[{"data":1,"prerenderedAt":176},["ShallowReactive",2],{"publication:en:P091":3},{"meta":4,"copy":17,"relatedArticles":134,"terms":168,"term":169,"resourceParent":170,"glossaryParent":173},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P091","\u002Fblog\u002Fsmall-business-asset-inventory","article","digital asset inventory for small business","Digital asset inventory for small business: owners and dependencies","Digital asset inventory for a small business","Map domains, websites, email, hosting, integrations and recovery owners. Build a useful inventory without storing passwords or losing business dependencies.",[13,14],"\u002Fhealth-check","\u002Fservices\u002Fdigital-security","2026-09-04","2026-10-30",{"intro":18,"sections":19,"checklist":88,"faq":94,"links":104,"sources":127,"cta":129},"A digital asset inventory for a small business should connect domains, websites, email, hosting, integrations and recovery arrangements to their business owners and dependencies. Record what each asset does, who can change it and what happens if access is lost. The inventory should point to securely managed credentials rather than contain passwords, private keys or live recovery codes itself.",[20,29,65,70,78,83],{"title":21,"paragraphs":22,"sources":25},"Map business processes before collecting product names",[23,24],"Start with the activities that keep the business operating: customers find the site, send an enquiry, place an order or receive a reply. Identify the assets behind each activity. A contact form can depend on a domain, hosting, application, email provider and integration even though the business experiences it as one function. Listing only the visible website misses the services needed to keep that function working.","NIST's 2024 small-business guide recommends maintaining an inventory of the hardware, software, systems and services the business relies on. Use that principle to define a useful scope, not to create an unmaintainable list of every technical object immediately. Start with important workflows and expand where a missing owner or dependency prevents a practical security or recovery decision.",[26],{"label":27,"url":28},"NIST SP 1300 (2024): small-business roles, assets and recovery","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002FSpecialPublications\u002FNIST.SP.1300.pdf",{"title":30,"paragraphs":31,"table":34},"Choose fields that help someone make a decision",[32,33],"An inventory entry should explain the asset's purpose, ownership and maintenance or recovery route. Our register emphasizes decisions a small team needs to make when a supplier leaves, a renewal fails or a website stops working. It is an original planning aid, not a complete automated discovery system or a claim that every hidden asset has been found.","Keep unknowns explicit. A record saying recovery owner not established is more useful than filling the field with the name of the person who last logged in. Do not confuse technical access with business ownership or legal title. The person who can edit a service may not control billing, authorize a domain transfer or recover the account after a lost device.",{"caption":35,"headers":36,"rows":40},"Business asset, owner and dependency register",[37,38,39],"Field","What to record","Decision it supports",[41,45,49,53,57,61],[42,43,44],"Asset and purpose","Domain, service or application and its business function.","What work stops if it fails?",[46,47,48],"Business owner","Person responsible for the asset’s use and priorities.","Who can accept risk or authorize change?",[50,51,52],"Technical administrator","Current operator and supplier scope.","Who can perform the agreed maintenance?",[54,55,56],"Access and recovery","Secure credential reference and recovery owner.","Can legitimate control be regained?",[58,59,60],"Dependencies","Mail, hosting, integration, data and provider links.","What else must be available for the function to work?",[62,63,64],"Maintenance and lifecycle","Renewal, update, change and exit ownership.","Who acts before the next avoidable failure?",{"title":66,"paragraphs":67},"Keep ownership, administration and permissions separate",[68,69],"Review the actual control points for important assets. A domain can involve registration, DNS and billing accounts; a website can have application, hosting and deployment access; email can have user, shared-mailbox and administrative roles. Record the relevant owners rather than collapse all of them into the name of the agency that built the site.","Link the inventory to a secure credential-management process without copying secrets into the register. Restrict access according to what the record reveals, since a dependency map can itself be sensitive. If supplier access is unclear, assign a separate review rather than remove it as part of inventory collection. Business ownership should be able to continue through a controlled supplier change with necessary functions and recovery access preserved.",{"title":71,"paragraphs":72,"example":75},"Verify a critical workflow instead of assuming the diagram is complete",[73,74],"Select a representative process and confirm where it leads using authorized, controlled checks. For a form, the question may be which mailbox or CRM receives the enquiry and who owns that destination. For a recovery plan, confirm which accounts and data the administrator would need. Do not send live customer information or trigger external transactions simply to make an inventory entry look complete.","Record the evidence and its limits. A working enquiry at one moment does not establish that every notification, domain or recovery path is owned. The purpose is to identify the next practical dependency and assign it. If a provider or supplier holds information the business cannot access directly, request the relevant scope or handoff through the established authorized relationship.",{"title":76,"text":77},"Illustrative example: the form works, its destination is unknown","A fictional business receives website enquiries but cannot say which account owns the integration that routes them. The team records the form, receiving