Asset Management Procedure

1. Purpose

This procedure sets out how the Organisation records, issues, tracks, maintains, moves and retires the assets that carry or process its information, so that every asset has a named owner, a known classification and a known location from the day it arrives until the day its data is destroyed.

It turns the principles of the IT Asset Management Policy into steps with owners, time targets and evidence. Where the Asset Disposal Process describes the destruction methods in detail, this procedure decides when an asset enters that process and who signs it off.

2. Scope

The procedure applies to every employee, contractor and third party who orders, receives, uses, supports or disposes of an asset that belongs to the Organisation or is used to handle its information.

• In scope: laptops, desktops, servers, network and security devices, mobile devices, removable media, printers, badges and tokens, and other physical equipment [with a purchase value above the capitalisation limit, and any item that can store data regardless of value].
• In scope: information assets such as databases, document repositories, source code, configuration files, contracts, customer data sets and backups, held in any format.
• In scope: licensed and open-source software, operating systems, firmware, and subscriptions.
• In scope: cloud accounts, subscriptions, virtual machines, storage, containers, domains, certificates and software-as-a-service tenants, including those bought outside IT.
• In scope: personally owned devices only to the extent that the Mobile Device Management Procedure enrols them.
• Out of scope: consumables with no storage capability, furniture, and facilities equipment managed under the Physical and Environmental Security Procedure.

3. Terms and Definitions

4. Roles and Responsibilities

4.1 Accountability notes

Accountability for an asset never rests with the supplier or with the person who last touched it. If an owner leaves or changes role, the line manager nominates a successor within [5 working days]; until then the manager is the owner. The register must never show an asset with no owner, and an unowned asset found during a verification cycle is reported as an exception to the Head of IT Operations.

5. Entry Criteria and Inputs

Work under this procedure starts only when the inputs below exist. IT Operations returns an incomplete request to the requester within [1 working day] with the missing item named.

• An approved purchase order, internal transfer note, hire contract or subscription order for any addition.
• A completed request in [the ticketing tool], approved by the line manager and, for assets above [the cost threshold], by the budget holder.
• A named asset owner and a proposed classification under the Information Classification and Handling Procedure.
• For a withdrawal or disposal, a trigger: end of life, fault beyond repair, role change, exit, project closure or security finding.
• Access to [the asset management tool] and the asset tag stock held by IT Operations.

6. Asset Classification and Criticality

Each asset is given a criticality rating that drives how closely it is tracked, how fast it is repaired and how it is disposed of. The rating is set by the asset owner at registration and reviewed at every verification cycle.

7. Activities Overview

8. Monitoring

The Asset Management team checks the health of the register continuously and reports gaps. Monitoring covers both whether the register is accurate and whether the controls around it are working.

• Discovery scans of [the network and the endpoint management tool] run [weekly] and are compared with the register; every device seen but not registered is a shadow asset and is raised as a ticket within [1 working day].
• A report of assets with no owner, no classification, no location or no check-in for [30 days] is reviewed [monthly].
• Warranty, licence and certificate expiry dates are listed [90 days] ahead and reviewed [monthly].
• Cloud billing and account reports are reviewed [monthly] for unrecognised subscriptions or resources.
• Spot checks: the Information Security team physically traces [10 percent] of High and Critical assets [each quarter].

9. Procedure

The sub-procedures below apply to the assets and situations named in each heading. Every step is recorded in [the ticketing tool] against the asset record, and the register is updated by IT Operations before the ticket is closed.

9.1 Addition or upgrade of a physical asset

1. Raise the needThe requester logs a request stating the purpose, user or team, expected data classification and the budget code. The line manager approves within [2 working days].
2. Check for reuseIT Operations checks stock of withdrawn and sanitised assets before a purchase is approved, and reuses a suitable item where it meets the baseline.
3. OrderProcurement places the order with an approved supplier only, using the specification set by IT Operations and Information Security, and shares the expected delivery date with IT Operations.
4. Receive and inspectIT Operations receives the goods, checks them against the purchase order, inspects for tampering or damage, and records the serial number and supplier. Discrepancies are held in quarantine and reported to Procurement.
5. Register and tagIT Operations assigns a unique asset identifier, applies a tamper-evident tag and creates the register entry with the fields in Annexure A, including owner, classification, location and warranty end date.
6. ConfigureThe asset is built from the approved baseline image, encrypted, enrolled in endpoint management and malware protection, and tested. Default passwords and unused services are removed. The build checklist is attached to the ticket.
7. Authorise for useThe asset owner or IT Operations lead confirms the build, and the status in the register changes from In build to In stock or In use.
8. UpgradeFor an upgrade of memory, storage or firmware, a change ticket is raised under the Change Management Policy and Procedure; replaced components holding data are sanitised or destroyed and the register is updated.

