Specialized asset

The list is closed, and your asset either appears on it or it does not.

Five types qualify: Government furnished equipment, Internet of Things and Industrial Internet of Things devices, operational technology, restricted information systems, and test equipment. Operational technology covers programmable systems that interact with the physical world, which is how a machine tool controller or a building system qualifies. An old server running software you cannot patch is not on the list, however specialized it feels.

These assets are documented and managed, not assessed against the requirements.

Table 3 to 170.19(c)(1) asks you to put them in the asset inventory and draw them on the network diagram. Describe their treatment in your system security plan. Show they are managed under your risk-based policies and practices. The assessor reviews the plan and does not assess them against the other requirements. For a manufacturer, this is the provision that keeps a shop floor from becoming an assessment problem.

Show how you manage the risk, because that is what is actually reviewed.

Describe what the equipment is, why it cannot be fully secured, where it sits on the network, what limits what can reach it, and who may operate it. A machine controller on a segment that reaches nothing else, with a documented process for moving programs onto it, is a description an assessor can work with. An entry that says the equipment is legacy is not.

A specialized asset still sits inside your boundary, so plan the network around it.

The treatment covers the assessment of the asset. It does not make the asset harmless. Equipment that cannot be patched or authenticated properly is exactly what an attacker looks for, and it usually sits next to the work that matters. Put it behind controls you do assess, and record that arrangement.