Know Which Apps Run the Shop Before an Update Is Due

A tablet at the counter asks for an update. One person says it is the ordering app, someone else thinks it belongs to the previous manager, and nobody is sure whether the business still pays for it. That is an awkward moment to discover that the shop has no idea what is installed on its own equipment.

A small inventory can help. It does not have to be a special security product or a detailed technical database. A spreadsheet or shared list can record the devices and applications the business expects to use, who looks after them, and where to find support. The Cybersecurity and Infrastructure Security Agency's small business software guidance recommends maintaining an up-to-date inventory of authorized devices and applications, alongside keeping software updated. A clear list gives a small team a practical place to start.

List the devices people rely on

Start with equipment that connects to business accounts, stores customer or payment information, or helps the team serve customers. That might include shop tablets, computers, phones, the router, a point-of-sale terminal, a booking workstation, and a label printer connected to the network. The exact list depends on the business. A one-person repair shop may have a few devices; a café with several registers and staff tablets may have more.

For each item, record a plain name, where it is used, who is responsible for it, and the basic model or operating system if you can find it. A label such as "front counter tablet" helps more than "tablet 2." If the device has a serial number, keep it in a restricted business record rather than on a public label. Do not put passwords, recovery codes, or payment details in the inventory.

Include equipment that is easy to forget. An old phone used for delivery calls, a spare laptop in a drawer, or a tablet brought in for seasonal staff can still be part of the business's setup. You do not need to track every personal device in the building. Focus on equipment the business owns or has approved for work.

Make a short list of the software, too

Record the applications and online services the team depends on. Include the name, what the business uses it for, which device or role uses it, and who manages the account or subscription. For example: "booking service, appointment calendar, manager owns the account, used at front desk and on the owner phone." That sentence is more useful than a bare product name when someone needs to decide whether an app is still needed.

Note the vendor's support page or business contact if staff can find it easily. You can also record when the item was last checked and whether automatic updates are enabled, when that setting is visible. Do not assume every application updates in the same way. Follow the provider's instructions, especially for software tied to payment, appointments, inventory, or specialized equipment.

Keep the inventory separate from login secrets. A list can point to the approved password manager or explain who administers an account, but it should not contain the actual password or recovery code. Limit access to people who need the information. That makes the list useful without turning it into a map of every way into the business.

Use the list to make updates less mysterious

When an update notice appears, staff can check whether the device or application is approved and who should handle the update. For ordinary business apps, follow the vendor's update instructions and do not ignore security updates indefinitely. CISA advises businesses to enable automatic updates where possible and to replace software or devices that are no longer supported. If you are unsure whether an update is safe to apply immediately, ask the software provider or the person responsible for the system rather than clicking through on a busy shift.

Some equipment needs a planned update window. A point-of-sale system or booking service may affect active work, so choose a time when the team can confirm it still works afterward. This is not a reason to put off updates without a plan. Write down the person who will schedule the change, the vendor instructions, and how staff can report a problem. For equipment with special requirements, follow its manufacturer's directions.

A device or app that no one recognizes deserves a calm check, not a hurried deletion. Ask whether a vendor, accountant, booking partner, or former contractor installed it. Confirm its purpose and whether the business still needs it before removing it. If a device appears lost, unauthorized, or connected to a suspicious account, follow your incident procedure and get help from the appropriate support provider.

Review the list when the business changes

Assign one person to own the inventory, even if several people help update it. Review it when staff join or leave, equipment is replaced, a new service is adopted, or a vendor says support is ending. A short quarterly check can also catch tools that have been forgotten. Put the review on the calendar and ask the person who owns each tool to confirm it is still used and supported. If that schedule does not fit your business, tie the review to an existing staff or bookkeeping routine.

When a device leaves the business, note that it was retired and follow the organization's process for removing business accounts and information. When an app is no longer needed, confirm who owns the account and whether any business records must be kept before cancelling it. Do not leave a former employee's personal account as the only administrator for an important service. Set up an appropriate business owner or backup contact instead.

A useful starter inventory can fit in a few columns:

• Device or application name and business purpose.
• Location, role, or team that uses it.
• Person responsible for updates or account administration.
• Vendor support or instructions, and last review date.
• Status: approved, being checked, or retired.

Keep the wording simple enough that a new staff member can understand it without translating a row of technical shorthand. Review the list with the person who handles your IT or bookkeeping if you have one, and store it where authorized staff can reach it. A current inventory will not prevent every software problem, but it can help the right person answer the first useful question: what is this, and who owns the next step?