Guide · Cyber Essentials preparation
A Cyber Essentials asset register is a working list, not a document you hand in.
The scheme prescribes no register and asks you to upload nothing. What it does is ask questions about your devices that nobody can answer accurately from memory — so this is what those questions need, taken from the current requirements and question set, and what a list has to do to still be true a year later.
Free to read · no signup · all KitLog guides
- Sourced from NCSC and IASME
- No register format is prescribed
- Nothing is uploaded
- Free spreadsheet at the end
Start from the questions, not from a template
Almost everybody approaches this backwards. They search for a Cyber Essentials asset register, find a template, fill it in, and then discover at assessment time that it answers a question nobody asked while missing two that were. There is no register to produce: the assessment is a question set you answer on IASME's platform, and a board-level representative signs your answers off before an assessor marks them. What the device questions do assume is that you can say, accurately and without guessing, what you have, how many of them there are, what each one runs, and who is using it. A list is how a small company gets to that answer. Which list matters far less than whether it is true — so it is worth reading what is actually asked before choosing a shape to write it in.
What the scheme itself says
Six things worth knowing before you open a spreadsheet, each attributed to the document it comes from. These are the scheme's words rather than ours, and the numbered links go to the sources at the bottom of this page.
- Asset management is not one of the five controls. The requirements document is explicit: asset management “isn't a specific Cyber Essentials control, but effective asset management can help meet all five controls, so it should be considered as a core security function”. Nobody will mark you on your register. You will be marked on answers that are very hard to get right without one. [1]
- You define the scope, and end-user devices cannot be left out of it. Scope means “the networks, hardware and software assets, and cloud services that are included in the assessment”, and it has to be agreed with your certification body before the assessment starts. A partial scope is allowed and has to be justified — but “a scope that doesn't include end-user devices isn't acceptable”, and cloud services cannot be excluded at all. “Devices” is broad: “all types of hosts, networking equipment, servers, networks, and end user devices such as desktop computers, laptops, thin clients, tablets and smartphones – whether physical or virtual”. [1]
- The device questions ask for quantities, makes and operating systems. Not an itemised register. You summarise: the example the question set itself gives is “We have 25 DELL laptops running Windows 11 Professional version 23H2 and 10 MacBook laptops running MacOS Ventura”. Windows editions and feature versions are required. The requirement to list each device's model was removed. [2]
- Serial numbers are explicitly not needed. The question set says so twice: for end-user devices you “do not need to provide serial numbers, MAC addresses or further technical information”, and for network equipment you “are not required to list any IP addresses, MAC addresses or serial numbers”. Keep serials for your own reasons — insurance, theft, telling two identical laptops apart — not because the assessment wants them. [2]
- Laptops, thin clients, servers and mobile devices are counted separately. They are four different questions — laptops, desktops and virtual desktops; thin clients; servers, hypervisors and VDI hosts; tablets and mobile devices — so the one column that genuinely changes your answers is device type. The laptop question applies “to both your corporate and user owned devices (BYOD)”, and the mobile one repeats that a scope without end-user devices is not acceptable. [2]
- Every in-scope device has to be running supported software, patched inside 14 days. Software must “be licensed and supported”, be removed once it becomes unsupported, and have critical or high-risk fixes applied “within 14 days of release”. That is why an operating system version on the row is worth more than a model number: it is the field that decides whether a machine is still answerable. [1]
What is recommended, and what simply follows
None of the following is a control you are marked against. All of it is either guidance the scheme points you at, or a consequence of the scoping rules above that a list has to cope with.
