Where Are Your Assets and What Do They Do?

A Guide to Creating the Inventory of Your Technology Assets

In today’s world of cloud-based assets and “as a service” offerings, almost any employee can spin up new systems which can threaten security of your technology assets.

The best way to stay on top of new systems is to create and maintain an up-to-date inventory of technology assets which contains sufficient information to support monitoring and upkeep. The task can be tedious, which is why many organizations do a half-baked job of it. But in the ever-changing environment we live in, an up-to-date asset inventory is critical for maintaining overall security.

Download Our Technology Asset Inventory Tool

If your organization is starting from scratch with a technology asset inventory, the process may seem overwhelming. But don’t despair! We have provided a downloadable tool to make it less daunting and easier to manage. Once you complete the initial inventory, the information can be easily updated as your organization’s technology assets change and new systems are added.

Getting Started

A complete technology asset inventory should include hardware, software and data assets. The process of building and maintaining an asset inventory can be organized into four key steps.

Step One: Survey Your Team Leadership

Your asset inventory starts with general information about each system that comprises your organization’s technology environment. The best sources of information about the systems and data your organization uses for its operations are the people performing the jobs. So, the first step is to have your team leadership provide baseline information about each technology asset used to perform their job functions. You should allow at least three-four weeks to complete the survey with this specific information about each system, to ensure information provided is complete and accurate for periodic processes:

• System name
• System nicknames
• What is the system used for?
• How is the system accessed (e.g., desktop icon, website, emailed information)?
• Who or what inputs information into the system (e.g., team, person, or system)?
• Who or what uses information from the system (e.g., team, person, or system)?
• Who grants or changes access?
• Who provides technical support and troubleshooting (e.g., vendor, service provider, internal team member)?

Once team leaders have responded, aggregate their answers, removing duplication where possible, and add the survey fields to the survey tool’s Support Survey tab.

Step Two: Document Your Underlying Infrastructure

Once your asset list has been cleaned up, the next step is to populate information regarding the underlying infrastructure and system ownership. This task can be done by IT support personnel or technology specialists. Note: For Software as a Service (SaaS) solutions, there may be limited information added in Step 2. SaaS solution information is primarily completed in Step 1 and 3. Step 2 is used to confirm information provided by business users.

• Application name
• Application servers (where applicable)
• Database servers (where applicable)
• Databases (where applicable)
• Web servers (where applicable)
• Where is the system located (e.g., on-premises, cloud)?
• Business owner
• IT owners

Step Three: Populate Your Asset Inventory

The next step is for IT personnel to aggregate information gathered in Step 1 and 2 and add this information to the asset inventory. If a designated asset inventory tool is not already in place, existing tools, such as ticketing or monitoring systems, frequently include asset inventory capabilities that can be leveraged. Common fields within inventories are those previously documented by support personnel in Step 2, as well as additional information such as:

• Name
• Asset type and criticality
• Lifecycle stage
• Location, which may be physical or virtual
• Unique identifiers (IP address, URL, etc.)
• Hardware model or software version
• License information or serial number
• Purchase, maintenance, and support period dates
• Vendors or third party support contact info
• Business owner and IT owner
• Applicable regulations

Step Four: Continue to Update Information Regularly

Once your organization has a working inventory in place, you need to keep it up to date for it to be useful. Assign an asset inventory owner(s) (typically IT personnel) while keeping accountability for any necessary updates at the team leader and/or business owner level.

When a new asset is added to the environment, the leader of the team acquiring the asset should either: (a) coordinate with the owner of the asset inventory throughout the asset’s implementation such that the inventory is up-to-date when the asset goes live or (b) report the asset to the inventory owner as soon as possible and help populate information within the asset inventory tool.

To ensure all systems are documented, even when unreported, organizations should implement asset monitoring processes. Methods of monitoring for unreported assets include, but are not limited to:

• Tools: Host detection, vulnerability scanning, or website content filtering
• Observations: New or increased traffic through the firewall
• Financial records: New vendors and new or increased expenses

Why all four steps matter: Knowing where each of your assets reside and what each does has value that cannot be overstated. With accurate asset inventories, organizations can more thoroughly secure their environments, develop business continuity plans with greater reliability, and reduce remediation time for incident response processes.

Our professionals are here to help your organization wrangle and then inventory its technology assets. Contact us today.

© 2023