Insights · Worksheet
Asset and configuration review worksheet
Every control depends on knowing what exists. This worksheet builds the asset and configuration register from discovery and records, reconciles the differences, and rates lifecycle risk so that replacement is planned rather than forced.
How to use it
Before the first step.
- Discovery finds what is on the network; records say what should be; reconciliation finds the truth.
- The register is maintained through change control afterward.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Collect existing records: purchase, inventory, CMDB, cloud accounts, licenses. | IT lead | Record exports |
| 02 | Run network and endpoint discovery across all segments and cloud environments. | IT operations | Discovery output |
| 03 | Reconcile discovery against records; list unknown, missing and duplicate assets. | IT lead | Reconciliation list |
| 04 | Record for each asset: owner, location, function, criticality, data handled. | Asset owners | Register columns |
| 05 | Record configuration baselines for critical systems and compare running configuration against them. | IT operations | Configuration comparison |
| 06 | Record support status: vendor support end dates for hardware, operating systems and software. | IT lead | Support status column |
| 07 | Rate lifecycle risk: unsupported, approaching end of support, single points of failure. | IT lead | Risk rating |
| 08 | Identify assets handling regulated data and confirm they appear in the relevant scope documents. | Compliance lead | Scope cross-check |
| 09 | Produce the replacement and remediation plan for high-risk assets with budget estimates. | IT lead | Plan with estimates |
| 10 | Define how the register is maintained: change control, periodic rediscovery, ownership reviews. | IT lead | Maintenance procedure |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days