Home Compliance & Certification Asset Inventory List Guide

Asset Inventory List Guide

Last updated on Sep 23, 2025

1. Purpose of this Guide

This artefact shows your company has a complete and accurate inventory of IT assets — devices, systems, and accounts. Most cyber compliance standards require this because you can’t secure what you don’t know exists. An Asset Inventory makes sure no laptops, servers, or cloud accounts slip under the radar.

2. What You Will Submit

You will need:

  • Your Asset Inventory List document or spreadsheet.

  • It should capture details such as:

    • Asset name (device, account, or system).

    • Owner/assigned user.

    • Department / role.

    • Asset type (laptop, phone, server, software licence, cloud account).

    • System or service linked to the asset.

    • Approval / assigned by.

    • Date created or assigned.

    • Last used / last logon date.

    • Status (active, inactive, decommissioned).

    • Remarks (e.g. “required for role,” “shared account,” “spare laptop”).

3. How to Collect / Obtain / Generate This Evidence

  • If you already track assets using a tool:

    • Export your inventory from your IT management system (e.g. Intune, Jamf, Google Admin, AWS Console) into Excel/PDF.

  • If you wish to track assets using a template:

    1. Use the StrongKeep template, or create a new spreadsheet.

    2. List all devices (laptops, desktops, servers, mobile phones, tablets).

    3. Add all cloud systems or major SaaS accounts (e.g. Microsoft 365, Google Workspace, AWS, GitHub).

    4. Fill in the key details listed above.

    5. Update the file regularly — especially when new assets are bought or staff leave.

4. Evidence Format

  • Accepted file types: XLSX, CSV, or PDF.

  • Suggested naming format:
    YourCompanyName_AssetInventory_YYYY-MM-DD.xlsx

5. What “Good” Looks Like

  • Covers all major asset categories (devices, software, cloud).

  • Shows ownership/accountability (each asset tied to a person/role).

  • Status field clearly marks assets as active/inactive/retired.

  • Regularly updated with last activity dates (not just a one-off snapshot).

Why it matters: auditors want confidence you know exactly what tech you own and use — no forgotten laptops or abandoned accounts floating about.

6. Tips

  • Keep shared assets to a minimum and note the justification.

  • Tag decommissioned assets clearly — don’t just delete them.

  • Review your inventory quarterly to keep it sharp and up to date.