Asset Management
Start an Asset and Service Inventory
Build and maintain an authoritative inventory of all hardware and software assets to enable effective risk management.
Content review: 2026-09-22 · Estimated effort: Medium
Priority and effort are editorial starting points, not calculated risk or mandatory deadlines. Adapt to business impact, vendor instructions, available licenses, and applicable obligations. Test changes before broad rollout.
Before you start
Before starting: assign an owner and a restricted shared location. Do not store passwords, recovery keys, or customer records in the inventory.
Put it into practice
- Start with a spreadsheet of devices, software, cloud services, key accounts, and external IT providers. Include off-network equipment and SaaS subscriptions.
- Record an owner, business purpose, support status, and importance for each item. Reuse purchasing and existing management exports before buying discovery tools.
- Update the inventory when people join or leave or services change. A monthly owner review is a starting cadence, not a universal requirement.
- Use discovery scans only with authorization and an agreed scope. Test settings before scanning fragile, operational, or third-party systems.
- Verify: compare a sample of actual devices, subscriptions, and active accounts against the inventory. Resolve missing owners and unsupported products.
Make a start
Tools and templates
Start with what you already have. “Included” means part of an existing eligible product or subscription, not a free standalone service. Options reviewed 2026-09-22; check current vendor terms before choosing.
Start without another software subscription
Use the free inventory template in your existing Excel installation. Reconcile it against devices and service records before buying discovery software.
Where this stops: The worksheet requires a named owner and repeat reviews. Automated discovery or device management may need additional software and administration.
See the official sources and eligibility details below. Free software can still require equipment, storage and staff time.
Microsoft Excel
Use Excel from your existing Microsoft Office license or Microsoft 365 subscription
Open the CSV worksheet in Excel. If columns or characters look incorrect, use Data > From Text/CSV and select comma as the separator and UTF-8 encoding. Replace the example row and save in a restricted folder.
Limits: A manual inventory, not automated discovery. CSV preserves text and values, not formatting or validation; save an Excel Workbook (.xlsx) copy to keep those features. Review imported identifiers and dates for unintended conversions.
Your information: Local files need no cloud upload. Cloud-synced folders and sharing choices can still transfer your completed records.
Official instructions: Microsoft Excel ↗Download a working template
Free to download and adapt for your team. Open CSV files in Microsoft Excel using your existing Office license; Markdown files open in a text editor such as Notepad. Save an Excel Workbook (.xlsx) copy if you add formatting. These are manual worksheets, with no macros, scoring or automatic verification.
- Asset and service inventory (CSV) ↓
Record an owner, purpose, support status and review date for each device, application or service. Replace the example row, then add your own entries.
Fictional worked example
Illustration only. This is not a customer story, lab result, or evidence that your environment is protected. Replace the example entries and record your own observations.
A small team finds a shared reception laptop missing from its device list.
Use the Asset and service inventory template.
What to enter before testing
- Asset or service ID
- EXAMPLE-LAPTOP-01
- Owner role
- Office manager
- Support status
- Unknown: check operating system and vendor support
- Open action
- IT owner to confirm device details and support status
How to verify
With permission, compare the device itself and its management record with the inventory. Confirm its owner, purpose and actual software version. Enter Last verified date only after that check.
If the result is unexpected
If the device is unmanaged or unsupported, record the gap and assign an owner and next action. Do not mark it supported merely because it turns on; agree remediation before disrupting a business device.
Save completed worksheets privately. They can describe security gaps, systems and people. Do not include passwords, recovery keys or confidential message content. This site does not receive your edits; a cloud editor or synced folder may send them to its provider.
Sources and review approach
Original small-team guidance with selected NIST CSF 2.0 alignments, not an official crosswalk or a complete framework implementation. These instructions are a starting point, not a claim of testing in your environment.
- NIST CSF 2.0: ID.AM-01, ID.AM-02, ID.AM-04: hardware, software, and supplier services