Is a spreadsheet enough for a SOC 2 asset inventory?

SOC 2 does not name a format. Your policy says what the register holds and how often it is reconciled, and the auditor tests that. Konfirmity advises a dedicated tool over spreadsheets, and Reftab, which sells asset software, says a spreadsheet keeps only the current value of a cell. Both are sellers' positions, and neither cites an audit finding. The fix without software is the one in the workbook: a dated copy after every reconciliation, with the reconciliation tab showing what you compared and what you changed.

Do cloud resources and SaaS count as assets?

In the Policyseed Asset Management Policy, yes. Its scope covers hardware, cloud resources, software and services, and data assets, and it asks for cloud accounts, projects and subscriptions to be recorded in the register with their purpose and administrative owner. The workbook has a tab each for cloud accounts, SaaS and data stores. Individual cloud resources are better listed from the cloud console or infrastructure code than typed by hand; the policy asks for tags on each one.

What about personal devices?

The policy lists personally owned devices approved for work use as in scope. The Devices tab has a column for company-owned or approved personal device so they appear in the register. Whether you allow them at all is a policy decision; if you do not, say so in the policy and let the reconciliation against your identity provider or device management list show there are none.

How often should the inventory be reconciled?

Quarterly is the interval both the Policyseed policy and Konfirmity use. Konfirmity's FAQ says to review at minimum every quarter and before major audits. Whatever you write in your policy is what the auditor tests, so choose an interval you will keep and add a row on the Reconciliation tab each time.

What if the register and the device management list do not match?

Record the difference and explain it. Reftab's example is an MDM that shows 283 enrolled devices against an inventory of 247, and it says to expect questions about the gap. The Reconciliation tab works out the difference for you; the work is naming each device that explains it (a recently issued laptop, a retired one still enrolled, a personal phone) and fixing the side that is wrong.

Who should own the inventory?

The policy gives each asset a named owner and splits the register: the IT or operations lead keeps hardware and services, and engineering keeps cloud resources and the software bill of materials. One person, named in the how-to sheet, is accountable for the reconciliation happening on schedule.

SOC 2 asset inventory template

Updated 29 October 2026

A free asset inventory in Excel format: separate tabs for devices, cloud accounts, SaaS, data stores and vendors, each with an owner, a status and the lifecycle fields the Policyseed Asset Management Policy asks for, and a reconciliation tab that works out the gap between your register and the system you compare it with. Every row is blank because the assets are yours.

What an auditor does with the inventory

The sources we read describe the register as the list the rest of the work is checked against. Konfirmity's SOC 2 asset inventory guide says it is used to verify that controls cover all systems, and that evidence of access revoked for terminated staff is expected alongside it. Reftab's IT asset management for SOC 2 says auditors want to reconstruct what happened to every device over the audit period, including disposal records linked to the asset. Reftab sells asset management software, and its page does not name an audit or a finding behind these points, so read them as a vendor's account of what to prepare for.

Neither source agrees with the other on which criterion the inventory belongs to (Reftab's own page calls the same criterion both risk assessment and asset classification), so this page does not print a mapping. Ask your CPA firm which criteria they test it under. The Policyseed Asset Management Policy is mapped in our crosswalk to CC2.1, CC6.5 and C1.2.

The fields to record

The policy states what every entry holds:

Northwind Cloud Inc maintains an asset register covering hardware, cloud resources, software and services, and data assets. Every entry records the asset identifier, type, owner, assigned user where applicable, location or hosting platform, classification of the data it holds, and status. Kandji is the authoritative source for endpoint records and the register is reconciled against it.
Asset Management Policy, section 4.1

Konfirmity's guide lists more, by asset class: for hardware, serial number, model, operating system, assigned user and encryption status; for software and cloud, name, version, license type, vendor, contract renewal date and the data processed; for data stores, classification, owner, location, access controls, encryption status, backup schedule and retention; for vendors, service type, contract dates, data processed and access privileges. The workbook uses the policy's fields as the base and adds the lifecycle fields the policy refers to elsewhere, such as the SaaS renewal date and the disposal method and date:

Tab	What it holds
Devices	Laptops, desktops, phones, tablets, security keys and external drives.
Cloud accounts	Every account, project and subscription, with its purpose and administrative owner.
SaaS	Subscriptions and services, including the ones bought on a card.
Data stores	Databases, buckets, repositories, backups and logs that hold company or customer data.
Vendors	Third parties that process company or customer data or have access to systems.
Reconciliation	One row each time you compare a tab with a system of record. The difference and the gap check calculate themselves; you write what explains each difference and what was fixed.

The Devices tab has 18 columns: Asset ID; Type (laptop, phone, key, drive); Make and model; Serial number; Operating system and version; Assigned user; Owner (accountable person); Location; Data classification (use your policy's labels); Company-owned or approved personal device; Disk encryption on; In device management (MDM); Issued on; Status; Returned or disposed on; Disposal method and certificate (wipe, destruction); Last updated; Notes or link to evidence. Status is a dropdown (In use, In stock, Lost or stolen, Retired or disposed). Each of the five tabs has 100 ready-made rows with a filter on every column and the header frozen. The data classification column is free text on purpose: use the labels from your own Data Classification and Handling Policy.

