IT Asset Management Process Document Template

SOP-ITAM-001: IT Asset Management (ITAM) Lifecycle

1. Executive Summary & Purpose

This document establishes the institutional standard for the end-to-end lifecycle management of IT assets—spanning procurement, deployment, maintenance, and decommissioning. The purpose is to minimize financial waste, ensure software license compliance, mitigate security vulnerabilities related to rogue hardware, and maintain an accurate Source of Truth (SoT) within the Configuration Management Database (CMDB).

2. Scope & Prerequisites

• Scope: All physical hardware (laptops, servers, networking gear), virtual instances, and enterprise software licenses owned or leased by the organization.
• Prerequisites:
  • Active access to the enterprise CMDB (e.g., ServiceNow, Jira Assets, or Snipe-IT).
  • Hardware imaging workstation (PXE/WDS/Intune/JAMF).
  • Physical barcode/RFID scanner.
  • PPE: Anti-static wrist straps and ESD-safe mats for physical hardware handling.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase I: Procurement & Onboarding

• Verify asset request against departmental budget and security policy.
• Create asset record in CMDB with SKU, Serial Number, and Vendor PO.
• Apply asset tag (Barcode/RFID) to the physical chassis.

Phase II: Deployment & Provisioning

• Image hardware via authorized deployment server.
• Assign asset to specific user profile in CMDB (Link UUID to User ID).
• Verify security baseline (encryption, EDR, MDM enrollment) post-deployment.

Phase III: Maintenance & Auditing

• Execute quarterly physical spot-checks (scan 10% of inventory).
• Update software license seat counts in CMDB following monthly reconciliations.
• Log all repairs/component swaps under the asset's service history.

Phase IV: Retirement & Disposal

• Revoke software licenses upon offboarding or upgrade.
• Execute secure data wipe (NIST 800-88 compliant) on all storage media.
• Update CMDB status to "Retired" and generate Certificate of Destruction (CoD).

5. Quality Assurance & Pro-Tips

• Metric Thresholds:
  • Inventory Accuracy: >98% match between CMDB and physical audit.
  • Procurement Lead Time: <10 business days for standard hardware.
• Pro-Tips:
  • Never rely on spreadsheets: If it’s not in the CMDB, it doesn't exist.
  • Auto-Discovery: Deploy network agents to automatically detect and flag "orphan" devices that appear on the network without an asset record.
  • Common Pitfall: Failing to reclaim licenses from inactive user accounts; implement automated triggers for license harvesting.

6. Frequently Asked Questions

Q: What do I do if I find an asset that has no barcode or record? A: Immediately isolate the device from the production network. Tag it as "Unknown/Quarantine" in the CMDB and perform a discovery scan to identify the MAC address and hostname before physical inspection.

Q: How do we handle assets that are permanently lost or stolen? A: File an incident report within 24 hours. The ITAM Manager must update the asset status to "Missing/Stolen" and trigger a remote wipe command via the MDM console. Remove the asset from the active inventory report after 30 days of unsuccessful recovery.

Approved By: Julian Vance, Chief Architect Template Registry IT Governance Committee