Cyber Safety Update: You Can’t Protect What You Can’t See: Why Municipal Asset Inventories Matter

The information contained in this article is not intended as legal advice and may no longer be accurate due to changes in the law. Consult NHMA's legal services or your municipal attorney. 

You know what equipment your town owns. You probably know how many police cruisers are in the fleet, how many plow trucks need maintenance, and when the town hall roof needs attention.

But could you answer the same questions about your town’s technology?

How many firewalls are protecting the network?  What network switches, wireless access points, computers, cameras, tablets, or other connected devices are operating in the buildings? Who is responsible for maintaining them? When will they need to be replaced? And perhaps most importantly: who can access them—and how?

If answering those questions takes some digging, you are not alone.

Technology environments grow over time. A new department purchases a system. A vendor installs equipment. A device is replaced but the old one remains connected. A staff member leaves and an account remains active. Each decision may make sense individually, but collectively they can create an environment that becomes difficult to understand, budget for, and protect.

An Inventory Is More Than a List

When people hear “technology inventory” or “asset management,” they may picture a spreadsheet of computers and serial numbers. That can be useful, but an effective inventory should tell you more: what technology exists, where it is, what it does, who is responsible for it, how it is maintained, and how it is accessed.

That information has an obvious budgeting benefit.

If you know what you own, you can plan for replacement instead of being surprised by a failure. You can identify equipment approaching end of life, determine whether a system is still necessary, and avoid paying for technology or services that no longer serve a purpose. One of the most common findings we hear about when a new technology partner onboards a municipal customer is just how much excess spend is happening for unused, redundant, or antiquated equipment.

But there is another reason this information matters: you cannot protect technology you do not know exists.

Visibility Is the First Step in Security

Cybersecurity is often discussed in terms of sophisticated tools and increasingly complex attacks. But one of the most basic questions is simply: What are we protecting?

If you do not know a device exists, you may not know whether it is updated, supported by the manufacturer, exposed to the internet, or accessible to someone who should no longer have access.

Municipal leaders should be able to ask basic questions about critical technology:

Who has access? Do they still need it? Is that access secure? Are former employees or vendors still able to log in?

These questions do not require a municipal leader to become a cybersecurity expert. They are leadership questions.

Where Do You Begin?

Creating better visibility does not have to become another overwhelming municipal project. Start small:

• Ask for inventory. If your IT staff or service provider has one, ask when it was last reviewed and how it is kept current.
• Look beyond computers. Include servers, network equipment, firewalls, wireless equipment, cameras, mobile devices, specialized systems, and other connected technology.
• Identify responsibility. Know who maintains each important system and who to contact when something goes wrong.
• Check age and support status. Identify equipment approaching end of life or no longer supported by its manufacturer.
• Review access. Know who can log into important systems and whether they still need that access. Pay particular attention to former employees, vendors, and shared accounts.
• Document it. A well-maintained spreadsheet is better than relying on someone's memory.

Then make keeping the inventory current part of your normal process. An inventory that is accurate once but ignored for five years will eventually become another source of uncertainty.

The Leadership Question

Municipal leaders are not expected to know the technical details of every device in their organization. Your IT staff and technology partners are there to help manage those details.

But leadership still requires visibility.

Across our work with New Hampshire municipalities, the Overwatch Foundation has seen how staff turnover, aging infrastructure, limited resources, and reliance on outside providers can make it difficult to maintain a clear understanding of technical environments. In some cases, municipalities have identified technology they are unsure is still working, what it does, or who is responsible for maintaining it.

That uncertainty matters.

You cannot make a good budget decision about something you do not know you own. You cannot plan its replacement if you do not know how old it is. And you cannot confidently protect it if you do not know how it is connected or who can access it.

Know what you have. Know what it does. Know who is responsible for it. Know who can access it.

You cannot protect what you cannot see.