A digital asset inventory is a map of the accounts, systems, data, content, licenses, and recovery paths the business depends on. It should tell an authorized person what exists, why it matters, who owns it, who manages it, when it renews, and how continuity works.
It is not a spreadsheet full of passwords.
What belongs in the inventory
Include:
- Domains, registrars, DNS, and certificates
- Email, identity, and password-management systems
- Website hosting, CMS, code, plugins, and backups
- Google Business Profile, analytics, Search Console, and ads
- Social pages, video channels, and directory profiles
- CRM, forms, scheduling, phone, and automation
- Cloud storage, design files, photos, video, and brand assets
- Payment, ecommerce, donation, and booking systems
- Software subscriptions, licenses, and vendor contracts
- Data sets, retention obligations, and critical exports
For each asset, record the business purpose, owner account, administrator, vendor, URL, billing owner, renewal date, MFA method, recovery contacts, backup location, data sensitivity, dependencies, and last test date.
Store credentials in a business password manager, not the inventory itself. Link to the vault record by a safe label.
Map dependencies
The domain may control the website and email. Email may control password recovery for nearly everything else. A form may rely on the website, email, automation platform, and CRM.
Mark those relationships. They determine recovery order. CISA recommends inventorying logical and physical assets and understanding which systems support critical business functions.
Assign business ownership
Every critical asset needs an internal accountable owner even when a provider operates it. Record provider access separately. Use individual accounts and role-based permissions instead of shared logins.
Add a status such as business-controlled, vendor-controlled, disputed, unknown, or scheduled for retirement. “Unknown” is a useful finding, not a reason to guess.
Review it through real events
Update the inventory after purchases, cancellations, launches, staff changes, provider changes, incidents, and rebrands. Quarterly, confirm access and renewals. Annually, run a tabletop exercise:
- The owner loses a phone.
- The web provider is unavailable.
- The office manager leaves.
- The domain renewal card fails.
- The CRM export is needed today.
Can the company recover without using a former employee’s personal email?
Keep the inventory protected
Limit access, maintain version history, and keep an encrypted or otherwise appropriately protected backup. Do not place recovery codes, passwords, customer secrets, and a complete system map in an unsecured shared document.
An inventory rarely feels urgent until something breaks. Its value is turning a mystery into a procedure.
A starter inventory structure
- Asset: Domain; Business purpose: Website and email identity; Primary owner: Company account; Provider/admin: Web or IT provider; Renewal: Date and card owner; Recovery: MFA and recovery contact; Backup/export: Registrar export or documented settings; Dependencies: DNS, email, website; Status: Controlled
- Asset: Business Profile; Business purpose: Maps and local information; Primary owner: Company Google account; Provider/admin: Marketing manager; Renewal: None; Recovery: Secondary owner; Backup/export: Profile records; Dependencies: Website, phone, location; Status: Controlled
- Asset: CRM; Business purpose: Lead and customer workflow; Primary owner: Company administrator; Provider/admin: Sales/automation provider; Renewal: Contract date; Recovery: Admin recovery; Backup/export: Scheduled export; Dependencies: Forms, email, phone; Status: Review needed
Do not publish this table or store secrets in it. Adapt fields to the business and link safely to password-vault entries.
Classify assets by criticality
Tier 1: Losing it stops revenue, customer contact, identity, or legal obligations. Examples include domain, email, payment systems, CRM, and primary data.
Tier 2: Losing it materially disrupts marketing or operations but has a workaround, such as a social page or design library.
Tier 3: Replaceable or inactive tools with limited current impact.
Tier 1 assets need stronger access redundancy, MFA, recovery documentation, tested exports, and renewal monitoring.
Record data, not only software
The CRM account is an asset, but so are its customer records, field definitions, consent history, automations, and exports. The photo library includes originals, usage rights, captions, and project mapping. A website includes content, database, media, code, DNS, analytics, and form destinations.
Knowing the tool name without knowing what must be recovered is not enough.
Retire assets deliberately
When canceling a service, export needed data, transfer ownership, remove integrations, update DNS, revoke users and API keys, document retention, and record the cancellation. Confirm that the change did not break forms, email, analytics, or customer links.
Who should maintain the inventory?
Assign one internal accountable owner and a backup. Providers can update technical fields but should not be the only people with the record. Review Tier 1 entries quarterly and the full inventory annually or after major changes.
Professional help is worthwhile for the first discovery when nobody knows what exists, for security classification, or for testing backups and dependencies. The business should never send a consultant a spreadsheet of plaintext passwords as the starting point.
Related reading
What Accounts Should a Business Owner Personally Control?
What Happens to Your Website If Your Web Designer Disappears?
Should Your Business Use Gmail or a Professional Email Address?
The Online Business Information Audit: What to Check Before 2027
Sources
https://www.cisa.gov/stopransomware/ransomware-guide
TechDad Technology can facilitate an inventory session to clarify ownership, recovery, and dependencies. Keep credentials in your password manager rather than sharing them unnecessarily. Contact TechDad Technology.
