Asset management and Cyber Essentials
Asset management is not a Cyber Essentials control, but the NCSC says it can help meet all five and should be treated as a core security function. Here is how to build the inventory the question set asks for.
Asset management is not a specific Cyber Essentials control, but the NCSC says effective asset management can help meet all five controls and should be considered a core security function. The question set relies on it: A2.5 to A2.9 ask for counts and versions of network equipment, computers, thin clients, servers, mobile devices and cloud services.
- Status
- Not a specific Cyber Essentials control; a core security function that helps meet all five
- NCSC definition
- Creating, establishing and maintaining authoritative and accurate information about your assets that enables both day-to-day operations and efficient decision making
- Where it is tested
- A2.5 to A2.9 (inventory), A6.2.1 to A6.2.4 (software versions), A7.8 (admin account register)
- What changed in 2026
- Not in the v3.3 what's new list; the section is unchanged in substance
- Source
- Requirements for IT Infrastructure v3.3, Section D, Asset management and Cyber Essentials
Why does the NCSC include asset management in the requirements?
Because you cannot patch, configure or protect a device you do not know about. The requirements say that most business operations depend on some aspect of asset management, and that cyber security should not be considered in isolation or as the primary consumer of asset information. IT operations, financial accounting, software licence management, procurement and logistics all need overlapping information about the same assets, and coordinating them reduces conflict.
Effective asset management, in the NCSC's words, does not mean making lists or databases that are never used. It means creating, establishing and maintaining authoritative and accurate information about your assets that enables both day-to-day operations and efficient decision making when you need it, and in particular tracking and controlling devices as they are introduced into the business.
What does the question set actually ask for?
The scope section is an inventory in disguise. You need:
- A2.5: make, model and quantity of network equipment that controls internet traffic, including firewalls and routers
- A2.6: quantities, make and operating system versions for laptops, desktops and virtual desktops, corporate and BYOD. The model is no longer required, but the edition and feature version of Windows are
- A2.6.1: thin clients with make and operating system
- A2.7: servers, virtual servers, hypervisors and VDI servers with operating systems
- A2.8: quantities, make and operating system versions of tablets and mobile devices
- A2.9: every third-party cloud service in use
- A6.2.1 to A6.2.4: browsers, anti-malware, email clients and office applications with versions
How do I build an inventory that survives assessment?
Pull from systems rather than memory: MDM or Intune device reports for endpoints and phones, the hypervisor console for servers, the identity provider's app registrations and the finance system's subscriptions for cloud services, and the firewall's own admin page for firmware. Record the support end date next to every operating system so that A6.1 becomes a lookup rather than a guess. Review it before each renewal and whenever a device is introduced.
The NCSC has comprehensive separate guidance on asset management, which the requirements document references.
How do assessors check this?
Related requirements
Frequently asked questions
There is no question that asks for a register by name, and the NCSC says asset management is not a specific control. But A2.5 to A2.9 and A6.2.1 to A6.2.4 cannot be answered accurately without one, so in practice every applicant needs an inventory of devices, operating systems, software versions and cloud services.
Quantity, make and operating system version for each type of device, for example '12 x MacBook, macOS Tahoe 26' or '40 x iPhone, iOS 26'. The A2.6 guidance says the edition and feature version of Windows are required, and that the device model no longer needs to be listed. Serial numbers and MAC addresses are not needed.
Yes. A2.9 asks for all cloud services provided by a third party, including IaaS, PaaS, SaaS and social media accounts, and cloud services cannot be excluded from scope.
Whatever produces accurate exports. Intune, Jamf or another MDM for endpoints, the hypervisor or cloud console for servers, and the identity provider plus finance records for cloud services. The NCSC's separate asset management guidance covers the broader discipline.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh