MTSA asset inventory: what maritime teams need to inventory now

TL;DR: MTSA’s cybersecurity rules make accurate asset inventory the first control that everything else depends on, according to Dragos, and the scope includes critical IT, OT, software, firmware, cloud services and third-party-managed systems that could affect a transportation security incident. Without inventory discipline, segmentation, plans and recovery work all start from incomplete visibility.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “You Can’t Protect What You Can’t See: MTSA’s Asset Inventory Mandate”.

Key questions

Q: What breaks when OT asset inventory is incomplete?

A: Incomplete OT asset inventory breaks segmentation, vulnerability prioritisation, and incident response because security teams cannot reliably tell which devices exist, where they are, or what they connect to.

Q: Why does vendor-managed equipment still need to be in the inventory?

A: Vendor-managed equipment still needs to be inventoried because delegated ownership does not remove operational impact.

Q: How can security and IT teams tell whether an asset platform is actually working?

A: Look for evidence that ownership, usage, renewal, and retirement data stay synchronized without constant manual correction.

Practitioner guidance

• Map criticality before technical controls Classify each network-connected system by whether compromise could create a transportation security incident, then separate critical IT from supporting infrastructure and non-critical assets.
• Build a single master asset register Use one authoritative register for hardware, software versions, firmware revisions, physical location, support status and owner, and keep it aligned to change and decommission events.
• Record third-party systems as in-scope assets Include vendor-managed systems when the vendor owns, operates, maintains or controls part of the service, and document support contacts, access paths and decision authority.

Bottom line: MTSA turns asset inventory into a prerequisite for every downstream control, which is why incomplete scope now creates both security and compliance exposure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →