OT asset governance: what UK manufacturers need in place
OT asset governance is the discipline of knowing what automation is installed on a site, keeping that record current, controlling changes to it, controlling who can access it, and planning for the day each part stops being supported. It is the OT equivalent of the asset and change management most businesses already run for IT.
This guide covers which rules apply to a UK manufacturer, and what you need in place to answer the questions assessors and customers ask.
This is general information, not legal advice. Whether a specific regulation applies to your business depends on your sector, size and customers; take advice on your own obligations.
Which rules apply in the UK
The NIS Regulations 2018. The UK’s network and information security law applies to operators of essential services (in sectors such as energy, transport, water, health and digital infrastructure) and to some digital service providers. Most manufacturers are not directly in scope.
The Cyber Security and Resilience Bill. Introduced to Parliament in November 2025, the Bill updates the NIS Regulations. It extends scope to areas such as managed service providers and data centres, and lets regulators designate critical suppliers to essential services. A manufacturer that supplies an essential service could be affected that way, even if it is not regulated directly.
NIS2. NIS2 is an EU directive and does not apply in the UK. It matters to UK manufacturers in two cases: if you operate in an EU member state, or if your EU customers are in scope and pass their supply-chain security requirements down to you. NIS2 explicitly covers sectors including food production and processing, chemicals, and the manufacture of pharmaceutical products and medical devices.
IEC 62443. An international standard series for industrial automation and control system security. It is not law, but it is the reference many customers, insurers and integrators use. See IEC 62443 and your OT asset inventory.
Sector standards. Food manufacturers certified to BRCGS have their own expectations around equipment, change control and food safety. See BRCGS and PLC programs.
For most UK manufacturers, then, the pressure comes less from direct regulation and more from customers, insurers and auditors asking for evidence.
The questions you will be asked
Whatever the framework, the questions come back to the same few:
- What automation is installed, and where?
- What software is it running, and where are the backups?
- Who changed it, when, and was the change controlled?
- Who can access it, and how is remote access controlled?
- What happens if a critical device fails, and is it still supported?
The four records that answer them
An asset inventory. Every PLC, HMI, drive and network device, with part number, firmware, location and lifecycle status. Not a spreadsheet that was right in 2019, but a record that is kept current.
Versioned program backups. Every program stored against the device it runs on, with each change kept as a new version, and the software, version and cable needed to restore it recorded alongside.
A change and access log. Every change, download and remote session logged against a named person and a time.
A lifecycle and recovery view. Which devices are discontinued or phasing out, which have spares, and which would stop a line if they failed today.
Together these answer most of what an assessor asks. They also do the job they exist for in the first place: getting a line running again when something fails.
Why it has been neglected
OT has historically been run informally. It changes slowly, it was often isolated from the office network, and the same few engineers looked after it for years. That model breaks when those engineers leave, when equipment ages past support, or when someone outside engineering asks for evidence.
Where to start
Start with the inventory and the backups; everything else builds on them. A Capture site audit records every device, takes the backups and checks lifecycle status in one visit, and loads the result into Command Centre, which keeps the versions, the change log and the access log from then on.