A device register you can answer the Cyber Essentials questions from.
The self-assessment asks which devices are in scope and who uses them. This is somewhere to write that down properly — one row per device, with the columns those questions actually need.
Download the CSV- No email address needed
- 9 columns, one row per device
- Notes on what goes in each
- Imports into KitLog as-is
What this file is, and what it is not
Cyber Essentials prescribes no register format, and there is no register to upload with the questionnaire — the assessor reads your answers, not your spreadsheet. What the device questions do assume is that you can say what you have, who uses it, and whether it is still receiving security updates. That is a list, and this is a sensible shape for one. Treat it as the working evidence behind your answers rather than a document anybody will ask you to hand over.
Every column, and what belongs in it
Nine columns, in the order the file opens. None of them is mandatory to Cyber Essentials — they are here because each one answers something the questions ask, or makes the row findable a year later.
| Column | What goes in it | Example |
|---|---|---|
| tag | Your own number for the device — a sticker, an engraving, whatever you already use. Invent a scheme if you have none; it is the only column that makes two identical laptops tellable apart on paper. | LT-001 |
| name | Make and model, written the way somebody would say it out loud. | MacBook Air M3 |
| category | Laptop, desktop, phone, tablet. The device questions are answered per type, so this is the column you will end up sorting by. | Laptop |
| serial | The manufacturer's serial number. This is what ties a row to a physical object when an insurer or the police ask. | C02XYZ123 |
| status | available, assigned, repair or retired. Retired rows stay in the file and drop out of scope. | assigned |
| assigned to | The person who actually uses it. A named human, not “Finance” — a department cannot hand a laptop back. | Jane Smith |
| purchase date | Year-month-day. Age is the cheapest predictor of a device falling out of vendor support. | 2025-03-01 |
| purchase cost | A plain number with no currency symbol, so the column still adds up. | 1099 |
| notes | The operating system and its version belong here. There is no column for it because the answer changes far more often than the rest of the row. | macOS 15, auto-update on |
Filling it in without doing it twice
- Settle the scope before the first row
Decide what you are declaring: company-issued end-user devices are the obvious core, and anything else — servers, personal phones reading company mail, a director's home desktop — is a decision you make and can defend. Write the decision down somewhere; it is the question that comes back. - One row per physical object
Two identical laptops are two rows with two serials. A row that means “four of these” cannot say who holds which, which is the half the questions care about. - Name a person, not a team
The owner column is the one an auditor's follow-up question lands on, and “IT” is not an answer to “who uses this device”. - Put the operating system in notes, with its version
The device questions ask whether software is still supported by its vendor. “Windows” does not answer that; “Windows 11 24H2” does. - Set a date to read it again
A register is wrong the month after you write it. Put a recurring reminder in a calendar — quarterly is plenty for most small companies — and diff it against reality rather than rewriting it.
Four things that make a register wrong on paper
- A device marked available that is in somebody's bag. This is the exact gap the questions are testing for, and it is the most common one. If you cannot say where a row's device physically is, the row is a guess.
- Leavers still in the owner column. Somebody who left in March cannot be the current user of a laptop in November. Either it came back and the row is stale, or it did not and the row is a finding.
- A “spare” with nobody's name against it. Shared and pool devices still get used by people. Record who has it now and change the row when it moves, or record the person responsible for the pool.
- An operating system recorded two refreshes ago. The note that said “Windows 10” when you wrote it is now the answer to a question about unsupported software. This is why the review date matters more than the first pass.
Download the asset register template
CSV · opens in Excel, Numbers or Google Sheets. Free, and there is no email address to give — the button is the file.
Download the CSVPrefer it in your inbox? We'll email you the link:
One email with your download link — no mailing list, no follow-up spam.
When the spreadsheet stops being true
A register goes stale at the handover, not at the keyboard — the row is correct until a laptop changes hands and nobody opens the file. KitLog is the same nine columns with the handover built in: assign a device to somebody and the owner column maintains itself, mark a person as leaving and their kit becomes a return checklist, and the device inventory exports as CSV when you sit down to answer the questions. The file above imports into it unchanged, so nothing you type now is wasted.
Questions, answered
- Is there an official Cyber Essentials asset register template?
- No. The scheme sets no prescribed register format and applicants do not submit a register alongside the questionnaire, so anything claiming to be the official one is describing a document that does not exist. What matters is that you can answer the device questions accurately; a list like this is how most small companies get there.
- What counts as a device in scope?
- That is your scoping decision rather than something a template can settle. The usual core is company-issued end-user devices — laptops, desktops, tablets, phones — used to access organisational data or services. Servers, cloud services and personal devices used for work each have their own treatment, so read the current scheme requirements from IASME and record what you decided and why.
- Do we need to list monitors, docks and mice?
- Generally no — the device questions are about things that run an operating system and reach your data. Peripherals are worth tracking for other reasons, which is what an ordinary equipment register is for, but padding the file with them makes the rows that matter harder to check.
- Can we keep using the spreadsheet after we certify?
- Plenty of people do. The thing to watch is not the format but the review: a file that nobody updates between renewals is a snapshot of one afternoon, and renewal asks the same questions again a year later.