Most businesses produce a full list of their digital assets only once one goes missing. By then the inventory is no longer a management tool but a search operation — and usually a late one.
Short answer: what is a digital asset inventory?
It is a single document collecting domains, certificates, hosting and servers, software licences, accounts and data, with an owner, a responsible person, a renewal date and access details recorded for each. Its purpose is not passing an audit but being able to answer three questions at any moment: what do we own, who can access it, and when must it be renewed? With those answers ready, missed renewals, lost access and unnecessary subscriptions all become manageable.
Six categories
| Category | What belongs | Most often missed |
|---|---|---|
| Domains | All extensions, defensive registrations | Addresses bought for an old campaign |
| Certificates | SSL, code signing, financial seals | Subdomain certificates |
| Hosting and servers | Hosting, VPS, cloud resources | Unused test servers |
| Software and subscriptions | Licences, SaaS subscriptions, plugins | Tools nobody uses but everyone pays for |
| Accounts and access | Panels, e-mail, social media, advertising | Accounts registered to departed employees |
| Data and content | Backups, databases, media archives | Company files sitting in personal accounts |
The fourth category produces the most cost. Subscriptions for tools trialled and abandoned during the year keep renewing quietly; a year-end inventory typically surfaces at least two or three unused items. The fifth produces the most risk: an account registered to a personal e-mail may be unrecoverable once that person leaves.
Ownership and renewal columns
- Asset name and type. What it is should be clear at a glance.
- Provider. Where it was purchased and which account manages it.
- Registrant. Who owns it legally — the company or a person? Critical for domains especially; detailed in our ownership article.
- Owner and deputy. Who tracks it, and who covers when they are away.
- Renewal or expiry date, plus whether auto-renewal is enabled.
- Payment method. Which card or account; note the card's expiry date too.
- Who has access. This column also forms the basis of access review.
- Criticality. What happens if this asset is lost? Marking high/medium/low simplifies prioritisation.
Eight columns may look excessive, but each closes a different question. The criticality column is particularly valuable: as the inventory grows, it determines which items warrant close attention.
Keeping it current
- One full review a year. Year-end is the natural moment; every row gets verified.
- A light quarterly check. Only upcoming renewals and newly added items.
- Event triggers. Update the inventory when a new tool is purchased, an employee leaves, or a provider changes. Writing those triggers down keeps it current by itself.
- A single owner. One person must maintain it; a document everyone owns goes stale quickly.
- An accessible location. The inventory must be reachable when needed — but must contain no passwords. Passwords live in a password manager; the inventory records only who has access.
Netişlem expert view: an inventory is a crisis tool, not a compliance document
Inventories are usually treated as an audit requirement. In our experience their real value appears during a crisis: which systems are affected when an account is compromised, which access to close when someone leaves, who to call when a service stops. A business with an inventory answers those in minutes. One without spends the first day asking them.
Our second observation is that most surprises from producing an inventory are financial. Unused subscriptions, forgotten servers, the same service bought twice from different providers. A year-end inventory usually pays for itself within the first year.
Third, the registrant column produces the most value. Domains, social accounts and advertising accounts registered to personal addresses are common, and it stays invisible until a relationship sours. Simply preparing that column amounts to a serious risk scan.
Year-end checklist
- Rows created for all six categories.
- Registrant verified on every row — does it name the company?
- Owner and deputy assigned.
- Renewal dates and auto-renewal status recorded — see the renewal calendar.
- Payment methods and card expiry dates checked.
- Access holders listed; departed employees removed.
- Unused subscriptions and servers identified.
- Criticality marked.
- Notification addresses verified as corporate.
- Data retention periods matched to the inventory — see the registry guide.
- An owner assigned for the inventory with update triggers written down.
- Next review scheduled.
Frequently asked questions
Which tool should I use?
A simple table suffices for most businesses. What decides is not the sophistication of the tool but keeping it current. The only caution: the file must be accessible yet protected, and must contain no passwords.
Should I record passwords in the inventory?
No. The inventory should record only who has access; passwords belong in a password manager. Mixing the two turns the inventory into a high-risk document on its own — covered in our password manager article.
How many items will a small business have?
More than expected. Even with a single website, domain, hosting, e-mail, certificates, a few subscriptions and five or six accounts easily reach twenty rows. A small count does not make the inventory unnecessary; it makes completing it easier.
How long does building one take?
Half a day for a small business, a few days for a mid-sized structure. Most of the time goes into gathering information; where records are scattered it takes longer. Once the first inventory exists, keeping it current takes a few hours a year.
Why is year-end the right time?
Budget planning, subscription renewals and the financial period close all coincide. Identifying unused items feeds directly into next year's budget, and renewal dates get written into the new year's calendar.
Conclusion
A digital asset inventory is more than a list of what you own: it collects who can access what, what renews when, and who responds when something goes wrong in one document. One day a year on this work reduces downtime risk, unnecessary cost and loss of access simultaneously.
If you would like help producing your inventory, get in touch. You can review our domain, SSL certificate and corporate hosting solutions.