- Contact Us
One of the most daunting and time-consuming tasks that an IT administrator can face is logging, monitoring, and tracking assets for their organization. Depending on the size of an organization, tracking can vary and may or may not include a robust program with various tools and spreadsheets that track the acquisition and lifecycle of assets. This multipart blog series will outline some of the various areas that should be addressed to have an operational and functional IT asset management program, as outlined below:
Several frameworks including ISO 27001/2, PCI-DSS, HIPAA HITECH, and NIST require that some form of asset management is in place and operational for organizations to be compliant. Regardless of how assets are tracked and managed, having a program that can meet all your organization’s needs is vital to keeping an operational business successful.
The first step in an asset management program is to establish the governance and policies that will dictate senior executives’ and the organization’s goals and standards. This process should include the following at a minimum:
Once the governance portion has been established and approved by executive management, distribution and necessary training of the workforce should be conducted. Like other established policies and procedures, this will ensure that all personnel know, and understand the process and the goals of the organization moving forward. Regardless of size, the importance of having a working governance program that outlines executive management’s goals will ultimately improve the workflow and productivity of the organization and its employees.
The next section of the IT asset management program that will be discussed is the process and acquisition of assets from reputable and vetted vendors. After the process of how assets are acquired has been established, the real work of monitoring and maintaining them begins. When assets arrive at the organization, they should be logged, tagged, and configured with the organization’s baseline security standards before being allowed access to the environment. Once the asset has been allowed, access monitoring and compliance with organizational standards needs to be maintained. Periodic audits throughout the year including an annual audit should occur to ensure that all assigned assets are in the locations they are assigned to and with the employees that are responsible for them.
As the Information Security Officer (ISO) for Compass IT Compliance, I use a cyclical quarterly audit and a full inventory audit to ensure that all assets are accounted for and accurately tracked. During these audits, like many organizations, we find discrepancies, which are logged and then remediated as needed. I have found that the quarterly audits help ensure that employees are following our established procedures and reduces the time spent on our full annual audit. Regardless of how frequently these audits occur, the overall goal is to ensure that all assets are tracked and that no unauthorized assets are operating within the organization.
Throughout the lifecycle of an asset, upgrades are introduced, and newer and better products come onto the market requiring decisions to be made on whether to maintain the asset or part ways for a different product. If an asset has reached the end of its usability for an organization, the final step of the asset management process needs to take place. Assets should be tracked up and until they are properly disposed. This could mean that hardware is taken offline and stored securely for an extended period until proper disposal occurs. However, it’s important that these assets are tracked to ensure that items don’t leave the organization without proper approval and possible organizational data isn’t leaked or disclosed to unauthorized personnel. Contact us today to learn more!