Answer yes only if the inventory is generated from real sources and refreshed on a schedule. State its scope, such as repositories, deployed services, third-party components and approved tools, say how often it updates, and describe how you find assets that nobody registered.
Three inventories people mix up
| Inventory | What it lists | Typical source |
|---|---|---|
| Asset inventory | Repositories, services, environments, devices | Source platform, cloud account, device management |
| Component inventory | Libraries and packages inside each product | Build output, SBOM |
| Vendor inventory | External companies and services | Procurement and subprocessor list |
Buyers often use "software inventory" to mean any of them. Ask which one they mean, or answer all three briefly.
What a good answer contains
Scope. Say what is covered and what is not. A claim of "everything" will be tested.
Source of truth. For example, repositories come from the source platform, deployments from the cloud account, components from build output.
Refresh. Automated daily or per build is stronger than quarterly manual updates.
Owner. A role responsible for accuracy.
Gap handling. How you find unregistered items. Examples: comparing cloud accounts against the register, scanning organisation repositories for unknown projects, and reviewing outbound connections from products.
A model answer
"We maintain inventories of repositories, deployed services and third-party components. Repositories and deployments are pulled automatically from our source and cloud platforms, and components are produced per build. The platform team owns accuracy, reviews discrepancies monthly and investigates any asset found outside the register."
Why AI tools belong in it
Teams now connect assistants and agents to source code and internal systems. If these are not in the inventory, you cannot answer questions on who has access to what. Add approved AI tools and the systems they can reach.
Evidence
An export of the inventory with last-updated dates, the list of data sources, and a record of the last gap review.
Mistakes
Treating a spreadsheet maintained at audit time as an inventory. Excluding test or internal tools, which often hold real data. Failing to remove retired items, which makes the register look larger and less reliable.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a project and read its component list. That is the component inventory your answer refers to.
Show the process, not only the list
An inventory export proves a moment. A short description of how it stays current proves a practice. Include the data sources, the review cadence and one example of an unregistered asset you found and resolved. That example does more for credibility than a claim of completeness.
Quick check
Is a CMDB required?
No. Any accurate, current and owned register works.
How do we show completeness?
Compare the register with an independent source, such as the cloud account list, and record the result.
Safeguard provides asset discovery and SBOM and dependency scanning, with a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
