NIS2 asset inventory: what should it contain?

The short answer

For every piece of IT equipment, the inventory should answer six questions:

What is it? Name, asset tag, type, manufacturer, model and serial number.
Who is responsible for it? A named person, not "IT".
Where is it? Department and location, including when the location is someone's home office.
What state is it in? Active, in storage, in repair or retired.
Is it protected? Operating system and version, and whether the disk is encrypted.
Is it still accurate? When the machine was last seen or checked.

The inventory as a whole also needs an owner and a fixed review rhythm. Without them it goes stale, and a stale inventory is almost worse than none, because it gives a false sense of security.

What the requirement actually says

Article 21(2)(i) of the NIS2 Directive names asset management alongside human resources security and access control. The directive itself says no more than that, and the Danish NIS2 Act that implements it does not list fields either.

The most concrete reading is in Commission Implementing Regulation (EU) 2024/2690. It applies directly to a limited group, including cloud, data centre and managed service providers, but it is the best description of what asset management means in practice. Its section on asset management asks for, among other things:

an inventory that is complete, accurate, up to date and consistent,
changes to the inventory recorded so they can be traced,
the inventory reviewed and updated regularly, and
assets returned or deleted when employment ends.

ISO 27001 says the same in other words: control 5.9 requires an inventory of assets, each with an owner, and control 5.11 requires assets to be returned when someone leaves. Get those two right and you have the equipment part of NIS2 covered.

This guide is not legal advice. Whether and how you are in scope is for the authority for your sector, or an adviser, to settle.

What each record should contain

These are the fields an auditor typically asks about. Not all matter equally for every kind of equipment, but each has a reason.

Field	Why
Name and asset tag	So a machine can be found and referred to without ambiguity, even when it changes hands.
Serial number	The manufacturer's number survives a new name and asset tag, and warranty and service are looked up by it.
Type, manufacturer and model	So you can answer "how many laptops do we have?" and find every machine hit by the same fault.
Responsible person	Both ISO 27001 and the regulation expect an owner. "The IT department" is not an owner.
Department and location	Home offices count. Write them down.
Status	Active, in storage, in repair or retired. Retired machines stay in the inventory, with the date and how the data was wiped.
Operating system and version	Systems that no longer get security updates are among the first things an auditor asks about.
Disk encryption	The field that decides whether a lost laptop is a nuisance or a data breach.
Installed software	To find programs that should not be there, and versions that are not being updated.
Purchase date and warranty	To plan replacement, and as a record of when the machine came in.
Last seen or checked	Shows whether the record still holds. A machine nobody has seen for six months is either gone or forgotten.

What is most often missing

An owner who is a person. When every machine lists "IT" as responsible, there is nobody to ask when one goes missing.
Retired machines. They are deleted from the spreadsheet, and with them goes the proof that the disk was wiped before the machine left the building.
Equipment outside the office. Laptops at home, a borrowed monitor, and the printers and network boxes nobody thinks of as IT.
Encryption that has actually been checked. It often says "yes" for every machine because someone set it up once. The status has to be read from the machine, not remembered.
A date. When was the list last reviewed? Without that you cannot show that it is being maintained.

Keeping it up to date

Making the list is not the hard part. Having it still be right a year from now is. Tie it to the moments when equipment changes hands:

New machine: recorded before it is handed out.
New starter or leaver: the responsible person is updated, and for a leaver it is noted that the equipment was returned.
Repair and replacement: the status changes, and what happened is noted.
Disposal: the status is set to retired, with the date and how the data was wiped.
Regular review: quarterly, for example. Compare the list with reality and write the date down.

Anything that can update itself should. Operating system, software, encryption and when a machine was last switched on all change without anyone telling you.

Spreadsheet or tool?

A spreadsheet is fine for a smaller company, as long as it really is maintained and has the columns above. It usually breaks in three places: there is no history of what changed, encryption status is copied by hand instead of read from the machine, and nobody can tell when a row was last correct.

If you recognise those three, it is time for a tool that collects data from the machines themselves and remembers every change.

That is what we built Nodavio for. It has the fields above, AutoDiscovery reports the operating system, software, BitLocker status and when the machine was last online from your Windows machines, every machine has its own history, and the whole list exports to CSV for your auditor. It does not make you NIS2 compliant on its own, and it covers only the IT equipment, but that is the part that otherwise ends up as a spreadsheet nobody keeps current.

Checklist

All IT equipment is included, including laptops at home, monitors, printers and network gear.
Every record has a named responsible person.
Every record has a serial number, status and location.
Encryption status is read from the machine, not copied by hand.
The operating system and version are known for every computer.
Retired machines are still listed, with the date and how the data was wiped.
Every leaver triggers a check that their equipment was returned.
The inventory has an owner and a fixed date for its next review.
Changes can be traced: who changed what, and when.

An asset inventory for NIS2: what should it contain?