Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list of internet-facing assets.
More than 10 workstations · support contract · remote, on-site and phone support
For decision-makers short on time.
Managing an IT estate without an inventory is like running a fleet without knowing how many vehicles you have or when their insurance runs out. An asset inventory gives the board three things: a defensible renewal budget, assurance that nothing forgotten is opening the door to an attack and, for entities covered by NIS2, the raw material for a specific legal obligation towards the CNCS (Portugal's National Cybersecurity Centre). It only works if it is collected automatically and reviewed methodically, never as a spreadsheet built once.
"How many laptops do we have, and how many are already out of warranty?" In most companies with between 10 and 200 workstations, the answer means cross-checking invoices, emails and several Excel sheets. As long as that is the case, equipment renewal is reactive, licences are paid for by estimate and security cannot be demonstrated to anyone.
The first survey usually pays for itself. It almost always turns up subscriptions with no user, machines with no warranty cover and access rights for people who have already left the company.
We recommend organising the register into five levels, each answering a question from the board:
| Level | Minimum fields | Decision it supports |
|---|---|---|
| Hardware | Workstations, servers, firewalls, switches, access points, printers, smartphones; manufacturer, model, serial number, purchase date, end of warranty, user and location | When and how much to renew |
| Software and subscriptions | Operating system and version, applications, Microsoft 365, endpoint protection, ERP; licences contracted versus licences actually used | Where to cut cost and which software is no longer supported |
| Identities | Users, administrator accounts, generic accounts, third-party access, MFA status | Who has access to what, and which access should already have been closed |
| Contracts | Internet, telephony, cloud, domains, certificates, maintenance; renewal dates and notice periods | What renews without a decision and how long you have to exit |
| Information | Where it lives (server, cloud, laptops), who is responsible for it and what backup it has | If it disappeared tomorrow, could it be recovered? |
Two terms to align the conversation. An asset is any element of value to the company that can fail or be attacked, hardware, licence, account, cloud service. Internet-facing means anything a third party can try to connect to from outside: the website, email, the VPN, the firewall, a badly configured IP camera.
Portugal transposed the NIS2 Directive through Decree-Law no. 125/2025 of 4 December, which created the Legal Framework for Cybersecurity, in force since the 120th day after publication. The implementing regulation arrived in June 2026, with CNCS Regulation no. 756/2026.
Under article 32, essential, important and relevant public entities must draw up, update and submit to the CNCS, through its online platform, the complete list of assets directly reachable from the internet, and that list must be based on the entity's asset inventory. The document is classified as restricted and describes, among other fields, the service each asset supports, the name of the equipment or software, model and version, operating system, IP address, domains, manufacturer and interdependencies.
| Obligation | Timetable |
|---|---|
| First submission | Whichever comes first: 31 January of the year following notification of qualification, or six months from that notification |
| Update by essential entities | Once a year, together with the annual report |
| Update by important and relevant public entities | Once a year, by the last working day of the following January |
The sequence is unavoidable: to know what is exposed, you first need to know everything that exists. If your organisation is, or may come, within the scope of the law, start with our NIS2 guide for SMEs. DataRoad does not give legal opinions on scope; we carry out the technical measures, the inventory included.
In accounts belonging to former employees and suppliers, in licences paid for with no user, in network equipment at branches and warehouses, in domains and certificates that renew on their own and in information that lives only on a laptop's hard drive.
A cyber-risk policy starts with a questionnaire on equipment, installed protection and backups. Clients auditing their suppliers, public tender panels and due diligence in acquisitions ask identical questions. With the inventory up to date, the answer is an export that takes minutes rather than weeks of gathering, and there is no risk of declaring something optimistic that, after an incident, turns against the company.
If you want to carry out a first internal survey now, use our IT estate audit guide.
Reltio by SAP (a US data software company with an office in Lisbon) has an IT Unlimited contract with DataRoad covering ongoing maintenance, technical consultancy and network management. In the published case, the estate comprises 40 MacBook Pros, 35 Dell devices, 125 structured cabling points and Cisco Meraki infrastructure with a firewall, three switches and several access points.
Two operating systems, several hardware lines and different warranty periods cannot be managed from memory. As an Apple Technical Partner, DataRoad - IT Services and Consulting keeps Macs and PCs in a single inventory, under the same process.
In practice, yes, for the entities covered: CNCS Regulation no. 756/2026 requires the list of internet-facing assets built from the inventory, and that list cannot be produced without it.
Only as a starting point. Maintained by hand, it is wrong within a few weeks; the sustainable model is automatic collection from workstations and the network, with regular review.
Collection is continuous and the review with the board should be at least quarterly. For NIS2 entities, the list of exposed assets must be updated once a year.
We survey hardware, software and subscriptions, identities, contracts and information; flag what is internet-facing, out of warranty or due to be closed; and deliver the inventory with a prioritised action plan. To keep it up to date afterwards, see how estate management works on the IT Unlimited Premium plan and our NIS2 technical implementation offering. No-obligation proposal.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950 * or write to sales@dataroad.pt.
*Call to a Portuguese landline.
Chosen by respected and international companies
![MUN[it]](/assets/img/logos-c/munit.webp "MUN[it]"){kind=small}
★★★★★ 5,0 · 52 Google reviews
The real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…
· 7 min read
Automated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …
· 5 min read
The question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …
· 6 min read
In Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…
· 6 min read
Without documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…
· 6 min read
The risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…
· 5 min read
A locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…
· 5 min read
A cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…
· 6 min read
A backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…
· 6 min readNumbers you can verify
Partners and certifications
DataRoad · Managed cybersecurity
Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client.
We do IT right.
Documentation, inventory and one contact who answers for everything.
