Loudoun Water and CISA outline practical steps for building and sustaining OT inventories

Loudoun Water and CISA presenters offered practical, operator-focused guidance for creating OT asset inventories, emphasizing that inventories should be built iteratively and integrated into operations, maintenance and cybersecurity processes.

Andy Krapf, Director of Operations Technology at Loudoun Water, said his utility pursued a five-year program combining manual records, institutional knowledge and automated discovery across more than 100 facilities to reach comprehensive visibility. "Once we laid the foundation for our remote communications ... we were then able to deploy tools that allowed that automated data collection," Krapf said, describing how the capability improved detection of pressure drops and enabled more proactive responses.

CISA’s Derek Hittie walked through practical implementation steps operators can use: define scope and objectives with clear governance and stakeholder representation; perform a logical survey followed by physical walkdowns to capture vendor, model and firmware data; group assets by function and criticality; map zones and conduits to identify trust boundaries and protections; centralize the inventory in a protected repository; and embed lifecycle updates into change-management and maintenance workflows.

Krapf and Hittie both stressed starting small: automate what you can, rely on institutional knowledge where automation isn’t feasible, and iterate. Krapf urged operators "Don't let perfect be the enemy of good progress" while Hittie recommended validating taxonomy and visualizations with operators so the inventory becomes an operational tool rather than just a spreadsheet.

Practical takeaways: use a phased pilot approach, capture third-party responsibilities in the inventory, consider passive-discovery tools to reduce manual workload, secure the inventory with access controls and encryption, and ensure backups and resiliency so the record remains available during incidents.