IT Asset Management for Small Companies: A Lightweight Approach

IT asset management for a small company starts with one register: a record for every laptop, phone, monitor and paid software licence, with who has it, its serial or licence key, its status, and key dates (purchase, warranty, expected replacement). Update it through the processes that already change assets — onboarding, offboarding, repairs, purchases — rather than a separate yearly count. The security payoff is as important as the financial one: you can't protect, patch or recover devices you don't know you have.

Why bother at a small company

With twenty laptops, it seems easy to remember who has what. Then:

• Someone leaves and their laptop isn't returned — or is, and sits in a drawer unwiped.
• A warranty expires the week before a motherboard fails.
• Three people pay for the same SaaS tool on company cards; nobody cancels it when they leave.
• A lost phone had company email on it, and nobody can say whether it was encrypted.

The CIS Critical Security Controls list inventory and control of enterprise assets as their very first control, and software inventory as the second, because every other control — patching, encryption, access removal — depends on knowing what exists.

What to track

A minimal register has one row per asset:

Field	Example
Asset ID	LAP-0042 (a label on the device)
Type	Laptop
Model	14-inch, 16 GB
Serial number	C02XYZ…
Assigned to	Priya Shah
Status	In use
Purchased	2025-03-10
Warranty ends	2028-03-10
Expected replacement	2029-03
Encrypted / managed	Yes / Yes
Notes	Replaced battery 2026-06

For software and SaaS, track: product, plan, seats, owner, cost, renewal date, and who has a seat. The renewal date is the one that saves money — see tracking your team's AI and API spend for the budgeting side.

Don't track what you won't maintain. Cables and mice don't need records; anything with data, a cost over your threshold, or a licence does.

Lifecycle states

Assets move through a small set of states. Keep them explicit:

1. Ordered — on its way.
2. In stock — received, set up, not assigned.
3. In use — assigned to a person.
4. In repair — with a vendor or IT.
5. Lost / stolen — reported; triggers remote lock or wipe and credential review.
6. Retired — wiped and awaiting disposal.
7. Disposed — recycled or sold, with a record of how data was destroyed.

Each state change is an event with a date and who made it. That history answers "who had this laptop in March?" instantly.

Hook it into the processes you already run

The register stays accurate only if updating it is part of existing work, not a separate chore:

• Onboarding creates or assigns the asset — a checklist item on the onboarding request. See the IT onboarding checklist.
• Offboarding returns it and changes its status — see the offboarding checklist.
• Repair requests link to the asset, so repeated faults on one device are visible.
• Purchases create the record when the order is placed, with warranty and expected replacement dates.
• Lost-device requests set the status and trigger the security steps.

When requests in your help desk reference the asset ID, you get repair history for free: "LAP-0042 has had three battery requests in a year" is a replacement decision.

Security basics tied to assets

For every device holding company data:

• Full-disk encryption on, recorded in the register.
• Enrolled in device management, so updates, screen locks and remote wipe are enforced.
• Operating system still supported — the register's model and purchase date tell you which devices are ageing out of updates.
• Assigned to one person, so there's an owner for its security.

For lost or stolen devices: lock or wipe remotely, sign the owner out of all sessions, and rotate any credentials stored on it. The NCSC's device security guidance covers the technical settings in more depth.

Tools: start simple

A spreadsheet works for a first register if it has one owner and is updated through the processes above. Move to a dedicated tool (or an asset module in your help desk) when:

• More than one person updates it and edits collide.
• You want assets linked to requests and people automatically.
• You need history of every change.

Device-management tools often report hardware inventory automatically; use that as a cross-check against your register, not a replacement for ownership and lifecycle data.

Replacement planning

A register with purchase dates turns hardware replacement from a surprise into a budget line. For each device type, set an expected life based on your own experience and the manufacturer's support period — for example, laptops replaced at four years, phones at three. Then, once a quarter:

• List devices reaching their replacement date in the next six months and put the cost in the budget.
• Check which devices will stop receiving operating-system security updates; those move to the front of the queue regardless of age.
• Look at repair history: a two-year-old laptop with three battery requests may be worth replacing early.

Staggered replacement also avoids the trap of buying twenty identical laptops in one year and having all of them fail — and all of them need replacing — in the same later year.

Disposal without data leaks

When a device leaves the company, its data must not:

• Wipe with the device-management tool or a verified method, then record it: who wiped it, how, when.
• Remove it from device management and any cloud account (activation locks can make a device useless to the next owner otherwise).
• Keep a disposal record — recycler, sale or donation, with a certificate of destruction where the recycler provides one.
• Never dispose of drives from devices you can't wipe; destroy them physically.

Audit twice a year

• Compare the register with device-management reports: devices in one but not the other need investigation.
• Ask each person to confirm the assets assigned to them.
• Check warranty and replacement dates for the next six months.
• Reconcile SaaS seats against current staff.

FAQ

What is IT asset management?

Tracking an organization's hardware and software — what exists, who has it, its condition and dates — through its whole lifecycle from purchase to disposal.

What should a small company track in its asset register?

Every device that holds company data or costs more than a set threshold, and every paid software licence: ID, model, serial, assigned person, status, purchase and warranty dates, and security status.

How do I keep an asset register up to date?

Update it through existing processes — onboarding, offboarding, repair and purchase requests — rather than periodic manual counts, and audit twice a year.

Why does asset management matter for security?

You can't patch, encrypt, wipe or recover devices you don't know about. That's why inventory is the first of the CIS Critical Security Controls.

Sources

• CIS — Inventory and control of enterprise assets
• CIS Critical Security Controls v8
• NCSC — Device security guidance
• Atlassian — IT asset management