Operators ask most what counts as an asset, which fields to record and whether SMB1001 Gold requires a register.
What is a digital asset register, and does my business actually need one?
A digital asset register is a maintained list of the information and technology your business relies on: devices, user, admin and service accounts, SaaS and cloud services, domain names and DNS, data stores and the places personal information lives, software and licences, network gear, and systems a supplier runs for you. Each entry records an owner and a few security facts. The short policy that goes with it says what must be recorded, who keeps it current and when it is checked. No single Australian law requires every private business to keep a document with this exact title. Australian guidance still assumes you know what you have: business.gov.au tells businesses to identify the technology and information assets that matter to them, the OAIC suggests a list or register of the types and locations of personal information you handle, and the ISM expects registers of systems, IT equipment, software and cloud services. The register is also what makes patching, backups, access reviews and breach response workable, and it is reportedly an SMB1001 Gold requirement.
- sole trader or micro business (under 5 staff) — A one-page spreadsheet covering laptops and phones, the main cloud accounts, the domain name, and where customer data is kept is usually enough to start.
- business using a managed service provider (MSP) — The MSP may already hold device and licence data in its tools, but SaaS sign-ups, domains and supplier-held data are often missing. The business should own the register and be able to get a copy of it.
- business working towards SMB1001 Gold — Provider summaries of the 2026 edition list a digital asset register among the Gold controls, so the register stops being optional for that certification.
The organisation maintains a digital asset register of the information and technology assets it owns, uses or relies on. The register covers end-user devices, servers and network equipment; user, administrator, shared and service accounts; software, licences and online services, including SaaS and cloud services; domain names, DNS and email-sending services; data stores and the locations of personal information; removable media; and systems operated on the organisation's behalf by suppliers. An asset that is not recorded in the register is not approved for business use.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What must it contain: the non-negotiable sections and minimum fields?
The policy needs five things: a scope saying what counts as an asset, the minimum fields, who maintains the register, the events that trigger an update, and how often it is reviewed. It should also say how the register feeds patching, backups, access reviews, incident response and disposal. For each asset, record an ID, a description and type, a business owner, a custodian and location (a site, cloud tenancy or supplier), a classification, whether it holds personal information, support and patch status, MFA status, backup status, the supplier and contract, the record's status and the next review date. ASD's own registers are a useful model. The ISM's managed service and outsourced cloud service registers record the provider, the service, its purpose, the sensitivity of the data, the next assessment date, contractual arrangements and contacts, and its software registers record versions and patch histories. Only include fields you will actually keep up to date. A short spreadsheet that is current is worth more than a detailed one nobody trusts.
- cloud and SaaS-heavy business — Accounts, SaaS subscriptions, domains and data stores will outnumber devices. Record the tenancy or provider as the location and the admin account owner as custodian.
- business with an office network, printers or on-site servers — Add network equipment, multifunction devices and any non-networked equipment, and note firmware support status as well as operating-system support.
- ISM-aligned or government-supplier business — The ISM specifies separate registers (systems, networked and non-networked IT equipment, software, removable media, managed services and outsourced cloud services). A small business can keep them as tabs of one register, provided each required field is present.
Minimum fields for every asset in the register: 1. Asset ID 2. Asset name and description 3. Asset type: device, account, software or licence, SaaS or cloud service, domain or DNS, data store, network equipment, removable media, or supplier-held system 4. Business owner (a named person) 5. Custodian and location: site, cloud tenancy or supplier 6. Classification: Public, Internal, Confidential or Sensitive 7. Personal information held: Yes or No, and the kinds held 8. Support and patch status: current version, date last patched, vendor end-of-support date 9. MFA enforced: Yes, No or Not applicable 10. Backed up: Yes or No, method, date of last successful restore test 11. Supplier and contract reference 12. Status: in use, retired or disposed, with a link to the disposal record 13. Date added 14. Next review date
A model clause — adapt the bracketed decisions to your organisation before you use it.
What does the law or a framework require here, and how fast?
