Skip to content

Asset Management Policy And Procedure

Asset Management Policy/Procedure

Version history

Version Number Date Description Created By Approved By
0.1 17/Apr/2024 Initial Copy [Name]
0.2 18/Jun/2024 Approved [Name] [Name]
0.3 28/Aug/2026 Knowledge kernel, AI/agents, control alignment Knowledge steward [Name]

Purpose

The purpose of this document is to define the rules for acquisition, inventorying, configuring, allocation, de-allocation, and disposal of Assets within The tecciance Environment.

Scope

This policy applies to all IT and Non-IT Assets within the tecciance Environment.

Terms and Conditions

Following is an explanation of various terms used within this document –

  • Asset: Any equipment, device, or information system which carries data or information and is of importance to the Organization. In information security, an asset is any data, device, or another component of the environment that supports information-related activities.

  • Procurement: A process wherein goods or service is sourced and purchased, hired, rented, subscribed, leased, or acquired from another person, entity, or Organization.

  • Inventorying Asset: Preparing, updating, and reconciling an itemized list of all assets available or owned by the Organization. This may also include categorizing the assets based on their financial value, business requirement, sensitivity, criticality, or information security value.

  • Configuring Asset: Process of making the asset ready to use or deploy by installing required software and utilities, defining rules and policies for usage, and adding required security settings for safe usage.

  • Allocation of Asset: Process of assigning the assets to the user or person who shall be holding the custody of the asset or shall be responsible for the management of assets during its lifetime.

  • Recovery of Asset: Process of collecting or taking the asset back from the custodian (person or user to whom the asset was allocated) at the end of a lifetime or at the time of separation. This may also include decommissioning of any asset at the end of its lifetime.

  • Disposal of Asset: Process of safely disposing or destroying any IT asset or equipment while minimizing the risk of exposure and misuse of any sensitive data stored on that equipment.

Responsibilities

The primary ownership of implementing this policy is with the IT and Admin Team.

Policy

Asset Inventorying

  • Asset procurement shall be done based on capacity planning and requirements approved by Department Heads.

  • All assets shall be inventoried within Asset Inventory capturing serial numbers as unique identification.

  • Assets, wherever possible, shall be tagged or labeled using the Asset Tagging scheme developed by tecciance.

  • Assets shall be classified using the Data Classification Policy.

  • Asset Inventory shall cover below types of Assets –

  • Hardware (Laptops / Desktops / Tablets etc.)

  • Software (Operating system / Applications / Tools / Utilities etc.) Licenses for Software

  • Subscriptions for Services or Products

  • Cryptographic Keys and Controls (Tokens / VPN etc.)

  • Networking Devices (Switches / Routers / Firewall / IPS / IDS etc.) Communication Devices (Telephones / VOIP Phones / Mobiles etc.)

  • Access Control Devices (CCTV Cameras / RFID Access / Biometric Devices)

  • Storage Devices (Hard Disks / USB Drives / CD – DVD / Tapes / NAS / SAN etc.) Support Utilities (Power Backups / UPS / Gen Sets etc.)

Asset Allocation and Installation

  • Assets shall be installed/configured as per instructions provided by OEM.

  • Before allocating any asset to the user, all required software and tools shall be installed in the Laptops / Desktops including Anti-Virus.

  • Asset Undertaking and Acknowledgement shall be taken from the User at the time handing over the assets.

Asset Inventorying

  • Assets allocated shall be promptly collected from the Users when Employee or Contract Staff leave the Organization.

  • Assets movement (inward and outward) shall be tracked through the Jira tool.

  • Assets, while sent out to Vendors or OEMs for repairs or replacements, shall be cleaned to remove any sensitive information which may be contained in it.

  • Assets containing data or information shall be cleaned or sanitized or formatted before reusing or disposal.

  • Assets, at the end of their life, shall be disposed of using secure disposal methods.

Procedure

Asset Procurement Process

  • Procurement of assets shall be done based on capacity planning done on an annual basis or through requirements provided by the concerned User/Department.

  • For annual capacity planning, Policy – Capacity Management shall be referred to and followed.

