Why the inventory comes first
Every OT security framework starts with the asset list. ISA/IEC 62443 can't put an asset in a zone nobody has recorded, and NIST SP 800-82 Rev. 3 treats the inventory as a core part of an OT security program. In August 2025, CISA and eight partner agencies published a joint guide, Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators. It is free, short, and the best checklist available. This guide follows it and shows where each part lives in NetBox.
NetBox's job: the intended state
NetBox is a free, open-source source of truth for infrastructure. For OT, its role is to hold the intended state: every asset and how it relates to everything else. That means the device, its cabinet, its ports and cables, its addresses and VLANs, and the services it shares with IT. Your tools then compare what is actually running against that record, and any difference is drift you can act on.
That role is why NetBox and discovery tools complement each other rather than compete. Passive monitoring tools such as Cisco Cyber Vision, Claroty or Nozomi Networks listen to traffic and decode industrial protocols, so they see what is talking right now. NetBox records what should be there, including assets the sensors can't see: spares on the shelf, serial-only and isolated safety devices, quiet segments without a sensor, and the physical layer of cabinets, patch panels and fiber.
The five steps, in NetBox
CISA's guide has five steps. Here is where each one lands.
- Define scope and objectives. Decide who owns the inventory, who collects and who validates, and which sites, zones and systems are in scope. In NetBox, assign owners as contacts with a role such as Asset owner, on the site, the location or the device.
- Identify assets and collect attributes. Use both a physical inspection and a logical survey, plus documents such as integrator handover packs, switch backups and maintenance records. The free NetBox import guide gives the loading order.
- Create a taxonomy. Classify assets by criticality and by function, then organize them into zones and conduits (CISA's guide uses ISA/IEC 62443 for this). In NetBox, function is the device role, criticality is a custom field, and the zone is a tag on the location that every device under it inherits.
- Manage the data. Keep it in one central system with access control. NetBox is that system. Link out to manuals and vendor documents rather than copying them in.
- Life cycle management. Define the stages from acquisition to decommissioning, and require an inventory update for every device added or removed, even under an emergency change. NetBox's device status (planned, staged, active, offline, failed, inventory, decommissioning) already covers these stages.
CISA's high-priority attributes, mapped to NetBox
CISA lists 14 attributes to collect first. Most of them are already built into NetBox.
| CISA attribute | Where it lives in NetBox |
|---|---|
| Hostname | Device name |
| Asset number | Device asset tag (serial number alongside) |
| Asset role/type | Device role |
| Manufacturer, model | Device type and its manufacturer |
| Operating system | Platform, with the running version in a sw_version custom field |
| IP address | IP addresses assigned to interfaces |
| MAC address | Interface MAC addresses |
| Physical location | Site, then a location tree (building, area, cell), then rack or cabinet |
| Ports/services | Services on the device (port and TCP/UDP) |
| Communication protocols | A tag or custom field for the industrial protocols (EtherNet/IP, PROFINET, Modbus TCP, OPC UA) |
| Asset criticality | criticality custom field |
| Logging | log_forwarding and log_destination custom fields |
| User accounts | Don't store accounts in NetBox. Record where they are managed and who owns them. |
The custom fields are additions, not changes to NetBox itself. Book 1's Appendix I lists the full set, and the free NetDiagrams tool can create them (netdiagrams netbox-setup, which only adds objects). Put support dates such as end_of_support on the device type, so one entry covers every unit of that model.
Reconcile discovery with the record
Once the record exists, discovery keeps it honest:
- Export the discovery tool's asset list (most can export CSV or offer an API) and match it to NetBox by IP address, then MAC address, then name.
- Seen but not in NetBox: an unknown device. Find out why it is there before you add it.
- In NetBox but never seen: a spare, a quiet device or an unmonitored segment. Mark which one, so the next review doesn't ask again.
- In both but different (firmware, model, address): drift. Decide which side is right and fix the other.
- Record the date of the last check in a
last_verifiedcustom field, so an auditor can tell a checked record from a guess.
Run this monthly at a busy plant and quarterly at a quiet one. The discovery tool stays the alarm and NetBox stays the record.
From the inventory to the drawing
CISA's guide also asks you to visualize the taxonomy as zones and conduits diagrams. With the inventory in NetBox, that diagram doesn't need to be a separate job. The free NetDiagrams tool draws the Purdue levels, zones, cells and cables in draw.io straight from those records, and marks anything missing instead of guessing. The Purdue model chapter shows what the zones should look like, and 62443 zones and conduits shows how to write down what each zone may talk to.
Where to go next
- Free: How to import a plant network into NetBox (Book 1, Appendix F).
- Free: OT security basics for IT people.
- Studying for an OT security certification? The OT security study map shows where asset inventory sits in each exam.
- Manufacturing Network Diagrams, Book 1, builds the full inventory and drawing set for a sample plant, field by field.
Cisco Cyber Vision, Claroty and Nozomi Networks are trademarks of their owners and are named only to describe the kind of tool. NetDiagrams is not affiliated with or endorsed by any of them.
