The IT asset inventory template: devices, systems and their data
Every device with its protections, and every system with its owner and the data it holds.
An asset inventory lists every company device and every in-scope system. For devices it records the owner and whether encryption, endpoint protection and a screen lock are on. For systems it records the owner and the data held.
The workbook is below with its devices sheet, its systems sheet and a guidance sheet. Fill the device columns from your device management tool where you have one.
The template in full
Below is the whole workbook as it downloads. Every bracketed field, such as [Company name], is a detail to fill in before you adopt it. There is no form and no email address to hand over, and the file is yours to edit.
Asset Inventory
Devices
One row per device used for [Company name] work, including personally owned devices that access company email or systems. Check each device when it is issued and every quarter after.
| Asset ID | Device type | Assigned to | Operating system | Disk encryption on? | Endpoint protection | Protection up to date? | Screen lock 5 min or less? | Last checked | Status |
|---|
The sheet starts empty: one row per entry, under these columns.
Systems and data
One row per system in scope. Data stored is the most sensitive class the system holds: Restricted is customer data and secrets, Confidential is internal business data.
| System | Owner | Data stored | Hosted in | Criticality | Last reviewed |
|---|
The sheet starts empty: one row per entry, under these columns.
How to use
- Give every device an Asset ID (for example LT-001 for laptops, PH-001 for phones) and add a row for it. Include personally owned phones that receive company email.
- Endpoint protection and disk encryption are free on modern computers. You do not need to buy a tool to meet this control.
- Mac (macOS)
- Endpoint protection: macOS includes XProtect, which scans for known malware and updates itself. Enter "macOS XProtect (built in)" in the Endpoint protection column.
- Keep it up to date: System Settings > General > Software Update > Automatic updates (the "i" button). Turn on "Install Security Responses and system files". If it is on, mark "Protection up to date?" Yes.
- Disk encryption: System Settings > Privacy & Security > FileVault shows "FileVault is turned on". Or run "fdesetup status" in Terminal.
- Screen lock: System Settings > Lock Screen. Set "Turn display off when inactive" to 5 minutes or less and "Require password after screen saver begins or display is turned off" to Immediately.
- Windows
- Endpoint protection: Windows 10 and 11 include Microsoft Defender Antivirus. Open Windows Security > Virus & threat protection and confirm "No action needed". Enter "Microsoft Defender Antivirus (built in)".
- Keep it up to date: in the same screen, "Protection updates" shows the last update. Click "Check for updates" and confirm it is current.
- Disk encryption: Windows Pro uses BitLocker (Control Panel > BitLocker Drive Encryption shows "BitLocker on"). Windows Home on supported hardware uses Device encryption (Settings > Privacy & security > Device encryption). Or run "manage-bde -status" in an administrator Command Prompt.
- Screen lock: Settings > System > Power (or Power & battery) sets the screen to turn off after 5 minutes or less, and Settings > Accounts > Sign-in options sets "If you have been away" to require sign-in when the screen turns off.
- Phones and tablets
- iPhone, iPad and current Android phones encrypt storage once a passcode is set. Require a passcode and set Auto-Lock to 5 minutes or less.
- Evidence
- For each device, take one screenshot of the encryption screen and one of the endpoint protection screen, name them with the Asset ID, and upload them as evidence. Enter the date in "Last checked".
- Re-check every device each quarter, when it is issued, and when it is returned. Set Status to Retired once the disk is wiped, and note the wipe date.
- On the Systems and data sheet, confirm each owner and data class. [Security owner role] reviews both sheets every quarter.
What an auditor checks
An auditor uses the inventory as the population for other tests. They pick laptops from it and ask for proof of encryption, and they pick systems and check each one appears in the access review and the risk register.
A device missing from the inventory, or a system nobody owns, weakens every test that relies on the list. Keep it current when people join and leave, and date each update. The data classification standard supplies the data levels for the systems sheet.
Which criteria it maps to
It supports CC6.1, CC6.8 and CC7.1.1 A template is evidence of intent. The examination tests whether the control operated over the period, so keep the dated records the workbook produces. Every criterion, explained one by one, is on the Trust Services Criteria page.
Questions
What should a SOC 2 asset inventory include?
How often should the asset inventory be updated?
Can a device management tool replace the inventory spreadsheet?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.