Why every compliance programme starts with an asset inventory

You cannot protect, patch, classify, back up or decommission what you have not recorded. Every framework - ISO 27001, the NCA ECC, SAMA CSF, PCI DSS, SOC 2 - requires an asset inventory, because almost every other control depends on it. It is also the control most often found incomplete, which is why experienced auditors test it early: a weak inventory predicts weakness everywhere else.

What counts as an asset

Broader than most first attempts assume:

• Hardware - servers, laptops, mobile devices, network equipment, and anything in an operational technology environment.
• Software and services - applications, SaaS subscriptions, libraries and dependencies.
• Cloud resources - accounts, subscriptions, compute, storage, managed databases.
• Data assets - databases and repositories, with their classification.
• Identities - including service accounts and API keys, which are assets in every meaningful sense.
• Suppliers holding your data or connected to your systems.

The fields that make it useful

A list of hostnames is not an inventory. For each asset record:

• Owner - a named person, not a team.
• Business purpose - what breaks if it stops.
• Classification of the data it holds or processes.
• Criticality, which drives recovery objectives.
• Location - physical site, cloud region, or provider.
• Lifecycle state - in use, being decommissioned, retired.
• Dependencies - what it relies on and what relies on it.
• Last verified date - the field that tells you whether to trust the row.

Ownership is the field that makes the inventory operational. Without a named owner, every downstream control - patching, access review, recovery testing - has nobody to assign it to.

Finding what you do not know about

The assets that hurt you are the ones nobody listed. Cross-reference several sources rather than trusting one:

• Cloud provider APIs - every account and region, not just the main one.
• Identity provider application lists - the fastest route to unknown SaaS.
• Expense and procurement records - shadow IT is usually visible on a card statement before it is visible to IT.
• Network discovery and endpoint management.
• DNS and certificate inventories for forgotten public-facing services.

Keeping it current

Inventories decay from the day they are built. Sustainable approaches share three traits:

1. Automated discovery as the default source, with manual entry as the exception.
2. Provisioning integration - assets register themselves when created, rather than depending on someone remembering.
3. Periodic owner attestation - owners confirm their assets on a cycle, which also produces audit evidence.

Add a decommissioning process. Orphaned assets - a forgotten VM, an unused SaaS tenant, a dormant service account - are simultaneously a security risk, an audit finding and a recurring cost.

What auditors do with it

Expect the inventory to be used as the population for sampling. An auditor picks assets from your register and asks: is it patched, who has access, is it backed up, is it classified, was it in the last review? Two failure modes follow - assets in the register that do not exist, and systems that exist but are not in the register. The second is worse, because it suggests your controls are applied to an incomplete population.

Key takeaways

• Nearly every other control depends on the asset inventory.
• Named ownership is what makes it operational rather than decorative.
• Discover from several sources - expense records expose shadow IT fastest.
• Auditors sample from your register; unlisted systems are the worse finding.