Under APP 11, an APP entity must take reasonable steps to protect the personal information it holds and to destroy or de-identify it once it is no longer needed, including archived and backup copies. The OAIC says 'holds' covers records you have the right or power to deal with, such as data stored by a supplier. You cannot protect or destroy information you cannot find, which is why the OAIC suggests a register. At Essential Eight Maturity Level One, an automated asset discovery method must run at least fortnightly, critical or actively exploited vulnerabilities in internet-facing services must be patched within 48 hours, and unsupported applications and online services must be removed. All of these depend on an accurate list. The ISM expects IT equipment, software and cloud service registers that are maintained and regularly verified. For SMB1001, an Australian provider's summary of the 2026 edition lists a digital asset register among the 27 Gold controls, and a licensed holder reports that SMB1001:2027 widens it to cover physical as well as IT assets. ISO/IEC 27001:2022 Annex A includes A.5.9, an inventory control. If personal information is involved in a suspected breach, the NDB assessment must be completed within 30 days at most.
- APP entity covered by the Privacy Act (generally annual turnover over A$3m, or a covered small business such as a health service provider) — APP 11 applies. The register should show where personal information is held, including supplier-held copies and backups, so that both protection and destruction can be shown.
- small business not covered by the Privacy Act — APP 11 may not apply directly, but clients, insurers and certification schemes increasingly expect the same visibility. Treat it as good practice and a contractual expectation.
- Essential Eight Maturity Level One target — Fortnightly automated asset discovery and the patching and unsupported-software rules need a register to check against. Without one, maturity cannot be shown.
- SMB1001 Gold (2026 edition), moving to the 2027 edition — A digital asset register is reported among the Gold controls. A licensed holder reports the 2027 edition broadens it to physical assets and applies when you next certify or renew. Confirm against DSI's published text.
The register must identify every system, service and data store that holds personal information, the kinds of personal information involved and where they are located, including copies held in backups and by suppliers. Each technology asset must record its vendor support status. Assets no longer supported by the vendor must be removed or replaced, or covered by an approved, time-limited exception with compensating controls.
A model clause — adapt the bracketed decisions to your organisation before you use it.
Who owns it, and who has to sign it off?
Accountability for the register sits with the business, not only with IT or the managed service provider. Name one register owner, often the person responsible for security or operations, and have the directors or business owner approve the policy. Every asset also needs a named business owner, who decides classification, access and retirement, and a custodian (often the MSP or an internal admin), who keeps the technical fields accurate. The ISM expects the board or executive to understand what systems exist, their value, where they reside, who has access and how they are protected. It also expects a register of systems to be maintained and regularly verified. The OAIC suggests designating people who know what personal information is held, where and how, and who answer to senior management. If an MSP keeps the register in its own tools, the contract should confirm the business owns that data and can get a full copy at any time.
- owner-operated business — The owner is usually both the policy approver and the register owner. Use the MSP or bookkeeper as custodian for the fields they can see.
- business with a board or management committee — The board approves the policy and should receive an annual summary of critical assets, personal-information locations and unsupported assets.
- outsourced IT — Make the MSP the custodian, not the owner. Put register access, export and handover obligations in the contract.
The [role, e.g. Operations Manager] owns this policy and the digital asset register and is accountable to [the directors / the business owner], who approve this policy. Every asset has a named business owner, who approves its classification, access and retirement, and a custodian, who keeps its technical details accurate. Where a managed service provider maintains the register, the organisation retains ownership of the register and can obtain a complete, current copy on request.
A model clause — adapt the bracketed decisions to your organisation before you use it.
How does it actually get used by the team?
A register only stays current if updates are tied to things that already happen: purchases and new subscriptions, joiners, movers and leavers, and decommissioning. The working rule is simple: nobody signs up for a new online service or connects a device for work until it is recorded. When someone leaves, the register shows every device to recover, every account to disable and every shared credential to change. ACSC's small-business guide already asks for a list of shared accounts and who can use them, and for those logins to be changed when staff leave. To catch shadow IT, regularly compare the register with discovery sources: device-management exports, the identity provider's app list, card statements and supplier invoices, DNS records and network scans. Essential Eight Maturity Level One expects automated asset discovery at least fortnightly. The register then drives routine work. Support status feeds patching, the backup field shows what is protected, and the account entries feed access reviews.
