IT Asset Inventory: A Starter Playbook for Mid-Market Owners and Operators

IT Asset Inventory: A Starter Playbook for Mid-Market Owners and Operators

2026-10-21

The takeaway: An IT asset inventory is the least glamorous security control and the one everything else depends on. You can’t patch, back up, insure, or retire what you don’t know you have. Start with a simple list of devices and software, give every row an owner, deal with unknown devices weekly, and flag anything the vendor no longer supports.

Why the boring list comes first

The Cybersecurity and Infrastructure Security Agency (CISA) put it plainly in an October 3, 2022 directive to federal civilian agencies: “Continuous and comprehensive asset visibility is a basic pre-condition for any organization to effectively manage cybersecurity risk” (CISA BOD 23-01).

The directive binds only federal agencies, but the same idea runs through guidance written for everyone. Inventory is Control 1 (hardware) and Control 2 (software) of the Center for Internet Security’s CIS Critical Security Controls v8.1 (CIS Control 1, CIS Control 2). Subcategories ID.AM-01 and ID.AM-02 of the NIST Cybersecurity Framework 2.0, published February 26, 2024, call for maintained inventories of hardware, software, services, and systems (NIST CSWP 29). And CISA’s Cross-Sector Cybersecurity Performance Goals 2.0, dated December 2025, rate goal 2.A, “Manage Organizational Assets,” as low cost and high impact, with moderate ease of implementation (CISA CPG 2.0).

Low cost, high impact. That’s a rare combination in security.

Step 1: Decide what counts

CIS Safeguard 1.1 covers every asset that can “store or process data”: laptops and phones, network gear, servers, Internet of Things (IoT) devices like cameras and smart TVs, and assets in the cloud. It also covers devices “regularly connected” to your network “even if they are not under control of the enterprise,” such as a personal phone on the office Wi-Fi (CIS Controls Navigator v8.1).

CISA’s version is broader still: data, hardware, software, systems, facilities, and personnel (CPG 2.0). Start with devices and software. Add the rest once the habit sticks.

Step 2: Capture a few fields, not fifty

For each device, CIS asks for the network address (if fixed), hardware address, machine name, owner, department, and whether it’s approved to connect. For each piece of software, Safeguard 2.1 asks for the title, publisher, install date, and business purpose (CIS Navigator).

The field that matters most for an operator is owner. A device with no owner never gets patched, and a subscription with no owner never gets canceled.

Step 3: Build it from systems you already pay for

You probably don’t need a new tool on day one. Pull lists from:

  • Your device management or endpoint security console
  • Your router or firewall’s list of connected devices (CIS Safeguard 1.4 suggests DHCP logs, the record of which devices got a network address)
  • Your cloud provider consoles
  • Accounts payable and company card statements, which tend to surface software subscriptions nobody told IT about

Then reconcile. Anything that shows up in one list and not another is a question worth asking.

Step 4: Deal with unknowns on a schedule

CIS Safeguard 1.2 says to address unauthorized devices “on a weekly basis” by removing them, blocking remote access, or quarantining them. For software, Safeguard 2.3 says unauthorized software is removed or gets a documented exception, reviewed monthly (CIS Navigator).

The point isn’t to play network police. It’s that an unknown device is either harmless and should be listed, or not harmless and should be gone.

Step 5: Flag what the vendor no longer supports

Safeguard 2.2 says only currently supported software should be authorized. If you must keep something unsupported, document an exception “detailing mitigating controls and residual risk acceptance,” and check support status at least monthly (CIS Navigator).

This is where inventory pays off fast. In a February 5, 2026 directive, CISA ordered federal agencies to deal with end-of-support devices on the edge of their networks, like firewalls and routers. It said such devices no longer receive vendor updates, and that agencies should “identify hardware and software nearing their EOS dates” and plan replacements (CISA BOD 26-02). You can’t do that without a list with dates on it.

Step 6: Set a review rhythm

CIS calls for reviewing and updating the full device inventory “bi-annually, or more frequently” (CIS Navigator). CISA adds that IT and operational technology assets “critical for business or operational functions” should be updated more often (CPG 2.0). For comparison, BOD 23-01 required federal civilian agencies to run automated asset discovery every 7 days starting April 3, 2023 (CISA BOD 23-01). That’s a federal benchmark, not your legal requirement, but it shows how often the pros look.

CIS Safeguards 1.1, 1.2, 2.1, 2.2, and 2.3 all sit in Implementation Group 1, which CIS defines as “essential cyber hygiene” that every enterprise should start with (CIS Implementation Groups).

Five questions for your IT lead or provider

  1. How many laptops, servers, and network devices do we have, and where’s the list?
  2. Who owns each one?
  3. What happens when an unknown device joins our network?
  4. Which of our systems are past end of support?
  5. When was the list last reviewed?

Where outside help fits

An inventory of systems, licenses, and contracts with owners and renewal dates is a standard Yellow Coop deliverable, alongside risk-based patching priorities and cyber insurance application support with a control gap list (what we do). We do it as virtual advisory hours or fractional leadership at 1 to 4 days a week (how we engage). If nobody can answer question one, book a call.

Sources