How to build the NIS 2 asset inventory
Article 21(2)(i) NIS 2 names asset management and § 30(2) No. 9 BSIG carries it into German law. CIR point 12.4 sets what the inventory holds for the digital providers it covers. BSI 200-2 (8.1.1) lets you group similar objects, so you end up with a short list of grouped entries rather than one row per device.
The short version
NIS 2 names asset management in Article 21(2)(i) as one of the ten minimum risk-management measures; Germany carries it in § 30(2) No. 9 BSIG as a concept for managing IT systems, products and processes. For the digital providers listed in its Art. 1, Implementing Regulation (EU) 2024/2690 makes it concrete in point 12.4: a complete, accurate, up-to-date inventory that lists the operations and services and the systems and other assets behind them, at a granularity that fits the entity's needs, reviewed regularly. It names no fields.
The number that scares people (200 servers, 600 laptops, 40 SaaS tools) shrinks once you read BSI Standard 200-2 section 8.1.1. Objects of the same type, with similar tasks and conditions and the same protection need, are grouped into one entry. The 600 laptops become one row with a quantity field, not 600 rows.
The result is a short list of grouped entries rather than one row per device, spanning IT, OT, SaaS, network gear and physical sites. That register is the foundation the risk assessment, supplier register, access policy and incident plan all reference. Build it once, review it regularly, update it when something material changes.
Article 21(2)(i) NIS 2 Directive (EU) 2022/2555
[The measures shall include at least] (i) human resources security, access control policies and asset management.
Article 21(2)(i) names asset management as one of the ten minimum measures every besonders wichtige and wichtige Einrichtung has to take. The Directive does not say what the register looks like. For the digital providers listed in Art. 1 CIR, that detail sits one layer down in the Implementing Regulation.
Commission Implementing Regulation (EU) 2024/2690, Annex point 12.4 (asset inventory)
12.4.1. The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent inventory of their assets. They shall record changes to the entries in the inventory in a traceable manner. 12.4.2. The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The inventory shall include the following: (a) the list of operations and services and their description, (b) the list of network and information systems and other associated assets supporting the relevant entities' operations and services. 12.4.3. The relevant entities shall regularly review and update the inventory and their assets and document the history of changes.
CIR 2024/2690 binds only the digital providers listed in its Art. 1 (DNS, TLD, cloud, data centres, CDNs, MSPs, MSSPs, online marketplaces, search engines, social networks, trust services). Point 12.4 asks them for a complete, current inventory at a granularity that fits their needs, listing operations and services and the systems behind them, reviewed regularly. It names no fields and no interval. For every other entity, § 30(2) No. 9 BSIG asks for a concept for managing IT systems, products and processes, without prescribing a form.
§ 30(2) No. 9 BSIG (Germany) + BSI Standard 200-2 section 8.1.1 (recommended method)
§ 30 Abs. 2 Nr. 9 BSIG: Erstellung von Konzepten für die Sicherheit des Personals, die Zugriffskontrolle und für die Verwaltung von IKT-Systemen, -Produkten und -Prozessen. BSI 200-2, 8.1.1: 'Ähnliche Objekte sollten deshalb sinnvoll zu Gruppen zusammengefasst werden.' Objects can share a group if they are of the same type, have similar tasks, are subject to similar conditions and have the same protection need.
§ 30(2) No. 9 BSIG carries Article 21(2)(i) into German law; the explanatory memorandum says that 'Verwaltung von IKT-Systemen, -Produkten und -Prozessen' describes what is technically called asset management (BT-Drs. 21/1501, p. 148). BSI Standard 200-2 (section 8.1) explains how the structure analysis is done: objects of the same type, with similar tasks and conditions and the same protection need, are grouped into one entry. That is the rule that turns 600 laptops into one register row.
Start from the processes, not from the network scan
Write down the business processes the company depends on (order intake, invoicing, payroll, customer support, the production line, district heating control, route dispatch). For each, name the dependencies. This is the entry point BSI 200-2 calls Strukturanalyse. The process map sets which assets matter and what their protection need is. A network scan started cold gives you noise, not a register.
List the assets each process depends on, grouped
Walk each process and capture the assets it needs: applications, databases, servers, endpoints, network gear, cloud and SaaS services, OT and ICS components, physical sites. Apply BSI 200-2 section 8.1.1: 45 identical office laptops are one entry with a quantity field, not 45 rows. Three identical PLCs on the same line are one entry. SaaS services count even though they are not on your network. The output is a short list of grouped entries rather than one row per device.
Fill a few fields per entry
For every entry, record what you need to manage it. ENISA's guidance suggests, among others: a unique ID (a short asset ID like ERP-01), a description (what it is and what process it serves), an owner (a named person, not a department), a classification (how much protection it needs in confidentiality, integrity and availability, derived from the process it serves) and a location (data centre, cloud region, physical site, or the supplier that hosts it). These come from an indicative list, not from the law.
