Article 32 GDPR requires technical and organisational measures appropriate to the risk. This includes confidentiality, integrity, availability and resilience of systems, the ability to restore availability of data and regular evaluation of security measures.
An inventory system processes information about goods, users and operations. Availability and integrity of this data are important for business continuity.