Mission 05
Understanding Your Digital Assets
You cannot protect what you do not know you have. This mission helps you list the devices, accounts, data, domains and online services your business depends on, and give each important one a clear owner.
In this mission you will
- Recognise the main types of digital assets in a small business: devices, accounts, data, domains, cloud services and supplier connections.
- Identify which accounts act as master keys because they can reset access to other assets.
- Explain why every important asset needs a named owner and a criticality rating.
- Start a simple inventory of ten important assets without recording any passwords or secrets.
What is a digital asset?
A digital asset is anything digital that your business needs to operate, earn money or keep promises to customers. It is not only the computer on the desk. It is the email account that receives orders, the accounting software that holds your GST records, the website domain customers type in, the WhatsApp Business number on your visiting card and the customer list in a shared folder. If losing it, leaking it or having it changed would hurt the business, it is an asset worth knowing about.
The main types of digital assets
- Devices: laptops, desktops, mobile phones, tablets, the office Wi-Fi router, printers, CCTV recorders and point-of-sale machines.
- Accounts: email, banking and UPI logins, accounting software, social media pages, the WhatsApp Business number, government portals and admin logins for any tool.
- Data: customer lists, invoices, price lists, designs, employee records, contracts and backups of all of these.
- Domains and websites: your business domain name, the registrar account where it is managed, the website host and any online shop.
- Cloud and SaaS services: cloud drives, online accounting, CRM, payroll, email marketing and payment gateways.
- Supplier connections: an IT vendor with remote access, a CA firm with a login to your books, or an app connected to your email.
Master-key accounts
Some accounts matter more than they first appear because they can unlock other assets. Your main business email is usually the biggest one. If someone controls it, they can use 'forgot password' to reset the accounting software, the cloud drive and sometimes even the domain registrar. The mobile number that receives OTPs is another master key. So is the registrar account: whoever controls the domain controls where your website and email point. When you build your list, mark these master-key accounts clearly. They deserve the strongest protection first.
What to record for each asset
- Name: a plain description, for example 'Accounts laptop' or 'Main business email'.
- Owner: the one person accountable for it. Not 'everyone' and not 'IT'.
- Purpose: what the business uses it for.
- Criticality: high, medium or low, based on how badly the business would be hurt if it were lost, leaked or changed.
- Data held: does it contain customer, financial or employee information?
- Recovery: how you would get it back, for example a backup, a recovery contact or the vendor’s support.
- Never record: passwords, OTPs, PINs, API keys or full account numbers. The inventory is a map, not a key ring.
Build a first inventory in one hour
- 1Open a simple sheet with columns for name, owner, purpose, criticality, data held and recovery.
- 2Walk through a normal business day: taking an order, sending an invoice, receiving payment, paying a supplier. Note every device, account and service you touch.
- 3Add the domain, website host, email admin account and the mobile numbers used for OTPs.
- 4Mark the master-key accounts and the assets holding customer or financial data.
- 5Assign one owner to each high-criticality asset. If nobody owns it, that is your first finding.
- 6Store the sheet somewhere access-controlled and agree to review it every quarter or whenever you add or remove a system.
Practical business example
Kaveri Spices finds the account nobody owned
Kaveri Spices, a fictional 15-person spice trader in Kochi, decided to build its first asset list during a slow afternoon. The owner, Anitha, expected it to be boring. Within an hour, the team listed two laptops, four phones, the accounting software, a cloud drive, the website and the payment gateway. Then they reached the domain name. Nobody knew who managed it. After some searching, they found it had been registered years earlier by a former web designer using his own email address. The renewal reminders were going to him. Anitha contacted the designer politely, and with his help the domain was moved to a business-owned account with Anitha as owner and her manager as backup. They also noticed the main business email was the recovery address for almost every other service, so they turned on multi-factor authentication for it first.
The lesson: The inventory did not just produce a list. It revealed a master asset with no owner and a single email that unlocked everything else. Knowing that let Kaveri Spices fix the most important gaps first.
Key takeaways
- You cannot protect what you do not know you have, so start with a simple list of your important digital assets.
- Look beyond hardware: accounts, data, domains, cloud services and supplier connections are assets too.
- Master-key accounts, such as the main email and OTP phone number, can unlock others and should be protected first.
- Every critical asset needs one named owner, a criticality rating and a recovery route.
- Never record passwords or secrets in an inventory, and review it whenever systems change.
Scenario lab · +25 XP
Which assets unlock the others?
You help the owner of Sagar Electricals, a fictional 20-person electrical goods distributor in Indore. The business uses a domain registrar, a website host, an online accounting service, a cloud drive, three office laptops, a payment gateway and one main business email. The owner asks you to help decide where to start protecting things.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
Which asset should you look at first?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
List your top ten assets
Build a starter inventory of the ten assets that matter most to your business. Describe them in general terms. Do not write down any passwords, OTPs, account numbers or customer details.
- 1.Create a sheet with columns: asset name, owner, purpose, criticality (high, medium, low), data held and recovery method.
- 2.Walk through one normal business day and list the devices, accounts and services you use.
- 3.Add the main business email, the domain registrar, the website host and the phone numbers that receive OTPs.
- 4.Choose your top ten and mark which ones are master-key accounts.
- 5.Write one owner name against each. Highlight any asset where you could not name an owner.
- 6.Save the sheet in an access-controlled location and set a reminder to review it in three months.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress