Deep Dive - Asset Inventory

What is the Asset Inventory control?

Strike Graph's default control language is: "An inventory of information assets, including hardware and software, is maintained and updated at least annually. All assets have an assigned asset owner. All assets are classified based on the data classification convention."

This language should be customized to reflect the specific process that your organization has defined. For example, if your organization's inventory contains different assets or occurs at a different frequency, then you should update the control language to reflect that. It's important that your stated control description accurately reflects how your organization implements this control.

Why is this control important?

Assets are defined as anything that’s valuable and necessary for the function of your service (data is also considered an asset, but we will discuss that in another control). Knowing which software and hardware assets store, transmit, and process data is beneficial for a number of reasons: you will know where your data resides so that you can apply appropriate logical and physical access controls, and track who "owns" which products in order to make decisions about maintenance and invoice approvals.

Who's involved with this control?

• Typical Control Owner: CTO (or equivalent)

• Typical Parties Involved: Security Manager

When should I perform this control?

The list should be updated and reviewed annually at a minimum, but in most organizations, this inventory is a "living" document.

How do I perform this control?

In smaller organizations, the simplest way to track hardware is to maintain a spreadsheet of assets based on purchasing history. Details to include are:

• Make

• Model

• Purchase date

• Who has been issued the asset

• On-site servers

• Routers

• Desktops

• Modems

There are tools out there like Asset Tiger that can also be used to track hardware assets.

For software, we find it useful to maintain a spreadsheet of all products utilized from development tools, to HR and sales tools. The software asset list should include both purchased and free tools. The inventory list should include who in the organization makes decisions about the product (typically who will be approving the invoice), the team that primarily uses the software, who the superusers or admins are, and what the password settings look like - so you can make sure that the settings either follow the corporate password policy OR an exception has been approved.

You will also need to identify whether the asset touches any sensitive or confidential information (based on how you classify your data). Any asset that holds, transmits, or processes sensitive information should have appropriate security controls applied to them.

Hot Tip: On your software inventory, include information on licensing and renewal dates. Then this document becomes both an IT compliance artifact as well as a budgeting or money saving tool! You can track how many licenses you own, and whether you need to increase or reduce the users.

A video demonstration of how to utilize the Asset Inventory template can be found here.

Want to learn more?

Reach out to your Customer Success Manager for Asset Inventory examples and templates.