A machine-readable Software Bill of Materials for every control-system component, listing every third-party and open-source library it contains, so a newly disclosed vulnerability can be matched to affected assets in hours rather than weeks.
Blockchain / distributed ledger for OT supply-chain integrity
Industrial IT / OT / Critical Control Information Infrastructure
Reality Check
Mid-term · 5–10 yrs
Evidence E2 · Field pilot
Distributed-ledger records intended to give an immutable, tamper-evident history of a control-system component's provenance, firmware updates and maintenance history.
Short entry. This page summarises our current placement. Full, sourced analyses are published first for the technologies closest to practical use; see the list of full analyses.
How it works
A distributed ledger is a record shared between several parties in which each entry is cryptographically linked to the one before, so that history cannot be altered without detection. In an industrial supply chain the idea is that manufacturers, integrators and owners each add signed entries, such as build records, firmware releases, shipments and repairs, to form one provenance history for a component.
Industrial designs are almost always permissioned: a known group of organisations runs the ledger, without the open participation and energy cost of public blockchains. A ledger proves that a record has not been changed since it was written. It cannot prove that the record was true in the first place, or that the physical item matches it.
Why it matters
Could, in principle, make firmware and spare-parts provenance verifiable across a multi-tier supplier chain — a real problem in ICS supply-chain security.
Where it fits
The underlying problem, proving that a part or a firmware image is genuine, is real. Much of it is now addressed more simply by signed firmware, hardware device identity and software bills of materials. A shared ledger adds value mainly where several organisations that do not fully trust one another must all write to the same record and no single party is acceptable as its keeper.
Why we place it at the Reality Check stage
The broader blockchain hype wave of the early 2020s crashed hard; most surviving industrial pilots have quietly re-scoped toward narrower, centrally-verified ledger designs rather than public/decentralised blockchain. Estimated time to the Proven in Use stage: 5–10 yrs. What the stages mean.
Key risk
Very few of the ambitious 2019-2022 industrial blockchain pilots reached production use — treat any current vendor claim in this space with particular scrutiny.
Questions to ask before committing
- What does the ledger provide that digitally signed records in an ordinary shared database would not?
- How is each physical item reliably tied to its digital record?
- Who runs the ledger, who pays for it, and what happens to the records if a participant leaves?
Standards and terms to know
- Permissioned ledger
- A distributed ledger operated by a defined group of known participants.
- Provenance
- The documented origin and history of a component or piece of software.
- Tamper-evident
- Constructed so that any later change to a record can be detected.
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on public information as of October 2026, not engineering, safety or investment advice; see the Terms of Use.