Does NIS2 require an inventory of IT assets?

Yes, as part of a required area. Article 21(2)(i) covers human resources security, access control policies and asset management, and it is hard to protect, patch or recover systems you do not know you have. A useful inventory lists, for each device, system and cloud service: what it is, where it runs, who owns it, how critical it is, which data it holds, and whether it is supported and patched. Keep it current by combining sources: device management, purchase records, cloud accounts and what you actually see on the network. Unknown devices are a common finding, from old servers to small computers in a wall socket. On every plan, the NetSenX network map lists the devices seen on monitored segments with their announced names and first and last seen, which helps you find what the paper inventory missed.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

Read next

← All 40 questions on NIS2 scope and dutiesAll topics