NIST SP 800-82r3 makes OT asset discovery a method-risk decision
NIST treats an accurate OT asset inventory as important to risk management while warning that collection methods can affect the environment being observed. Passive, active, automated, and manual approaches have different evidence gaps and operational consequences, so discovery authority must be bounded before a tool is run.
Editorial figure by OT Defense Review. Source context: NIST — Guide to Operational Technology Security, SP 800-82 Rev. 3.
Inventory accuracy does not authorize one discovery method
NIST connects an accurate asset inventory to OT risk management, but it does not turn that objective into a blanket instruction to scan. The guide repeatedly emphasizes OT’s performance, reliability, and safety characteristics. Discovery therefore has two evidence questions: what the method can establish about assets, and what the method may change or disrupt while collecting that evidence.
A governance record should identify the environment and process boundary, method proposed, expected visibility, known blind spots, evidence owner, engineering and operations approvals, test status, timing restrictions, stop conditions, and retention of results. Those are review fields, not operational instructions. The authorized site team remains responsible for deciding whether and how any collection activity is safe.
Passive visibility has limits that a dashboard can hide
The guide notes that passive methods introduce no additional traffic, an important characteristic in sensitive environments. It also identifies limitations: a device that is not communicating may not appear, encrypted traffic can obscure details, and some devices may require days of observation before they are detected. A clean passive-discovery screen is therefore not proof that the inventory is complete.
Buyers should require each observed asset record to carry the observation source, sensor location, first and last seen times, identifiers, confidence, network or process context, and unresolved conflicts. They should also distinguish observed, inferred, imported, manually verified, and retired records. Blending those states into one inventory count can create false certainty about coverage.
Active collection changes the assurance burden
NIST warns that active scanning can affect OT devices and can interfere with process state, with possible safety and integrity consequences. The guide discusses offline testing, planned outages, caution, and manual alternatives. This is a safety boundary, not a recipe. A publication or product demonstration cannot determine whether a technique is appropriate for a live facility.
Procurement evidence should show whether a provider distinguishes identification, vulnerability assessment, configuration collection, and continuous monitoring rather than marketing them as one discovery capability. The evaluation should request documented prerequisites, unsupported-device behavior, authorization controls, rate and scope safeguards at a policy level, audit records, and a safe simulation or non-production demonstration approved by the asset owner.
The inventory is an input to accountable risk decisions
SP 800-82 Rev. 3 also provides OT-oriented guidance for applying NIST controls and an OT overlay. An asset inventory can support that work, but a detected model, protocol, or software string does not by itself establish criticality, exposure, vulnerability, exploitability, compensating controls, or an acceptable response. Those conclusions require contextual evidence and authorized review.
OT Defense Review will treat discovery claims as method-specific and time-bounded. A credible statement identifies what was observed, by which approved method, where and when, with what limitations, and who verified the result. It should never imply that a current dashboard is complete merely because the collection completed without a visible error.
Enterprise buyer test
Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.
A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.
What we will watch next
OT Defense Review will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.