9.2 Allotment of an asset

1. Request and approveThe line manager requests the asset for a named user. For privileged or Critical assets the asset owner approves as well.
2. SelectIT Operations selects an asset of the right class and confirms it is clean, patched and compliant with the baseline.
3. IssueThe user collects the asset in person or through tracked courier, shows identification, and signs the allotment form in Annexure B accepting responsibility.
4. BriefIT Operations reminds the user of the Acceptable Usage Policy, the duty to report loss within [4 hours], and the ban on installing unauthorised software or lending the device.
5. RecordThe register entry shows the user, issue date, expected return date for temporary loans, and accessories issued. The signed form is attached.
6. ConfirmFor a long-term allotment, the user confirms possession in the next verification cycle.

Temporary loans for events, travel or testing are issued for no more than [30 days]; IT Operations chases overdue returns on day [31] and escalates to the line manager on day [38]. Shared assets such as meeting-room devices have a named custodian rather than a named user.

9.3 Replacement of a faulty asset

1. ReportThe user logs a fault ticket with symptoms and any error. If data loss or physical damage by liquid or impact is suspected, the Information Security team is informed.
2. DiagnoseIT Operations attempts remote repair within [4 hours] for High and Critical assets and within [1 working day] for others.
3. Back upBefore any hand-over of a faulty device, IT Operations confirms the user's data is backed up under the Backup Management and Retention Procedure, or records that the storage is unreadable.
4. Issue a replacementA like-for-like asset is issued under the allotment steps. The replacement is registered against the user and the faulty asset's status changes to In repair.
5. Repair or write offRepairs are done only by the approved service provider under a contract that forbids data retention. Where the storage cannot be wiped, it is removed and held for destruction before the device leaves the premises. Beyond-repair assets go to withdrawal and disposal.
6. CloseThe register shows the old asset's outcome, warranty claims are logged with Procurement, and the ticket records time to replace.

9.4 Withdrawal of an asset

1. TriggerHR, the line manager or IT Operations raises a withdrawal ticket on an exit, transfer, end of loan, end of project or fault. For leavers it is raised no later than the notice date.
2. CollectIT Operations collects the asset and every accessory, token and badge on or before the last working day, in person or by tracked courier for remote staff within [3 working days].
3. InspectThe condition is checked and noted. Missing items are recorded and reported to the line manager and Information Security.
4. Remove accessAccounts bound to the device are disabled or reassigned and device certificates are revoked, following the User Access Management Procedure.
5. Preserve if neededIf the user is under investigation or the data is subject to a legal hold, the asset is isolated, bagged and logged as evidence and is not wiped.
6. Back up and sanitiseBusiness data the next user needs is copied to the team repository. The device is then sanitised using the method in the disposal procedure for its type, and a sanitisation record is created.
7. DecideThe asset owner decides to reuse (status In stock), repair, or dispose. Assets older than [5 years] or failing the baseline are not reused.
8. Update the registerStatus, location, user and date are updated, and HR is told that the clearance is complete.

An employee's final clearance is not signed by HR until IT Operations confirms in the ticket that all assets are returned or that a recovery action has been agreed with Finance. Unreturned assets are reported to Information Security and handled as a potential loss of information.

9.5 Disposal of assets

1. IdentifyIT Operations compiles a disposal list [monthly] from assets with status Withdrawn, Beyond repair or End of life. No asset is disposed of without an entry on the list.
2. ApproveThe asset owner approves each item. The Head of IT Operations approves the batch. Finance approves write-off of assets above [the write-off threshold].
3. Sanitise or destroyData-bearing assets are sanitised or destroyed using the method in the table below. The Information Security team witnesses the destruction of Critical assets and High assets that held restricted data.
4. Select the routeReusable, sanitised items may be donated, sold or returned to a lessor. Others go to an authorised recycler who gives a certificate of destruction and environmental compliance.
5. Hand over under controlDisposal contractors collect against a signed manifest listing identifiers and serial numbers. Assets are never left unattended and never released to staff for personal use unless sanitised and approved.
6. Certify and closeThe disposal certificate in Annexure C is signed by IT Operations and the witness, filed, and the register status changes to Disposed. Finance updates the fixed asset ledger within [5 working days].
7. ReviewThe Head of IT Operations reviews the certificates against the manifest [each quarter] for mismatches.

Further detail on methods, vendors and certificates is held in the Asset Disposal Process.

9.6 Change of location of an asset

1. RequestThe user or custodian raises a move ticket naming the asset, the old and new location, the date and the reason.
2. ApproveThe asset owner approves. A move of a Critical asset or a move between sites also needs the approval of the Information Security team, which checks the destination's physical controls.
3. MoveFacilities or IT Operations moves the asset with a movement form (Annexure D). Assets leaving the premises travel in tamper-evident packaging, are encrypted, and are carried by an approved courier or by the user.
4. RecordIT Operations updates the location in the register within [1 working day] and files the signed form.
5. VerifyReceipt at the destination is confirmed by the receiver within [1 working day]. If no confirmation arrives, the asset is treated as lost.

Equipment taken off-premises is covered by the Acceptable Usage Policy and the Mobile Device and Teleworking Policy; the user keeps the device in view or locked away and reports loss within [4 hours].

