Cybersecurity Asset Management: Build Your First Inventory
Cybersecurity asset management is the practice of knowing every device, application, account and data store you are responsible for. This guide shows how to build a first inventory in a week.
Key Takeaways
- Inventory comes first. CIS places enterprise assets as Control 1 and software assets as Control 2 for a reason: every other control depends on knowing what exists.
- Count software and cloud services, not only laptops. Shadow IT is usually the largest gap.
- A first inventory can be built in about a week from sources you already have, then kept current by automated discovery.
- Manage the whole lifecycle, including secure disposal and data wiping, not just purchase and set-up.
- Assign an owner to every asset. An unowned asset is an unpatched one.
Cybersecurity asset management is the process of identifying, recording and maintaining a current list of everything your organisation relies on that could be attacked: laptops, servers, phones, network equipment, software, cloud services, accounts and the data they hold. Each item has an owner, a purpose and a status, and the list is kept up to date as things change.
It sounds like admin, but it is the base for nearly every other control. You cannot patch a server you have forgotten, remove access from a device nobody tracks or answer an insurer's questionnaire accurately without a reliable list.
This article covers what to record, how to find what you do not know about, how to handle the full lifecycle and how to build a first inventory in a week. Our managed IT support service maintains inventories as part of day-to-day management if you would rather not run it in-house.
What counts as an asset
Many first inventories stop at laptops and miss most of the real exposure. Cast the net wider.
- Hardware: laptops, desktops, servers, phones, tablets, printers, firewalls, switches, access points and any smart or connected devices on your network.
- Software: operating systems, applications, browser extensions and licences, including versions.
- Cloud services and SaaS: Microsoft 365 tenants, line-of-business web apps, file-sharing and marketing tools.
- Identities: staff accounts, shared mailboxes, service accounts and admin roles.
- Data: where sensitive information such as customer records and financial files is stored.
For each item, record at minimum an owner, location or tenant, purpose, version or model, support status and the date it was last confirmed.
↑ Back to ContentsCIS Controls 1 and 2: the benchmark for inventory
The Center for Internet Security lists Control 1 as Inventory and Control of Enterprise Assets and Control 2 as Inventory and Control of Software Assets. The current version, as at October 2026, is CIS Controls v8.1, and the full list is on the CIS Controls list. CIS also advises every organisation to start with Implementation Group 1, its entry-level baseline of essential cyber hygiene.
In practice these two controls mean three things: know what hardware is connected, know what software is installed, and have a way to deal with unauthorised items by removing them, blocking them or recording an approved exception. Placing them first reflects a simple dependency. Patching, malware protection and access control all depend on a trustworthy list.
↑ Back to ContentsFinding what you do not know about
Spreadsheets drift out of date within weeks. Automated discovery gives you a living picture, and it helps to combine several sources.
- Device management: endpoint management such as Intune reports enrolled devices and installed software. See our explainer on Intune and MDM.
- Remote monitoring and management (RMM): agents on devices report hardware, software and patch state back to a central console.
- Network scanning: finds devices that have no agent, such as printers, cameras and visitors' laptops.
- Identity directory: your sign-in system lists users, devices registered to them and applications granted access.
- Finance records: card statements and purchase ledgers reveal subscriptions the IT team never saw.
Each source has blind spots, so no single one is enough. Where these sources disagree, you have found something worth investigating.
Tool categories to consider
| Category | What it gives you | Good fit |
|---|---|---|
| Endpoint management (MDM) | Device enrolment, configuration, compliance state | Businesses using Microsoft 365 |
| RMM | Hardware and software inventory, patching, alerts | Mixed estates and managed providers |
| Network discovery | Finds unmanaged and unknown devices | Offices with printers, IoT and guests |
| CMDB or asset register | Relationships between assets, owners, lifecycle records | Larger or regulated organisations |
| SaaS discovery | Surfaces unapproved cloud applications | Organisations with shadow IT concerns |
A well-kept spreadsheet is acceptable at the start, as long as it has an owner and a reconcile date. Move to a tool when it stops being accurate. A cyber security audit will also test whether your inventory matches reality.
↑ Back to ContentsSoftware and licence inventory
A software inventory serves two purposes: security and cost. For security, it shows which products and versions are running so you can see what is out of support or missing updates. For cost, it shows which licences are used, which are idle and which are missing.
Record the product, version, vendor, number of installs, licence type, renewal date and the person responsible. Flag anything that no longer receives security updates. The end of support for an operating system is a clear example; our guide to the Windows 10 end of life and the ESU programme shows how that affects planning.
Licence data also supports audits. Being able to show what you own and where it is installed reduces the stress of a vendor review.
↑ Back to ContentsShadow IT: the assets nobody approved
Shadow IT is any service, device or application used for work without IT knowing. A team signs up for a free file-sharing tool or a project board, staff forward documents to personal email, or someone connects a personal device to the office wifi. The intent is usually to get work done, not to cause harm, but the result is company data in places you do not control.
Approach it as a visibility problem, not a disciplinary one.
