IT Asset Management Policy

1. Purpose

An organisation cannot protect what it does not know it has. This policy requires that every information asset and every IT asset that supports it is identified, recorded, given an owner, classified, used within rules, kept in a known state and retired safely. It provides the inventory on which risk assessment, patching, access review, licence control and incident response depend.

The working steps, forms and tool settings are in the Asset Management Procedure, and the disposal steps are in the Asset Disposal Process.

2. Scope

• In scope: hardware (servers, laptops, desktops, phones, tablets, network and security devices, storage, printers, peripherals, removable media and badges that act as tokens).
• In scope: software (operating systems, applications, firmware, licences, scripts and code repositories) and cloud and software-as-a-service subscriptions, domains and certificates.
• In scope: information assets (databases, document repositories, datasets, logs, backups) and their classification.
• In scope: assets owned, leased, borrowed or provided by suppliers for the Organisation's use, and personally owned devices that are approved for work under the Mobile Device and Teleworking Policy.
• Out of scope: general office furniture and consumables, unless they hold information such as lockable cabinets for records.

3. Terms and definitions

4. Roles and Responsibilities

5. IT Asset Management Policy Statements

5.1 Inventory

• Every asset in scope must be entered in the asset register within [2 working days] of receipt or creation, and no asset may be put into production before it is registered.
• The register records at minimum the fields in the table below. Fields for cloud services and data assets are adapted to suit.
• Automated discovery tools run at least [weekly] to find unregistered devices and software. Anything found is registered, approved or removed within [5 working days].
• The register is reconciled with physical counts, directory entries, finance records and supplier invoices at least [every 12 months], and with the discovery tool [monthly]. Differences above [2 percent] are investigated by the Head of IT.

5.2 Ownership and classification

• Every asset has a named owner who is a manager with authority over its use. Shared platforms have a platform owner, and the data inside them has data owners.
• The owner classifies information assets under the Information Classification and Handling Policy. Hardware and software inherit the highest classification of the information they hold or process.
• A criticality rating is assigned to each asset as shown below and is used in risk assessment, patch priority and recovery planning.

5.3 Acceptable use of assets

Assets are used for authorised business purposes in line with the Acceptable Usage Policy. Personal use is limited as that policy sets out. Users must not install unapproved software, change security settings, connect unapproved devices or lend assets to others.

5.4 Acquisition, receipt and deployment

• Assets are purchased through approved suppliers and routes, and meet the security requirements in the purchase specification.
• On receipt, the packaging is checked for tampering, the asset is tagged and registered, and the secure configuration baseline in the Secure Configuration Policy is applied before issue.
• User equipment is issued against a signed acknowledgement of responsibility. Security tooling such as endpoint protection and disk encryption is installed and checked before the asset leaves IT.

5.5 Software and licence management

• Only approved and licensed software may be installed. Requests for new software are approved by the asset owner and the Head of IT Security.
• Licence entitlements and usage are compared at least [every 6 months]. Over-use or unlicensed use is corrected immediately and reported to the Head of Compliance.
• Software and operating systems no longer supported by their supplier are replaced or isolated with compensating controls within [6 months] of end of support, with the risk accepted in writing.

5.6 Cloud services and shadow IT

New cloud and software-as-a-service tools are registered, risk-assessed and approved before any Organisation data is placed in them, as required by the Cloud Computing Security Policy and Procedure. Departments must not buy or sign up for such services outside the process. Discovery of unapproved services is handled as a policy breach and the service is registered or stopped.

5.7 Movement, repair and storage

• Movement of assets between sites or users is recorded in the register with the date, the sender and the receiver.
• Assets in storage are kept in a locked place with an inventory and a record of who holds the key. Spares held for critical services are counted [every 3 months].
• Faulty assets are repaired by approved parties after data has been removed or under supervision, and records of repairs are kept.

5.8 Return of assets

Assets issued to a person are returned on leaving, on a change of role where no longer required, and at contract end for suppliers. The exit steps in the HR Security Policy include a checked return list. Assets not returned within [10 working days] are escalated to Finance and Legal, and remote wipe and account blocking are applied immediately.

5.9 Lost, stolen or compromised assets

• Loss or theft must be reported to the service desk within [1 hour] of discovery, or as soon as the person is able.
• The Head of IT Security decides within [4 hours] whether to remote wipe, revoke credentials and certificates, and open an incident under the Information Security Incident Management Policy.
• Where personal data may be affected, the data protection lead assesses notification duties, including those under the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement].

5.10 Disposal and reuse

Assets that leave service are sanitised or destroyed in line with the Asset Disposal Process. Disposal needs the owner's approval, evidence of data erasure or destruction, removal of licences and update of the register. Devices are never donated, sold or recycled until the register shows sanitisation is complete.

5.11 Information assets and data inventory

• Information assets such as datasets, repositories and backups are recorded with owner, location, classification, retention period and the systems that process them.
• Information-asset records feed the data protection record of processing and the risk assessment.
• Information assets are reviewed by the owner at least [every 12 months].

6. Lifecycle Controls Summary

7. Performance Indicators

8. Compliance and monitoring

The Head of IT reports the indicators [quarterly] to top management. Internal audit checks a sample of at least [25] assets from register to physical or logical existence and back, and a sample of leavers and disposals, at least [once a year].

9. Records and evidence

• The asset register with change history: kept for the life of the asset plus [3 years].
• Purchase, receipt and issue records, and signed acknowledgements: [duration of use plus 3 years].
• Disposal certificates and sanitisation logs: [5 years].
• Annual inventory reconciliation reports and licence reviews: [3 years].

Annexure A: Asset register entry

10. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

11. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

12. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Asset Management Procedure
• Asset Disposal Process
• Acceptable Usage Policy
• Information Classification and Handling Policy
• Mobile Device and Teleworking Policy
• Secure Configuration Policy