Nookwire field guide · Small-business IT

How to build and maintain a small-business network inventory

A reliable inventory gives a small business or service team a shared view of the devices, software, and information it depends on. Start with a useful baseline, then update it as the network changes.

Grounded in NIST and CISA guidance, with practical field and review suggestions called out separately.

01 · Set the scope

Inventory the things the work depends on.

NIST’s Cybersecurity Framework 2.0 includes outcomes to maintain hardware and software inventories and to prioritize assets by factors such as criticality and business impact. Its small-business quick-start guide introduces the framework for smaller organizations. CISA’s Cybersecurity Performance Goals 2.0 recommends a regularly updated inventory spanning data, hardware, software, systems, facilities, and personnel. It also calls for more frequent updates to critical IT and OT assets.

Hardware

Count endpoints and the equipment that connects or supports them: computers, phones, tablets, servers, switches, routers, firewalls, wireless access points, printers, and business-critical connected devices. Include equipment at each site and devices used remotely.

Software and services

List operating systems and the applications or hosted services the team relies on. Useful notes can include the business purpose, responsible team, version or support state, and where license or vendor records are kept. Do not put passwords, recovery codes, or secret keys in an inventory.

Information assets

Record important categories of business information, such as customer, employee, financial, or proprietary records. Note who is responsible, where the information is stored, how important it is to operations, and what should be restored first. Describe the information; do not copy sensitive records into the inventory.

Practical suggestion: begin with equipment and services the team already knows it relies on, then compare that list with what is actually connected or in use. Keep a short “needs follow-up” list for anything whose owner or purpose is unclear.

02 · Make records useful

Give each device a clear, findable record.

The fields below are a practical starter schema for day-to-day troubleshooting and planning. They are suggestions for a useful record, not a claim that every field is a formal compliance requirement. Use the fields that fit the team’s network, and be clear when an address or version has not yet been verified.

Unique asset ID
An organization-assigned identifier that stays with the record when a device moves.
Role or type
What it does: for example, laptop, access point, printer, or firewall.
Hostname
The current network name, when the device has one.
IP address
Record the current address and whether it is static, reserved, or observed dynamically.
MAC address
Useful for distinguishing a network interface from its changing IP address.
Manufacturer and model
Enough detail to identify the device and check its support information.
Operating system
Include the version when it helps the team understand support and maintenance.
Location
Site, room, rack, or remote assignment that helps someone find the asset.
Criticality
A simple impact rating for how much business work depends on the device.
Owner and last verified
A responsible team or role, plus the date and source of the latest check.

For software and information assets, add a business purpose, responsible role, and support or storage location where those details help the team act. Link to an approved password manager or document store if needed; do not duplicate secrets in the inventory.

03 · Maintain the record

Update it when the network changes, then review it on a schedule.

An inventory is only useful while it reflects the environment. CISA’s CPG 2.0 says to keep the inventory regularly updated and to update critical IT and OT assets more frequently. Treat routine business changes as update points too.

  1. Update during the change. Add a device when it is purchased or connected; revise its record when it moves, changes role, or receives a major system change; mark it retired when it leaves service.
  2. Check that the record matches reality. Compare the inventory with equipment at each location and with the network or administration views the team already uses. Record when and how an item was last verified.
  3. Review the full inventory at least annually. This guide uses an annual review as a practical minimum. CISA calls for regular updates and more frequent attention to critical assets; teams can use quarterly checks for their highest-impact devices as a practical starting cadence.
  4. Resolve unknowns instead of hiding them. Keep uncertain owner, location, or support details visible as follow-up work, and assign someone to close the gap.

Practical suggestion: assign one role to coordinate the list, but let the people who purchase, deploy, support, and retire equipment update the relevant records as part of their normal handoff.

References

Primary guidance

Citation note: the supplied research snapshot ended before its bibliography, so its numbered references [1], [2], and [11] could not be matched to source titles and URLs. The links above are verifiable NIST and CISA publications. The device-field list and annual review cadence are practical recommendations in this guide; they are not presented as verbatim requirements from the unavailable references.