Here is a question that makes most IT and compliance teams uncomfortable: can you produce a complete list of every critical asset in your organisation right now? Not a rough sketch. Not a spreadsheet that was last updated eighteen months ago. A current, structured inventory that covers hardware, software, data stores, third-party services, people, and processes.
If you cannot, you are not alone. According to industry surveys, fewer than 30% of organisations maintain an up-to-date asset inventory that meets the requirements of frameworks like ISO 27001, NIS2, or DORA. And yet, asset identification is literally step one in almost every cybersecurity and compliance framework ever written.
Why asset mapping matters more than you think
Asset mapping is not just a compliance checkbox. It is the foundation on which every other security control depends. Consider what breaks without it:
- Vulnerability management. You cannot patch what you do not know exists. Shadow IT, forgotten cloud instances, and legacy systems are the entry points attackers love most.
- Incident response. When something goes wrong, the first question is always "what was affected?" Without a current asset map, your team spends critical hours trying to figure out what is connected to what.
- Risk assessment. You cannot prioritise risks if you do not know what assets carry the most value or the most sensitive data.
- Regulatory compliance. NIS2 explicitly requires "an inventory of assets." DORA mandates "identification and classification of ICT assets." ISO 27001 starts with asset identification in Annex A. There is no shortcut around this.
- Third-party risk. Your asset map should include the external services and vendors your organisation depends on. A breach at a cloud provider or SaaS vendor is your problem too.
What counts as a critical asset?
Most teams think of servers and laptops when they hear "asset mapping." But critical assets span a much wider range. Here is what a complete inventory should cover:
Hardware. Servers, workstations, laptops, mobile devices, network equipment (routers, switches, firewalls), IoT devices, printers, physical access systems.
Software and services. Operating systems, business applications, SaaS platforms, cloud services (AWS, Azure, GCP accounts), APIs, databases, middleware, development tools, CI/CD pipelines.
Data stores. Databases, file shares, cloud storage buckets, backup systems, archives. For each, you need to know what type of data is stored (personal data, financial data, intellectual property, trade secrets) and its classification level.
People and roles. Key personnel with privileged access, system administrators, security team members, third-party contractors with access to systems. People are assets too, and their access rights are part of your attack surface.
Third-party services. Payment processors, email providers, analytics tools, cookie consent platforms, CDNs, DNS providers, identity providers. If it processes your data or your customers' data, it belongs on the map.
Processes and workflows. Business-critical processes like invoicing, customer onboarding, data backup, disaster recovery. Understanding process dependencies helps you identify single points of failure.
The Kontrol Sentinel critical asset mapping template
To help you get started, we have built a structured template that covers all the asset categories above. Use it as a cheat sheet for your next asset mapping exercise or as a starting point for building your own asset register.
| Category | Examples | Key attributes to record | Owner |
|---|---|---|---|
| Hardware | Servers, laptops, firewalls, IoT | Location, serial number, OS, patch status, end-of-life date | IT Ops |
| Software & SaaS | CRM, ERP, cloud accounts, APIs | Version, licence expiry, data processed, SSO status | IT / Procurement |
| Data stores | Databases, S3 buckets, file shares | Data classification, encryption at rest, backup frequency, retention | Data / Engineering |
| People & access | Admins, contractors, key holders | Role, privilege level, MFA status, last access review date | Security / HR |
| Third parties | Payment provider, CDN, analytics, consent platform | Contract expiry, data shared, sub-processors, SLA, incident history | Legal / Procurement |
| Processes | Invoicing, onboarding, backup, DR | Dependencies, RTO/RPO, last test date, SPOF risk | Operations |
| Websites & cookies | Domains, subdomains, tracking scripts | Cookie inventory, consent mechanism, third-party trackers, privacy policy | Marketing / Legal |
PRO TIP — For each asset, also record:
- Criticality level (Critical / High / Medium / Low) — based on business impact if unavailable
- Data sensitivity (Public / Internal / Confidential / Restricted) — drives access controls
- Last review date — stale entries are as dangerous as missing entries
- Regulatory relevance — which frameworks require this asset to be documented (GDPR, NIS2, DORA, ISO 27001)
How Kontrol solutions help you map and manage assets
The Kontrol platform covers several asset categories out of the box:
- Kontrol Consent maps the "Websites & cookies" row. Its domain scanner automatically discovers every cookie, localStorage entry, and third-party tracker on your websites — turning "we think we use Google Analytics" into a documented, categorised cookie inventory with an audit trail.
- Kontrol Reputation monitors the "Third parties" row. It watches your vendors, suppliers, and partners for adverse signals (sanctions, ESG controversies, financial crime) so your third-party asset register is backed by continuous risk intelligence.
- Kontrol Assets handles the "Data stores" row for digital files. Every upload, download, and share is logged with per-user permissions, giving you a complete access audit trail for your document and media assets.
- Kontrol Analytics helps you understand the "Websites & cookies" row from the privacy side. Because it collects no personal data and sets no cookies, it removes one entire category from your cookie inventory — one less thing to manage and explain to regulators.
The compliance angle: what the frameworks actually require
Let us look at what the major frameworks say about asset identification:
How to run your first asset mapping exercise
If you are starting from scratch, here is a practical approach:
1. Define scope and owners. Decide which parts of the organisation you are mapping first. Assign an owner to each asset category from the template above. Do not try to map everything at once — start with the most critical business unit or system.
2. Start with what you know. Pull data from your existing sources: CMDB, cloud console, SaaS admin panels, HR systems, vendor contracts. You will be surprised how much information already exists — it is just scattered.
3. Walk the perimeter. For each category, ask: "what would happen if this disappeared tomorrow?" If the answer is "significant business disruption," it is a critical asset and belongs in your register with a high criticality rating.
4. Include the invisible. Shadow IT, personal devices used for work, spreadsheets stored on local drives, test environments with production data, old domains still pointing somewhere. The things nobody officially manages are often the biggest risks.
5. Automate what you can. Use tools that continuously discover and catalogue assets. Kontrol Consent scans your websites for cookies and trackers. Kontrol Reputation monitors your third-party ecosystem. Cloud security posture management tools can inventory your cloud resources. The goal is to make the register self-updating, not a quarterly manual exercise.
6. Review and repeat. Asset mapping is not a one-time project. Set a cadence — quarterly at minimum, monthly for critical assets. Every new vendor contract, every new SaaS subscription, every new server should trigger an update to the register.
The bottom line
Asset mapping is not glamorous. It is not the cybersecurity topic that gets keynote slots at conferences. But it is the single most impactful thing you can do for your organisation's security and compliance posture. Every control, every audit, every incident response plan starts with the same question: what do we have and where is it?
If you cannot answer that question today, start with the template above. Map one category at a time. Assign owners. Set review dates. And use tools like the Kontrol platform to automate the discovery and monitoring of the assets that fall within its scope — from cookie inventories to third-party risk to digital file management.
The organisations that get breached are not usually the ones with the weakest firewalls. They are the ones that forgot about a server, a vendor, a database, or a cookie.