What should an IT asset register include?

The question usually arrives sideways. An insurer's renewal form asks how many devices you have. A customer sends a supplier questionnaire. Microsoft announces a flaw in something and a director asks, reasonably, whether it affects us. And the honest answer, in a lot of small offices, is that somebody will have to walk round and count.

That is when people search for what an IT asset register should include. The short answer is more than a list of laptops, and less than the forty-column templates that get downloaded, half filled in and never opened again.

What the register is for

The NCSC puts it better than most vendors do. Its asset management guidance says the job is not making lists or databases that never get used. It is keeping information about your assets that is accurate enough to act on when you need it most.

That last part is the test. A register earns its keep on three kinds of morning. The morning a vulnerability is announced and you need to know in ten minutes which machines run the affected version. The morning a laptop is stolen from a car and you need to know whether it was encrypted and what was on it. And the morning somebody asks what the business will need to spend on hardware next year.

It also sits underneath almost everything else in IT security. The NCSC's Cyber Essentials requirements, version 3.3 from April 2026, say asset management isn't a specific control in the scheme, but that effective asset management can help meet all five. You cannot patch a machine you have forgotten about.

The columns that earn their place

Every column should answer a question somebody will actually ask. If nobody will ever ask it, leave the column out. For computers, phones and tablets, these are the ones that do:

• Name and type. The name the device shows on the network, and whether it is a laptop, desktop, phone, tablet or server.
• Make, model and serial number. The serial is what the manufacturer's warranty desk, the insurer and the police all ask for.
• Who uses it, and where. A named person, and whether it lives in the office or goes home.
• Bought when, from whom, for how much. This is what turns replacement into a budget line.
• Warranty end date. The date, not "3 years".
• Operating system and exact version. More on this below, because it is the column that gets filled in wrong.
• Encrypted or not. For a lost laptop, this single field decides how bad the week is.
• Vendor support end date. When the security fixes stop.
• Last seen. When the machine last checked in. A date three months old means a laptop in a drawer, or one that has left with somebody.
• Status. In use, spare, awaiting repair, retired.

The NCSC's 10 Steps guidance adds one more for each asset: who is responsible for it and what it is used for. On a small register those are usually the same person as the user. On a server they almost never are.

Why "Windows 11" is not an answer

Most home-made registers have an operating system column that says Windows 11 on every row. That tells you almost nothing.

Microsoft supports each yearly version of Windows 11 for a fixed period, not the product as a whole. Its lifecycle page for Windows 11 Home and Pro gives version 24H2 an end date of 13 October 2026, which is less than three weeks away as this is written. Version 25H2 runs to 13 October 2027. Two laptops bought in the same month, both honestly described as Windows 11, can sit either side of that line if one of them has been quietly refusing its feature update since the spring.

Cyber Essentials is strict about this. Every piece of software on an in-scope device has to be licensed and supported, and the requirements define supported as a vendor committing to regular vulnerability fixes and publishing the future date when they will stop. Unsupported software has to be removed, or the device taken out of scope behind a sub-set with no internet traffic in either direction. So the register needs the version number and the date that goes with it. The NCSC's vulnerability management guidance says the same from the other side: when you find products that are obsolete or on extended support, mark them as such.

We made the same point about servers in the Windows Server 2016 article, where the date is 12 January 2027. A register with dates in it is how you see those coming from a year out rather than a week.

The assets that are not laptops

This is where most registers fall short, and it is the part that tends to hurt.

Start with the network. The router, the firewall, any switches and the Wi-Fi access points all run firmware, and the Cyber Essentials requirements count firewall and router firmware as software. They need a model, a firmware version and a support date like anything else. We wrote about the box in the comms cupboard in the firewall article, and the register is where its end-of-support date belongs. If the business gave a home worker a router, that router is in scope as well. Printers and cameras go on too, because they sit on the same network and nobody patches them.

Then phones. A personal phone that opens work email is in scope for Cyber Essentials. One used only for calls, texts or an authenticator app is not. You don't need a serial number for somebody's own handset, but you do need to know it exists and which version of iOS or Android it runs.

Then the things you can't touch. The NCSC's guidance says a complete register covers the organisation's internet presence: domain name registrations, social media accounts, IP address ranges and digital certificates. Cyber Essentials says cloud services cannot be excluded from scope. For each, write down who it is with, whose name and card it sits on, the login that controls it, and the renewal date. The domain is the one that bites. It lapses on a personal card belonging to someone who left in 2023, and your email stops. We covered who should hold it in who actually owns your business website.