  • For ad-hoc requirements, Asset Requisition shall be filled through email or Jira and sent to IT.

  • Admin Team depending on the type of Asset.

  • The Asset Requisition shall contain a minimum of the below information – Type of Asset

  • Details of the requirement

  • Business reason/justification for the requirement,

  • The Asset Requisition shall be approved by the Head of Concerned Department before forwarding to the IT / Admin Team.

  • IT / Admin Team shall review the requirement and necessary approval.

  • For fulfillment IT / Admin shall check if the required Asset is available in their stock.

  • If the Asset is available within the stock, IT / Admin shall proceed to fulfill the requirement If the Asset is not available in stock, then IT / Admin shall follow the below steps for procurement of Asset.

  • IT / Admin shall take quotations from vendors/suppliers for the Asset. A minimum of 03 quotations shall be procured for ease of comparison, wherever possible.

  • IT / Admin shall compare technical specifications and prices before finalizing the vendor and asset.

  • If the specific specifications are not available with the vendor, or better specifications are offered by the vendor, the Concerned Department shall be consulted before finalizing the specifications.

  • Once the specifications and pricing are confirmed with the vendor, necessary approvals shall be taken from the Head of IT / Admin before procurement.

  • Purchase Order / Work Order shall be provided to the Vendor for Asset procurement.

  • Wherever required, Contracts / Agreements shall be signed with the Vendor / Supplier while procuring the Assets.

  • The Assets, once delivered by Vendor / Supplier, shall be inventoried using `Asset Inventory.’ The information to be captured within Asset Inventory shall include –

  • Asset Details

  • Asset Serial Number

  • Specifications of Asset as applicable

  • Name and other details of custodian to whom the asset will be assigned,

  • Purchase Date, Warranty period and Expiration date.

  • In case an Asset Labelling scheme is developed by tecciance, Asset shall be labeled accordingly.

Asset Installation / Allocation Process

  • Once the Asset is inventoried, the configuration/installation process shall be initiated.

  • For Assets such as Laptops / Desktops / Tablets etc., software and applications which are required for the User, shall be installed before assigning the Asset to the User.

  • Anti-Virus software shall be installed on Laptops / Desktops.

  • When Assets such as Laptops, Desktops, Tablets, Mobile, etc. are assigned or allocated to Users, the acknowledgment shall be taken through the Asset Undertaking Form.

  • For Networking Devices, proper hardening shall be done before commissioning of Assets. For Servers, the hardening process shall be followed based on industry practices and OEM guidelines.

  • For Assets needing installation, instructions provided by the Manufacturer or OEM shall be followed.

  • Wherever required, Laptops shall be encrypted using Full Disk Encryption.

Asset Procurement Process

  • Assets shall be tracked during their movement within the tecciance Environment.

  • Whenever any Asset is required to be moved inward or outward from tecciance, the movement request shall be raised within Jira.

  • The movement request shall be duly approved by the Head of IT / Admin. Records of movement shall be maintained within Jira.

  • Locations of the Asset shall be updated within Asset Inventory.

  • Whenever any asset containing media, is required to be sent to external party, the data within the Asset shall be cleaned or deleted.

  • Whenever any employee or contract staff leaves or separates from tecciance, the assets that are allocated to them shall be promptly collected back.

  • Such collected assets shall be sanitized by removing data or formatting the asset, before reusing or reissuing them to another person.

  • At the end of the life of any Asset, the assets shall be disposed of using secure methods. Asset Disposal shall be initiated through email by listing the assets which are due for disposal.

  • The Disposal request shall be approved by Senior Management and approvals records should be maintained within Jira.

  • Whenever Asset containing media is due for disposal, the media should be destroyed or degaussed before disposal.

  • Assets should be disposed through E-Waste Vendors duly registered with tecciance.

  • Necessary Licenses / Permits of the Vendor shall be validated and verified before handling over the assets for disposal.

  • Asset Disposal Certificate shall be taken from Vendor, wherever possible.

  • Records of Assets Disposal shall be maintained for future reference and audit purposes within Jira.