Home / Insights / You Can’t Secure What You Don’t Know You Have: Why Every Organisation Needs an IT Asset Register

You Can’t Secure What You Don’t Know You Have: Why Every Organisation Needs an IT Asset Register

Ask most organisations how many laptops, phones, tablets and licences they have, and the honest answer is often “roughly”. An IT asset register turns “roughly” into a list you can trust. It isn’t glamorous, but it sits underneath almost everything else IT does: security, support, budgeting, onboarding and offboarding. If a device isn’t on the list, nobody is checking whether it’s patched, encrypted or still in the right hands.

This article covers what an asset register is for, what to record, and how to keep it accurate without it becoming a full-time job.

Why an IT asset register matters

Security. You can only patch, encrypt and monitor devices you know about. A forgotten laptop in a drawer, or an old phone still signed in to email, is exactly the sort of gap that causes problems later. The UK government-backed Cyber Essentials scheme asks organisations to define the scope of their assessment, including the devices within it, which is very hard to do without a reliable list.

Data protection. Under UK GDPR, organisations must keep personal data appropriately secure. If a device holding personal data goes missing, you need to know quickly what was on it, whether it was encrypted and who had it, so you can judge whether the incident has to be reported to the ICO. A register makes that a five-minute lookup instead of a guessing game.

Joiners, movers and leavers. When someone starts, you know what to issue. When they leave, you know what to collect back. Without a record, kit quietly walks out of the door and accounts stay open longer than they should.

Budgeting and renewals. Knowing purchase dates and warranty end dates lets you plan replacements over time rather than facing a wall of failing devices in the same year. It also shows where you’re paying for licences or subscriptions nobody uses.

Support. When a device fails, the help desk can see straight away what it is, who uses it, whether it’s under warranty and what’s installed.

What to record in an IT asset register

Keep it practical. For each asset, the essentials are:

• Asset tag or ID and serial number
• Type, make and model
• Assigned user or location (for shared devices, the room, site or team)
• Purchase date, supplier and warranty end date
• Operating system and whether it’s managed (for example, enrolled in your device management platform)
• Encryption status
• Status: in use, in stock, in repair, retired or disposed of
• Disposal record: date, method and certificate of data destruction where relevant

It’s worth recording software and cloud subscriptions too, not just hardware: what you pay for, how many seats, who owns the relationship with the supplier and when it renews.

Shared devices and multi-site organisations

Organisations where devices are shared between people, or spread across several sites, have a harder job. Schools, nurseries, care settings and businesses with field or warehouse teams often have kit that moves around and doesn’t belong to one named person. In those cases, assign the device to a location or team, and make someone at that site responsible for it. A short, regular check at each site catches devices that have moved, broken or disappeared long before an audit does.

Keeping the register accurate

An asset register is only as good as its last update. A few habits make the difference:

1. Make it part of the process, not an extra task. Add devices when they’re received, not when someone remembers. Update the record as part of every joiner, mover and leaver change.
2. Let your tools do the heavy lifting. Device management platforms such as Microsoft Intune can report which devices are enrolled, their operating system and encryption status. Use that data to check the register rather than typing everything in by hand.
3. Reconcile regularly. Compare the register against your device management reports, licence counts and supplier invoices. Anything that appears in one place but not the others is worth a closer look.
4. Give it an owner. One person, or one role, should be accountable for the register being right.
5. Close the loop on disposal. Record how every retired device was wiped or destroyed. That record is what you’ll need if anyone asks later.

A simple starting checklist

• Can you list every laptop, desktop, phone and tablet the organisation owns, and who has each one?
• Do you know which devices are encrypted and enrolled in device management?
• Do you know when your main warranties and software subscriptions end?
• Is there a clear step to collect equipment and close accounts when someone leaves?
• Do you keep evidence of secure data destruction for retired devices?

If any of those answers is “not really”, a basic spreadsheet maintained consistently is a much better start than waiting for the perfect system.

If you’d like help getting your devices and licences under control, our managed IT services team can set up and maintain an asset register alongside your device management, and our guide on how to plan an IT infrastructure upgrade shows how a good register makes replacement planning easier. For an independent view of where you stand, our IT consultancy service can help. Get in touch for a no-pressure conversation.

Useful references: NCSC Cyber Essentials (ncsc.gov.uk/cyberessentials); ICO guidance on security and personal data breaches (ico.org.uk).