Last, suppliers. The 10 Steps guidance asks you to keep a list of suppliers and what assets they hold for you, with contact details you can reach during an incident. The accountant with your payroll data, the company hosting the booking system, the IT firm with admin rights to everything. That includes us, for our clients.

Software and licences

Hardware is the easy half. Software is where registers usually stop.

The NCSC makes the case plainly: knowing the version of every piece of software installed finds far more vulnerabilities than knowing the operating system alone. A small business does not need to catalogue every browser extension by hand. It does need to know which machines run the accounts package, the CAD software or anything else a vendor has to support, and which version, because those are the ones that hold up a Windows upgrade.

Licences belong alongside. Seats bought, seats used, renewal date, who it is billed to. We went through the Microsoft 365 side of that in the unused licences article. It is often the column that pays for the register, because a seat for somebody who left keeps billing until a person notices.

Spreadsheet or tool?

Both, usually.

The NCSC is relaxed about manual entry where you only have a handful of assets, provided somebody reviews it. A five-person office can run a perfectly good register in a spreadsheet. Past fifteen or so devices, a hand-kept list starts to drift, and it drifts quietly, which is worse than drifting loudly.

A device management tool fixes the technical columns. Microsoft Intune, for example, records the serial number, operating system version and installed apps for every enrolled device, and Microsoft's documentation says its hardware and software inventory refreshes every seven days from enrolment. What it can't know is what the laptop cost, when the warranty ends, or that it is the spare in the bottom drawer. Those columns still come from a person with the invoice in front of them.

One thing people forget. The register is a map of your business for anybody who wants to attack it. The NCSC's guidance says to restrict access to asset data, let staff look up what they are responsible for, and prevent bulk queries. A spreadsheet sitting in a shared folder that the whole company and two contractors can open is not that.

Finding the devices nobody listed

Almost every register is missing something. That is not a criticism of whoever kept it. It is what happens when a list depends on people remembering to update it.

The NCSC suggests a few ways to catch the gaps. Reconcile procurement records and cloud billing against the register, since anything bought but not listed is a gap. Look for stale records that have not been seen for weeks. And try the test in its guidance: if somebody plugged a new laptop into your network today, would you know?

A network sweep answers that. Some tools do it from the machines already enrolled. Microsoft's device discovery in Defender for Endpoint Plan 2, for instance, uses onboarded computers to find unmanaged endpoints, routers, switches, printers and cameras, probing each unmanaged device typically no more than once every three weeks. On our own audits we sweep the network and list every device on it. That list alone tends to produce a surprise or two.

It is also question three on our free IT health check: could you list, right now, every device that connects to your network? Most people answer "not sure", which is honest.

Keeping it from going stale

A register is accurate on the day it is finished and slightly wrong every day after. The fix is to tie updates to the moments things change, rather than to a yearly tidy-up.

A machine goes on the register the day it arrives. The NCSC calls this registration before use, and it is the only day the serial number, invoice and warranty are all in front of you at once. We covered that moment in the new starter checklist. When somebody leaves, the register tells you which laptop to collect and which accounts are in their name, which is the offboarding half. When a machine is retired, it gets marked as wiped, with the date and who did it, as set out in disposing of old business computers.

Then once a month, somebody reads down the last-seen column and the version column. It takes twenty minutes on a small register. Those twenty minutes are where most of the value is.

What it costs with us

An asset register and documentation are part of every managed IT plan, starting with Essential at £50 per user per month and carried into Professional at £77 and Complete at £108. It is kept in our client portal, where every managed machine shows its specification, its age and its warranty position, updated automatically. Managed network devices are £34 each per month and servers £162 each, and those put the firewall and the server on the same register as the laptops. The register is yours. If you leave us, you take it with you.

If you only want one built, it is hourly work: £126 an hour without an agreement, £86 an hour on a plan, and £167 an hour out of hours with a two-hour minimum. Ask for an estimate first. A ten-person office with one site is a short job. Three sites, a pile of home workers and a comms cupboard nobody has opened since the last provider left is not. Replacement hardware, when the register says it is due, is supplied at cost plus 20%. All prices are on the pricing page and exclude VAT.

What we will not do is tell you a register makes you compliant with anything. It helps with Cyber Essentials and nearly everything else, but we don't hold Cyber Essentials ourselves and only a certification body licensed by IASME can certify you.

Where to start this week

Open a spreadsheet and give it the ten columns above. Fill in the laptops first, because you know where they are. On each Windows machine run winver and write down the version, not just the number 11. Then add the router, the printers, the domain name and the Microsoft 365 tenant, with the renewal date and whose card pays for each. Put your own name at the top as the owner.

It will be incomplete. The point of the first version is to find out how.