The benefits of a comprehensive IT asset management (ITAM) program may seem obvious since it provides the data needed to strategically and tactically manage the life cycle of IT assets from purchase to end of life. Of course, companies can leverage IT asset management to reduce costs, improve operational efficiency, determine the full cost of existing investments and provide accurate cost information to guide future investment decisions. But an IT asset management program can also help identify and manage information risk as well.

A Strategic Imperative

Despite all these benefits, many companies struggle to implement a mature IT asset management program that enables them to accurately account for assets throughout the enterprise. They do not pay enough attention to managing and tracking IT assets where confidential information is stored. Cloud computing, virtualization, mobile devices, bring-your-own-device (BYOD) policies and the Internet of Things (IoT) add to this challenge.

With increasing risks, mounting regulations on security and privacy, and more software licensing audits, the role of IT asset management is no longer an optional activity. According to a Gartner report titled “Maturing the IT Asset Management Discipline Primer for 2017,” the time for IT asset management is now. Due to the onslaught of change driven by the business and its component assets, a robust, dynamic and well-funded IT asset management discipline is a strategic imperative for leaders and a success prerequisite for businesses.

An IT asset management program allows your company to maintain an accurate, documented IT environment outlining asset and data owners, and pinpointing risk and security issues across the network. Maintaining an IT asset management program also eases the process and costs of collecting documentation and other information for regulatory compliance. Industry regulations such as the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) require companies to identify and record the location and movement of any media or hardware containing confidential data.

Additionally, IT asset management can help address issues related to software piracy, noncompliance with software license agreements, copyright infringements and improper disposal of electronic equipment. To comply with these requirements, your company must understand what IT assets are owned, what data is being stored on them and who has access to them. Companies that fail to comply with these requirements could face fines or other penalties.

The Foundation of IT Asset Management

An IT asset management program should be designed to monitor, manage and report on the overall health of your company’s IT asset environment. Specifically, the program should have the capability to report on the security of network devices, operating systems, service patches and applications across the enterprise, both historically and in real time.

The foundation of an IT asset management program is a comprehensive inventory of the entire environment, which includes:

  • Device type/model;
  • Manufacturer serial number;
  • Device description;
  • Basic input/output system (BIOS) level;
  • Location/invoiced to;
  • Install date or lease commencement and end dates;
  • Owner;
  • Department;
  • License;
  • Asset tag;
  • Operating system (e.g., level/version, service packs, security patches, etc.);
  • Patch installation status;
  • Applications installed;
  • Software package version and updates (e.g., antivirus definitions);
  • Data managed;
  • Risk rating of data and applications;
  • Criticality rating of data and applications;
  • Backup and recovery provisions; and
  • Disaster recovery provisions.

Mature programs leverage IT asset management data for ongoing decision support at each stage of the asset life cycle. These programs use asset data as a methodology to develop an organizational discipline for reducing ongoing information risks, meeting compliance requirements, and facilitating technology implementations and change management. An effective program should include:

  • Funding that supports the IT asset management program and skills training;
  • A policy and procedure that defines the scope, processes, and roles and responsibilities;
  • An asset management team responsible for identifying each IT asset across the organization and maintaining the inventory;
  • An asset management inventory database with business and technical requirements defined for each asset class (e.g., servers and network devices) across the company;
  • Reporting functionality and decision tools to use the information provided by the asset management system;
  • Change management processes that ensure information is added to the inventory database as assets migrate to production status;
  • Asset inventory tools and solutions that integrate with purchasing/procurement and IT departments as well as software distribution and change management;

Purchasing/procurement should serve as the sole path through which IT assets are acquired to ensure that they are tracked through their entire life cycles. An IT asset management program should also provide oversight governance by monitoring and consistently enforcing asset management policies and procedures.

Long-Term Benefits

You can’t ensure adequate security protection throughout the enterprise without an accurate IT asset inventory to verify and validate. An IT asset management program is fundamental to handling your information risks more effectively and ensuring compliance with regulatory requirements. This investment may not deliver an instant return, but as the effort matures, opportunities to save money and improve your security posture will ultimately reveal themselves.

More from Data Protection

Beyond Requirements: Tapping the Business Potential of Data Governance and Security

3 min read - Doom and gloom. Fear, uncertainty and doubt. The "stick" versus the "carrot". What do these concepts have in common? They have often provided the primary motivation for organizations’ data governance and security strategies. For the enterprise, this mindset has perpetuated the idea that data governance, data security and data privacy are reactive cost centers existing due to externally imposed requirements or mandates.Yet, what if data governance and security practices could upend the prevailing paradigm and demonstrate direct business value?[button link=""…

3 min read

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

4 min read - More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating. Credit rating agencies continuously strive to gain a better understanding of the risks that companies face. Today, those agencies increasingly incorporate cybersecurity into their credit assessments. This allows agencies to evaluate a company’s capacity to repay borrowed funds by factoring in the risk of cyberattacks. Getting Hacked Impacts Credit Scoring As per the Wall Street Journal…

4 min read

IBM Security Guardium Ranked as a Leader in the Data Security Platforms Market

3 min read - KuppingerCole named IBM Security Guardium as an overall leader in their Leadership Compass on Data Security Platforms. IBM was ranked as a leader in all three major categories: Product, Innovation, and Market. With this in mind, let’s examine how KuppingerCole measures today’s solutions and why it’s important for you to have a data security platform that you trust. The Transformation of the Data Security Industry As digital transformation continues to expand, the impact it has had on enterprises is very apparent when…

3 min read

SaaS vs. On-Prem Data Security: Which is Right for You?

2 min read - As businesses increasingly rely on digital data storage and communication, the need for effective data security solutions has become apparent. These solutions can help prevent unauthorized access to sensitive data, detect and respond to security threats and ensure compliance with relevant regulations and standards. However, not all data security solutions are created equal. Are you choosing the right solution for your organization? That answer depends on various factors, such as your industry, size and specific security needs. SaaS vs. On-Premises…

2 min read