How to prepare for and plan your organisation's response to severe cyber threat: a guide for CNI

You should maintain a definitive record of your systems since you can’t defend an asset if you don’t know about it. This should be a continually updated, accurate and up-to-date view of your system (or element of a system). The definitive record will change over time as all system changes are recorded to maintain its accuracy and authority. It captures the system architecture as a holistic design that not only encompasses the components of a system (including technology, security controls, people and process), but how these elements integrate into larger business functions and objectives. This helps you understand your attack surface.

For operational technology (OT) and ICS create a separate inventory that maps critical assets and their relationship to business processes. Start by mapping your most critical systems, then expand coverage to all assets. Focus on assets that, if compromised, would cause the most damage to your operations or public safety.