- business with frequent staff turnover or contractors — Link the onboarding and offboarding checklists to the register so device, account and licence entries are updated on the same day.
- business where staff buy their own SaaS on a card — Review card statements and expense claims monthly for new subscriptions, and register or cancel each one.
- Essential Eight Maturity Level One target — Use an automated discovery tool (often part of the MSP's device-management or vulnerability scanner) at least fortnightly, and reconcile its output with the register.
The register must be updated within [5] business days when an asset is purchased, subscribed to, connected, transferred, retired or disposed of, and when a person joins, changes role or leaves. Staff must not sign up for, connect or use a new device, account, application or online service for business purposes until it has been recorded and approved. At least [monthly], the custodian must compare the register with discovery sources, such as device-management and identity-provider reports, network scans, DNS records and supplier invoices, and resolve any unrecorded assets.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What evidence proves it's real to an auditor or insurer?
An auditor or insurer wants to see three things: that the register exists, that it is current, and that it is actually used. Strong evidence includes the register itself with a 'current as at' date and change history, signed review records, and reconciliation output (a discovery scan or device-management export compared with the register, with discrepancies resolved). Leaver and decommissioning checklists that reference register entries help too, as do patch and backup reports that line up with registered assets, and sanitisation or destruction certificates for disposed devices. The ISM expects security documentation to be reviewed at least annually and to carry a 'current as at' statement, which works well for a register. Current CyberCert material describes SMB1001 Gold as a light-touch self-assessment, and a provider summary says a director signs off that the controls are in place. The evidence should exist even if nobody asks for it at certification.
- SMB1001 Gold (self-assessed) — A director attests that the register exists and is maintained. Keep the dated register and review records so the attestation can be supported if questioned by a client, insurer or certifier.
- ISO/IEC 27001 certification — Auditors will sample register entries against reality (for example a laptop or SaaS tenancy) and check the inventory control is applied as the Statement of Applicability says.
- business renewing cyber insurance — Proposal forms may ask about asset inventories, unsupported systems and backups. Answer from the register so the answers can be supported later.
The register owner must keep evidence that the register is maintained and used, including: the register with a 'current as at' date and change history; signed review records; discovery or reconciliation reports and how discrepancies were resolved; leaver and decommissioning checklists; and sanitisation or destruction records for disposed assets. Evidence must be retained for at least [two] years.
A model clause — adapt the bracketed decisions to your organisation before you use it.
How often must it be reviewed, and what triggers an off-cycle review?
Do a full review of the register and policy at least once a year, matching the ISM's annual review expectation for security documentation. Add a lighter reconciliation monthly or quarterly so drift is caught early, and have asset owners confirm their entries. The ISM wording for its registers is 'maintained and regularly verified', which means a continuing process rather than a one-off list. Some events should trigger a review straight away: a security incident or data breach, a change of IT or cloud provider, a merger or office move, a major system change, a vendor end-of-support announcement for a registered asset, and changes to a framework you have committed to. One example of the last: a licensed holder reports that SMB1001:2027 widens the Gold asset register to physical assets and applies at your next certification or renewal.
- stable micro business — An annual full review plus a quarterly ten-minute check of new subscriptions and devices is usually proportionate.
- growing or acquisitive business — Review after every acquisition, office opening or provider change. Inherited systems and domains are a common blind spot.
- SMB1001 certified business — Schedule the full review before each annual recertification so the attested register is current, and check whether the edition you will certify against changes the register scope.
The register owner must review the full register and this policy at least annually and record a 'current as at' date. Asset owners must confirm their entries at least [quarterly]. An off-cycle review is required after a security incident or data breach, a change of IT or cloud provider, a merger, acquisition or office move, a significant system change, a vendor end-of-support announcement affecting a registered asset, or a change to a framework the organisation has committed to.
