--- sourceDocument: Australia Operational Technology Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/operational-technology Release : - australia ft:locale : - en-US ft:publication_title : - Australia Operational Technology Management ft:clusterId : - optm bundleId : - optm workflow : - Technology --- # Operational Technology Hardware Vulnerability Assessment # Operational Technology Hardware Vulnerability Assessment {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Operational Technology Hardware Vulnerability Assessment The Operational Technology (OT) Hardware Vulnerability Assessment (HVA) application enables ServiceNow customers to evaluate firmware vulnerabilities in OT devices within their inventory. It identifies devices at risk by matching normalized OT device data---such as manufacturer, firmware version, and product model---to Common Vulnerabilities and Exposures (CVEs) from the National Vulnerability Database (NVD) using Common Platform Enumeration (CPE) standards. Show full answer Show less HVA supports assessments even for firmware discovery models without normalized or CPE-mapped content by applying a matching score algorithm to find the best possible CPE matches. It also leverages version range information from NVD for more accurate vulnerability determinations. ## Key Features * **Normalized Content Usage:** Utilizes normalized OT device data mapped to CPE to assess vulnerabilities accurately. * **Matching Algorithm:** Compares unmapped firmware discovery data with CPE records to enable vulnerability assessments before full normalization. * **Range Information:** Applies NVD version range data to evaluate vulnerabilities when exact version details are missing. * **Scheduled Jobs:** Supports automated, periodic vulnerability assessments through Full and Delta Hardware Vulnerability Assessment jobs. * **Role-Based Access:** Requires specific roles (snvul.manageexposureassessment and snotvr.vuleventmanager) for managing and acting on assessments. * **Industrial Workspace Integration:** Presents vulnerability assessment records via the Hardware Vulnerability Assessment menu, with tabs for fully matched, partially matched, vulnerable items, ignored assessments, and devices awaiting normalization. * **Automatic Vulnerable Item Creation:** Can automatically generate Vulnerable Items (VITs) for fully matched assessments, streamlining risk tracking. * **Confidence Scoring:** Provides confidence scores for partially matched assessments and VITs to help prioritize risk investigation. ## Key Outcomes * Enables OT hardware vulnerability analysts to identify and focus on high-risk vulnerabilities in OT devices effectively. * Allows proactive management of vulnerabilities by automatically creating Vulnerable Items for confirmed risks. * Facilitates investigation of partial matches to uncover potential risks before normalized data is fully available. * Helps monitor OT devices pending normalization to ensure ongoing comprehensive vulnerability coverage. * Improves accuracy of vulnerability assessments through integration with Enterprise Asset Management normalization processes and NVD data. ## Practical Guidance * Activate and schedule the Full and Delta Hardware Vulnerability Assessment jobs to maintain up-to-date vulnerability data automatically. * Ensure necessary roles are assigned to users managing vulnerability assessments and responses. * Enable the Firmware Discovery Model Opt-in feature in Enterprise Asset Management to facilitate normalization of OT device data. * If already using HVA, rerun NVD integrations to leverage the enhanced range information feature for improved assessment accuracy. * Use the Industrial Workspace HVA menu to review assessments, investigate risks, and manage Vulnerable Items efficiently. The Operational Technology (OT) Hardware Vulnerability Assessment (HVA) application enables you to assess the firmware vulnerabilities of the OT devices in inventory and create vulnerable items (VIT) against the impacted OT devices. ## Hardware Vulnerability Assessment overview {#understanding-hwd-vuln-assessment__section_ocl_g2x_ydc} Hardware Vulnerability Assessment uses normalized content for firmware discovery model to perform assessments. The normalized content contains OT device data, such as manufacturer, firmware version, and product model. It's based on the normalization process available in Enterprise Asset Management. The normalized content for OT devices is mapped according to the Common Platform Enumeration (CPE) format provided by the National Vulnerability Database (NVD). An OT device is considered at risk, when the Common Vulnerabilities and Exposures (CVEs) data available in the NVD database, matches the OT device data available in the CPE-mapped normalized content. The Hardware Vulnerability Assessment menu available in the Industrial Workspace displays the OT devices that are at risk. HVA can assess firmware discovery models, which don't have normalized content and they haven't been CPE-mapped yet. HVA uses a matching score algorithm to compare CPE values with existing firmware discovery values. The matching algorithm searches for CPEs that matches OT devices with the same discovery publisher name, model name, and version. The HVA matching algorithm compares the data from CPEs and unmapped firmware discovery model. Based on the comparison, the matching algorithm evaluates the best possible CPE match for unmapped firmware discovery models. Even though the results may not be fully accurate, it helps in vulnerability assessments until CPE-mapped normalized content is available. Also, HVA uses the range information provided by NVD to assess vulnerabilities more accurately. For example: * In case there's a version information unavailable for a CPE, the range information available for a specific OT device publisher