Asset inventory
In one sentence
A current list of the devices and software you run. You can't protect or patch what you don't know you have.
An asset inventory records every computer, server, network device, and key application, with details like operating system and support status. It's the foundation for patching, access control, and knowing your exposure.
Why it's on your cyber insurance application
Underpins the device-count, EDR-coverage and end-of-life questions. You can't honestly answer "EDR on all endpoints" or "nothing unsupported" without a list to check the claim against.
What this looks like in practice
A spreadsheet is fine. One row per device: what it is, who uses it, what operating system, whether it's still supported. Twenty rows for a ten-person business. It feels like busywork right up until the application asks whether anything is running an unsupported OS, and you can answer in thirty seconds instead of guessing.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
Do you run any systems that no longer receive security updates (end-of-life)?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Replace what you can; isolate what you can't (separate VLAN, no internet). Either path turns a 'no' answer into a defensible one.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.