Build two lists before buying any security tool: every online service your organization uses, and the software components inside the applications you run or build. The first shows where data goes. The second shows what could be vulnerable. The U.S. Department of Education recommends the first for schools, and it fits any public body.
Inventory one: online services
PTAC's guidance on online educational services recommends that a school or district take an inventory of the online services in use. It says this helps assess the scope and range of information shared with providers, and a master list helps officials evaluate which services work best and talk with parents.
Include free tools and extensions. Teachers and staff adopt them quickly, and PTAC specifically warns against bypassing internal controls for free services.
| Column | Example content |
|---|---|
| Service name and owner | Who uses it and who answers questions |
| Data it receives | Student, staff, code, logs, none |
| Agreement | Signed contract, terms accepted, none |
| Approval date | When it passed review |
| Next review | A date, not "later" |
Inventory two: software components
Most modern applications are assembled from open source libraries and packages. A component inventory, often delivered as a software bill of materials (SBOM), lists those parts and their versions. When a new flaw is announced, the list answers "are we affected?" in minutes instead of days.
| Column | Example content |
|---|---|
| Application | Student portal, scheduling tool, internal script |
| Component and version | Library name and exact version |
| Where it comes from | Registry or vendor |
| Owner | Team that updates it |
How to start in one week
- Day one: pull the finance or purchasing list of software spend. It is rarely complete but gives a first pass.
- Day two: ask each department head to list tools staff use that were not bought centrally.
- Day three: for each service, mark whether student or sensitive data is involved.
- Day four: list the applications you build or customize.
- Day five: generate a component list for the two most important ones.
Perfection is not the goal. A first list with gaps beats no list.
Common gaps
- Browser extensions and IDE plugins that individuals installed.
- Tools accepted by clicking terms on a free plan.
- Old internal applications with no named owner.
- Components added deep inside other components.
Keep it alive
An inventory goes stale in months. Tie updates to events: a new purchase, a new application, a staff change, or a yearly review date. Then connect it to watching. See continuous monitoring for how a list of components stays useful after the first scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how new findings appear against components you already listed.
Safeguard generates SBOMs and runs dependency scanning, and has an asset discovery capability for finding what is in use. A free scan is at gold.safeguard.sh/scan.
Quick check
Which inventory comes first?
Start with online services, since it shows where data goes, then add components for applications you build.
Does the list need to be perfect?
No. Start with gaps and fix them as you learn.
Sources
Last reviewed: 19 October 2026.
