Passive-first asset discovery reduces the risk of disrupting fragile controllers and legacy protocols. GDF combines packet observation, switch and firewall records, engineering files, maintenance systems, drawings, purchase records, and operator knowledge. The result is reconciled against what the organization already believes it owns. Active follow-up is used only when operator-designated authority approves the method, process conditions, stop points, and recovery plan.
Passive does not mean automatic
Sensor placement determines visibility. An appliance on one trunk may miss isolated cells, serial gateways, maintenance laptops, cellular modems, and dormant assets. Analysts document collection points, observation periods, inaccessible segments, encrypted traffic, and the operational states represented during capture.
Identity plus context
Observed addresses and protocol fingerprints are checked against controller projects, HMI configurations, network drawings, asset registers, and personnel knowledge. Conflicts are retained for resolution. High-value fields include process function, safety relevance, zone, normal peers, remote-access path, backup location, vendor support, and recovery owner.
- Passive network observation with documented coverage
- PLC, HMI, historian, engineering workstation, gateway, and network-device reconciliation
- Unmanaged remote access and cross-zone communication review
- Owner, criticality, backup, and replacement-data enrichment
- Export to the client's CMDB or governance workflow
A maintained operating record
Discovery is a baseline, not a one-time count. GDF helps define change review, exception handling, passive monitoring, and periodic reconciliation so new vendor connections, replacements, and temporary engineering assets do not become permanent blind spots.