and model is used to perform a hardware vulnerability assessment. * For versions, a comparison algorithm is used to determine if the input version is in range. {#understanding-hwd-vuln-assessment__ul_i45_k4v_vfc} Important: If you're already using HVA, rerun the NVD Integrations to use the range information feature. For more information, see [Run NVD Integrations for Hardware Vulnerability Assessment](https://www.servicenow.com/docs/pEyloxsYYUhA1A~QpY2Kmg "Install and run National Vulnerability Database (NVD) integrations to perform hardware vulnerability assessment."). You must activate and schedule the following scheduled jobs to perform hardware vulnerability assessment automatically and periodically: * Hardware Vulnerability Assessment - Full * Hardware Vulnerability Assessment - Delta {#understanding-hwd-vuln-assessment__ul_wyk_qjb_zdc} ## Required Operational Technology and Hardware Vulnerability Assessment roles {#understanding-hwd-vuln-assessment__section_tz2_bt2_xdc} You must have the following roles to use the Hardware Vulnerability Assessment (HVA) menu: * sn_vul.manage_exposure_assessment: Assign roles to admin users or user groups as needed, which enables them to view or edit properties for HVA. * sn_otvr.vul_event_manager (OT Vulnerability Event Manager): Assign roles to HVA users  or user groups as needed, which enables them to view assessment records and act accordingly. {#understanding-hwd-vuln-assessment__ul_lmy_y1f_ydc} ## Use Case {#understanding-hwd-vuln-assessment__section_ctp_qgf_ydc} OT hardware vulnerability analysts can use HVA to: * Identify cybersecurity risks in OT devices. * Focus on high-risk vulnerabilities via fully matched assessments on OT device data. * Set up automatic creation of vulnerable items for fully matched assessments. * Investigate and address partially matched assessments to identify potential risks and act accordingly. * Monitor unprocessed OT devices from the Awaiting Normalization tab, which are pending full discovery or pending content updates. {#understanding-hwd-vuln-assessment__ul_h3y_3z5_zdc} ## HVA tabs {#understanding-hwd-vuln-assessment__section_cl2_knm_ydc} The HVA menu displays HVA records created for the OT devices. These assessment records are created based on many criteria. For example, CVE vulnerability, OT device at risk, Common Vulnerability Scoring System (CVSS) score, Confidence Score, and Device Criticality. * The Fully matched assessments tab displays the assessment records, where the CVEs fully match with the manufacturer, product model, and firmware version of the OT devices. A fully matched assessment means that an OT device matches all vulnerability factors specified in a CVE. * The Partially matched assessments tab displays the assessment records, where the CVEs partially match the firmware version or the manufacturer and model on the OT device. Also, HVA creates partial assessments for normalized discovery models, which don't have firmware version available. Using the matching algorithm, the version information from the normalized content of OT devices with the same publisher and model is used to create an assessment. * The Vulnerable Items tab displays the VITs that are created automatically or you create manually based on the assessments. * The Ignored assessments tab displays the assessments of the devices that you choose to ignore. * The Awaiting Normalization tab displays the OT device data that doesn't have the normalized data and hasn't been used for assessment. {#understanding-hwd-vuln-assessment__ul_skw_qhb_zdc} Important: * If the property to create automatic VIT is enabled, the Fully matched assessments tab doesn't display any data. You can view this information on the Vulnerable Items tab. * Enable the Firmware Discovery Model Opt-in feature in Enterprise Asset Management so that OT devices data are available for normalization. For more information, see [Opt-in to the Enterprise Asset Management Content Service](https://www.servicenow.com/docs/access?context=optin-cs-eam&version=australia&pubname=australia-it-asset-management&ft:locale=en-US). {#understanding-hwd-vuln-assessment__ul_u4z_m5g_c2c} ## Additional Resources {#understanding-hwd-vuln-assessment__section_nvv_ww5_xfc} * **[Confidence score calculation for hardware vulnerability assessment](https://www.servicenow.com/docs/XwHGEvIrZtJkOjEN6pH98g)** Confidence Score is displayed for partially matched assessments, vulnerable items (VITs), and ignored assessments. * **[Confidence score reference tables for hardware vulnerability assessment](https://www.servicenow.com/docs/AzY7r4Y3fEBDEx5bMgwl3Q)** Reference values used to calculate the confidence score. **Related concepts** * [Industrial Workspace](https://www.servicenow.com/docs/g7SsnkWxoFYJCHY5_FuPZg "The Industrial Workspace is a user interface that provides Operational Technology (OT) users with the tools they need to manage their OT data.") **Related tasks** * [Set up the Hardware Vulnerability Assessment of Operational Technology devices using guided setup](https://www.servicenow.com/docs/NdORgf2Hg6E3BQbS3zGwrQ "Use the Industrial Workspace Admin guided setup to walk you through configuring the Hardware Vulnerability Assessment feature available on the Industrial Workspace menu.") * [Use the Hardware Vulnerability Assessment menu in the Industrial Workspace](https://www.servicenow.com/docs/Qn6A2Xj1Ru9wBvjE9920dw "Use the Hardware Vulnerability Assessment menu to view and track all the firmware vulnerability assessments in your OT environment. Also, in the HVA menu you can view the vulnerable items that are created based on the firmware vulnerability assessments.") **Related topics** * [Enterprise Asset Management normalization](https://www.servicenow.com/docs/access?context=normalization-eam&version=australia&pubname=australia-it-asset-management&ft:locale=en-US)