In this article
Managing an IT estate without an inventory is like running a fleet without knowing how many vehicles you have or when their insurance runs out. An asset inventory gives the board three things: a defensible renewal budget, assurance that nothing forgotten is opening the door to an attack and, for entities covered by NIS2, the raw material for a specific legal obligation towards the CNCS (Portugal's National Cybersecurity Centre). It only works if it is collected automatically and reviewed methodically — never as a spreadsheet built once.
Could you answer this question today?
"How many laptops do we have, and how many are already out of warranty?" In most companies with between 10 and 200 workstations, the answer means cross-checking invoices, emails and several Excel sheets. As long as that is the case, equipment renewal is reactive, licences are paid for by estimate and security cannot be demonstrated to anyone.
The first survey usually pays for itself. It almost always turns up subscriptions with no user, machines with no warranty cover and access rights for people who have already left the company.
What management benefit does an inventory bring?
- Smaller attack surface Incidents often start with something nobody remembered having: an old server still switched on, a branch router with its factory password, a laptop a former employee never returned.
- Predictable investment Knowing the age of every machine, replacement is planned in batches and negotiated, rather than happening at the point of failure and at whatever the price is that day. We set out the recommended cycle in the right lifecycle for laptops and desktops.
- Regulatory compliance For NIS2 entities, without an inventory there is no way to deliver the list the regulation requires to the CNCS.
What information should the inventory contain?
We recommend organising the register into five levels, each answering a question from the board:
| Level | Minimum fields | Decision it supports |
|---|---|---|
| Hardware | Workstations, servers, firewalls, switches, access points, printers, smartphones; manufacturer, model, serial number, purchase date, end of warranty, user and location | When and how much to renew |
| Software and subscriptions | Operating system and version, applications, Microsoft 365, endpoint protection, ERP; licences contracted versus licences actually used | Where to cut cost and which software is no longer supported |
| Identities | Users, administrator accounts, generic accounts, third-party access, MFA status | Who has access to what, and which access should already have been closed |
| Contracts | Internet, telephony, cloud, domains, certificates, maintenance; renewal dates and notice periods | What renews without a decision and how long you have to exit |
| Information | Where it lives (server, cloud, laptops), who is responsible for it and what backup it has | If it disappeared tomorrow, could it be recovered? |
Two terms to align the conversation. An asset is any element of value to the company that can fail or be attacked — hardware, licence, account, cloud service. Internet-facing means anything a third party can try to connect to from outside: the website, email, the VPN, the firewall, a badly configured IP camera.
What does the CNCS require from entities covered by NIS2?
Portugal transposed the NIS2 Directive through Decree-Law no. 125/2025 of 4 December, which created the Legal Framework for Cybersecurity, in force since the 120th day after publication. The implementing regulation arrived in June 2026, with CNCS Regulation no. 756/2026.
Under article 32, essential, important and relevant public entities must draw up, update and submit to the CNCS, through its online platform, the complete list of assets directly reachable from the internet — and that list must be based on the entity's asset inventory. The document is classified as restricted and describes, among other fields, the service each asset supports, the name of the equipment or software, model and version, operating system, IP address, domains, manufacturer and interdependencies.
| Obligation | Timetable |
|---|---|
| First submission | Whichever comes first: 31 January of the year following notification of qualification, or six months from that notification |
| Update by essential entities | Once a year, together with the annual report |
| Update by important and relevant public entities | Once a year, by the last working day of the following January |
The sequence is unavoidable: to know what is exposed, you first need to know everything that exists. If your organisation is, or may come, within the scope of the law, start with our NIS2 guide for SMEs. DataRoad does not give legal opinions on scope; we carry out the technical measures, the inventory included.
How do you keep the inventory up to date without manual effort?
- Collection agents — software installed on workstations and servers reports hardware, applications and versions on its own.
- Network discovery — the firewall and switches reveal every connected device, including those that should not be there.
- Integration with joiners and leavers — every new starter triggers equipment and accounts; every departure triggers return of equipment and blocking of access, on the same day.
- Quarterly review with the board — fifteen minutes on expiring warranties, surplus licences and accounts to close.
- A named owner — a specific person is accountable for the inventory; shared responsibility is nobody's responsibility.
Where are the usual gaps?
In accounts belonging to former employees and suppliers, in licences paid for with no user, in network equipment at branches and warehouses, in domains and certificates that renew on their own and in information that lives only on a laptop's hard drive.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Why will insurers and auditors ask for this document?
A cyber-risk policy starts with a questionnaire on equipment, installed protection and backups. Clients auditing their suppliers, public tender panels and due diligence in acquisitions ask identical questions. With the inventory up to date, the answer is an export that takes minutes rather than weeks of gathering — and there is no risk of declaring something optimistic that, after an incident, turns against the company.
If you want to carry out a first internal survey now, use our IT estate audit guide.
What does managing a mixed estate look like in practice?
Reltio by SAP — a US data software company with an office in Lisbon — has an IT Unlimited contract with DataRoad covering ongoing maintenance, technical consultancy and network management. In the published case, the estate comprises 40 MacBook Pros, 35 Dell devices, 125 structured cabling points and Cisco Meraki infrastructure with a firewall, three switches and several access points.
Two operating systems, several hardware lines and different warranty periods cannot be managed from memory. As an Apple Technical Partner, DataRoad - IT Services and Consulting keeps Macs and PCs in a single inventory, under the same process.
Frequently asked questions
Does NIS2 make an inventory mandatory?
In practice, yes, for the entities covered: CNCS Regulation no. 756/2026 requires the list of internet-facing assets built from the inventory, and that list cannot be produced without it.
Can I use a spreadsheet?
Only as a starting point. Maintained by hand, it is wrong within a few weeks; the sustainable model is automatic collection from workstations and the network, with regular review.
How often should it be reviewed?
Collection is continuous and the review with the board should be at least quarterly. For NIS2 entities, the list of exposed assets must be updated once a year.
Next step: an IT estate inventory in 10 working days
We survey hardware, software and subscriptions, identities, contracts and information; flag what is internet-facing, out of warranty or due to be closed; and deliver the inventory with a prioritised action plan. To keep it up to date afterwards, see how estate management works on the IT Unlimited Premium plan and our NIS2 technical implementation offering. No-obligation proposal.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