- Record who is responsible for each asset and what it is used for. The NCSC's asset management guidance asks for exactly that, alongside knowing what you have. It is also the single field that makes a device count checkable: a row with a named human beside it can be confirmed by asking them. [3]
- A list nobody opens is not asset management. The requirements document puts it bluntly — effective asset management “doesn't mean making lists or databases that are never used”, but maintaining “authoritative and accurate information about your assets” that supports day-to-day operations. A register that is only written the fortnight before a renewal describes one afternoon a year. [1]
- Staff-owned devices belong on the list too. User-owned devices that access organisational data or services are in scope, with the narrow exception of devices used only for native voice and text and for MFA prompts. You are not going to hold a serial number for somebody's own phone — but you do need to be able to say how many there are and what they run. [1]
- So do company devices somebody else is using. End-user devices your organisation owns and has loaned to a third party must be included in the scope. If you lend laptops to contractors, volunteers or a partner organisation, those loans are part of your answer, which is a custody question before it is a security one. [1]
- Name the person responsible for the in-scope systems. The question set asks for the name and role of whoever manages them, and says that person “must be a member of your organisation and cannot be a person employed by your outsourced IT provider”. Worth settling early if an MSP runs your estate. [2]
Which columns earn their place
Nine columns, and the third one is the point of the table: only four of them are there because the assessment asks. The rest are there because a list that cannot be kept accurate stops being able to answer the four.
| Column | Why it is there | Basis |
|---|---|---|
| Device type | Laptop, desktop, virtual desktop, thin client, server, tablet, phone. The four device questions are answered per type, so this is the column that decides which answer a row belongs in. | Asked |
| Make | The manufacturer, as the question set words it — Dell, Apple, Lenovo. The model is no longer required for end-user devices. | Asked |
| Operating system and version | “Windows 11 Pro 24H2”, not “Windows”. Editions and feature versions are required, and this is the field that goes stale fastest. | Asked |
| Quantity | The answers are summaries — so many of this make running that version. One row per physical device is still the easiest way to produce a count you can defend. | Asked |
| Owner or current user | A named human, not a department. Nothing asks for it, and it is the field that lets you check the rest: you can confirm a device exists by asking the person holding it. | Recommended |
| Company-owned or staff-owned | BYOD is in scope and is treated differently by almost every other process you run. Two rows that look identical can need very different answers. | Follows from scope |
| Status | In use, spare, in repair, retired. Retired devices drop out of scope and out of the counts, and a register that cannot mark them ends up over-reporting. | Your own operations |
| Serial or asset tag | Explicitly not required by the assessment. Keep it anyway: it is what tells two identical laptops apart, and what an insurer or the police ask for when one goes missing. | Not asked |
| Support end date | When the vendor stops issuing fixes. The scheme defines supported software by the existence of that date, so writing it down turns a renewal scramble into a sort. | Recommended |
Keeping the list true between renewals
Registers do not go wrong at the keyboard. They go wrong at arrivals, handovers and departures — and at the scoping decision nobody wrote down. Five habits, every one of them a person's job rather than a spreadsheet's.
- Write the scoping decision down, not just its result
Whether the director's home desktop, the spare in the cupboard or the phone somebody reads email on is in scope is a decision you made. Record what you decided and why, because the question comes back at renewal and is answered by a different person half the time. - Add the row when the device arrives, not when you need the list
A device entered on the day it was unboxed is a fact. The same device entered eleven months later is an archaeology exercise, and the operating system column is a guess. - Change the owner at the handover
This is the one that quietly breaks every register. A laptop reassigned verbally is a row that now names the wrong person, and a wrong name is worse than a blank one: it looks checked. - Close the leavers before the last day
Somebody who left in March cannot be the current user of a laptop in November. Either it came back and the row is stale, or it did not and the row is a finding sitting in plain sight. - Re-read it on a schedule, and diff rather than rewrite
Quarterly is plenty for most small companies. Walk the list against reality and correct the differences; rewriting it from scratch loses the history that makes the previous answer explicable.
Where KitLog fits, and where it does not
Everything above is true whether or not you ever use this product, and a spreadsheet does most of it. What KitLog is for is the middle column of the table above — the five moments a device changes hands — because that is the part a file cannot do for you.
What the product does
- One row per device, with a current holder. Type, make, model, serial, asset tag, status, purchase date and cost, with notes for the operating system and its version. Assigning a device to somebody updates the owner column as a side effect of the handover rather than as a thing to remember.
- A device inventory export. Asset tag, device make and model, type, serial, owner and their email address, status, purchase date and OS notes, as a CSV, with retired kit left out. It is the working evidence you answer the device questions from — you still answer them.
- The handovers, in both directions. Every assignment and return stays on the device and on the person, dated, with the condition recorded at each end. That is what makes a count checkable a year later instead of merely current.
