The benefits of a comprehensive IT asset management (ITAM) program may seem obvious since it provides the data needed to strategically and tactically manage the life cycle of IT assets from purchase to end of life. Of course, companies can leverage IT asset management to reduce costs, improve operational efficiency, determine the full cost of existing investments and provide accurate cost information to guide future investment decisions. But an IT asset management program can also help identify and manage information risk as well.

A Strategic Imperative

Despite all these benefits, many companies struggle to implement a mature IT asset management program that enables them to accurately account for assets throughout the enterprise. They do not pay enough attention to managing and tracking IT assets where confidential information is stored. Cloud computing, virtualization, mobile devices, bring-your-own-device (BYOD) policies and the Internet of Things (IoT) add to this challenge.

With increasing risks, mounting regulations on security and privacy, and more software licensing audits, the role of IT asset management is no longer an optional activity. According to a Gartner report titled “Maturing the IT Asset Management Discipline Primer for 2017,” the time for IT asset management is now. Due to the onslaught of change driven by the business and its component assets, a robust, dynamic and well-funded IT asset management discipline is a strategic imperative for leaders and a success prerequisite for businesses.

An IT asset management program allows your company to maintain an accurate, documented IT environment outlining asset and data owners, and pinpointing risk and security issues across the network. Maintaining an IT asset management program also eases the process and costs of collecting documentation and other information for regulatory compliance. Industry regulations such as the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA) require companies to identify and record the location and movement of any media or hardware containing confidential data.

Additionally, IT asset management can help address issues related to software piracy, noncompliance with software license agreements, copyright infringements and improper disposal of electronic equipment. To comply with these requirements, your company must understand what IT assets are owned, what data is being stored on them and who has access to them. Companies that fail to comply with these requirements could face fines or other penalties.

The Foundation of IT Asset Management

An IT asset management program should be designed to monitor, manage and report on the overall health of your company’s IT asset environment. Specifically, the program should have the capability to report on the security of network devices, operating systems, service patches and applications across the enterprise, both historically and in real time.

The foundation of an IT asset management program is a comprehensive inventory of the entire environment, which includes:

  • Device type/model;
  • Manufacturer serial number;
  • Device description;
  • Basic input/output system (BIOS) level;
  • Location/invoiced to;
  • Install date or lease commencement and end dates;
  • Owner;
  • Department;
  • License;
  • Asset tag;
  • Operating system (e.g., level/version, service packs, security patches, etc.);
  • Patch installation status;
  • Applications installed;
  • Software package version and updates (e.g., antivirus definitions);
  • Data managed;
  • Risk rating of data and applications;
  • Criticality rating of data and applications;
  • Backup and recovery provisions; and
  • Disaster recovery provisions.

Mature programs leverage IT asset management data for ongoing decision support at each stage of the asset life cycle. These programs use asset data as a methodology to develop an organizational discipline for reducing ongoing information risks, meeting compliance requirements, and facilitating technology implementations and change management. An effective program should include:

  • Funding that supports the IT asset management program and skills training;
  • A policy and procedure that defines the scope, processes, and roles and responsibilities;
  • An asset management team responsible for identifying each IT asset across the organization and maintaining the inventory;
  • An asset management inventory database with business and technical requirements defined for each asset class (e.g., servers and network devices) across the company;
  • Reporting functionality and decision tools to use the information provided by the asset management system;
  • Change management processes that ensure information is added to the inventory database as assets migrate to production status;
  • Asset inventory tools and solutions that integrate with purchasing/procurement and IT departments as well as software distribution and change management;

Purchasing/procurement should serve as the sole path through which IT assets are acquired to ensure that they are tracked through their entire life cycles. An IT asset management program should also provide oversight governance by monitoring and consistently enforcing asset management policies and procedures.

Long-Term Benefits

You can’t ensure adequate security protection throughout the enterprise without an accurate IT asset inventory to verify and validate. An IT asset management program is fundamental to handling your information risks more effectively and ensuring compliance with regulatory requirements. This investment may not deliver an instant return, but as the effort matures, opportunities to save money and improve your security posture will ultimately reveal themselves.

More from Data Protection

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Millions Lost in Minutes — Mitigating Public-Facing Attacks

In recent years, many high-profile companies have suffered destructive cybersecurity breaches. These public-facing assaults cost organizations millions of dollars in minutes, from stock prices to media partnerships. Fast Company, Rockstar, Uber, Apple and more have all been victims of these costly and embarrassing attacks. The total average cost of a data breach has increased by 2.6% since 2021 and is now $4.35 million. Organizations that don't deploy zero trust security models also incur an average of $1 million more in…