When the equipment spreadsheet is no longer enough: an IT asset register

Many companies start by tracking equipment in a spreadsheet. With one or two sites and a team that knows each other, it works. As the company grows, devices move between sites and people, and the spreadsheet is updated by different people whenever they remember.

The symptoms are familiar. It is unclear where a device is or who is responsible for it. A physical inventory can take days. Warranties expire unnoticed, there is no repair history, and when people leave, equipment and access are returned from memory.

Information security frameworks start from the question of what you have. A device or an access right you do not know about cannot be reliably protected. That is why an asset inventory is the first of the CIS Controls and part of the ISO 27001 standard. The register is the foundation that antivirus, monitoring and policies build on.

A former employee with active access. If nobody recorded what a person received when they joined, their email, cloud services and shared folders can stay open after they leave, sometimes for months.

A lost or stolen device. Without a register you do not know what data is on it, whether it is encrypted, and whether it can be locked and wiped remotely.

Devices without updates. A register linked to the device management system shows which computers and phones have fallen behind on security updates.

The NIS2 Directive lists asset management among the risk-management measures that organisations in scope must apply. Even a company outside its scope may have clients that are in it, and they can require the same from their suppliers.

Lost equipment is the visible cost. A laptop nobody returned, or a monitor bought a second time because the first cannot be found.

Without warranty data, the company pays for repairs on devices that are still under warranty.

A working register starts from the lifecycle of every device: delivery and receipt, assignment to a site and a person, maintenance and repair, transfer and, finally, retirement, when the data is securely erased and the erasure is recorded. Each stage is a status in the register.

Each device has an asset number or tag, and every operation on it is recorded: who, when and what. The register is updated at the moment of the operation, so it stays close to reality. Part of the data can come automatically from device management (MDM) and network discovery tools, but handing devices over and taking them back remain part of the process.

This shows holdings by site and by person, warranties with their expiry dates, and the repair history of every device.

IT assets are more than devices. Software licences and cloud subscriptions are paid every month and often stay active for people who no longer work at the company. A register that includes them shows licences still assigned to people who have left, and cancelling them is a direct and quickly visible saving.

Add to that accounts with administrator rights, mobile numbers and SIM cards, domains and certificates. Domains and certificates expire on a fixed date and stop services if they are not renewed automatically and nobody tracks the deadlines. Personal devices that staff use to access company email should also be known, even though the company does not own them.

The same approach can also cover other equipment, such as tools or company phones, when the business needs it.

The biggest benefit comes from linking the register to the processes for people, known as Joiner-Mover-Leaver. When someone joins, equipment is assigned in the register before they receive accounts and access.

When they change role or site, devices are transferred. When they leave, devices are returned and recorded, and access is revoked from the same list. As people change, it becomes much less likely that equipment is left without an owner or that access stays active without a need.

For most companies an off-the-shelf product is the better start. There are several kinds: open-source asset registers installed on your own server, tools that discover devices and software on the network automatically, service desk systems with an asset module, and device management systems, which supply the data on updates and encryption.

An own system makes sense when the process is very specific or the register has to be closely tied to other internal systems. Even then, it is often cheaper to extend an existing product with integrations than to build from scratch.

The choice depends on the number of devices, the systems that need to be connected (email, accounting, a service desk) and who will maintain the solution. A good analysis compares the options with real figures, including the costs for the years ahead.

Decide who is responsible for the register. Without an owner, even the best system falls behind.

Run one complete inventory with tags, together with a list of licences and subscriptions. It is the starting point.

Link the register to joiners and leavers. That is where equipment and access are most often lost.

Check the register against reality once a quarter, site by site.