Asset Inventory

A complete list of IT assets for the ISMS

What is an asset inventory?

Asset classes:

• hardware (servers, PCs, mobile devices)
• software (licences, versions)
• data (classification, owners)
• cloud services (SaaS, IaaS)
• network (switches, routers, firewalls)
• people (with access)

Tools: GLPI, Snipe-IT, Microsoft Intune, Lansweeper.

The legal position: Germany and Austria

A complete asset inventory is the basis for the risk management measures that NIS2 requires of particularly important entities and important entities. The NIS2 Directive (Directive (EU) 2022/2555) has been transposed separately in Germany and Austria — the obligation is the same in substance, but the provisions and the supervisory authority differ.

Germany

Under § 30(1) and (2) BSIG (German BSI Act 2025), particularly important entities and important entities must take appropriate, proportionate and effective technical and organisational measures; the minimum catalogue in § 30(2) nos. 1 to 10 covers, among other things, risk analysis and security of IT systems as well as the management of ICT systems — both of which presuppose a complete inventory of assets. Supervision: Federal Office for Information Security (BSI).

Austria

In Austria, the Austrian Network and Information Systems Security Act 2026 (NISG 2026) applies (BGBl. I Nr. 94/2025). Under § 32(1), essential and important entities must implement appropriate and proportionate risk management measures; the minimum catalogue in § 32(4)(a) to (j) mirrors the EU catalogue (including risk analysis, incident handling, business continuity) and presupposes complete asset and ICT management. Supervision: the Cybersecurity Authority (Cybersicherheitsbehörde).

Practical example

An SME with 80 employees inventories: 95 end devices, 23 servers, 47 SaaS tools, 12 data classes, 134 user accounts. Updated quarterly.

See also

• ISMS
• Section 30 BSIG
• Patch Management