From Asset Inventories to Stop-the-Line Maps
Your renewal questionnaire is asking for the pieces of a document you have never built.
A list of people is not a list of ways in, and a list of assets is not a list of stoppages.
Read your cyber insurance renewal questionnaire. Underwriters covering industrial risk in 2026 ask for asset inventories, software bills of materials, and your IT and OT architecture with the segmentation drawn in. They also want an end-of-life systems inventory, mapping to IEC 62443 or NIST SP 800-82, patch cadence or the compensating controls where there is none, and the honest reach of your multi-factor authentication.
Those are fragments of one document. Nobody has asked you for the document, so nobody has built it, and the questionnaire gets answered field by field from eight different systems by whoever has capacity that week.
Three strands of the IT tether have run through this series, each with a different owner and a different failure. What follows is what happens when you stop arguing them one at a time and put them on a single page.
What your two existing documents actually answer
The asset inventory answers ownership. The maturity score answers conformance. Both are honest documents and neither was built to answer the question a board asks after a stoppage, which is why the plant stopped when the plant was secure.
Filling that gap does not require a new framework. It requires a different unit of analysis. Stop organizing by asset and organize by line.
The stop-the-line map
One production line, one page, six columns.
ColumnWhat goes in itThe lineThe physical line or cell, named the way the plant names itWhat it cannot finish a shift withoutThe enterprise system, not the categoryWhich strandOrder, host or accessOwnerA person, with a phone number. Not a team, not a queueRestoration timeMeasured with a stopwatch, with the date it was measuredLast testedBlank is an answer, and it is the most useful entry on the page
Five columns can be filled in from a desk. The restoration time cannot, which is why it is the column that decides whether the document is real. A map with an empty restoration column is a list, and you already have one of those.
Two controls that pay across all three strands
Privileged access review is the first. The administrator group on your ERP, the administrator group on the host carrying your HMI servers, and the accounts that can authenticate through your remote access path are three instances of one control. Most manufacturers run it three times, on separate calendars and against separate standards. Run it once, against the map, by line.
Restoration sequencing is the second. Every strand fails into the same question: what comes back first, and who decides. A plant that has sequenced its restart once has answered it for ransomware, for a failed migration, and for the afternoon a vendor pushes a bad update.
The self-assessment
Three questions. Answer them out loud, at your highest-value site.
Order. Name the person who decides your plant can ship without an electronic batch record.
Host. Name every account in the administrator group of the host carrying your HMI servers.
Access. Name what causes an integrator’s access to stop working, without anyone deciding to revoke it.
The one you cannot answer cleanly is the strand you have left exposed. In most of the plants I walk, it is the third.
The full argument, in one paragraph
Two producers stopped production this summer and neither attacker reached a controller. Order is what decides whether work exists, and it lives in systems your OT scope files as business applications. The host underneath your HMI servers decides whether anyone can see the work happening, and your Purdue diagram has no box for it. Access is the strand your annual review already covers, badly, because a list of people is not a list of ways in. Put all three on one page per line, with a person against every entry and a restoration time somebody has held a stopwatch on, and you have the only document that answers what stops your plant.
What you can do this week
If you’re a plant or OT leader: Build the map for one line. One page, six columns, and no entries you cannot name a person for.
If you’re a CISO or enterprise risk lead: Take the completed page to your next renewal or customer security review and answer from it. Then count how many questionnaire fields it covered.
If you’re a COO or CFO: Fund the map before you fund the next platform, and sequence the capital plan against the empty restoration times rather than against the severity scores.
A final thought
Standard cyber policies exclude physical damage, Lloyd’s mandated the nation-state exclusion in 2023, and roughly 25 percent of claims are denied on exclusions or policy limits. The market has decided that industrial buyers should be able to describe what stops them and how fast they come back. Your insurer will get that document out of you eventually, on their schedule and in their format. Building it first is cheaper, and it is worth more to you than to them.
Your turn
Which line would you map first, and what stops you from having a measured restoration time in that column by the end of the month? If the answer is that nobody will approve the downtime to test it, you have found the decision this whole series has been about.
This post is part of The IT Tether series. Read every chapter in one place in The IT Tether eBook, or book a demo to see how Resilion maps what stops your line.