Every IT team knows they should have a solid device inventory. Few actually do. Audits get deferred, spreadsheets go stale, and when compliance or security incidents hit, you're scrambling to figure out what you have. This checklist gives you a framework to audit your IT asset management process and identify gaps—whether you're starting from scratch or tightening up an existing system.
1. Hardware Tracking
Hardware is the foundation of IT asset tracking. You need to know what physical devices exist, where they are, and what they're capable of. Manual audits are time-consuming and error-prone; automated inventory pulls this data directly from the device.
Serial numbers and asset tags
Every device should have a unique identifier for warranty claims, theft recovery, and audit trails. Serial numbers are manufacturer-assigned; asset tags are your internal IDs. Both matter. During audits, auditors and insurance providers will ask for proof of asset existence—serial numbers are the gold standard.
- Capture manufacturer serial numbers for laptops, desktops, monitors, and peripherals
- Maintain your own asset tag or barcode if you use them internally
- Link serial numbers to purchase orders and warranty expiration dates
Model, manufacturer, and specs
Knowing the model and specs helps with capacity planning, lifecycle management, and support. A machine with 4GB RAM running modern productivity software is a different risk than one with 32GB. Specs also determine upgrade eligibility—you can't move everyone to Windows 11 if half your fleet fails the TPM or RAM requirements.
- Record manufacturer (Dell, HP, Lenovo, Apple, etc.)
- Capture model name and number
- Track CPU, RAM, disk type and size
- Note GPU for workstations that need it
2. Software Inventory
Hardware alone isn't enough. You need visibility into what software is installed, which versions are running, and whether licenses are properly allocated. Unapproved or outdated software creates security and compliance risk.
Installed applications and versions
A complete software inventory includes every application on every device. You're looking for shadow IT (unauthorized installs), outdated versions with known vulnerabilities, and duplicate or conflicting software. Version tracking is critical—Chrome 110 and Chrome 120 are very different from a security standpoint.
- List all installed applications (not just the ones you expect)
- Track version numbers for security-sensitive software (browsers, OS, office suites)
- Identify unauthorized or non-standard software
License tracking
Over-licensing wastes budget; under-licensing creates compliance risk. You need to correlate installed software with your license entitlements. Many teams discover they're paying for 500 seats of Adobe Creative Cloud while only 300 are actually installed—or worse, 600 are installed and they're paying for 500.
- Map installed software to license counts
- Flag devices with unlicensed commercial software
- Track license expiration and renewal dates
3. Network Information
When troubleshooting, responding to incidents, or auditing network segmentation, you need to know how devices identify themselves on the network. IP addresses change; MAC addresses and hostnames are more stable but still need to be current.
- IP address: Current IPv4 and IPv6 addresses (these can change with DHCP)
- MAC address: Hardware identifier that persists across reboots
- Hostname: Device name as it appears on the network (important for AD joins, DNS, and remote access)
- Domain: Whether the device is domain-joined and which domain
For incident response, being able to search "show me all devices with this MAC" or "which device has hostname XYZ" is invaluable. Network info also helps with NAC (Network Access Control) and firewall policy validation.
4. User Assignment and Location Tracking
Assets need to be tied to people and places. Who is responsible for this laptop? Where is it? When someone leaves, which devices need to be recovered? Location data also supports physical security and capacity planning (e.g., how many devices in Building A vs. remote).
- Assign each device to a user or department
- Track physical location (office, site, remote)
- Record assignment date and last verified date
- Maintain an offboarding checklist that includes asset recovery
User assignment is often the messiest part of manual inventory. People change roles, devices get reassigned without paperwork, and "shared" devices fall through the cracks. Automated tools can pull the logged-in user from the OS, which helps—though you still need a process for shared or kiosk devices.
5. Compliance and Security Auditing
Compliance isn't optional for most organizations. SOC 2, HIPAA, ISO 27001, and industry frameworks all expect you to know what you have and whether it meets baseline security requirements. Auditors will ask for evidence.
- Identify devices running end-of-life operating systems (Windows 7, 8, Server 2012, old macOS)
- Ensure approved endpoint protection (AV/EDR) is installed and active on every device
- Enforce minimum browser versions to reduce web-based attack surface
- Detect unauthorized remote access tools (TeamViewer, AnyDesk, etc.)
- Block or flag known malware disguise filenames
Compliance rules should run continuously, not just during audit prep. The goal is to catch deviations before they become findings. For a deeper dive, see our post on 5 Software Compliance Rules Every IT Team Should Set Up.
6. Retirement and Disposal Procedures
The lifecycle doesn't end when a device is replaced. Proper disposal prevents data leakage, supports environmental compliance (e-waste), and ensures you're not still counting retired assets in your inventory or license counts.
- Document a formal decommissioning process (data wipe, asset tag removal, disposal method)
- Remove retired devices from active inventory promptly
- Maintain an audit trail of disposal (who, when, how)
- Update license counts when devices are retired
Many teams forget to remove retired devices. They keep paying for licenses, and their inventory reports inflate over time. A good system lets you mark devices as retired or archived while preserving historical data for audits.
How InventoryOS Covers This Checklist
Manually maintaining this checklist across hundreds or thousands of devices isn't realistic. Spreadsheets decay, audits are painful, and by the time you finish, the data is already stale. InventoryOS automates the bulk of it.
Deploy a lightweight agent to your Windows and macOS devices—via GPO, script, or manual install. Within minutes, devices start reporting hardware specs, serial numbers, installed software with versions, network info, and logged-in user. Compliance rules run automatically and flag violations. You get a searchable, filterable inventory that stays current without manual updates.
Use this checklist to validate what you're capturing. If you're still on spreadsheets, identify which items are missing or stale. If you're using an inventory tool, confirm it covers each section. Gaps in any area create risk—and unnecessary work when the next audit or incident hits.