January is the month when owner-managed SMEs finally pause and look at what they own. New hires have been settled, old equipment has been unpacked from storage, and the list of things to do on the first real week back has finally been whittled down.

Most of these businesses do not have an IT asset inventory. They have a half-updated spreadsheet, a notebook, and the assumption that the person who bought the equipment last year still remembers which laptop has the company files on it.

That assumption stops being safe the moment someone leaves, goes on long-term sick absence, or simply forgets to update the shared drive. What follows is a practical IT asset inventory template you can build in a single afternoon — and a framework for keeping it useful after that.

[[toc]]

What Counts as an IT Asset for Your SME?

Before you open a spreadsheet, decide what you are tracking. The common mistake at this stage is starting too narrow.

An IT asset inventory for a typical SME covers four categories:

• Hardware: laptops, desktops, monitors, phones, tablets, routers, switches, Wi-Fi access points, printers, and specialised equipment such as POS terminals or digital signage.

• Software and licences: Microsoft 365 seats, Adobe Creative Cloud, accounting software, sector-specific applications, and any other paid software used by the business.

• Warranties and support contracts: manufacturer warranty dates, third-party support subscriptions, and any extended warranty arrangements.

• Cloud accounts: shared Google Workspace accounts, cloud storage subscriptions, SaaS tools registered to the business rather than an individual.

Every category above has a cost implication, a security implication, or both. Omitting software licences from your inventory is the fastest way to find yourself paying for seats nobody uses or — worse — using unlicence software when an insurance broker asks for proof.

IT Asset Inventory Template — Fields That Matter

Here is a minimal, working structure for a spreadsheet-based inventory. It is designed for a business with 10 to 25 seats, not a corporate IT department. The aim is six fields you will actually use, rather than twenty you will spend more time maintaining than the inventory is worth.

When the business operates from more than one location, add a Location column. When licences matter to your insurance or Cyber Essentials preparation, add a Licence key / purchase date column. Do not add every field that sounds useful — add only fields that drive a decision.

Software Licences and Warranties

Hardware gets most of the attention. Software licences deserve the same level of tracking.

For each software item, record:

• Product name and version

• Licence type: per-user, per-device, or site-wide

• Number of seats or units

• Renewal date

• Primary contact or admin account

Software renewal dates are the asset that slips through first. A missing renewal notice does not immediately break anything. But when the insurance broker requests evidence of licence software and you cannot produce it, the conversation shifts from pricing to compliance.

Warranty tracking follows the same principle. Record the purchase date, warranty expiry date, and the support contact. If a laptop dies on 3 January and the warranty expired the week before, the business either replaces it or repairs it — and the decision is informed rather than reactive.

Why Most Inventories Fail After Six Months

A spreadsheet inventory that works on day one and deteriorates by month six is not a failure of the template. It is a failure of the process around the template.

Three patterns appear repeatedly:

No one owns the update. Someone builds the inventory once, leaves it on a shared drive, and nobody takes responsibility when an asset changes. The solution is simple: assign one person as the inventory owner. That person does not need to be the IT manager. They just need to be the person who notices when a laptop goes missing.

The inventory is not checked at joiner and leaver events. Every time someone starts or leaves, devices and accounts change. If those changes are not reflected in the inventory within a week, the record becomes a historical document rather than an operational tool.

Update deadlines are assumed rather than scheduled. An inventory that is last touched "sometime last summer" is worse than no inventory at all, because it gives a false sense of certainty. Set a monthly or quarterly review date, put it on the calendar, and treat it like any other business meeting.

The Centre for Internet Security's Control 1 on inventory and control of enterprise assets establishes that organisations must know what needs to be monitored and protected. That principle applies whether your first version is a spreadsheet or a dedicated asset management system. The discipline of maintaining the record is what determines whether the inventory has any value at all.

When to Upgrade from a Spreadsheet

Spreadsheet inventories work well up to a point. A business managing 30 to 50 assets with one person maintaining the record will find spreadsheets entirely adequate.

The signs that it is time to consider a dedicated IT asset management tool are:

• Multiple people need to update the record simultaneously and versions start conflicting.

• The business runs assets across several locations and staff cannot access a live record remotely.

• Compliance or insurance requirements demand evidence of audit trails, change logs, or certified reporting.

• The time spent manually maintaining the spreadsheet exceeds the value it provides.

