The benefits of a comprehensive IT asset management (ITAM) program may seem obvious since it provides the data needed to strategically and tactically manage the life cycle of IT assets from purchase to end of life. Of course, companies can leverage IT asset management to reduce costs, improve operational efficiency, determine the full cost of existing investments and provide accurate cost information to guide future investment decisions. But an IT asset management program can also help identify and manage information risk as well.

A Strategic Imperative

Despite all these benefits, many companies struggle to implement a mature IT asset management program that enables them to accurately account for assets throughout the enterprise. They do not pay enough attention to managing and tracking IT assets where confidential information is stored. Cloud computing, virtualization, mobile devices, bring-your-own-device (BYOD) policies and the Internet of Things (IoT) add to this challenge.

With increasing risks, mounting regulations on security and privacy, and more software licensing audits, the role of IT asset management is no longer an optional activity. According to a Gartner report titled “Maturing the IT Asset Management Discipline Primer for 2017,” the time for IT asset management is now. Due to the onslaught of change driven by the business and its component assets, a robust, dynamic and well-funded IT asset management discipline is a strategic imperative for leaders and a success prerequisite for businesses.

An IT asset management program allows your company to maintain an accurate, documented IT environment outlining asset and data owners, and pinpointing risk and security issues across the network. Maintaining an IT asset management program also eases the process and costs of collecting documentation and other information for regulatory compliance. Industry regulations such as the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) require companies to identify and record the location and movement of any media or hardware containing confidential data.

Additionally, IT asset management can help address issues related to software piracy, noncompliance with software license agreements, copyright infringements and improper disposal of electronic equipment. To comply with these requirements, your company must understand what IT assets are owned, what data is being stored on them and who has access to them. Companies that fail to comply with these requirements could face fines or other penalties.

The Foundation of IT Asset Management

An IT asset management program should be designed to monitor, manage and report on the overall health of your company’s IT asset environment. Specifically, the program should have the capability to report on the security of network devices, operating systems, service patches and applications across the enterprise, both historically and in real time.

The foundation of an IT asset management program is a comprehensive inventory of the entire environment, which includes:

• Device type/model;
• Manufacturer serial number;
• Device description;
• Basic input/output system (BIOS) level;
• Location/invoiced to;
• Install date or lease commencement and end dates;
• Owner;
• Department;
• License;
• Asset tag;
• Operating system (e.g., level/version, service packs, security patches, etc.);
• Patch installation status;
• Applications installed;
• Software package version and updates (e.g., antivirus definitions);
• Data managed;
• Risk rating of data and applications;
• Criticality rating of data and applications;
• Backup and recovery provisions; and
• Disaster recovery provisions.

Mature programs leverage IT asset management data for ongoing decision support at each stage of the asset life cycle. These programs use asset data as a methodology to develop an organizational discipline for reducing ongoing information risks, meeting compliance requirements, and facilitating technology implementations and change management. An effective program should include:

• Funding that supports the IT asset management program and skills training;
• A policy and procedure that defines the scope, processes, and roles and responsibilities;
• An asset management team responsible for identifying each IT asset across the organization and maintaining the inventory;
• An asset management inventory database with business and technical requirements defined for each asset class (e.g., servers and network devices) across the company;
• Reporting functionality and decision tools to use the information provided by the asset management system;
• Change management processes that ensure information is added to the inventory database as assets migrate to production status;
• Asset inventory tools and solutions that integrate with purchasing/procurement and IT departments as well as software distribution and change management;

Purchasing/procurement should serve as the sole path through which IT assets are acquired to ensure that they are tracked through their entire life cycles. An IT asset management program should also provide oversight governance by monitoring and consistently enforcing asset management policies and procedures.

Long-Term Benefits

You can’t ensure adequate security protection throughout the enterprise without an accurate IT asset inventory to verify and validate. An IT asset management program is fundamental to handling your information risks more effectively and ensuring compliance with regulatory requirements. This investment may not deliver an instant return, but as the effort matures, opportunities to save money and improve your security posture will ultimately reveal themselves.