Standard Operating Procedure: Asset Inventory and Configuration Management

Standard Operating Procedure: Asset Inventory & Configuration Management

Document ID: TR-OPS-INV-001
Effective Date: 2023-10-27
Version: 1.0.4
Review Cadence: Quarterly (Q-Cycle)

1. Executive Summary & Purpose

This SOP dictates the methodology for conducting a comprehensive asset inventory. The objective is to establish a "Single Source of Truth" (SSoT) for all hardware, software, and virtualized assets. This ensures lifecycle visibility, audit readiness, and risk mitigation against unauthorized modifications.

2. Scope & Prerequisites

• Scope: All physical data center infrastructure, edge devices, and cloud-native service instances.
• Prerequisites:
  • Administrative access to the Centralized Configuration Management Database (CMDB).
  • Network scanning credentials (Read-Only).
  • Physical access badges (for on-premise hardware).
• Tools: Nmap/OpenVAS for discovery, Snipe-IT or ServiceNow for registry, handheld barcode scanner (RFID/QR).

3. Roles & Responsibilities (RACI Matrix)

4. Step-by-Step Procedure

Phase I: Discovery & Reconciliation

• Initialize network discovery scan to map active IP endpoints.
• Export current digital registry from CMDB to CSV format.
• Cross-reference network logs with physical registry to identify "Ghost Assets."

Phase II: Physical/Logical Verification

• Physically tag all hardware with UID (Unique Identifier) labels.
• Verify MAC address, Serial Number (SN), and Service Tag against physical labels.
• Update firmware version and OS patch levels during verification.

Phase III: Lifecycle Classification

• Categorize assets as: Active, Maintenance, Decommissioned, or Reserved.
• Record "End-of-Life" (EOL) and "End-of-Support" (EOS) dates for all hardware.
• Assign owner/cost-center metadata to each entry.

Phase IV: Final Validation

• Upload reconciled data to the Master Registry.
• Generate delta report showing changes from previous cycle.
• Perform spot-check audit on 5% of randomized assets.

5. Quality Assurance & Pro-Tips

• Metric Threshold: Total inventory accuracy must remain at >99.9%. Discrepancies >0.1% trigger an immediate manual recount.
• Pro-Tip (Normalization): Standardize nomenclature (e.g., use SRV-WEB-01 instead of webserver1).
• Pitfall Avoidance: Never rely solely on automated discovery; undocumented "shadow IT" devices are the primary source of security breaches.
• Red Flag: If an asset's power draw does not align with its reported load/usage, investigate for potential cryptojacking or unauthorized secondary utilization.

6. Frequently Asked Questions

Q: What do I do if an asset is found that has no record in the CMDB? A: Isolate the asset from the production network immediately. Perform a forensic analysis to determine its origin and purpose before tagging it for inclusion in the registry or disposal.

Q: How do we account for virtual assets that are spun up/down rapidly? A: Utilize API-driven discovery tools that integrate directly with your hypervisor (e.g., VMware vCenter or AWS Config). Static spreadsheets are insufficient for ephemeral cloud instances.

Q: How often should the Master Registry be backed up? A: Daily. Snapshots must be stored in an immutable, off-site repository to ensure recovery after a ransomware event or systemic corruption.

Authorized by: Julian Vance Chief Architect, Template Registry