A model clause — adapt the bracketed decisions to your organisation before you use it.
The common gaps and red flags?
The most common gap is a register that lists hardware only, or is really the accountant's fixed-asset schedule, and misses SaaS subscriptions, admin and service accounts, domains and DNS, and data held by suppliers. A close second is having no personal-information column, which leaves the business unable to say quickly what was exposed when something goes wrong. The OAIC is clear that outsourcing storage to a supplier, including a cloud provider, does not remove APP 11 or NDB obligations if you still hold the information. Other red flags include unsupported operating systems or network devices still in use without a recorded exception, owner fields that just say 'IT', no update in over a year, and disposed devices marked 'gone' with no sanitisation record. A domain, DNS or cloud admin account registered to a former staff member's or web designer's personal email is another warning sign.
- business that relies on a web designer or freelancer — Check who the registrant and DNS account holder are for each domain, and move them to a business-controlled account recorded in the register.
- business with ageing on-premises equipment — Record end-of-support dates for routers, firewalls, NAS devices and servers. Unsupported internet-facing devices are a priority to replace.
- APP entity using several SaaS platforms — Map which platforms hold customer, employee or health information. These are the entries you will need first in a breach assessment.
The following are policy exceptions and must be reported to the register owner: an asset in use that is not in the register; an asset without a named business owner; a domain name, DNS, cloud or administrator account registered to a personal or former staff member's email address; an unsupported asset without an approved exception; and a disposed asset without a sanitisation or destruction record. Each exception must be resolved, or formally accepted with an expiry date, within [30] days.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What happens when it's invoked or breached: incidents, data breaches and disposal?
In a security incident, the register tells responders what is affected, who owns it, what data it holds (including personal information), which supplier to call and how it is backed up. That speeds up containment and helps finish the NDB assessment within its 30-day maximum. ASD's incident response readiness checklist starts with identifying critical assets. The register is also used at end of life. Before a device is sold, donated, recycled, returned at lease end, sent for repair or reassigned, its storage must be sanitised or the device destroyed, and the disposal recorded. The OAIC asks whether hardware containing personal information is properly sanitised, whether destruction by third parties such as cloud providers has been verified, and whether backups are also dealt with. APP 11.2 extends destruction duties to all copies. A breach of the policy itself, such as an unregistered SaaS sign-up, should lead to the asset being registered or shut down. Repeat or deliberate cases go through the acceptable use and disciplinary process.
- APP entity with a suspected data breach — Use the personal-information column to scope who may be affected and whether serious harm is likely. Record any newly discovered data stores during the incident.
- business replacing or returning leased devices — Get a sanitisation or destruction certificate from the recycler or lessor and attach it to the register entry before marking the asset disposed.
- business cancelling a SaaS or cloud service — Export or delete the data before cancelling, ask the provider to confirm deletion including backups where possible, and record the outcome.
During a security incident or suspected data breach, responders must use the register to identify affected assets, their owners, suppliers, backups and the personal information they hold, and must record any newly discovered assets. Before any device or media leaves the organisation's control through sale, donation, recycling, lease return, repair or reassignment, it must be sanitised using an approved method or destroyed. The asset owner must authorise the disposal, and the register must record the date, method and evidence. Online services must be closed only after data has been retrieved or deleted, and the provider's confirmation of deletion must be recorded where available.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What's my next step?
- Download this template — it's part of the free starter pack.
- Nominate a policy owner and an approver.
- Complete the bracketed decisions and delete anything that doesn't reflect how your business actually operates.
- Compare the wording against your real systems and practices before you sign it.
- Get it approved and set a review date, normally within 12 months.
Common misconceptions
These are things people commonly get wrong — the statement itself is the myth, not the fact.
