A device inventory should tell you which equipment can reach firm data, who is responsible for it, and how access can be removed.
Those records may be split among the HR roster, IT asset register, mobile-device management console, and cloud accounts. Reconcile them before adding more fields.
Use this starter to build an initial inventory. The thirty-day target is a suggested work plan, not a legal deadline.
What to put on the first list
Collect information you can verify within thirty days. Leave unknowns visible rather than filling them with assumptions.
People and endpoints
- Company-issued laptops and desktops
- Company-issued phones and tablets
- Known personal devices used for work (BYOD)
- Contractor and temporary-staff devices that reach firm systems
- Conference-room systems and shared workstations
- Copiers, scanners, and multifunction printers that store documents
- Job-site or field devices (tablets, cameras, ruggedized units)
- Any device that holds or transmits customer, financial, or controlled data
- Remote access tools and VPN clients
- Cloud accounts that sync files to personal devices
- Browser-based tools that store credentials or documents locally
Shared and specialized equipment
Access paths
Three questions for every entry
- Who is responsible for it? Name a person, not a department.
- What data can it reach? Customer information, deal materials, financials, controlled technical data, or none of the above.
- How do we remove access or recover it? Record the offboarding step: remote wipe, certificate removal, or physical return. Flag any access that depends on an informal request to remove it.
The thirty-day test
After thirty days, the inventory should let you answer these questions without searching across systems:
- How many devices currently reach our customer or deal data?
- Which of those devices are not company-owned?
- For the last person who left the firm, how long did full access removal take?
If an answer requires a meeting, find the missing or outdated record.
These requirements are related but not interchangeable. NYDFS Part 500 requires applicable covered entities to maintain policies for a complete, accurate, documented information-system asset inventory, with exemptions to assess. The FTC Safeguards Rule requires covered financial institutions to identify and manage relevant data, personnel, devices, systems, and facilities. CMMC uses level-specific assessment-scope rules. This starter does not by itself establish compliance with any of them.
The inventory supports the security program by showing which devices the firm needs to manage.
Verify known devices and access, then follow up on missing or incomplete entries.