4.2 — Asset Management: 16

Asset acquisition process

Formal purchasing workflow: end user requests, IT and budget review, approvals, supplier negotiation, purchase, invoice and payment terms.

Asset tracking system

Central system recording ownership, type, and location of every organizational asset across its full lifecycle.

Asset ownership/assignment

Recording who currently has control of an asset, e.g. a laptop assigned to a specific employee.

Hardware vs software (asset classification)

Hardware is a capital expenditure that depreciates over time. Software is an operating expense and generally doesn't depreciate. Different tax treatment.

Asset inventory

Ongoing record of all devices and components on the network, used for tracking, help desk support, and lifecycle management.

Device enumeration

Breaking a single asset down into its component parts (CPU, memory, storage, peripherals) within the tracking system, or viewing it as one unified entity.

Asset tag

Physical label or barcode attached to a device for identification and tracking; also acts as a theft deterrent.

Asset lifecycle

The full cycle an asset moves through: acquisition, assignment and tracking, monitoring, and disposal/decommissioning.

Media sanitization

Removing data from storage before reuse or disposal; the method depends on whether the device will be reused internally or fully retired.

Secure delete/wipe

Software-based method of erasing data so it cannot be recovered, leaving the drive reusable. The only sanitization method that keeps the drive usable afterward.

Physical destruction

Shredding, pulverizing, or drilling/hammering a drive to make data recovery physically impossible.

Degaussing

Using a strong electromagnetic field to erase data on a drive, rendering it unusable. Works on magnetic hard drives only; does not work on SSDs.

Incineration

Burning storage media to guarantee complete destruction.

Certificate of destruction

Formal confirmation from a third-party destruction vendor proving that submitted drives were fully destroyed.

Data retention

Policy governing how long data, and its copies and backups, must be kept, often driven by legal or regulatory mandates.

Data retention drivers

Legal or regulatory requirements, such as retaining emails or financial records for a set number of years, or internal best practice like backup recovery and disaster recovery readiness.