An IT asset register is a single, maintained record of every device, piece of software, cloud service and account your business depends on, with who holds it, what it is for and when it stops being supported. It is not a list made once for an audit and then forgotten. A useful register is the one you open when a laptop goes missing, when someone leaves, or when a supplier asks you to prove your software is up to date.
Quick answer: An IT asset register should record every laptop, desktop, phone, server and network device, plus your software licences, cloud services, admin accounts and domain names. For each one, note a unique identifier, who holds or owns it, where it is, when it was bought, its warranty and support end dates, and its current status. Keep it current by updating it whenever something is bought, issued, returned or disposed of.
In this guide: what counts as an IT asset, the fields worth recording and the ones you can skip, how to build a first version from data you already hold, and how to stop it going stale.
What an IT asset register actually is
Think of it as the answer to a simple question: what do we have, who has it, and is it still safe to use? With six staff you can answer from memory. Add home working and a few devices bought on a personal card, and nobody can.
Three different documents often get confused with it, and it helps to separate them early.
| Document | What it tracks | Who usually owns it |
|---|---|---|
| IT asset register | Devices, software, cloud services and accounts, with their owner, status and support dates | IT support, internal or outsourced |
| Fixed asset register | Items above a value threshold, for depreciation in the accounts | Finance or your accountant |
| Record of processing activities | What personal data you hold, why, where it goes and how long you keep it | Whoever handles data protection |
The fixed asset register will not show a £180 router, but that router is the edge of your network and it needs firmware updates. The record of processing is a data protection document; the ICO’s documentation guidance explains who must keep one. The IT register supports both, because it tells you which devices and systems the personal data actually sits on.
What belongs in the register
The NCSC’s asset management guidance takes a broader view than most businesses expect. It covers hardware and software, and goes on to include accounts, domain names, suppliers and the cloud services your data lives in. That breadth is the point: incidents tend to start with the thing nobody remembered owning.
In practice, a small business register usually has five groups:
- End-user devices. Laptops, desktops, tablets and company phones, including spares in a drawer and anything on loan to a contractor.
- Network and office equipment. Routers, firewalls, switches, wireless access points, printers, NAS boxes and any on-site server.
- Software and licences. Microsoft 365 or Google Workspace seats, accounting and line-of-business software, design tools, security software and anything installed locally.
- Cloud services and accounts. Every SaaS subscription, plus the admin accounts for Microsoft 365, your domain registrar, your website host and your social media.
- Domains and certificates. Each domain name, where it is registered, who can log in, and when it renews.
Staff-owned phones and home laptops are the awkward group. If they open company email or files, they matter. The Cyber Essentials requirements put personally owned devices that access organisational data or services in scope, with an exception for phones used only for calls, texts and an authenticator app. Even if you never apply for the certificate, that is a sensible line to draw for your own register.
Which fields to record for each asset
Every column is something someone has to keep current, and a register with forty columns half filled in is less useful than one with ten that are always right. These are the fields that earn their place:
| Field | Why it matters |
|---|---|
| Asset ID and serial number | Proves which physical device you mean. The serial is what your insurer will ask for first. |
| Make and model | Lets you find every device affected by a recall or a vulnerability in one filter. |
| Assigned user or owner | The first question during a leaver, a lost device or a security alert. |
| Location | Office, home address or “with contractor”. Matters for onsite visits and insurance. |
| Operating system and version | Shows which machines cannot take current security updates. |
| Purchase date and supplier | Drives replacement planning and warranty claims. |
| Warranty end date | Tells you whether a fault is a free repair or a purchase decision. |
| Support end date | The date the vendor stops issuing security fixes. The single most useful field. |
| Encryption and management status | Whether a lost device is a nuisance or a reportable incident. |
| Status | In use, spare, in repair, returned, wiped or disposed, with a date. |
For software and cloud services, swap the hardware fields for the licence type, number of seats, renewal date, monthly or annual cost, the named admin, and who approved it. For accounts and domains, record who holds the login and whether multi-factor authentication is switched on. Never store passwords in the register itself; point to the password manager entry instead.
Why the support end date matters most: Windows 10 reached its end of support on 14 October 2025. A register with this column made that a one-filter job: here are the machines, here is who uses them, here is when they need replacing. Without it, the answer came from walking round the office.
What a register is used for in practice
A register only pays back if it gets used. These are the moments where it does.
-
Someone joins the businessA new starter needs a device and the right licences. The register shows whether a suitable spare exists and records what was issued, which is the start of a clean IT onboarding checklist.Check: everything issued is recorded against the person’s name.
-
Someone leavesYou cannot recover what you never recorded. The register is the list you work through on the last day, from the laptop to the admin rights on the website. The IT offboarding checklist covers the access side.Check: every item against the leaver’s name is marked returned, reassigned or closed.
-
A laptop is lost or stolenWithin minutes you need the serial number, the user, whether the disk was encrypted and whether the device can be wiped remotely. Those answers decide whether you have a data breach to assess.Check: encryption status is recorded for every laptop, not assumed.
-
A security update or vulnerability landsCyber Essentials expects critical and high-risk updates to be applied within 14 days of release, and unsupported software to be removed. You cannot meet either if you do not know which devices run what.Check: you can list every device on a given operating system version in under a minute.
