How to create a business digital-asset inventory

“We’ll figure it out when something breaks” is not a recovery plan. It is how a one-hour DNS fix becomes a three-week ownership dispute.

A digital-asset inventory is a living document that answers, for every critical system: what is it, who owns the login, who pays for it, when does it renew, and how do we recover if the usual person is unavailable? It is boring paperwork that prevents exciting disasters.

Why inventories fail when you need them most

Businesses usually have fragments — a sticky note with the host login, an old invoice PDF, a developer’s onboarding email from 2019. Nobody assembles the full map until:

• A developer leaves and takes DNS knowledge with them — see former developer hosting control.
• A domain expires because renewal notices went to the wrong inbox — covered in who should own your domain name.
• A personal Gmail account is locked and Stripe, hosting, and Google Analytics reset flows all dead-end together — read accounts that should never use personal email.

The inventory’s job is to make those gaps visible before revenue stops.

What belongs on the inventory

Start with business-critical systems. You can expand later; do not let perfect block useful.

Core web stack

Asset	Record
Domain registrar	Company, login URL, account email, renewal date, auto-renew Y/N
DNS host	Where records live (registrar, Cloudflare, Route 53, host panel)
Web hosting	Provider, plan, panel URL, account ID, data center region
WordPress (or CMS)	Admin URL, hosting path, PHP version, must-use plugins
SSL	Issuer, expiry, whether auto-renew via host or Cloudflare

Email and communications

• Google Workspace / Microsoft 365 tenant, super-admin, domain verification status.
• Transactional email (SendGrid, Postmark, SMTP plugin credentials).
• DNS records for SPF, DKIM, DMARC — who can edit them.

Commerce and forms

• Payment gateway (Stripe, PayPal, Square) — live vs test keys location, never paste secrets in the inventory; note where secrets live (password manager entry name).
• WooCommerce or other cart — version, critical plugins.
• Form providers (Gravity Forms, HubSpot embeds) and where submissions route.

Analytics, ads, and search

• Google Analytics / GA4 property ID, Google Search Console verified owner.
• Meta Pixel, Google Ads, Tag Manager container — which login owns them.
• Cookie/consent tooling if legally required for your market.

Security and backups

• Firewall / CDN (Cloudflare, Sucuri), WAF rules owner.
• Backup plugin or host snapshots — schedule, retention, last verified restore date.
• Malware monitoring or uptime alerts — who receives pages.

SaaS attached to the site

Membership plugins with external APIs, booking systems, CRM embeds, review widgets — anything whose outage breaks a workflow.

If a row’s “owner login” column says a person’s name instead of a role or company account, flag it for cleanup.

Fields every row should include

Use consistent columns so the sheet stays scannable:

1. System name — plain language (“Primary domain registrar”).
2. Vendor / URL — where to log in.
3. Account identifier — username, account number, property ID.
4. Login email — must be business-controlled for critical tiers.
5. Billing owner — card or invoice path; renewal date.
6. Technical owner — who maintains it day to day (internal or vendor).
7. Access method — password manager entry, SSO, 2FA device location.
8. Dependencies — “Email breaks if DNS MX changes.”
9. Recovery notes — support phone, account recovery docs, backup location.
10. Last verified — date someone confirmed login still works.

Store secrets in a password manager, not in the spreadsheet itself. The inventory points to vault entries; it does not duplicate passwords in Google Sheets.

How to build the first draft in one working session

Block two hours with someone who has been there longest plus anyone with billing access.

Hour one — discover

• Walk domain → DNS → hosting → WordPress → email in order.
• Log into each layer; screenshot account IDs if helpful.
• Note anywhere you needed to ask a third party for access.

Hour two — normalize

• Replace personal emails with business aliases where possible.
• Mark unknown renewals and fetch expiry dates from registrar and host panels.
• List every external person who still has admin access.

Publish the draft internally — imperfect inventory beats imaginary completeness.

Keeping the inventory alive

An inventory dies the day after launch unless someone owns updates.

Triggers to update immediately

• New vendor or plugin that handles payments, email, or login.
• Employee or contractor offboarding.
• Migration, redesign launch, or domain change.
• Failed renewal scare or password reset incident.

Rhythm

• Quarterly: spot-check logins for registrar, hosting, WordPress, email admin.
• Annually: full pass before busy season or contract renewals.

Assign a single accountable owner — office manager, ops lead, or IT — not “the whole team.” Others contribute; one person keeps the document current.

Where to store it

Requirements:

• Encrypted or access-controlled (not a public Notion link).
• Recoverable if one laptop disappears.
• Readable during an outage (printed summary of vendor contacts and account emails is optional but useful).

Common pattern: spreadsheet or doc in a company drive + credentials in 1Password, Bitwarden, or Dashlane with emergency access configured.

How repair and care use this document

When intake asks whether you have hosting access, a good inventory lets you answer in seconds with URLs and account context — not a vague “I think our old guy has it.”

Repair technicians still need live credentials through secure share links, but the inventory tells them which doors exist before anyone guesses. That shortens diagnosis when DNS, hosting, and WordPress are split across three vendors.

If you are evaluating how Rescue 404 handles access during repair, align your inventory first: business-owned domain, separable admin users, and a clear list of what you can grant temporarily versus what must stay under your control permanently.

Common gaps to fix while inventorying

• Domain in a personal registrar; DNS in a developer’s Cloudflare.
• Single WordPress admin on @gmail.com.
• Host billing on a credit card nobody recognizes.
• Backups that exist but nobody has tested restore.
• Analytics owned by a marketing intern’s Google account from 2017.

Each gap gets a remediation task with a due date — not a shrug.

Templates you can copy today

Minimum viable tabs

1. Domains & DNS
2. Hosting & CMS
3. Email
4. Payments & forms
5. Analytics & ads
6. Vendors & people (who to call, contract end dates)

One-line recovery test

Once per quarter, pick a random row and log in without asking the usual person for help. If you cannot, update access or documentation the same week.

The bottom line

A digital-asset inventory is the difference between “we know who to call” and “we are negotiating with a stranger’s Gmail to save the domain.”

Build it in an afternoon, store it securely, and treat updates as part of offboarding and launches — not as archival busywork. Ownership posts in this series exist because each row of this sheet exposes a real failure mode: wrong owner on the domain, ghost-held hosting, personal inboxes on critical accounts. The inventory makes those problems visible while you still have time to fix them calmly.