Owners and updates

Two statements keep the register from going stale. Every asset has an owner, and changes are recorded quickly:

Every asset has a named owner accountable for its security, lifecycle and retirement. Ownership passes explicitly when a person changes role or leaves, and assets are not moved, lent, reassigned or removed from an office without the register being updated. Company equipment is never sold, gifted or discarded by individuals.
Asset Management Policy, section 4.2

Register updates. Any change to an asset's owner, user, location or status is recorded within two business days. The IT/Operations Lead edits the register for hardware and services; Engineering edits it for cloud resources and the software bill of materials.
Asset Management Policy, section 5.2

Copy the policy's timing into the how-to sheet if you change it. The register is only as good as the last time someone told it a laptop moved.

Reconciling the register

A register is trustworthy when it matches the systems that already know the answer. The policy sets a quarterly comparison:

Quarterly reconciliation. Within the first month of each quarter the IT/Operations Lead reconciles the hardware register against the device list in Kandji and the active user list from Okta, and Engineering reconciles the cloud register against a fresh resource export from AWS and Vercel. Discrepancies are investigated and recorded, and the signed-off reconciliation is retained as evidence.
Asset Management Policy, section 5.3

Konfirmity gives the same interval, quarterly at minimum and before major audits. The Reconciliation tab has one row per comparison: the date, which tab you compared, the other source (the device management console, the cloud account list, the identity provider's app catalog, expense records), the count in each and a calculated difference and gap check. The columns are: Date; Register tab compared; Compared with (MDM, cloud account list, identity provider, expense records); Count in the other source; Count in this register; Difference (calculated); Gap check (calculated); What explains each difference (names or IDs); Fixes made and ticket; Done by; Reviewed by; Review date; Evidence location (export, screenshot, folder).

The gap check only compares two numbers. It does not know whether a gap matters; you write down what explains each difference and what you fixed. Reftab's example of the failure is an MDM that shows 283 enrolled devices against an inventory of 247, which it says draws questions from auditors. Its second example, 12 laptops disposed of during the period with sanitization certificates for 8, is an illustration on its page, not an audit finding; it is a good reason to fill in the disposal columns on the same day.

SaaS gets its own comparison:

SaaS review. Each quarter the IT/Operations Lead compares the services register against the application catalog in Okta and expense and card records, adds any service in use without an entry, refers it to the Security Owner for approval or termination, and flags renewals due next quarter so that unused subscriptions are canceled rather than auto-renewed.
Asset Management Policy, section 5.5

Spreadsheet or tool

Konfirmity advises a dedicated tool over spreadsheets and warns that spreadsheets go out of date and drift. Reftab argues that a spreadsheet keeps only the current state, because overwriting a cell erases the earlier value. Both write for readers who might buy such a tool, and neither shows an audit that failed a spreadsheet. The weakness they point at is real, though: a sheet alone does not show how it looked at the last reconciliation.

A workable answer without software is to save a dated copy of the whole workbook after every reconciliation and keep the exports you compared against. The Reconciliation rows say what changed between copies. If your fleet is large enough that this becomes a chore, that is the point to move to a tool, with the same fields. For the device side, see whether SOC 2 requires MDM and the Endpoint and Workstation Security Policy; for remote teams, the remote company guide explains why the device list should match the HR roster.

Tie it to people and access

The inventory is most useful next to two other records. Return of devices belongs on the onboarding and offboarding checklist, and the accounts on each system are checked in the user access review, which starts from the list of systems this register holds. Third parties are assessed on the vendor review sheet; the Vendors tab here is the list that review works from. The full policy is the Asset Management Policy, and the Audit Kit ($59, one time) tailors its procedures to the tools you named.

Frequently asked questions

Is a spreadsheet enough for a SOC 2 asset inventory?: SOC 2 does not name a format. Your policy says what the register holds and how often it is reconciled, and the auditor tests that. Konfirmity advises a dedicated tool over spreadsheets, and Reftab, which sells asset software, says a spreadsheet keeps only the current value of a cell. Both are sellers' positions, and neither cites an audit finding. The fix without software is the one in the workbook: a dated copy after every reconciliation, with the reconciliation tab showing what you compared and what you changed.
Do cloud resources and SaaS count as assets?: In the Policyseed Asset Management Policy, yes. Its scope covers hardware, cloud resources, software and services, and data assets, and it asks for cloud accounts, projects and subscriptions to be recorded in the register with their purpose and administrative owner. The workbook has a tab each for cloud accounts, SaaS and data stores. Individual cloud resources are better listed from the cloud console or infrastructure code than typed by hand; the policy asks for tags on each one.
What about personal devices?: The policy lists personally owned devices approved for work use as in scope. The Devices tab has a column for company-owned or approved personal device so they appear in the register. Whether you allow them at all is a policy decision; if you do not, say so in the policy and let the reconciliation against your identity provider or device management list show there are none.
How often should the inventory be reconciled?: Quarterly is the interval both the Policyseed policy and Konfirmity use. Konfirmity's FAQ says to review at minimum every quarter and before major audits. Whatever you write in your policy is what the auditor tests, so choose an interval you will keep and add a row on the Reconciliation tab each time.
What if the register and the device management list do not match?: Record the difference and explain it. Reftab's example is an MDM that shows 283 enrolled devices against an inventory of 247, and it says to expect questions about the gap. The Reconciliation tab works out the difference for you; the work is naming each device that explains it (a recently issued laptop, a retired one still enrolled, a personal phone) and fixing the side that is wrong.
Who should own the inventory?: The policy gives each asset a named owner and splits the register: the IT or operations lead keeps hardware and services, and engineering keeps cloud resources and the software bill of materials. One person, named in the how-to sheet, is accountable for the reconciliation happening on schedule.

Outside sources are cited for their own positions and were read on 29 October 2026; their pages may change. Policyseed is not affiliated with Konfirmity or Reftab.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.