Yes. A browser extension is software with access to your staff's sessions and pages, and it is installed outside most procurement processes. Keeping a record of which extensions are approved, who owns each one and when it was last reviewed closes a gap that questionnaires and auditors increasingly probe.
Why extensions slip through
Laptops are usually inventoried, and so are cloud services. Extensions sit between the two. People install them in seconds, they update themselves, and they rarely appear in a purchase record. Yet an extension with broad site access can read what a user sees in your code host, your cloud console and your customer data tools.
What to record per extension
A short row is enough:
- Name and extension ID.
- Publisher, and the store listing link.
- Business reason and a named owner.
- Permissions and site access it requests.
- Approval date, approver and next review date.
- Install mode: allowed, force installed, or blocked.
- Notes: data it handles, any exceptions.
Do not try to record every personal extension on every machine. Choose the scope that matches your risk: all managed browsers, or only profiles used for work.
How to keep it current
- Use managed browser policy so approved extensions are named, not discovered by accident. The installation mode guide explains the options.
- Export the installed list from your device management tooling on a schedule and compare it with the approved list.
- Review on a set cadence, and also after a permission change or an ownership change. Update prompts are covered in this post.
- Add an exception process with expiry dates so temporary approvals do not become permanent.
What auditors may ask
Frameworks differ, and you should confirm with your own auditor, but common questions include: how do you control software installed on endpoints, how do you review third party code that touches customer data, and can you show the last review. A short inventory plus a policy and a review log answers all three without much effort. Save a dated export as evidence each cycle. The policy template gives you a starting document.
Where tooling can help
Safeguard's asset discovery and compliance evidence automation can hold software inventory records and attach review evidence, so the list does not live only in a spreadsheet. Whatever tool you use, the habit matters more than the tool.
Common mistakes
Teams build a huge spreadsheet once and never update it. Keep the record small, assign an owner to every row, and tie the review date to a calendar entry. An accurate short list beats a long stale one every time an auditor or customer asks.
Quick check
Do personal extensions on personal browsers need to be listed?
Usually not. Scope the inventory to browsers and profiles used for work, then write that scope into your policy.
How often should extensions be reviewed?
Pick a regular cadence, such as quarterly or twice a year, and review sooner after a permission or ownership change. Confirm expectations with your auditor.
Sources
Last reviewed: 19 October 2026.