service, technical administrator and recovery gap, then assigns an owner to verify the handoff with synthetic data. This is a proposed inventory exercise, not a customer case or a form test performed by CyberFixCrew.",{"title":79,"paragraphs":80},"Prioritize gaps by dependency and business impact",[81,82],"Not every incomplete field needs the same urgency. An unowned domain recovery account or a missing backup dependency can block several business functions at once. Use the register to identify those shared dependencies and assign an action, owner and review trigger. Avoid inventing a numeric risk score from the number of blank cells or treating a large inventory as evidence of mature security by itself.","Keep the scope connected to what the team can maintain. A small business may begin with an owned register rather than an enterprise discovery product. Document where automated or provider information was used and what it does not cover. The useful result is a set of actionable ownership and recovery decisions, with a clear way to update the record as the environment changes.",{"title":84,"paragraphs":85},"Make inventory maintenance part of the next change",[86,87],"Update the relevant entry when a supplier, application, domain, payment method or administrator changes. Include new integrations and retired services so obsolete access or billing does not remain invisible. Assign a business owner for the register and technical owners for its sections. A completed first pass becomes unreliable if future changes have no route back into it.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website, email and digital-infrastructure knowledge. We can discuss a scoped technical review of the assets and dependencies described on this site. No complete asset discovery or managed inventory coverage is implied. Describe the important workflow and missing ownership without sending passwords or private recovery information in the initial enquiry.",[89,90,91,92,93],"Start with important business processes and their supporting services.","Separate business owner, administrator and recovery authority.","Record dependencies and unknowns without storing secrets.","Verify a representative workflow with controlled data.","Assign ownership for gaps and future inventory changes.",[95,98,101],{"question":96,"answer":97},"Is a list of domain names enough?","No: connect domains to hosting, email, applications, integrations, owners and recovery dependencies relevant to the business workflow.",{"question":99,"answer":100},"Should the inventory contain every password?","No: use secure references to an appropriate credential-management process. Keep passwords, private keys and live recovery codes out of the register.",{"question":102,"answer":103},"Does an inventory prove the assets are secure?","No, it supports ownership and prioritization. Controls, permissions, maintenance and recovery need their own verification.",[105,108,111,114,117,119,121,124],{"path":106,"label":107},"\u002Fblog\u002Fvendor-access-review","Review the permissions behind each supplier",{"path":109,"label":110},"\u002Fblog\u002Fhosting-security-responsibility","Clarify provider and customer task ownership",{"path":112,"label":113},"\u002Fblog\u002Fbusiness-recovery-plan","Connect assets to business recovery",{"path":115,"label":116},"\u002Fglossary\u002Fzero-trust","Define resource-based access decisions",{"path":13,"label":118},"Discuss a focused technical check",{"path":14,"label":120},"Scope practical digital-security work",{"path":122,"label":123},"\u002Fblog\u002Fbusiness-data-map","Map information routes and copies across those assets",{"path":125,"label":126},"\u002Fblog\u002Fsecurity-budget-small-business","Prioritize owned security work across those assets",[128],{"label":27,"url":28},{"title":130,"description":131,"button":132,"type":133},"Find the missing owner or dependency in a business workflow","Describe the website, email or infrastructure process and what is unclear. Keep credentials and recovery secrets out of the initial form.","Discuss the asset-review scope","check",[135,144,152,160],{"id":136,"path":137,"title":138,"description":139,"category":140,"artwork":141,"order":142,"publishedOn":143},"P088","\u002Fblog\u002Femployee-ai-data-policy","Employee AI data policy for a small business","Build an employee AI data policy around approved tasks, accounts, information and connectors. Use synthetic examples and clear exception and reporting routes.","governance","access",84,"2026-08-21",{"id":145,"path":146,"title":147,"description":148,"category":140,"artwork":149,"order":150,"publishedOn":151},"privacy-regulation","\u002Fblog\u002Fcyber-regulation-privacy-compliance-website-checklist","Website Privacy Checklist for a Technical Review","A technical website privacy review maps collected data, recipients, access rights, retention and deletion. First have an adviser determine the requirements that apply to your organization, then compare settings and test results with those requirements. The resulting evidence supports a wider assessment; it is not a legal compliance certificate.","plan-plus",100,"2026-05-05",{"id":153,"path":154,"title":155,"description":156,"category":140,"artwork":157,"order":158,"publishedOn":159},"P089","\u002Fblog\u002Fprompt-injection-business","Prompt injection risks for business: separate content from authority","Understand prompt injection in business AI workflows. Map untrusted content, connected data and action controls without relying on prompts alone.","security",76,"2026-08-07",{"id":161,"path":162,"title":163,"description":164,"category":140,"artwork":165,"order":166,"publishedOn":167},"P198","\u002Fblog\u002Fcorporate-ai-security-data-leak-prevention","Corporate AI security: controlling data shared with AI tools","Check how ChatGPT, Claude and Microsoft Copilot handle business data, and define what staff can share with each tool.","integrations",109,"2026-11-07",[],null,{"path":171,"label":172},"\u002Fresources","Website security resources and templates",{"path":174,"label":175},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059363]