An IT inventory is more than a table of computer brands and serial numbers. When a service stops, it should reveal the affected asset, the person responsible for decisions and the business activity that must wait. Start with the assets supporting critical workflows.
1. Cover physical and virtual assets
Include workstations, servers, VMs, network devices, printers, NAS systems and business cloud services. Give each record a unique identifier, location, owner, business purpose and last verification date. Network addresses can change, so avoid using them as the only identity. Computers supporting production equipment or cameras should appear as part of the relevant service. Explicitly name any areas outside the inventory's scope.
- Use identity, location, business owner, technical owner and status fields.
2. Link software and service dependencies
Record operating systems, application versions, maintenance records and where licensing evidence is held. Keep product keys and administrator passwords out of the inventory. Showing which database, shared folder or external service an ERP depends on can be more useful than a device count. Management tools can supply inventory data, but check report scope and freshness before treating it as complete.
- Connect each critical service to its dependencies and backup record.
3. Make the inventory part of routine decisions
Assign someone to update records after purchases, staff changes, software migrations and retirement. CISA identifies a maintained asset inventory as a foundation for security preparedness. The business can also review records regularly to identify unowned devices, unverified backups and maintenance needs. One access-controlled working record is easier to maintain than conflicting lists kept by different people.
- Refresh record ownership and verification dates during each review.
Official technical sources
- CISA — Cybersecurity Performance Goals 2.0, Manage Organizational Assets
- Microsoft Learn — Discovered apps in Microsoft Intune
- Microsoft Learn — View device details in Microsoft Intune
This is general information. Version- and environment-specific work needs an authorised technical assessment.