The register is split. The plant is one.

CISA's 2030 agenda – asset visibility, OT modernisation, supply-chain security – has put an official date on something plant people have quietly fumbled for years. Ignore the decade-long programme for a moment. Run the simpler test this week. Ask your security team for their OT asset list. Ask your quality office for the master equipment list. Put the two side by side. You will not find gaps so much as two different plants – one built of IP addresses, one built of gauges – sharing a single factory floor and almost no line items.

The register you already own

Quality has been running an OT asset register for decades; nobody in security calls it that. IATF 16949 clause 7.1.5 and its aerospace counterpart require every measurement resource to be identified, calibrated, protected and traceable. VDA 6.3 auditors walk the line holding that list: gauge ID, location, owner, calibration interval, last result, the containment plan for the day the gauge is found out of tolerance. That is not discovery output. That is a governed register with change control bolted on.

When I built a greenfield QA/QC department for a 900-plus-employee plant, the master equipment and calibration list was the first artefact we created – before the quality manual, before the first control plan. You cannot control what you have not named. Every product-touching device went on it: calipers, torque wrenches, CMMs, vision systems, the weld checker on the assembly cell. Each line carried an owner, an interval, a status, a history.

Here is the catch, and the point of this whole piece: the register stops at the gauge casing. The CMM's operating system, the vision system's network card, the PLC driving the torque station – none of it appears anywhere. We tracked the instrument to two decimal places and had no idea what firmware the box underneath it ran. I kept registers like that for years and never asked either.

Discovery scans find addresses, not criticality

The SOC holds the other half, and I say this with sympathy. I hold a CEH; my name sits on T-Mobile's public bug-bounty Hall of Fame for clickjacking disclosures. I know exactly what a passive discovery tool returns: MAC addresses, IP ranges, vendor strings, firmware versions, maybe a protocol fingerprint. What it never returns is a flag saying this node feeds characteristic CTQ-14 in the control plan, and if it lies, the hinge ships wrong and you are into containment on three trucks of parts.

Criticality is quality data. It lives in the PFMEA and the control plan – documents the scan will never read. So the SOC ends up with a technically accurate inventory and no way to rank it, while quality holds the ranking of everything critical and no view of the network underneath. Each function owns half a register. In two decades I have never seen anyone run the diff between them.

The adversary will run it for you.

Recent reporting – internet-exposed refrigeration controllers, AI-assisted attack planning against industrial control systems – makes the point plainly: automated reconnaissance now maps an OT estate faster than most internal teams ever have. Attackers learn criticality the crude way, by watching which lie hurts you most.

An asset nobody answers for is not an asset – it is an incident that has not been scheduled yet.

Merge the lists the way you would qualify a gauge

Here is the trade nobody prices honestly. A passive OT monitoring deployment starts around €80,000 before integration. The merge costs a workshop, a shared spreadsheet and one uncomfortable afternoon of turf negotiation, because the expensive part was never tooling – it was two departments admitting their lists describe the same machines. The mechanics themselves are boring on purpose, and boring survives audits:

• Add four columns to the control plan beside each characteristic: network dependency – which PLC, HMI or server the measurement depends on – plus firmware version, owner and fail state, written like an out-of-tolerance containment.
• Give the PLC what the gauge already has: an owner, an interval (patch, backup, config-restore test), a status and a change-management gate. Calibration recall is management of change with a sticker on it.
• Run one joint gemba walk with both documents – scanner export and master equipment list – and put a name against every discrepancy before you leave the line.

Nobody gets fired for buying another monitoring appliance, which is why so many plants own five discovery tools and zero merged registers.

The deadline is not 2030

The real deadline is whoever next asks to see what is connected and why it is controlled: a VDA 6.3 auditor probing process security, an IATF 16949 surveillance visit, an incident commander at two in the morning. The auditor's question and the attacker's question are identical – what does this node touch, who owns it, what happens when it fails. Quality has answered exactly that for gauges, under audit conditions, since before CISA existed. A plant with one merged register answers in minutes. A plant with two half-registers answers with a project plan.

Two decades of chasing defects, and years spent breaking things on the other side of the fence, taught me one lesson worth printing: quality management and security are a single discipline – the study of how complex systems fail – and the only real difference is whether the failure has intent behind it.

Start the 2030 inventory in the calibration lab, not the SOC. The most accurate OT asset register you own has been maintained under third-party scrutiny for decades, and it already has owners. All it needs is permission to continue past the gauge casing – and once it has that, the two plants on your floor finally become one.