Comprehensive IT Asset Inventory Operations Standard Operating Procedure

Standard Operating Procedure: Comprehensive Information Technology Asset Inventory Operations

1. Document Control Block

---

2. Executive Summary & Purpose

2.1 Executive Summary

This Standard Operating Procedure (SOP) defines the mandatory lifecycle management, discovery, tracking, and auditing protocols for all Information Technology (IT) hardware, software, and cloud-based infrastructure assets deployed within Template Registry environments. Maintaining an authoritative, real-time inventory is critical for attack surface reduction, vulnerability management, cost optimization, and regulatory compliance (e.g., SOC 2, ISO 27001).

2.2 Purpose

To establish a repeatable, auditable engineering framework for capturing, classifying, monitoring, and retiring IT assets. This document ensures zero "shadow IT" gaps and provides complete asset visibility across on-premises, edge, and multi-cloud topologies.

---

3. Scope & Prerequisites

3.1 Scope

• In-Scope: All physical hardware (servers, networking equipment, user endpoints), virtual machines, software licenses, SaaS subscriptions, and cloud resource instances (AWS, GCP, Azure) owned, leased, or operated by Template Registry.
• Out-of-Scope: Personally Owned Devices (BYOD) not connected to corporate Single Sign-On (SSO) or MDM boundaries (note: BYOD connected to enterprise resources falls in-scope strictly regarding access logging).

3.2 Prerequisites & Tooling

• Agent-Based Discovery: Jamf (macOS), Microsoft Intune (Windows), Datto RMM.
• Network Discovery: Lansweeper, Cisco Prime / DNA Spaces (SNMP v3).
• Cloud Asset Management: AWS Config, GCP Cloud Asset Inventory, Azure Resource Graph.
• Configuration Management Database (CMDB): ServiceNow / Jira Service Management (JSM).
• Authentication: Privileged Access Management (PAM) credentials with read-only API scopes across all target environments.

---

4. Roles & Responsibilities

---

5. Step-by-Step Procedure

Phase 1: Automated Discovery & Ingestion

• 1.1 Verify that the network discovery scanner (e.g., Lansweeper) has active credentials for all corporate VLANs and data center subnets.
• 1.2 Confirm cloud provider connectors (AWS Config, GCP Asset Inventory) are synchronizing daily and outputting state changes to the primary CMDB webhook.
• 1.3 Execute manual synchronization script for MDM profiles (Intune/Jamf) to capture newly provisioned user endpoints.
• 1.4 Cross-reference automated ingestion logs for orphaned nodes or failed API handshakes.

Phase 2: Classification, Tagging, & Enrichment

• 2.1 Apply mandatory metadata tags to all newly discovered assets matching the Template Registry tagging schema:
  • Environment (prod, staging, dev, corp)
  • Owner (engineering-lead@templateregistry.internal)
  • CostCenter (CC-9021)
  • DataClassification (restricted, confidential, internal, public)
• 2.2 Map hardware assets to physical locations (Data Center Rack ID, Office Floor/Desk).
• 2.3 Link software licenses to purchase orders (POs) and vendor agreements within the ITAM system.

Phase 3: Verification & Reconciliation Audit

• 3.1 Generate the weekly Variance Report comparing active network telemetry against CMDB baseline records.
• 3.2 Isolate unclassified or untagged assets ("Ghost Assets") and place them in an isolated quarantine VLAN if unverified after 48 hours.
• 3.3 Conduct spot-checks on 5% of physical hardware assets via barcode/RFID scanning against the physical asset ledger.

Phase 4: Lifecycle Transition & Retirement

• 4.1 Initiate decommissioning workflow in JSM upon receipt of hardware End-of-Life (EOL) notice or software deprecation request.
• 4.2 Revoke all cloud IAM policies, API keys, and associated SaaS licenses tied to the retiring asset.
• 4.3 Perform cryptographic data destruction (NIST SP 800-88 Rev. 1 compliant) for physical storage media; archive certificates of destruction in the compliance vault.
• 4.4 Update asset status in the CMDB from Active to Decommissioned / Disposed.

---

6. Quality Assurance & Pro-Tips

6.1 Best Practices

• Immutable Audit Trails: Never manually delete an asset record from the CMDB; always transition states to preserve historical auditability for compliance frameworks.
• API-First Operations: Avoid manual entry of cloud assets. If it's not provisioned via Infrastructure as Code (IaC) with automated CMDB registration hooks, it violates engineering policy.

6.2 Common Pitfalls

• Orphaned Cloud Resources: Neglecting to scan unattached EBS volumes, static IPs, or stopped instances, leading to undetected cloud spend and security drift.
• Stale Metadata: Failing to update asset ownership when internal transfers occur, rendering incident response escalations ineffective.

6.3 Metric Thresholds

• Discovery Coverage: $\ge 99.5%$ of active network-connected endpoints must be cataloged.
• Reconciliation Cadence: Automated delta sync must execute every 24 hours; manual audits occur bi-weekly.
• Tagging Compliance: $\ge 98%$ of cloud infrastructure must possess compliant metadata tags within 4 hours of deployment.

---

7. Frequently Asked Questions (FAQ)

Q1: What is the required protocol if an unmanaged personal device is discovered on the corporate network?
A: Network Access Control (NAC) will automatically quarantine the device to a guest VLAN. The ITAM system will generate an alert to the Helpdesk. The user must either register the device via the corporate MDM/BYOD onboarding portal or disconnect from the network.

Q2: How are ephemeral cloud resources (e.g., Kubernetes pods, AWS Lambda functions) handled in the asset inventory?
A: Ephemeral infrastructure is tracked via aggregate cluster and service-level descriptors rather than individual transient execution nodes. Auto-scaling groups and container orchestration platforms report aggregate resource pools to the CMDB via API connectors, maintaining compliance without noise pollution in the active asset ledger.