-
Our accountant's fixed-asset register already covers this. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Data held in a SaaS or cloud platform is the provider's responsibility, so it does not belong in our register. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
An asset register is a one-off spreadsheet you build for certification and file away. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Only devices are assets; accounts, domains and online services do not need to be listed. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Deleting files or doing a quick reset is enough before selling or recycling an old laptop or phone. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
SMB1001 publishes a fixed list of register columns that every business must use. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
Obligations at a glance
The obligations most relevant to this guide, with the regulator, the trigger and the timeframe. Follow the source links in the appendix for the authoritative wording.
| OBLIGATION | REGULATOR | TRIGGER | TIMEFRAME | PENALTY |
|---|---|---|---|---|
| APP 11.1 security of personal information | Office of the Australian Information Commissioner | An APP entity holds personal information, including information stored by a supplier that the entity has the right or power to deal with. | Ongoing while the personal information is held. | |
| APP 11.2 destruction or de-identification, including copies and backups | Office of the Australian Information Commissioner | An APP entity holds personal information it no longer needs for a permitted purpose and no retention exception applies. | Once the information is no longer needed. | |
| NDB suspected eligible data breach assessment | Office of the Australian Information Commissioner | A covered entity becomes aware of reasonable grounds to suspect an eligible data breach. | Reasonable and expeditious assessment within a maximum of 30 calendar days. | |
| Essential Eight ML1 automated asset discovery | Australian Signals Directorate, Australian Cyber Security Centre | An organisation implementing Essential Eight Maturity Level One (patch applications and patch operating systems). | At least fortnightly. | |
| Essential Eight ML1 removal of unsupported software and online services | Australian Signals Directorate, Australian Cyber Security Centre | An organisation implementing Essential Eight Maturity Level One identifies applications, online services or operating systems no longer supported by vendors. | Ongoing; removed or replaced. | |
| ISM software registers | Australian Signals Directorate, Australian Cyber Security Centre | An ISM-aligned organisation operates workstations, servers, network devices or networked IT equipment. | Maintained and regularly verified; recording versions and patch histories. | |
| ISM networked and non-networked IT equipment registers | Australian Signals Directorate, Australian Cyber Security Centre | An ISM-aligned organisation uses IT equipment. | Maintained and regularly verified. | |
| ISM outsourced cloud service and managed service registers | Australian Signals Directorate, Australian Cyber Security Centre | An ISM-aligned organisation uses outsourced cloud services or managed services. | Maintained and regularly verified. | |
| SMB1001 Gold digital asset register (reported, 2026 edition) | Dynamic Standards International (standard); CyberCert (certification) | A business seeking SMB1001 Gold certification under the 2026 edition, according to an Australian provider summary. | At certification and each annual recertification. | |
| SMB1001:2027 Gold asset register covering IT and physical assets (reported) | Dynamic Standards International (standard); CyberCert (certification) | A business certifying to SMB1001:2027 Gold, according to a licensed holder's comparison; applies at next certification or renewal. Re-verify against DSI's text once public on 1 January 2027. | At certification or renewal under the 2027 edition. |
Sources
- Guide to securing personal information primary
- Chapter 11: APP 11 Security of personal information primary
- Part 4: Notifiable Data Breach (NDB) Scheme primary
- Create a cyber security policy primary
- Guidelines for system management (September 2026) primary
- Guidelines for information technology equipment primary
- Guidelines for procurement and outsourcing primary
- Guidelines for cyber security roles primary
- Guidelines for media primary
- Guidelines for cyber security documentation primary
- Essential Eight Maturity Model primary
- Small Business Cyber Security Handbook: securing accounts and identities primary
- Cyber security incident response planning: Practitioner guidance (December 2024) primary
- ISO/IEC 27001:2022 Information security management systems primary
- ISO/IEC JTC 1/SC 27 Journal 2025 primary
- DSI partner licence (SMB1001) primary
- CyberCert SCAP: About secondary
- SMB1001:2026 Changes Explained for Perth Businesses (Epic IT) secondary
- SMB1001:2027: Gold is a paperwork year, Platinum is a capability year (DJC Systems) secondary
This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.