Group identical assets, do not enumerate every device
BSI Standard 200-2 (8.1.1) says similar objects should be grouped where they are of the same type, have similar tasks and conditions, and have the same protection need. Use it. 600 laptops in the same MDM profile with the same Schutzbedarf are one register entry. Three identical wastewater pump PLCs are one entry. A pool of identical VDI workstations is one entry. The register should show that you understand your dependencies, not list asset tags.
Inventory the dependencies, not just the things you own
An owner and a protection need only make sense once you know which process the asset serves. Point 12.4.2(a) CIR lists operations and services first, and BSI 200-2 starts from the business processes. So map processes first and assets second. The same goes for SaaS: a tool you do not own but that your invoicing depends on belongs in the inventory, hosted by the named supplier.
BSI: structure analysis plus grouping as the recommended method
The BSI's IT-Grundschutz methodology (Standard 200-2, section 8.1) starts with the structure analysis and uses grouping (8.1.1) to keep it manageable. It is a recommended method, not a legal requirement.
ENISA Technical Implementation Guidance: asset management section 12
ENISA's Technical Implementation Guidance for CIR 2024/2690 covers asset management in section 12. For point 12.4 it suggests fields to consider (an indicative list including a unique ID, owner, description, location and classification). ENISA's mapping table (CC BY 4.0, v1.2, August 2025) links point 12.4 to ISO/IEC 27001:2022 A.5.9, NIST CSF 2.0 ID.AM and ETSI EN 319 401 clause 7.3.
Other Member States: ISO/IEC 27001:2022 A.5.9 as a starting point
Point 12.4 CIR applies directly in every member state, but only to the digital providers listed in Art. 1 CIR; national laws carry the general asset management duty of Art. 21(2)(i) in their own words. ENISA's mapping links point 12.4 to ISO/IEC 27001:2022 A.5.9, so an ISO register is a good starting point; ENISA states the mapping is not a measure of equivalence.
We will list every device individually so the register is complete.
No. BSI 200-2 (8.1.1) recommends grouping similar objects. A register with 600 laptop rows is hard to read and adds no information a short grouped register does not already carry.
SaaS is invisible because it is not on our network, so we skip it.
Wrong. Point 12.4.2(b) CIR covers the network and information systems and other associated assets supporting your operations and services, and a SaaS service your invoicing depends on is one of them. Enter it as one entry with the supplier and region as its location (for example Salesforce, eu-west), and keep the supplier on your supplier list too.
We can build the register from the network scan and add owners later.
You can, but the owner field will sit empty and the protection need will be a guess. Point 12.4.2(a) CIR starts the inventory from the list of operations and services, and BSI 200-2 starts the structure analysis from the business processes (8.1.2). Without that step no process points at an entry, so nobody can say who owns it or how much protection it needs.
Invented example, not a real company. A 60-staff machine-building company maps eleven business processes (order intake, design, procurement, production line A, production line B, quality, dispatch, invoicing, payroll, customer support, after-sales remote service). The asset walk produces twelve grouped entries: ERP (one), CAD and PLM (one), MES on the shop floor (one), file and print servers (one, three identical boxes), the 50-laptop fleet under one MDM profile (one), two grouped CNC controller families (two), the central network gear (one), Microsoft 365 (one), the customer support SaaS (one), the after-sales VPN appliance (one), and the physical site (one). Twelve entries covering IT and OT, each with a named owner, a protection need and a known location.
The same twelve entries are the spine of the risk register, the supplier register, the access policy, the BCM plan and the incident response runbook. A CMDB project is not needed for this: point 12.4 CIR names no fields, and BSI 200-2 (8.1.1) lets you group.
- Directive (EU) 2022/2555 (NIS 2), Article 21(2)(i): minimum risk-management measures include security of human resources, access control policies and asset management.
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, Annex point 12.4 (asset inventory): a complete, accurate, up-to-date and consistent inventory, at a granularity that fits the entity's needs, listing operations and services and the systems supporting them, reviewed regularly. Binds the entity types in Art. 1 CIR.
- BSIG (Germany), §30 (Risikomanagementmaßnahmen) Abs. 2 Nr. 9, transposing Article 21(2)(i) NIS 2; explanatory memorandum BT-Drs. 21/1501, p. 148 (asset management).
- BSI Standard 200-2 (IT-Grundschutz-Methodik), section 8.1.1 (Komplexitätsreduktion durch Gruppenbildung): similar objects are grouped when they are of the same type, have similar tasks, are subject to similar conditions and have the same protection need.
- ISO/IEC 27001:2022 Annex A.5.9 (Inventory of information and other associated assets), linked to CIR point 12.4 in ENISA's mapping table (v1.2, August 2025); ENISA states the mapping is not a measure of equivalence.
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Risk Management
Rate your risks
Place every piece of software, every device and every supplier on the matrix.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
