A software asset inventory is useful when it answers who owns each application, where it runs, what data it handles, who can access it, and what happens when it is updated or retired. Start with discovery, reconcile the list with purchasing and identity records, and keep the inventory tied to operational decisions.
Define the inventory boundary
Include installed desktop and server software, mobile apps used for work, browser extensions, cloud services, plugins, APIs, open-source packages that the team operates, and vendor-managed applications. Record production, test, and shared-account uses separately when their owners or data differ.
NIST's Cybersecurity Framework quick-start guidance recommends maintaining hardware and software inventories because these assets can be entry points for attackers. It notes that an inventory can begin with a simple spreadsheet when that is appropriate for the organization (NIST).
Capture fields that support action
For each item, record the product name, publisher, version or service tier, deployment location, device or tenant, business purpose, technical owner, business owner, user group, authentication method, data classification, integrations, renewal date, support status, and retirement plan. Link to the contract or admin portal without copying credentials.
Add a status such as approved, trial, exception, unsupported, pending retirement, or retired. A long list without lifecycle state does not tell a reviewer which item needs attention.
Discover from more than one source
Compare device-management reports, identity-provider applications, browser management, expense records, procurement systems, password-manager collections, vendor invoices, cloud consoles, and interviews with team leads. CISA's Cyber Essentials guidance says protecting systems requires knowing which devices and applications are in use, who has access, and what security measures apply; it recommends inventorying hardware and software assets (CISA).
Treat mismatches as review work. An invoice can reveal software no device scan sees, while a device scan can reveal unapproved or abandoned software that no current invoice identifies.
Reconcile ownership and access
Assign one accountable business owner and one operational contact where possible. List administrators and the process for granting or removing access. Flag personal accounts, shared credentials, inactive owners, former staff, unknown publishers, and applications without a recovery route.
For SaaS, inventory connected applications and service accounts as well as human users. Record whether the organization can export its data and whether a tested backup or migration path exists.
Review versions, support, and risk
Compare versions and service tiers with vendor support information. Prioritize unsupported software, internet-facing components, high-privilege tools, and applications that hold sensitive or business-critical data. Do not remove software solely because it looks old; confirm dependencies, preserve data, and prepare rollback or replacement.
Track exceptions with an owner, reason, compensating control, and review date. A known temporary exception is safer than a silent permanent gap.
Retire cleanly
Before retirement, export required records, transfer ownership, revoke integrations and tokens, remove user access, cancel renewal, uninstall clients, document data deletion or retention, and verify that no workflow still depends on the service. Preserve evidence of the decision and final state.
Set a recurring review and an event-driven review after hiring, departures, acquisitions, major migrations, or security incidents. Measure unknown-owner items, unsupported items, and overdue retirements rather than only total inventory size.
Quick completion test
The inventory is operational when installed and cloud software are covered, each item has purpose and ownership, access and data are mapped, versions and support status are known, exceptions expire, retirement includes export and revocation steps, and the list is reconciled from multiple evidence sources on a schedule.
Sources
- Cybersecurity Framework 1.1 Quick Start Guide — National Institute of Standards and Technology
- Cyber Essentials Toolkit 3: Your Systems — Cybersecurity and Infrastructure Security Agency, Aug. 17, 2020