Hardware, software, and Data Asset Management

The steps an organization follows to choose, buy, and implement new technology or services securely.

Acquisition/procurement process

Means tracking who is using what and what actions they perform.Ex: Logging which user accessed a file or system

Assignment / Accounting

Means assigning a person responsible for an asset (like data or a system). Ex: A manager is responsible for a company database

Assignment / Accounting - Ownership

Means labeling data based on how sensitive it is so it gets the right protection. Ex: Public, Internal, Confidential, Top Secret

Assignment / Accounting - Classification

A comprehensive database containing detailed records of all assets (laptops, machinery, software licenses) within an organization, including ownership, location, status, and warranty information

Monitoring/asset tracking - Inventory

The precise identification and logging of each individual asset within the inventory system, typically involving assigning a unique ID to every item.

Monitoring/asset tracking - Enumeration

Refers to the process of removing sensitive data from storage devices to ensure that it cannot be recovered by unauthorized individuals. Methods include: physical destruction, degaussing (Uses magnets to erase data completely), or overwriting.

Disposal/decommissioning - Sanitizing

Involves the physical dismantling or destruction of hardware to ensure that it cannot be used again. It is often used when storage devices cannot be reliably sanitized, or when the device itself is a security risk. However, it does not guarantee that the data cannot be recovered again.

Disposal/decommissioning - Destruction

Refers to the documentation process that confirms the proper sanitization and destruction of assets done by a third-party who destroyed the assets for you. It serves as proof that the organization has responsibly and securely disposed of the IT assets.

Disposal/decommissioning - Certification

Involves retaining certain data for a specified period as required by law or organizational policies, even during the disposal process. You can't just get rid of whatever you want to get rid of.

Disposal/decommissioning - Data Retention