You Can't Protect What You Can't See: MTSA's Asset Inventory Mandate
Summary: The second post in Dragos's MTSA cybersecurity series focuses on the asset inventory requirement at 33 CFR 101.650(b)(3), which mandates an accurate inventory of network-connected systems with critical IT and OT systems designated. The regulation's definition extends to systems whose ownership, operation, maintenance, or control is delegated wholly or in part to another party, and the post cites an engagement where consultants found a workstation on a client's network connecting to a domain now linked to a foreign gambling website, located after 2.5 hours of searching and found to lack a password.
What you should know: Under MTSA, a third-party vendor's system that your Cybersecurity Officer marks as critical pulls that vendor relationship into regulatory scope, so a supplier's security posture becomes part of your compliance. The post's example is the stake: a single undocumented workstation took 2.5 hours to find and was talking to a gambling domain with no password set.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026