September 5, 2017 By Brian Evans 3 min read

The benefits of a comprehensive IT asset management (ITAM) program may seem obvious since it provides the data needed to strategically and tactically manage the life cycle of IT assets from purchase to end of life. Of course, companies can leverage IT asset management to reduce costs, improve operational efficiency, determine the full cost of existing investments and provide accurate cost information to guide future investment decisions. But an IT asset management program can also help identify and manage information risk as well.

A Strategic Imperative

Despite all these benefits, many companies struggle to implement a mature IT asset management program that enables them to accurately account for assets throughout the enterprise. They do not pay enough attention to managing and tracking IT assets where confidential information is stored. Cloud computing, virtualization, mobile devices, bring-your-own-device (BYOD) policies and the Internet of Things (IoT) add to this challenge.

With increasing risks, mounting regulations on security and privacy, and more software licensing audits, the role of IT asset management is no longer an optional activity. According to a Gartner report titled “Maturing the IT Asset Management Discipline Primer for 2017,” the time for IT asset management is now. Due to the onslaught of change driven by the business and its component assets, a robust, dynamic and well-funded IT asset management discipline is a strategic imperative for leaders and a success prerequisite for businesses.

An IT asset management program allows your company to maintain an accurate, documented IT environment outlining asset and data owners, and pinpointing risk and security issues across the network. Maintaining an IT asset management program also eases the process and costs of collecting documentation and other information for regulatory compliance. Industry regulations such as the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) require companies to identify and record the location and movement of any media or hardware containing confidential data.

Additionally, IT asset management can help address issues related to software piracy, noncompliance with software license agreements, copyright infringements and improper disposal of electronic equipment. To comply with these requirements, your company must understand what IT assets are owned, what data is being stored on them and who has access to them. Companies that fail to comply with these requirements could face fines or other penalties.

The Foundation of IT Asset Management

An IT asset management program should be designed to monitor, manage and report on the overall health of your company’s IT asset environment. Specifically, the program should have the capability to report on the security of network devices, operating systems, service patches and applications across the enterprise, both historically and in real time.

The foundation of an IT asset management program is a comprehensive inventory of the entire environment, which includes:

  • Device type/model;
  • Manufacturer serial number;
  • Device description;
  • Basic input/output system (BIOS) level;
  • Location/invoiced to;
  • Install date or lease commencement and end dates;
  • Owner;
  • Department;
  • License;
  • Asset tag;
  • Operating system (e.g., level/version, service packs, security patches, etc.);
  • Patch installation status;
  • Applications installed;
  • Software package version and updates (e.g., antivirus definitions);
  • Data managed;
  • Risk rating of data and applications;
  • Criticality rating of data and applications;
  • Backup and recovery provisions; and
  • Disaster recovery provisions.

Mature programs leverage IT asset management data for ongoing decision support at each stage of the asset life cycle. These programs use asset data as a methodology to develop an organizational discipline for reducing ongoing information risks, meeting compliance requirements, and facilitating technology implementations and change management. An effective program should include:

  • Funding that supports the IT asset management program and skills training;
  • A policy and procedure that defines the scope, processes, and roles and responsibilities;
  • An asset management team responsible for identifying each IT asset across the organization and maintaining the inventory;
  • An asset management inventory database with business and technical requirements defined for each asset class (e.g., servers and network devices) across the company;
  • Reporting functionality and decision tools to use the information provided by the asset management system;
  • Change management processes that ensure information is added to the inventory database as assets migrate to production status;
  • Asset inventory tools and solutions that integrate with purchasing/procurement and IT departments as well as software distribution and change management;

Purchasing/procurement should serve as the sole path through which IT assets are acquired to ensure that they are tracked through their entire life cycles. An IT asset management program should also provide oversight governance by monitoring and consistently enforcing asset management policies and procedures.

Long-Term Benefits

You can’t ensure adequate security protection throughout the enterprise without an accurate IT asset inventory to verify and validate. An IT asset management program is fundamental to handling your information risks more effectively and ensuring compliance with regulatory requirements. This investment may not deliver an instant return, but as the effort matures, opportunities to save money and improve your security posture will ultimately reveal themselves.

More from Data Protection

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Data residency: What is it and why it is important?

3 min read - Data residency is a hot topic, especially for cloud data. The reason is multi-faceted, but the focus has been driven by the General Data Protection Regulation (GDPR), which governs information privacy in the European Union and the European Economic Area.The GDPR defines the requirement that users’ personal data and privacy be adequately protected by organizations that gather, process and store that data. After the GDPR rolled out, other countries such as Australia, Brazil, Canada, Japan, South Africa and the UAE…

Third-party breaches hit 90% of top global energy companies

3 min read - A new report from SecurityScorecard reveals a startling trend among the world’s top energy companies, with 90% suffering from data breaches through third parties over the last year. This statistic is particularly concerning given the crucial function these companies serve in everyday life.Their increased dependence on digital systems facilitates the increase in attacks on infrastructure networks. This sheds light on the need for these energy companies to adopt a proactive approach to securing their networks and customer information.2023 industry recap:…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today