None of this means that a spreadsheet is a waste of time at the start. It means you should know what the next step looks like and plan for it.

Getting Started: A Weekend Plan

If your business does not have an IT asset inventory yet, here is a practical approach:

1. Block two hours. Do not plan to "do it gradually." Inventories completed piece by piece tend to remain incomplete indefinitely.

2. Walk every desk. Physically go through the office, the meeting rooms, the storage cupboard. Message the remote staff about the equipment they are using.

3. Fill the spreadsheet. Use the minimal field structure above. If you are unsure whether an item belongs, record it and decide later.

4. Set the renewal date. Put a recurring calendar event on your wall for the first review, three months from today.

5. Hand over ownership. Name one person. Tell them they own it.

It takes longer to build a perfect inventory than it takes to build a useful one. Start with useful.

Can a Spreadsheet Really Work?

Yes, for a while. A spreadsheet is part of the Microsoft 365 suite that most SMEs already pay for, it is familiar, and it does not require training. If your asset count is under 50 and one person maintains the record, a spreadsheet is entirely adequate.

The limitation is not the spreadsheet itself. It is the single point of failure — one person's record that nobody else can verify or update when that person is unavailable. That is why the inventory owner is not optional, it is the entire safeguard.

How Often Should You Update Your IT Asset Inventory?

A monthly review is a reasonable baseline for SMEs at the 10–25 seat stage. You do not need to re-enter every field every month. A monthly review means:

• Confirm that joiners and leavers have been recorded.

• Check that any equipment purchased or disposed of during the month has been logged.

• Note any warranty or licence renewals approaching in the next 90 days.

• Flag any items showing as "in repair" or "missing" that have been unreported for too long.

That process should take no more than 20 minutes. If it takes longer, your inventory has accumulated unnecessary fields or too many people are responsible for entering data.

Why This Matters for Cyber Essentials

Cyber Essentials requires organisations to know what devices need protecting. You cannot apply security controls — patching, endpoint protection, device management — to something you do not know exists.

An IT asset inventory is not itself a Cyber Essentials requirement. It is the practical prerequisite that makes every other control possible. Without an inventory, device management becomes reactive rather than planned. Without it, you cannot demonstrate to an assessor that your controls cover every asset in scope. Without it, the gap between your Cyber Essentials claim and your actual defensible security position widens each month.

This is why a maintained IT Security Baseline — one that includes regular inventory reviews as part of its operating rhythm — matters more than a one-off inventory build followed by silence.

What Next?

An inventory is only as valuable as the discipline you keep around it. Start with a practical spreadsheet, assign ownership, and set a monthly review. Then, when you have that baseline, look at the broader picture: how your assets relate to security, how you standardise them, and whether the system you have chosen for tracking them will hold up as the business grows.

If you would like to see where your current IT asset inventory stands against a practical security baseline, book a Security Triage Call. It is the first step towards understanding what you own, what needs protection, and where the gaps are.

Book a Security Triage Call

Frequently Asked Questions

What is the simplest IT asset inventory template for a small business?

A spreadsheet with seven columns: Asset ID, Asset type, Make and model, Serial number, Assigned to, Status, and Purchase date. That structure lets you identify every item, know who has it, and look up when it was bought — which is the information most SMEs are actually missing.

Do I need software licences in my IT asset inventory?

Yes. Software licences are assets that cost money and carry compliance risk. Track product name, licence type, number of seats, and renewal date alongside your hardware. Unlicence software is a compliance gap that insurance brokers and Cyber Essentials assessors will notice.

How do I know if my inventory is accurate?

Run a simple cross-check: compare your inventory list against the actual equipment in the office and against the devices listed in Microsoft Intune or your endpoint management console. If more than 10% of items on the system do not appear in your spreadsheet (or vice versa), schedule a re-count.

Can I use Google Sheets instead of Excel for the inventory?

Yes. Google Sheets works well if multiple people need to update the record or if staff need remote access. The same fields apply; the choice between Excel and Google Sheets is an access question, not a capability question.

What happens after I build the inventory?

The inventory is a starting point, not a finish line. It enables device management, patching cadences, budget planning, and Cyber Essentials preparation. The next step is usually to ensure every device on the inventory is actually managed — software updated, endpoint protection installed, and access permissions reviewed. That is where a Security Triage Call helps: it shows how your inventory connects to a maintained IT Security Baseline.