In summary
- An IT inventory answers five questions: what equipment do we have, what software and licenses do we pay for, what accounts exist, what contracts tie us down, and where are the data.
- An inventory made once in a spreadsheet becomes outdated within weeks. It must be collected automatically and reviewed regularly.
- For companies covered by NIS2 (Decree-Law No. 125/2025 of December 4), the CNCS regulation requires a list of assets accessible via the internet, built on the asset inventory. First delivery: by January 31 of the year following the notification of qualification, or six months after that, whichever comes first.
- Even outside NIS2, inventory saves money: extra licenses, equipment that is out of warranty, and accounts from former employees appear right away on the first pass.
In this article
- Why inventory has ceased to be a “nice to have”
- What NIS2 specifically requires
- What to inventory: the five layers
- How to keep the inventory alive
- Insurance and audits: the inventory as evidence
- A real case: Apple, Dell and Cisco in the same office
- Frequently Asked Questions
- Complete computer inventory in 10 working days
Computer inventory It is knowing, with rigor, what the company actually has: each computer, server, network equipment, license, account, contract, and the location where the data are stored. It seems obvious. In practice, few companies with 10 to 200 employees can answer today without opening five different files to a simple question like “how many laptops do we have and which ones are out of warranty?”. And without that answer there is no credible budget, planned renewal, or proofable security.
Why inventory has ceased to be a “nice to have”
There are three reasons, all of them management-related:
- What is not known does not protect itself. The old server still connected in a corner, the router from a store with the factory password, the laptop of a former employee that was never returned — these are the points from which incidents begin.
- What is not budgeted is not counted. Without knowing the age of each equipment, the renewal is done when it breaks down, at the price that exists. We explained the correct cycle in when you replace the computers.
- It became required. For the entities covered by NIS2, the inventory is the basis for one of the concrete obligations of the National Cybersecurity Center regulation.
What NIS2 specifically requires
The NIS2 Directive was transposed in Portugal by Decree-Law No. 125/2025 of December 4, which approved the Cybersecurity Legal Regime and came into force 120 days after publication. In June 2026, the CNCS published the implementing regulation (Regulation No. 756/2026).
Article 32 of that regulation obliges essential, important and relevant public entities to prepare, keep up to date and send to the CNCS, via the electronic platform, a list of all assets directly accessible from the internet, It is prepared based on its asset inventory. The list is classified as reserved and includes, among others, the supported service, the name of the equipment or software, the model and version, the operating system, the IP address, the domain names, the manufacturer, and dependencies between assets.
The deadlines:
| Delivery | Timeframe |
|---|---|
| First version | Until January 31 of the year following the notification of qualification, or within six months after that notification, whichever occurs first |
| Update — essential entities | Annually, with the annual report |
| Update — important and relevant public entities | Annually, until the last working day of January of the following year |
Notice the detail: to make a list of what is exposed on the internet, you first need to have an inventory of everything. If your company is or may be covered, start with the guide NIS2 explained for SMEs. DataRoad does not provide legal advice on the framework; it implements the technical measures, including the inventory.
What to inventory: the five layers
| Layer | What to record | Question that answers itself |
|---|---|---|
| Equipment | Computers, servers, firewalls, switches, access points, printers, mobile phones; brand, model, serial number, purchase date, warranty, user, location | What do we have, where is it, and when do we replace it? |
| Software and licenses | Operating systems and versions, applications, Microsoft 365 licenses, antivirus, ERP; how much we pay and how much we use | Are we paying for more? Is there unsupported software? |
| Accounts and access | Users, administrators, shared accounts, provider access, active or not multi-factor authentication | Who gets in, with what privileges, and who should have already left? |
| Contracts and services | Internet, phones, cloud, domains, certificates, maintenance; renewal dates and pre-notifications | What renews itself on its own and when? |
| Data | Where are they (server, cloud, laptops), who is responsible, what backup do they have | If we lose this tomorrow, can we recover? |
How to keep the inventory alive
The most common mistake is to treat inventory as a project with a purpose. A spreadsheet made in March is wrong in May. What works:
- Automatic collection. An agent installed on every computer and server reports hardware, software, and versions without anyone writing anything.
- Integration with the network. The firewall and network equipment show what is connected — including what should not be there.
- Inputs and outputs related to Human Resources. A new employee generates equipment and accounts; an employee who leaves generates returns and closure of access, on the same day.
- Quarterly review. Fifteen minutes with the management: what is out of warranty, what licenses are left, which accounts have not been closed.
- A responsible person. Someone is responsible for the inventory. If it's everyone, then it's no one.
Insurance and audits: the inventory as evidence
If the company has or is considering cyber risk insurance, be prepared to ask questions about what it covers, what protection is in place, and what backups exist. The same applies to client audits, public tenders, and the company’s purchasing processes. An updated inventory transforms weeks of collection into minutes of export — and avoids optimistic responses that, after an incident, could prove costly.
For a first survey, use ours IT hardware audit checklist.
A real case: Apple, Dell and Cisco in the same office
A Reltio, DataRoad, an American data software company with an office in Lisbon, has an IT Unlimited contract with DataRoad for permanent IT maintenance, technical consulting and network management. The list published in the case shows why inventory matters in a mixed office: 125 structured network points, Cisco Meraki equipment (one firewall, three switches and several Wi-Fi access points), 35 Dell equipment and 40 MacBook Pro.
In a park with two operating systems, several equipment families and different warranties, no one can manage it all from memory. How? Apple Technical Partner, We manage Mac and Windows on the same inventory, with the same rigor.
Frequently Asked Questions
Does NIS2 require an IT inventory?
For the entities covered, CNCS Regulation No. 756/2026 requires a list of assets accessible via the internet, prepared based on the asset inventory. In practice, without an inventory, it is not possible to fulfill this obligation.
Will a spreadsheet arrive?
To begin with, yes. To maintain it, no: it becomes outdated in a few weeks. The ideal is automatic collection from computers and the network, with regular review.
What usually gets forgotten?
Accounts of former employees and suppliers, paid and unused licenses, network equipment in stores or warehouses, domains and certificates with automatic renewal, and data stored only on laptops.
How often should it be reviewed?
The collection must be continuous. The review with the management, at least quarterly. For entities covered by NIS2, the list of assets accessible via the internet must be updated annually.
Complete computer inventory in 10 working days
We raise equipment, software, and licenses, accounts, contracts, and data; we identify what is exposed to the internet that is out of warranty or due for closure; and we deliver the inventory with action priorities. For companies with more than 10 locations · support contract · remote, on-site, and telephone support. To keep it alive after the raise, learn more IT Unlimited Premium and our area of NIS2.
Complete inventory in 10 working days
Find out what your company actually has — and what is exposed.
Sources
- Diário da República — Regulation No. 756/2026 of the CNCS (Article 32, list of publicly accessible assets)
- EUR-Lex — Decree-Law No. 125/2025 of December 4 (Legal Regime of Cybersecurity)
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
