A device inventory should tell you which equipment can reach firm data, who is responsible for it, and how access can be removed.
Those records may be split among the HR roster, IT asset register, mobile-device management console, and cloud accounts. Reconcile them before adding more fields.
Use this starter to build an initial inventory. The thirty-day target is a suggested work plan, not a legal deadline.
Collect information you can verify within thirty days. Leave unknowns visible rather than filling them with assumptions.
After thirty days, the inventory should let you answer these questions without searching across systems:
If an answer requires a meeting, find the missing or outdated record.
These requirements are related but not interchangeable. NYDFS Part 500 requires applicable covered entities to maintain policies for a complete, accurate, documented information-system asset inventory, with exemptions to assess. The FTC Safeguards Rule requires covered financial institutions to identify and manage relevant data, personnel, devices, systems, and facilities. CMMC uses level-specific assessment-scope rules. This starter does not by itself establish compliance with any of them.
The inventory supports the security program by showing which devices the firm needs to manage.
Verify known devices and access, then follow up on missing or incomplete entries.