IT Asset Management Plan Template

Standard Operating Procedure: IT Asset Management (ITAM) Plan Deployment

Document ID: SOP-TR-ITAM-042
Effective Date: October 24, 2023
Version: 3.2.0
Review Cadence: Annual
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade framework for establishing, executing, and auditing the Information Technology Asset Management (ITAM) lifecycle at Template Registry. The objective is to achieve 100% inventory accuracy, enforce strict compliance with software licensing agreements, mitigate security vulnerabilities associated with unmanaged shadow IT, and optimize total cost of ownership (TCO) across hardware, software, cloud, and mobile assets. Adherence to this protocol is mandatory for all Engineering, Operations, and Procurement units.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all physical, virtual, and cloud-based assets owned, leased, or operated by Template Registry. This includes, but is not limited to:

• End-user compute devices (laptops, desktops, mobile devices).
• Datacenter infrastructure (servers, storage arrays, networking hardware).
• Software licenses (SaaS, perpetual, enterprise agreements, open-source dependencies).
• Cloud resources (AWS/Azure compute, storage, and serverless instances).

2.2 Prerequisites & Required Tools

• ITAM/CMDB Platform: ServiceNow / Jira Service Management with asset management modules configured.
• Discovery Agents: Microsoft Endpoint Configuration Manager (MECM) / Intune, Tanium, or equivalent network discovery agents deployed.
• Access Privileges: Enterprise Admin / ITAM Administrator role credentials.
• Hardware/PPE: ESD-safe wrist straps and static-dissipative mats for physical asset intake zones.

---

3. Roles & Responsibilities (RACI Matrix)

(R = Responsible, A = Accountable, C = Consulted, Informed = I)

---

4. Step-by-Step Procedure

Phase 1: Procurement, Intake, and Tagging

• 1.1 Route all hardware and software purchase requisitions through the ITAM Manager for pre-approval against current capacity thresholds.
• 1.2 Receive physical shipments at the designated secure loading dock; verify bill of lading against purchase order (PO) line items.
• 1.3 Affix tamper-evident, scannable Barcode/RFID asset tags to all physical hardware within 24 hours of intake.
• 1.4 Input baseline metadata into the CMDB: Serial Number, MAC Address, Asset Tag ID, PO Number, Cost Center, Vendor, and Warranty Expiration Date.

Phase 2: Deployment and Lifecycle Association

• 2.1 Assign the asset profile within the CMDB to the designated end-user or operational cluster prior to physical hand-off or provisioning.
• 2.2 Install mandatory enterprise endpoint protection, monitoring, and automated asset discovery agents during initial provisioning.
• 2.3 Link software licenses to specific hardware nodes or user profiles within the Software Asset Management (SAM) module to prevent unassigned license leakage.
• 2.4 Verify network ingress of the newly deployed asset via automated ping/agent heartbeat check within the central monitoring dashboard.

Phase 3: Continuous Auditing and Reconciliation

• 3.1 Execute automated network sweeps via discovery agents on a weekly cadence to identify rogue or unmanaged devices operating on the corporate network.
• 3.2 Perform monthly spot-check physical audits of high-value datacenter assets and 10% of distributed end-user inventory.
• 3.3 Conduct quarterly Software License Reconciliation audits to compare deployed installations against purchased entitlement counts.
• 3.4 Reconcile financial depreciation schedules against asset operational status in coordination with the Finance department bi-annually.

Phase 4: Decommissioning, Disposal, and Retirement

• 4.1 Submit an Asset Retirement Ticket (ART) upon hardware failure, lease expiration, or software deprecation.
• 4.2 Revoke and reclaim all associated software licenses and cloud access allocations, returning them to the enterprise pool.
• 4.3 Execute Department of Defense (DoD) 5220.22-M or NIST 800-88 Rev 1 data sanitization protocols on storage media; generate cryptographic erasure certificates.
• 4.4 Route physically destroyed or unrecoverable media to certified e-waste recycling vendors; secure Chain of Custody documentation.
• 4.5 Update asset status in the CMDB from "Active" to "Retired/Disposed" and archive historical telemetry.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Automate Discovery: Never rely on manual spreadsheets. Rely on automated network sweeps and endpoint agents to maintain dynamic inventory baselines.
• Tag Early: Tag assets at the exact moment of physical intake before items reach staging or deployment areas.
• Enforce Zero-Trust Onboarding: Block any device from corporate network access unless its asset tag and MAC address are pre-registered in the CMDB.

5.2 Common Pitfalls to Avoid

• The "Ghost Asset" Trap: Failing to update the CMDB immediately upon retirement, leading to bloated insurance, maintenance, and software support costs.
• License Blindness: Tracking hardware meticulously while ignoring SaaS seat utilization, resulting in excessive license over-subscription.

5.3 Metric Thresholds

• Inventory Accuracy Rate: $\ge 99.5%$ match between physical/virtual reality and CMDB records.
• Unmanaged Device Discovery Time: $< 24$ hours from network connection.
• License Compliance Variance: $0%$ negative variance during vendor audits.

---

6. Frequently Asked Questions (FAQ)

Q1: What should I do if an automated discovery agent fails to report on a deployed physical server?
A: Verify that the subnet allows outbound traffic on the agent communication ports (TCP 443/8883). If network rules are compliant, manually SSH/RDP into the host, restart the discovery agent service, and verify API token validity against the central CMDB repository. If failure persists, flag the asset for manual diagnostic inspection within 4 hours.

Q2: How are software entitlements handled when moving workloads from on-premises to cloud infrastructure (Bring Your Own License - BYOL)?
A: Submit an architectural change request to the SAM team prior to migration. The SAM engineer must verify that the underlying vendor agreement permits cloud mobility, log the license state change from "On-Premises Perpetual" to "Cloud Instance Dedicated" in the SAM module, and update the allocation keys accordingly.