Cyber Essentials asset register template
The itemised list behind your scope statement: every computer, phone and tablet with its operating-system version, every router with its model, any servers, and every cloud service — in the four tables the assessment actually asks about. Free, as a spreadsheet.
Download the template
A CSV with the four tables below and one example row in each. Opens in Excel, Numbers and Google Sheets (File → Import). Nothing is uploaded.
Computers, phones & tablets
| What | Make | Operating system & version | How many | Company or personal (BYOD) |
|---|---|---|---|---|
| Office laptops | Dell Latitude | Windows 11 — version from Settings › System › About | 6 | Company |
Network equipment
| What | Make & model | How many | Notes |
|---|---|---|---|
| Office router | [Make] [Model] | 1 | Boundary firewall in place; admin password changed from default |
Servers
| What | Operating system & version | How many |
|---|---|---|
| (none) | — | 0 |
Cloud services (including social media accounts)
| Service | What we use it for | Two-factor login available? | Two-factor on for every user? |
|---|---|---|---|
| Microsoft 365 | Email, files | Yes | Yes |
Why you need one
The scope section of the Cyber Essentials questionnaire (A2) asks you to list what the certificate covers: laptops and desktops with make and specific operating-system version (A2.6), phones and tablets with make and OS (A2.8), routers and firewalls with make, model and quantity (A2.5), any servers (A2.7), and every cloud service including business social-media accounts (A2.9). An asset register is simply that list, kept in one place — and because the version of each operating system decides whether a device counts as supported, it is also the quickest way to spot an automatic fail before an assessor does.
How to fill it in
- Be specific about operating systems. “Windows 11” is not enough; write the version shown in Settings → System → About. On a Mac, About This Mac. On phones, Settings → About. If you cannot find it, write “to be confirmed” rather than guessing, and come back to it.
- Include personal devices used for work. A staff member’s own phone with the work mailbox on it is in scope. Mark it as personal (BYOD) so the register matches your scope statement and any personal-devices policy.
- List every cloud service, including social media. Email, accounting, file storage, CRM, project tools, payment platforms, and the business accounts on LinkedIn, Facebook, Instagram and the rest. For each, note whether it offers two-factor login (almost all do) and whether it is switched on for every user — that is where the MFA automatic fails come from.
- Group identical devices. “Six Dell laptops, Windows 11 [version]” is one row with a quantity; you do not need a row per machine unless they differ.
- Keep it current. Add a line when a device is replaced or a new service is adopted. The register is the document you will reach for at renewal.
What it feeds
Your scope statement is a short prose summary of this register. The device table feeds the security-update questions (is everything supported, are updates automatic); the cloud-services table feeds the MFA questions (A7.14 to A7.17). Getting the register right first makes the scope section largely a matter of copying.
Frequently asked questions
Does Cyber Essentials require an asset register?
The scope section asks you to list your devices with operating-system versions, your routers and firewalls with make, model and quantity, any servers, and every cloud service. An asset register is that list in one place; it is the simplest way to answer those questions and keep them current for renewal.
What should a Cyber Essentials asset register include?
Computers, phones and tablets (make, exact OS version, quantity, company or personal); network equipment (make, model and quantity); servers if any; and cloud services including business social-media accounts, noting whether two-factor login is available and switched on.
Do personal phones go in the asset register?
Yes, if they are used for work email, files or data. Mark them as personal (BYOD). They are only out of scope if used solely for the phone’s built-in calls and texts, or two-factor codes.
Can I use this template in Excel or Google Sheets?
Yes. It downloads as a CSV, which opens directly in Excel and Numbers and imports into Google Sheets via File → Import.