- The leaver chase. Set somebody's last working day and their record becomes a return list, with reminders to your team and to them 14, 7 and 2 days before they go. Open loans against a person who has left are an alert rather than a silence.
- A starting spreadsheet, and a way out. The free template below is the same shape and imports unchanged, and the register exports back to CSV whenever you want it. Nothing here depends on staying.
What it does not do
- It discovers nothing. There is no agent, no network scan and no patch reporting. KitLog knows the devices you told it about, so it cannot tell you about the laptop nobody entered — which is the gap a scan would find and a register never will.
- It does not check or apply anything. Operating system versions are a note you maintain, not a reading. Nothing here installs an update, measures a patch level or knows whether a machine is inside the 14 days.
- It holds no cloud services, accounts or networks. Several of the questions are about cloud services, firewalls, routers and user accounts. This is a register of physical equipment and the people responsible for it; the rest of your answers come from elsewhere.
- It answers no questions on your behalf. The self-assessment is completed and submitted by you, signed off internally and marked by an assessor. KitLog is preparation evidence and nothing else.
Questions, answered
- Is there an official Cyber Essentials asset register template?
- No. The scheme prescribes no register format and there is no register to upload with the questionnaire, so anything sold as the official one is describing a document that does not exist. What exists is a question set, published free, that asks you to summarise your in-scope devices by type, make and operating system.
- Do I need to list every device individually?
- Not for the assessment. The device questions ask for quantities and operating systems — “25 Dell laptops running Windows 11 Pro 24H2” is the shape of the expected answer. Most small companies still keep one row per device, because that is the only practical way to produce a count that is right and to notice the machine nobody has seen for a year.
- Does the register need serial numbers?
- The question set says you do not need to provide serial numbers, MAC addresses or further technical information for end-user devices, and the same for network equipment. Serials are worth keeping for theft, insurance and telling identical machines apart — just not because the assessment asked.
- What about laptops staff own themselves, or ones we have lent out?
- Both are in scope. User-owned devices that access organisational data or services count, apart from devices used only for calls, texts and MFA prompts; and company-owned devices loaned to a third party have to be included. You are unlikely to hold a serial for a personal phone, so record the count, the make and the operating system, and be able to say who has what.
- How often should the list be reviewed?
- There is no mandated cadence. Quarterly is a reasonable rhythm for a small company, and the moments that matter more than any schedule are arrivals, handovers and departures — a list updated at those three points is usually right without a review, and one that is not will be wrong again a fortnight after each one.
- Does using KitLog mean we will pass?
- No, and nobody can honestly say otherwise. Cyber Essentials tests five technical controls — firewalls, secure configuration, security update management, user access control and malware protection — and a register is not one of them. What it does is let you answer the device questions from a record rather than from memory.
Sources
Primary documents only, all free to read. The scheme is owned by the NCSC and delivered by IASME, and both revise their material — check the version before you rely on a quotation, including the ones above.
- Cyber Essentials: Requirements for IT Infrastructure v3.3 — National Cyber Security Centre, April 2026. The scheme's own requirements document. The question set asks whether you have read it before you answer anything else.
- Cyber Essentials self-assessment question set — IASME Consortium, version 16, April 2026. The questions themselves, free to download before you register for an assessment. Answers are entered on IASME's platform.
- Asset management (10 Steps to Cyber Security) — National Cyber Security Centre, version 1.0, 11 May 2021. The guidance the requirements document points at when it says asset management is not a control but supports all five.
- Cyber Essentials overview — National Cyber Security Centre, current guidance. Who owns the scheme, who delivers it, and how a self-assessment is marked and signed off.
- Important update: changes to Cyber Essentials for April 2026 — IASME Consortium, published 2025. What moved in the April 2026 revision, and when the new requirements start applying to new assessment accounts.
If the list is the job rather than the reading
KitLog keeps the same information as a live register: one row per device with a current holder, every handover and return kept on the record, a device inventory export for the questions above, and a return checklist with reminders when somebody leaves. Starter is £9 a month + VAT for up to 300 assets, unlimited users on every plan, and the trial is 14 days with no card.