-
Renewals and costs come roundUnused Microsoft 365 seats, a second accounting licence for someone who left, a domain about to lapse. The register makes these visible before the invoice does.Check: renewal dates sit in the register and in a shared calendar.
-
An audit, insurer or customer asks questionsSecurity questionnaires and cyber insurance proposals ask how many devices you have and whether they are encrypted. A current register turns a week of guessing into an afternoon.Check: the totals in your last questionnaire match the register today.
Cyber Essentials is a good example of the register’s role. The v3.3 requirements, in force from April 2026 at the time of writing, are explicit that asset management is not one of the five technical controls. They also say good asset management helps you meet all five. If you are preparing for the scheme, our guide to what Cyber Essentials involves explains the controls themselves.
How to build a first version from what you already have
Most of the data already exists in systems you pay for. Work in this order, because each source fills gaps in the one before:
- Export your device management data. If your laptops are enrolled in Microsoft Intune, it already collects the serial number, manufacturer, model, operating system version, encryption state and last check-in for each device. Microsoft’s Intune device details documentation lists what is gathered; it refreshes every seven days. Export the device list to a spreadsheet as your starting point.
- Export users and licences. The Microsoft 365 admin centre will export every user with their assigned licences. This gives you the people column and shows any seats assigned to someone who has left.
- Read your purchase records. Invoices from the last four or five years fill in purchase dates and suppliers, and reveal devices bought outside the normal route.
- Check the router and network. The router’s list of connected devices shows printers, NAS boxes and anything else that never enrolled in management.
- Walk round. Check drawers, meeting rooms and the comms cupboard. Old laptops in a cupboard still hold data and still need recording, even if the status is “awaiting secure disposal”.
- Ask staff one question. “What do you use for work that IT did not give you?” The answers find the personal phones, the free file-sharing accounts and the browser extensions nobody approved.
Expect the first pass to be incomplete. The NCSC guidance says plainly that most organisations will never have a perfect picture of their assets, and that is fine. Record what you find, mark what you are unsure of, and fix the gaps as they surface. If your laptops are not yet in any management tool, that is a gap worth closing in its own right; our Microsoft 365 support team sets up Intune enrolment for exactly this reason.
How to keep it accurate without a big project
Registers usually fail the same way: built well, then never updated. Tie updates to events that already happen rather than to a reminder someone will snooze.
Update the register at these points, and only these points, and it stays close to right:
- when anything is bought, before it is handed over
- when a device is issued, reassigned or returned
- when a device goes for repair or comes back
- when anything is wiped, sold, recycled or destroyed, with the certificate or reference
- when a subscription is started or cancelled
Then, once a quarter, reconcile it against the automated sources: compare the register with the Intune export and the licence list, and chase anything that appears in one and not the other. A device that has not checked in for 60 days is lost, broken or sitting in someone’s loft, and you want to know which.
The format matters less than people think. A shared spreadsheet with locked headings works well up to roughly 30 or 40 devices. Beyond that, or with several sites, a proper asset tool or the reporting built into your device management platform saves time because it updates itself. Whatever you use, give one named person responsibility for it. The NCSC is clear that asset management needs an owner; without one, everyone assumes someone else updated it.
The register also feeds wider reviews. Our IT audit checklist puts the device inventory first for the same reason: a stale register usually points to gaps further down the list.
Frequently asked questions
Is an IT asset register a legal requirement in the UK?
No law requires a document called an IT asset register. However, UK GDPR requires appropriate security for personal data, and it is hard to show that without knowing which devices hold it. Cyber Essentials, many cyber insurance proposals and customer security questionnaires all ask questions you can only answer accurately with a current register, so most businesses end up needing one in practice.
Should staff-owned phones go in the register?
Yes, if they access company email, files or business apps. Record the user, the device type, the operating system and whether it is enrolled in management, but not personal details beyond that. Phones used only for calls or an authenticator app carry far less risk, and the Cyber Essentials requirements leave those out of scope. Record them separately if you want a complete headcount.
How often should the register be reviewed?
Update it whenever a device is bought, moved or disposed of, and do a full reconciliation against your management tools once a quarter. A yearly check is too infrequent for most businesses: in twelve months, staff change, devices move home and subscriptions quietly renew. A quarterly review of a well-kept register is a short job, not a project.
Can we just use a spreadsheet?
Yes, for a small business a spreadsheet is often the right choice. Keep it in one shared location with version history, use drop-down lists for status, and never store passwords in it. Move to a dedicated tool when the spreadsheet stops being updated, when you pass roughly 40 devices, or when you need automatic discovery across several sites.
A register is unglamorous, and that is why it is so often missing. The businesses that have one handle leavers, lost laptops and support deadlines calmly because the answers are already written down. If yours is out of date or does not exist, start with the Intune and licence exports this week, and use our guide to proactive IT maintenance to build the quarterly check into a routine.
Want a Clear Picture of Your IT Estate?
Our IT audit reviews your devices and licences against their support dates, then gives you an asset picture and a prioritised list of what to replace, retire or secure first.