9.7 Lost, stolen or damaged assets

1. ReportThe user reports the loss to the service desk and Information Security within [4 hours] of noticing, giving time, place and the data likely to be on the device.
2. ContainIT Operations locks and remotely wipes the device where possible, revokes certificates and sessions, and resets the user's credentials within [1 hour] of the report.
3. AssessInformation Security determines what information was at risk and, if personal data or a reportable cyber incident is involved, starts the Incident Management Procedure so notification clocks are met.
4. RecordThe register status becomes Lost or Stolen, with the report reference. A police report is filed where the line manager and Information Security agree it is needed.
5. LearnThe line manager and the asset owner decide on replacement and any disciplinary step under the HR Security Procedure.

9.8 Information asset management

Information assets are recorded at the level of the data set, repository or record series, not individual files. Each entry shows the owner, classification, format and location, personal data content, retention period, legal basis or contract, and the systems that process it.

1. IdentifyEach department head lists information assets during the annual review and whenever a new system, project or data flow starts.
2. Classify and labelThe asset owner classifies the asset under the Information Classification and Handling Procedure and applies the label or marking required for its form.
3. Assign handling rulesThe register links the asset to storage, sharing, encryption, retention and backup rules for its class.
4. Record personal dataAssets containing personal data are flagged and linked to the processing record maintained under the Data Protection and Privacy Procedure.
5. ReviewOwners confirm the entries [every 6 months] and mark data sets for archive or deletion when the retention period ends.
6. DeleteAt the end of retention, deletion is carried out and evidenced by the custodian under the Backup Management and Retention Procedure, including copies in backups where they can be selectively removed.

9.9 Software asset management

1. Approve before installOnly software on the approved list may be installed. A new title is assessed by Information Security for vulnerabilities, supplier standing, data handling and licence terms before approval.
2. RecordIT Operations records each product, version, licence type, licence key location, quantity purchased, quantity installed, support end date and the assets it runs on.
3. License and reconcileInstalled counts are reconciled to entitlements [quarterly] using discovery tooling. Shortfalls are fixed through purchase or removal within [30 days]; surplus is reviewed for reduction at renewal.
4. ControlStandard users cannot install software. Open-source components in products are logged with licence and version as part of the development process.
5. MaintainPatches follow the Patch Management Procedure. Software [12 months] from vendor end of support is flagged for replacement; unsupported software needs a documented risk exception.
6. RetireOn removal, the licence is returned to the pool or terminated at renewal, accounts and data are deleted or exported, and the register is updated.

Unlicensed, pirated or unapproved software found during discovery is removed within [2 working days] and reported to Information Security as an incident; the user's manager is told.

9.10 Cloud asset management

1. Onboard the serviceA cloud account, subscription or tenant is created only after approval under the Cloud Computing Security Policy and Procedure. The register records provider, account owner, business owner, region, data classification and contract end date.
2. Tag resourcesEvery resource must carry tags for owner, environment, classification and cost centre. Untagged resources are reported [weekly] and stopped after [14 days] if the owner does not claim them.
3. Control accountsAdministrator access to cloud consoles uses individual accounts with multi-factor authentication. Root or global-owner credentials are sealed and used only with dual approval.
4. MonitorConfiguration and cost are monitored continuously; changes to storage exposure, identity or network rules are alerted to Information Security.
5. ReviewEach cloud asset owner reviews resources, accounts and integrations [every 6 months] and removes anything unused.
6. ExitBefore ending a service, the owner exports required data, confirms backups, requests deletion from the provider in writing, obtains confirmation, and updates the register.

9.11 Asset verification

1. PlanThe Head of IT Operations publishes the verification schedule at the start of the year and appoints verifiers who are not the custodians of the assets they check.
2. ExtractThe register is exported by site, class and owner [30 days] before the cycle.
3. VerifyVerifiers check each asset by serial number and tag, its state, location and user, using a barcode reader or the endpoint management report where appropriate.
4. ResolveDifferences are classified as missing, found but unregistered, wrong location, wrong user or wrong class. Each is corrected or investigated within [10 working days].
5. ReportResults go to the Information Security Manager and Finance; unresolved losses are written off only with the approval of the Head of IT Operations and Finance.

10. Roles and Responsibilities Matrix

R is who does the work, A is the single person answerable for the result, C is consulted before the work is done, and I is informed after it.

11. Measures

12. Reporting and Management Review

The Head of IT Operations reports to the Information Security Steering Committee [quarterly] and gives management a summary for each management review. The report is short and uses the measures above.

• Totals by class and status, additions and disposals, and the movement since the last report.
• Verification results, losses, shadow assets and the actions taken.
• Expiring warranties, licences and unsupported software with a proposed action.
• Cloud accounts added or closed, and untagged or unowned resources.
• Exceptions granted, overdue actions and proposed changes to this procedure.

Management reviews the report, decides on funding for refresh and tooling, and records decisions in the management review minutes.

13. Records and Evidence

Annexure A: Asset register

Minimum fields for each register entry. Add rows for further assets.

Annexure B: Asset allotment and return form

Annexure C: Asset disposal certificate

Annexure D: Asset movement form

14. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

15. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

16. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• IT Asset Management Policy
• Asset Disposal Process
• Information Classification and Handling Policy
• Information Classification and Handling Procedure
• Cloud Computing Security Policy and Procedure
• HR Security Procedure
• Mobile Device Management Procedure