Why Excel Lists Have Had Their Day in IT Documentation for Critical Infrastructures

Excel is without a doubt one of the most successful and versatile software products ever developed. From simple household budgeting to complex financial modeling, the spreadsheet program provides loyal service worldwide. But in one specific area of the modern business world, Excel is not just the wrong tool, it is a ticking time bomb: in the IT documentation of critical infrastructure (KRITIS) and NIS-2-regulated companies.

Despite ubiquitous warnings from security experts and auditors, asset management in an alarmingly high number of companies is still operated in the form of endless, manually maintained spreadsheets. In this post, we shed light on why this "best-effort" approach has radically failed in the age of cloud computing and hybrid networks, and why regulations like NIS-2 are heralding the final end of the Excel CMDB.

The Anatomy of an Excel Catastrophe

Let's imagine a typical scenario: A medium-sized energy provider or a hospital (both prime examples of critical infrastructure) uses a central Excel file to manage its servers, routers, software licenses, and cloud instances. This file is located on a SharePoint drive. Various administrators access it.

At first glance, this might seem pragmatic. But as soon as you look beneath the surface, fundamental cracks in this system reveal themselves, which can have catastrophic consequences in an emergency:

• Human Error: A spreadsheet is only as good as the person who fills it out. An administrator hastily sets up a new virtual machine (VM) to bridge a bottleneck. The phone rings, another ticket requires his attention – and the entry in the Excel list is simply forgotten. From the perspective of IT documentation, this VM does not exist. If outdated, vulnerable software is running on this VM, the vulnerability scanner might not prioritize it because the business-critical context is missing from the documentation. A classic blind spot (Shadow IT) has been created.
• The Absolute Loss of Relations: IT infrastructures today are highly networked ecosystems. A web server is connected to a database, the database resides on a specific storage system, and the storage system is routed via a specific switch. All these components together support the business process "Patient Admission." Excel is two-dimensional. While it can list data in columns, it is extremely poor at mapping complex, multi-dimensional dependencies. If the switch fails, the IT team cannot use the Excel list to identify in a fraction of a second which business processes are affected. This lack of relational depth massively delays incident response.
• No History, Only Overwritten Cells: As we have already discussed in the context of NIS-2 audits, the most important asset of modern IT documentation is history. If an IT security auditor or BSI examiner asks: "Which systems were in this specific network segment four months ago?", Excel fails miserably. When a server changes owners or an IP address range is modified in a spreadsheet, the administrator usually just overwrites the old cell. The history is irretrievably lost. Versioning of entire Excel files does not help here, as it does not allow for granular, data-based comparisons of individual assets over time.
• The Silo Problem (Multiple Versions of the Truth): In practice, it rarely stays with one master Excel file. The network team has its own list for IP addresses, the security team maintains a list for firewalls, and the cloud team exports monthly CSV files from AWS. When a security incident occurs, these teams sit in a "war room" and first argue about whose list is the correct one. There is no "Single Source of Truth."

NIS-2 Does Not Tolerate Flying Blind

With the introduction of the NIS-2 directive, the tolerance for such makeshift solutions has vanished. The EU requires affected entities to have systematic, verifiable risk management.

• The Federal Office for Information Security (BSI) repeatedly makes it clear in its guidelines that the identification and inventory of information technology systems is the indispensable first step of any security architecture. How do you intend to assess the risk of a cyberattack on your supply chain if you cannot automatically prove which systems even exist?
• Auditors are trained to immediately question manual lists. They know that in dynamic cloud environments, these lists are already outdated the moment they are saved. Anyone presenting an Excel spreadsheet as the primary asset inventory during an audit has practically lost the audit in the first five minutes.

The Data-Driven Alternative

The only answer to the complexity of modern IT is full automation. A modern asset management solution works fundamentally differently than a static spreadsheet:

• It fetches the data itself: Via APIs (interfaces), a platform like Qbilon integrates directly into your existing systems (vCenter, Azure, AWS, Active Directory, network scanners).
• It works in real-time: As soon as a new resource is spun up, it automatically appears in the database.
• It understands connections: Through intelligent algorithms, dependencies between servers, software, and business processes are automatically mapped.
• It forgets nothing: Every state is historized. The "Time Machine" function allows for the exact reconstruction of the IT landscape at any point in the past.

Conclusion: Time for a Digital Spring Cleaning

Excel will always have a place in the business world – but in the management of IT assets for critical infrastructures, that place is definitely no longer there. The risks from human error, lack of historization, and insufficient relational depth are simply too high.

Anyone still trying to master the challenges of NIS-2, KRITIS regulations, or complex cloud migrations with spreadsheets today is gambling with the security of their company. It is time to retire the Excel lists and switch to an automated, dynamic, and historized IT memory. Only then will you maintain control in the hybrid IT world and pass every audit with flying colors.