IT Asset Management Policy Template

Standard Operating Procedure: IT Asset Management (ITAM) Policy & Lifecycle Operations

Document ID: SOP-IT-AM-042
Effective Date: October 24, 2023
Version: 3.1.0
Review Cadence: Annual
Owner: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

The purpose of this Standard Operating Procedure (SOP) is to establish a rigorous, institutional-grade framework for the lifecycle management of all Information Technology (IT) assets within Template Registry. This document defines the mandatory protocols for asset discovery, classification, deployment, maintenance, and secure decommissioning. Adherence to this SOP ensures regulatory compliance, mitigates cybersecurity vulnerabilities, optimizes capital expenditure (CapEx) and operational expenditure (OpEx), and maintains absolute data integrity across all physical, virtual, and cloud infrastructures.

---

2. Scope & Prerequisites

2.1 Scope

This policy applies to all hardware, software, firmware, virtual machines, cloud-hosted resources, and mobile devices owned, leased, or operated by Template Registry, as well as contractor-owned endpoints accessing corporate networks (BYOD per exception policy).

2.2 Prerequisites & Required Tooling

• ITAM & CMDB Platform: ServiceNow / Snipe-IT enterprise instance with API integrations.
• Endpoint Management & MDM: Microsoft Intune and Jamf Pro.
• Network Discovery: Lansweeper / Cisco DNA Center for automated subnet scanning.
• Cryptographic Sanitization Tools: Blancco Data Eraser (or hardware equivalent conforming to NIST SP 800-88 Rev. 1).
• Physical Security Equipment: ESD-safe workspace, barcode/RFID scanners, tamper-evident seals.

---

3. Roles & Responsibilities

---

4. Step-by-Step Procedure

Phase 1: Procurement, Receipt, and Intake

• 1.1 Generate an authenticated Purchase Order (PO) linking financial data directly to the ITAM system before equipment shipment.
• 1.2 Inspect physical shipments at the secure receiving dock for external tampering and manifest accuracy within 24 hours of delivery.
• 1.3 Apply tamper-evident asset tracking tags containing a unique barcode and human-readable identification number to all physical hardware.
• 1.4 Register baseline asset attributes (Make, Model, Serial Number, MAC Address, Cost Center, Warranty Expiration) into the central CMDB.

Phase 2: Provisioning and Deployment

• 2.1 Enroll mobile and desktop endpoints into the enterprise MDM (Intune/Jamf) prior to end-user handover.
• 2.2 Push baseline golden images containing mandated endpoint protection agents, encryption profiles (BitLocker/FileVault), and identity management certs.
• 2.3 Update the ITAM status from "In Stock" to "In Deployment" and bind the asset UUID to the primary user's directory services (Azure AD/Okta) record.
• 2.4 Execute a pre-deployment verification ping and compliance scan to confirm telemetry reporting to the SIEM.

Phase 3: Operational Maintenance and Audit

• 3.1 Perform automated weekly network discovery scans to identify unmanaged or rogue assets operating within internal subnets.
• 3.2 Execute quarterly physical and virtual asset audits, reconciling discrepancies between inventory logs and real-world counts (Target Accuracy: $\ge 99.5%$).
• 3.3 Log all hardware repairs, component swaps (RAM, storage, NICs), and software license reallocations in the ITAM change log within 48 hours.
• 3.4 Review software license utilization metrics monthly to identify under-utilized seats and reallocate licenses to control SaaS bloat.

Phase 4: Decommissioning and Disposal

• 4.1 Submit a formal Retirement Request ticket approved by the Asset Manager and Department Head upon hardware failure or end-of-life (EOL).
• 4.2 Isolate the asset from the corporate network and execute a cryptographic data wipe complying with NIST SP 800-88 Rev. 1 (Clear/Purge).
• 4.3 Issue a Certificate of Sanitization for every media-bearing device processed; archive certificates in the permanent compliance repository.
• 4.4 Route physical components to a certified e-Waste recycling vendor (R2 or e-Stewards certified) and update ITAM status to "Disposed/Retired."

---

5. Quality Assurance & Pro-Tips

5.1 Pro-Tips & Best Practices

• Automated Hooks: Leverage webhook integrations between your procurement platform and ITAM to auto-create asset stubs the moment a PO is approved.
• Immutable Logs: Never manually delete an asset record from the CMDB. Always use lifecycle state transitions (In Stock $\rightarrow$ In Use $\rightarrow$ Retired) to preserve historical audit trails.
• Zero Trust Alignment: Treat unmanaged network peripherals (IoT, printers) with the same rigor as workstations by mandating 802.1X port security.

5.2 Common Pitfalls to Avoid

• The "Ghost Asset" Trap: Failing to update the CMDB immediately upon hardware failure, leading to bloated insurance premiums and inaccurate tax assessments.
• Incomplete Sanitization: Relying on simple OS formats instead of block-level overwrites or degaussing for solid-state and magnetic drives.

5.3 Metric Thresholds (KPIs)

• Inventory Accuracy Rate: $\ge 99.5%$ discrepancy-free across quarterly audits.
• Unidentified Device Detection Time: $\le 24$ hours from network attachment.
• Disposal Processing SLA: $\le 10$ business days from retirement ticket approval to e-waste handoff.

---

6. Frequently Asked Questions (FAQ)

Q1: What is the protocol if an employee loses a corporate laptop while traveling?
A: The employee must notify the IT Service Desk and Security Operations Center (SOC) within 2 hours. The SOC will immediately issue a remote enterprise wipe command via the MDM, lock the Active Directory account, and update the ITAM record status to "Stolen/Missing" to trigger the incident response protocol.

Q2: How are software licenses managed when cloud instances scale dynamically?
A: Dynamic cloud resources (e.g., AWS EC2, Azure VMs) utilize automated tagging policies mapped to auto-discovery tools. Software metering agents track active concurrency, and true-up reports are generated automatically on the 1st of each month to prevent compliance drift with vendor agreements.

Q3: Can personal peripherals (monitors, keyboards) be attached to corporate assets?
A: Peripherals that do not connect to corporate data networks or store data are permitted. However, any external storage media (USB drives, external SSDs) must be corporate-issued, hardware-encrypted, and explicitly whitelisted via the enterprise endpoint security policy.