Inventory the service, not only the device
A list of laptops and servers cannot explain which business capability will fail when a component is unavailable. Start with important services and record their owner, purpose, users, information, supporting applications, cloud resources, identities, suppliers and recovery dependencies. This connects technical records to decisions about consequence and priority.
Include assets that traditional discovery often misses: SaaS tenants, domains, certificates, API integrations, service accounts, automation credentials, code repositories and external administration tools. Use authoritative sources where possible, but label confidence and collection date so an incomplete feed is not mistaken for complete truth.
Give every record ownership and lifecycle
An inventory remains useful when change updates it. Connect creation and retirement to procurement, deployment, identity, finance and supplier processes. A resource without an accountable owner should trigger investigation rather than being assigned permanently to the security team.
Define the minimum fields needed for each asset type and resist collecting data nobody maintains. Unique identifiers, environment, owner, criticality, support status, external exposure and dependencies usually matter more than decorative detail. Reconcile sources and make conflicts visible instead of silently choosing whichever database appears most complete.
Test the inventory against real questions
Use exercises to determine whether the inventory can answer operational questions: which internet-facing systems use a vulnerable product, which applications depend on one identity provider, which supplier accounts reach production and which services cannot recover without a specific key. Record the time and manual work required.
Measure known ownership, unsupported technology, stale records, unidentified public exposure and services without mapped recovery dependencies. Review the model after incidents and major changes. The goal is not a perfect database; it is a dependable decision aid whose gaps are understood and actively reduced.
What to do next.
- ✓Start with critical business services and owners.
- ✓Include cloud, SaaS, identity, domain and supplier assets.
- ✓Record collection source, date and confidence.
- ✓Connect inventory updates to creation and retirement workflows.
- ✓Test the inventory with incident and vulnerability questions.
- ✓Track unknown ownership and stale records as risks.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Reuben Botha
Enterprise Security ContributorFocuses on security programmes, risk translation and practical roadmaps that connect technical findings to accountable action.
More from this writer