswork. Second, periodic reviews stay current—when a topology change or equipment upgrade occurs, criticality tiers recalculate automatically rather than requiring manual reconciliation across two systems. Third, the audit trail is unified—the decision log tied to every classification is traceable from a single source, not assembled from two exports after the fact.

CISA's guidance recommends that asset inventories include a periodic review and update cycle to "reflect changes in technology and operations." That cycle is only as good as the architecture that supports it.

The Compounding Effect on Mixed Portfolios

Operators running only pipelines or only plants may find the inventory problem tractable with a single-domain EAM. The challenge compounds specifically in mixed portfolios—utilities with both transmission networks and generation or treatment facilities, transit operators with both track infrastructure and rolling-stock depots, industrial operators with both pipeline inputs and processing plants.

For these organisations, the foundational data model for linear-discrete asset management is not just a maintenance data problem. It is now a security architecture problem. The same unified model that supports better maintenance decisions, cascade failure analysis, and AI-agent-driven workflow automation is the one that can produce the OT asset inventory cybersecurity regulators are increasingly requiring as a baseline.

The DOD guidance frames asset inventory not as a milestone on the path to zero trust, but as its foundation. For mixed-portfolio operators, building that foundation requires getting the data model right for both types of assets—simultaneously, in one system.

Curious how UniEAM handles both? Request a demo.