- Review sign-in logs and application consent lists for services staff have connected.
- Check expense and card statements for software subscriptions.
- Ask each team what tools they use and why, then add the useful ones to the approved list.
- Publish a simple route for requesting new tools, so staff do not need to work around you.
The asset lifecycle, from onboarding to disposal
An asset record should change with the item. Define what happens at each stage.
- Procurement and approval: buy from known suppliers and log the purchase.
- Onboarding: apply a standard build, enrol in management, enable encryption and record the owner.
- In service: patch, monitor and review ownership when staff change roles.
- Reassignment or return: reset or rebuild the device and remove the previous user's access.
- End of life: retire items that no longer receive security updates, or isolate them with a documented reason.
- Disposal: securely erase data and keep a certificate or record. Do not rely on a simple delete or factory reset without confirming it suits the storage type, and remove the device from management and from the inventory.
Give each stage an owner and a checklist, so the handover from IT to HR to finance does not depend on anyone's memory. The disposal step is where many organisations lose control of data. Include phones, printers with hard drives and old servers, not only laptops.
Update the record, not just the device
An asset that has been wiped and sold but still appears as active in your inventory causes confusion in audits and incident response. Close the record when the asset leaves.
How asset management supports Cyber Essentials
Cyber Essentials is the UK government-backed baseline, and the NCSC describes five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC Cyber Essentials overview also notes that the free cyber insurance linked to certification requires cover for the whole organisation.
Each of those controls applies to specific devices, software and accounts, so an accurate inventory is how you define what is in scope and prove each item is covered. Applicants who have no reliable list often discover unsupported software or forgotten devices part-way through the assessment. Our Cyber Essentials requirements checklist shows what to prepare, and our Cyber Essentials service page explains how we support certification.
↑ Back to ContentsHow to build a first inventory in a week
This plan suits a business with up to a few hundred devices. Larger estates need more time, but the order still applies.
- Day 1, set scope and fields. Decide what you will record and who owns the list.
- Day 2, export what you already have. Pull device lists from your management console, directory and antivirus or EDR tool, and merge them into one sheet.
- Day 3, scan the network. Identify devices without agents and match them to the list.
- Day 4, list software and SaaS. Use installed software reports, application consent lists and card statements.
- Day 5, assign owners and flag risks. Mark unsupported software, unmanaged devices and unowned accounts.
- Weekend or Day 6, agree actions. Prioritise removals, enrolments and upgrades.
- Day 7, set the routine. Schedule a monthly reconcile and make discovery tools the source of truth.
Conclusion: cybersecurity asset management is where good security starts
Cybersecurity asset management gives you the list that every other control depends on. Start with hardware, software, cloud services and accounts, find the unknowns through several sources, assign owners, manage each asset through to secure disposal and reconcile regularly. A first useful inventory is achievable in about a week, and it will make Cyber Essentials, audits and incident response easier. Check the current CIS Controls and NCSC guidance as at October 2026 when you formalise your approach.
If you would like help building or maintaining yours, get in touch with NetMonkeys.
↑ Back to ContentsFrequently Asked Questions (FAQs)
What is cybersecurity asset management?
Cybersecurity asset management is the practice of keeping an accurate, current list of the devices, software, cloud services, accounts and data your organisation relies on, each with an owner and status. It lets you patch, monitor, restrict and retire assets properly, because you cannot protect something you do not know exists.
What are CIS Controls 1 and 2?
In CIS Controls v8.1, Control 1 is Inventory and Control of Enterprise Assets and Control 2 is Inventory and Control of Software Assets. They cover knowing which hardware and software exist and dealing with unauthorised items. CIS places them first because later controls such as patching and access management depend on accurate inventories, and CIS recommends starting with Implementation Group 1.
How do I find shadow IT in my business?
Combine several sources. Review sign-in and application consent logs, check card statements and expenses for subscriptions, scan the network for unmanaged devices and ask teams which tools they use. Then offer an easy approval route so useful tools are brought under management instead of being hidden.
How does asset management relate to Cyber Essentials?
Cyber Essentials covers five technical controls across your devices, software and accounts. An accurate inventory is how you define scope and confirm each item meets the requirements. Without one, unsupported software or unmanaged devices often come to light during assessment, which can delay certification and cost extra time.
Do I need a CMDB, or is a spreadsheet enough?
A spreadsheet can work for a small organisation if it has a named owner, agreed fields and a regular reconcile against discovery tools. Move to a CMDB or dedicated tool when the sheet becomes inaccurate, when you need to track relationships between assets, or when auditors or customers expect more detail than a sheet can give.
How should we dispose of old IT equipment securely?
Remove the device from management, securely erase the storage using a method suited to the device type, keep a record or certificate of erasure, and close its inventory entry. Include phones, printers and servers as well as laptops. If you use a disposal provider, ask how they erase data and what evidence they give you.
Speak to a NetMonkeys specialist
Practical, plain-English IT advice for UK businesses, from our Manchester headquarters and our teams in London and Nottingham.
Book a conversation
