Asset management policy

Last revision on March 26, 2024

1. Policy Statement

• Asset management is the process of receiving, tagging, documenting, and eventually disposing of equipment.

• It is critically important to maintain up to date inventory and asset controls to ensure computer equipment locations and dispositions are well known. Lost or stolen equipment often contains sensitive data.

• Proper asset management procedures and protocols provide documentation that aid in recovery, replacement, criminal, and insurance activities.

2. Purpose

• This policy provides procedures and protocols supporting effective organizational asset management, specifically focused on electronic devices within the organization.

3. Scope

• This policy applies to all employees of Random Team, and all contractors, consultants, temporary employees and business partners that possess or manage assets owned by the organization. It is the responsibility of all the above to familiarize themselves with this policy and ensure adequate compliance with it.

4. Policy

4.1 Asset types

The following minimal asset classes are subject to tracking and asset tagging:

• Desktop Workstations

• Laptop Mobile Computers

• Tablet Devices

• Printers, Copiers, Scanners And Other Peripheral Devices

• Servers

• Network Appliances

• Voice Over Internet Protocol (Voip) Telephony

• Internet Protocol (Ip) Enabled Video And Security Devices

• Memory Devices

4.2 Asset value

Assets which cost less than 120 euros shall not be tracked, including computer components such as smaller peripheral devices, keyboards, or mice. However, assets that store data, regardless of cost, shall be tracked either as part of a computing device or as a part of network attached storage (like temporary storage drives)

4.3 Asset Tracking Requirements

The following procedures and protocols apply to asset management activities:

• All assets must have an internal asset number assigned and mapped to the device’s serial number

• An asset-tracking database or system shall be created to track assets. It shall minimally include purchase and device information including:

• Data of Purchase

• Make, Model, and Descriptor

• Serial Number

• Location

• Type of Asset

• Owner

• Department

• Disposition

Prior to deployment, assigned staff shall assign an ID to the asset and enter its information in the asset tracking database or system. All assets maintained in the asset tracking database inventory shall have an assigned owner that is responsible for updating the associated asset information on a defined schedule.

4.4 Asset Disposal and Repurposing

Procedures governing asset management shall be established for secure disposal or repurposing of equipment and resources prior to assignment, transfer, transport, or surplus. When disposing of any asset, sensitive data must be removed prior to disposal (see “Security Policy” for more information).

5. Audit Controls and Management

• On-demand documented procedures and evidence of practice should be in place for this operational policy. Satisfactory examples of evidence and compliance include:

• Current and historical asset management system checks for various classes of asset records.

• Spot checks of record input and accuracy against the tracking database.

• Evidence of internal processes and procedures supporting this policy for compliance with general workstation computing policies.