# Phase 0 inventory worksheet — fill this out first

**What this is:** a plain fillable version of `PHASED_ROLLOUT.md` Phase 0's "inventory every
device" step. You cannot protect what you have not listed, and a filled table is something an
operator and an integrator can actually sit down and finish in an afternoon — this turns that one
line of advice into a real artifact instead of leaving it as prose.

**Honesty rule:** write "Unknown" where you don't know. A field marked Unknown is useful,
correctly-scoped information; a guessed answer is not — it's exactly the kind of silent gap Phase
0's Shodan self-check (see `PHASED_ROLLOUT.md`) exists to close.

**Handling rule — treat the finished worksheet as sensitive.** A blank worksheet is a form. A
*filled* one is a single table listing which of your devices are reachable, which cannot
authenticate, which are unsegmented, and which still hold factory credentials — which makes the
completed file more useful to someone attacking you than to almost anyone else. Keep it off
internet-facing shares and out of unencrypted email, give it only to the staff and integrators who
actually need it, and if it leaves the utility, ask the recipient how they intend to store it. This
is not a reason to skip the inventory — you cannot protect what you have not listed — it's a reason
to keep the result somewhere deliberate.

| Device / Location | Make & Model | Firmware Version | Protocol(s) in use | Internet-reachable? | Auth-capable (CIP Security / TLS / equivalent)? | Segmented from IT & internet? | Default credentials changed? | Last reviewed |
|---|---|---|---|---|---|---|---|---|
| *EXAMPLE (illustrative only — replace with your own)* | ControlLogix 5580 | Unknown — check | EtherNet/IP + CIP | Unknown — run Shodan self-check | No (legacy hardware) | No | Unknown | 2026-08-03 |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |

**Review cadence:** re-run this alongside Phase 4's periodic re-exposure check, not just once at
setup. Firmware gets updated, network topology changes, and "internet-reachable" is a fact about
right now, not a fact that stays true.

---
*l0gic — Patrick Crosby, 2026-08-03. Companion to `PHASED_ROLLOUT.md` Phase 0.*