Accountio / Templates / IT security / IT asset register

IT asset register template (Excel) for accountancy practices

Keep one list of every laptop, phone and router the firm uses and every account on every system, and see straight away which ones need action. This IT asset register template is one Excel workbook with room for 150 devices and 300 accounts, each checked against the Cyber Essentials rules.

UK practices
$15
In the pack
Practice IT security pack
Files
5, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

IT security · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the register looks like

IT asset register template
What the register coversSheet or column in the register
Every device the firm uses
✓
DevicesLaptops, desktops, tablets, phones, servers and routers, including personal devices used for firm work
What each device is and who has it
✓
Asset ID, Type, Make and model, Serial number, Used byWith the operating system and version
Software past its support date
✓
Supported untilFlagged as Unsupported: replace or remove from use
Encryption and malware protection
✓
Encrypted?, Automatic updates on?, Malware protection on?Routers are left out of the encryption and malware checks
Devices behind on security fixes
✓
Last updatedFlagged when the last patch is more than 14 days old, or the number of days you set
Spare and disposed devices
✓
Status, Disposed: date and methodIn use, Spare or Disposed, with how each one was disposed of
Every account on every system
✓
AccountsOne row per person per system: email, accounting software, practice management, payroll, HMRC online services, banking and file sharing
Multi-factor authentication on cloud services
✓
Cloud service?, Multi-factor authentication on?Yes, No or Not available, with No on a cloud service flagged
Separate administrator accounts
✓
Administrator rights?, Separate admin account?Flagged when an administrator has no separate account
Who approved access and when it was last reviewed
✓
Date granted, Approved by, Last reviewed, Next review dueNext review worked out every 3 months, or the period you set
Leavers and role changes
✓
Date left or role changed, Date disabled or removedFlagged until the account is disabled or access removed
What needs action
✓
Check, SummaryOK or the action to take on each row, and counts of devices and accounts needing action

When you need it

An IT asset register is the firm's list of every device and every account, and what each one needs. Cyber Essentials covers every device and cloud service that holds or reaches the firm's data, so the register shows what is in scope and what is not yet compliant. A small practice needs one when:

  • You are preparing for Cyber Essentials and need to know what is in scope
  • Staff use their own phones or laptops for firm email or client files
  • Someone has left and nobody is sure every account was closed
  • Nobody can say which laptops are encrypted or still get security fixes

How to use the IT asset register template

  1. Set your review periods. On Settings, choose how often accounts are reviewed (every 3 months as set) and after how many days without a patch a device is flagged (14 as set).
  2. List every device. One row on Devices for each laptop, desktop, tablet, phone, server and router, including personal devices used for firm work. Delete the example rows first.
  3. List every account. One row on Accounts for each person on each system, including every cloud service, with who approved it and when.
  4. Work through the Check column. Each row shows OK in green or the action to take in red, such as Turn on encryption or Disable this account or remove access.
  5. Review it every quarter. The Summary counts devices and accounts needing action, unsupported devices, cloud accounts without multi-factor authentication and leavers still with access.

Questions

What is an IT asset register?

A list of the hardware and accounts a business uses, with who has each one and its security status. This one keeps devices and accounts on separate sheets, because a leaver's laptop and a leaver's logins need different checks.

What should be in an IT asset register?

For each device: an asset ID, type, make and model, serial number, user, operating system, support end date, encryption, patching, malware protection and status. For each account: the system, the person, administrator rights, multi-factor authentication, who approved it, the last review and the date it was removed.

Does Cyber Essentials require an asset register?

Asset management is not one of the five Cyber Essentials controls, but the NCSC says good asset management helps meet all five. The requirements cover every device and cloud service that accesses the organisation's data, so you need to know what you have before you can show it meets them.

Should personal devices go in the register?

Yes, if they are used for firm work. Under Cyber Essentials, staff-owned devices that access the organisation's data or services are in scope. A phone used only for calls, texts and an authenticator app is out of scope.

How quickly must security patches be installed?

Within 14 days of release for patches that fix critical or high-risk vulnerabilities, or where the vendor gives no details of what they fix. Turn on automatic patching where you can, and remove software once it is no longer supported.

How often should user accounts be reviewed?

The register sets a review every 3 months, which you can change. Cyber Essentials requires accounts to be removed or disabled when they are no longer needed, for example when someone leaves, and extra access removed when someone changes role.

Also in the practice IT security pack

Information security policyDisaster recovery and business continuity planStaff IT acknowledgement

See the whole pack →

Who it's for

Small UK accountancy and bookkeeping practices, with or without Cyber Essentials certification.

Last checked

Checked against the Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026) in November 2026.