control
asset inventory
A list of the systems, devices, applications and data stores the company runs, each with an owner. Every other control starts from it, because nobody can protect, patch or recover what is not on the list.
- what it protects
- every other control, since nothing unlisted gets patched, backed up or recovered
- who owns it
- head of IT
- start with
- the services the business cannot run without, then widen
what it is
An asset inventory is a list of what the company runs: servers, laptops, network devices, applications, cloud services and the places where data is stored. Each line has an owner and says what the business uses it for.
NIS2 names asset management among the measures. DORA asks financial entities to identify and document their assets and the functions that depend on them. The implementing regulation for listed digital providers asks for an inventory. GDPR asks for a record of processing, which is a list of its own, and the two work best when they agree.
Start with the services the business cannot run without and list what sits behind each. Then widen it. The first version will be wrong in places, and that is fine if someone owns it and a date is set for the next check.
basis NIS2 Art. 21(2)(i); DORA Art. 8(1). The method and the order are practice.
how an asset list stays true
- 1findscan the network, the cloud accounts and the identity provider's app list
- 2comparematch what was found with accounts payable and with the list itself
- 3assignevery row gets an owner, a business function and a criticality
- 4feedpatching, backup and access reviews read from this one list
the next check, on a date someone owns
basis working practice. No legal text sets this.
an example
Picture a company of 120 people with a spreadsheet of laptops and servers.
The sheet was built for an audit and has no owners. Cloud subscriptions bought with a card are missing. When a supplier announces a flaw in a tool, nobody can say whether the company runs it.
One list holds servers, cloud services and data stores, each with an owner and a function. It is compared with accounts payable and the app list twice a year. A blank owner is treated as a defect and fixed within the quarter.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(i) | Human resources security, access control policies and asset management. | Keep a list of systems with an owner for each, and update it when something is bought, retired or changes hands. |
| IR 2024/2690 | IR 2024/2690 Annex 12.4 | Listed digital providers: an asset inventory. | Record each asset with its owner and how critical it is, so other controls can be sized by that. |
| DORA | DORA Art. 8(1) | Identify and document functions, assets and dependencies, reviewed at least yearly. | Link each asset to the business function that depends on it, and review the list at least once a year. |
| GDPR | GDPR Art. 30(1) | A record of processing activities. | Mark which assets hold personal data, so the record of processing and the asset list agree. |
basis NIS2 Art. 21(2)(i); IR 2024/2690 Annex 12.4 as a reference; DORA Art. 8(1); GDPR Art. 30(1). What the control has to do is practice.
what to look for when you choose
- Does it find assets on its own, or does someone type them in? A list that depends on typing is out of date within weeks.
- Does it cover what employees run themselves: cloud accounts, subscriptions bought with a card, personal devices used for work?
- Can each asset carry an owner, a business function, a criticality and a flag for personal data?
- Does it show relationships, such as which application runs on which server and which supplier hosts it?
- Can it export the whole list, with its history, in a form an auditor can read?
- Does it flag assets with no owner, assets nobody has seen for a long time and assets past support?
- Can other tools read from it, so the patching, backup and access review lists start from one source?
- Who can change an entry, and is every change logged?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
List the services the business cannot run without and what sits behind each. Give every row an owner.
- solid
Add cloud services and subscriptions, compare the list with accounts payable and the app list, and flag personal data on each row.
- strong
Let discovery tools feed the list, link assets to business functions and suppliers, and let patching, backup and access reviews read from it.
basis working practice. No legal text sets this.
where it goes wrong
a spreadsheet built once
A list made for an audit and never updated starts to drift on the day it is saved. Give it an owner and a refresh date.
hardware only
Cloud services, software subscriptions and data stores hold most of the value now. A list of laptops and servers misses them.
no owner on the row
An asset without a named owner has nobody who decides what happens when it fails. Treat a blank owner as a defect.
shadow assets stay hidden
Anything bought outside procurement is missing from the list. Compare it with accounts payable and the identity provider's app list.
one list for security and another for the record of processing
Two lists that disagree answer neither question. Keep one list and add a flag for personal data.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| asset list with owner, function and criticality for each entry | head of IT | twice a year |
| reconciliation against accounts payable and the identity provider's app list | head of IT | twice a year |
| list of assets with no owner and what was done about them | head of IT | quarterly |
| record of the yearly review, with the date and who signed it off | head of IT | yearly |
basis practice. The rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
your next step
Export the accounts payable list and the identity provider's app list, and count the services that are not on your asset list.