An IT asset inventory is one list of every device, account and service your business uses, with a named owner and a last-checked date against each entry. To build one, pull what you already know from your purchasing records, your identity directory and your bank statements, write each item into a single sheet with a fixed set of columns, assign an owner, then set a date to look again. A spreadsheet is enough to start and is easier to maintain than most people expect.
This article is general information about security administration and recordkeeping. It is not legal, compliance or security advice. Which frameworks and obligations apply to an organization varies by industry, size and jurisdiction, and those questions belong with a qualified professional who knows your situation.
What belongs in an IT asset inventory
Most people hear “asset inventory” and picture laptops. Devices are only one of four groups, and the other three are the ones that go missing from the record.
Physical devices. Laptops, desktops, phones and tablets that touch company data, plus network equipment, printers and any on-premises server hardware.
Accounts and identities. Staff accounts, shared accounts, service accounts used by software rather than people, and administrative accounts. Contractor and former-staff accounts belong here too, which is usually where the first surprises appear.
Software and subscriptions. Every paid or free service holding company or customer data, including the ones one person signed up for without telling anyone.
Data stores. Where files, records and backups actually sit. Not a tool name, but a location: this shared drive, that records system, these two backup destinations.
A record that covers devices only will look complete and still leave the accounts and subscriptions undocumented, which is the part that changes fastest.
What to record for each entry
Keep the columns few and fixed. A sheet with eight columns that are always filled in is more useful than one with twenty that are mostly blank.
| Column | What goes in it |
|---|---|
| Identifier | Serial number, asset tag, account name or subscription name |
| Type | Device, account, software or data store |
| Description | Plain language: “front desk laptop”, “shared billing login” |
| Owner | One named person accountable for this entry |
| User or users | Who actually uses it day to day |
| Location or host | Office, home, which service it lives in |
| Status | In use, spare, retired, pending return |
| Last checked | The date someone confirmed this row is still true |
Two of those columns carry most of the weight. The owner column must hold a person’s name rather than a department, because a department never answers an email. The last checked column is what turns the sheet from a document into a record, since it shows a reader that the entry has been confirmed rather than typed once.
Add a notes column for anything that does not fit, such as a device that is on loan or an account that exists only for a quarterly report. Resist adding more structure until the basic version is being maintained.
How to discover what you already have
You do not need to walk the building with a clipboard, though that step is worth doing once. Five existing records will produce most of your first draft.
- Purchase and expense records. Pull twelve months of card statements and supplier invoices. Every recurring charge is a subscription that belongs on the sheet, and every hardware purchase is a device somebody has.
- Your identity directory or email admin console. Export the full user list, including disabled and suspended accounts. Note which accounts hold administrative rights.
- Password manager or credential store. Whatever people have saved there is a working list of the services in genuine use, including ones nobody declared.
- Payroll and HR records. Compare current staff against the account list. Names in one and not the other are your first follow-up items.
- A short conversation with each person. Ask two questions: what devices do you use for work, and what services do you log into for work. Ten minutes per person fills the gaps the records miss.
Then do the physical walk. Check desks, drawers, the storage cupboard and the network cabinet. Spare and retired equipment counts, because an unlabeled laptop in a drawer with company data on it is still your responsibility to account for.
Labeling and tagging
Put a physical asset tag on everything you can, with a simple sequential number. The number goes in the identifier column alongside the serial. Serials are accurate but unreadable across a room, and the readable tag is what makes a stock check take minutes instead of an afternoon.
For accounts, adopt a naming convention and write it down: a prefix for service accounts, another for shared accounts, and the person’s name for individual ones. A convention applied consistently makes an unexplained account obvious at a glance.
How to assign ownership in the IT asset inventory
Ownership is where inventories usually fall apart, because the obvious answer is to put the owner’s manager or the owner’s department in the column and move on.
Two roles sit behind each entry and they are not the same. The owner is accountable for whether the entry is correct and whether the item is still needed. The user is whoever works with it. For a shared billing login, the owner might be the person who runs finance while four people are users. For a service account that runs nightly file transfers, the owner is the person who would notice and act if it stopped, and the user is a piece of software.
Service accounts need owners most and get them least, because no human logs into them and no one feels responsible. Make a rule that every service account has a named owner and a one-line note on what it does. An account nobody can explain is a documentation gap rather than anything more dramatic, and it is a gap you want closed on paper before anyone asks you about it.
Where an entry genuinely has no owner, write “unassigned” rather than guessing. A visible blank gets resolved; a wrong name never does.
Keeping the record current as people and equipment change
A list built once and never touched is worse than no list, because it reads as a maintained control when it is not. Tie updates to the events that actually cause change.
When someone joins. Add their accounts and devices before their first day, with their name as user and their manager as owner.
When someone changes roles. Review every row where they appear. Role changes add access and almost never remove it, so this is the moment to catch accumulation.
When someone leaves. Walk the inventory row by row for their name. Record the date each account was disabled and each device returned, in the notes column. This single habit answers most of the questions a customer or insurer will ask you later.
When equipment is bought, retired or lost. Add or update the row the same week. Retired does not mean deleted: change the status and keep the history, because the record of what you used to hold is sometimes the thing you need.
On a fixed cadence regardless. Quarterly, open the sheet, filter for rows whose last-checked date is more than ninety days old, and confirm them. Monthly works better for accounts specifically, since they change faster than hardware. Write the review date down even when nothing changed, because a dated review showing no change is still evidence of a review.
Keep superseded versions of the sheet rather than overwriting it. The history is what shows the process is real.
Making the inventory earn its keep
Once the sheet exists it becomes the source for almost every other piece of security administration you do. Your access reviews read from the account rows. Your update schedule reads from the device and software rows. Questionnaires from customers ask for counts you can now answer from one place instead of three guesses.
Start smaller than feels right. Fifty rows that are accurate and dated beat four hundred rows assembled in a weekend and abandoned. Add a column only when a missing column has actually cost you an answer.
If you want a structured way to see which parts of your asset and access records are thin before you start filling them in, work through the Free Cyber Security Scorecard page on this site and use the gaps it surfaces as your build order.