Joint guidance on creating and maintaining a definitive view of your operational technology architecture – Canadian Centre for Cyber Security
Summary
The Canadian Centre for Cyber Security, together with the UK National Cyber Security Centre (NCSC-UK) and partners from Australia (ASD’s ACSC), Germany (BSI), the Netherlands (NCSC-NL), New Zealand (NCSC-NZ), and US agencies (CISA and the FBI), has published joint guidance on creating and maintaining a definitive view of operational technology (OT) architecture.
The guidance sets out a principles-based framework for OT organisations (both greenfield and brownfield) to build, maintain and store a comprehensive record of their OT systems. It is aimed at cyber security professionals working in OT environments and highlights five core principles covering processes, governance, asset identification, connectivity mapping and third-party risk.
Key Points
- This is a multinational, joint publication by major national cyber agencies to improve OT cyber resilience.
- The guidance is principles-based and intended for both greenfield and brownfield OT deployments.
- Five core principles: establishing/maintaining the definitive record; OT information security management; asset identification and categorisation; documenting connectivity; and documenting third-party risks.
- Provides a framework for developing a comprehensive, authoritative record of OT systems to support risk-based decisions.
- Designed to help organisations understand internal and external connections and dependencies that affect OT security.
- Part of a wider series emphasising the importance of cyber security in operational technology.
Context and Relevance
OT systems underpin critical infrastructure — from utilities to manufacturing — so clear, accurate architecture records are foundational to assessing risk, responding to incidents and managing supply-chain or vendor exposure. This guidance reflects growing international alignment on OT security practices and provides a practical baseline for organisations to improve visibility, governance and third-party controls. For security teams, it helps turn fragmented system knowledge into a maintainable, auditable asset that supports prioritisation and mitigations.
Author style
Punchy: This isn’t high-level fluff — it’s a practical, jointly authored playbook from heavyweight national agencies. If you manage or secure OT, treat this as a blueprint to tighten your visibility and reduce nasty surprises.
Why should I read this?
Short and honest — if you’re responsible for OT, this is the checklist you’ve been meaning to write but haven’t got round to. It tells you what to document, why it matters and how to keep that record useful. Saves you time, helps you sleep better when suppliers or networks change, and makes incident response far less chaotic.
