Asset Management Policy Guidance

The following article contains guidance explaining portions of the Asset Management Policy that we frequently see questions around, explaining what the sections mean.

Guidance statements will appear in bold and enclosed in brackets “[ ]” below the statements of the policy.

____________________________________________________________________________

The purpose of this policy is to define requirements for managing and properly tracking assets owned, managed, and under the control of [COMPANY NAME] through their lifecycle from initial acquisition to final disposal.

<ROLES AND RESPONSIBILITIES>

[Please see here for more guidance on roles and responsibilities: https://help.drata.com/en/articles/5829670-roles-and-responsibilities-guidance. For example, “Who is responsible for updating, reviewing, and maintaining this policy?” The statement may become “The Chief Information Security Officer (CISO) is responsible for updating, reviewing, and maintaining this policy.”]

[Statement is saying the Asset Management Policy will ensure that physical and digital assets are properly protected, labeled, and controlled throughout their lifecycle.]

An asset inventory process must be in place to support the technological management of critical business processes and to meet legal and regulatory requirements. The inventory process will also support the discovery, management and replacement and/or disposal of all assets. It will further facilitate the identification and removal of any illegal or unauthorized software, asset, or processes found in the [COMPANY NAME] environment. To accomplish these goals, all physical and virtual assets under [COMPANY NAME] management or control (including external assets such as end-user devices, network devices, non-computing/IoT devices, and servers) will be listed in an inventory that will include:

[In the last sentence of the section above. The inclusion of "external assets" is specific to NIST CSF requirements and currently OPTIONAL for other frameworks.]

[Classification of the asset or the data processed by the asset can be listed within the Notes column of Drata’s Asset page.]

[This section describes that a detailed inventory of assets managed by your company will support security, legal, and regulatory compliance. The inventory must track each asset’s identity, classification, ownership, purpose, and location. Identify and remove unauthorized or illegal assets or software. In addition, ensures sensitive assets are properly marked and protected according to company and legal standards.]

[COMPANY NAME] will assign an owner to each asset when the asset is created or transferred to [COMPANY NAME]. The asset owner can be an individual or an entity with approved management responsibility to control the whole lifecycle of the asset; the asset owner will not necessarily have property rights to the asset.

The asset owner will be responsible for the proper management of the asset over the asset’s entire lifecycle, or until a new owner is assigned to the asset. The asset owner will:

[This section describes assets owned by [COMPANY NAME] must have a designated owner responsible for managing it throughout its lifecycle. The asset owner ensures the asset is inventoried, properly classified, protected, and securely handled until it is transferred or destroyed.]

[COMPANY NAME] leverages a SaaS-based asset management system, Drata, to maintain inventory of all company-owned physical computing equipment, including but not limited to:

[If you use a system that is not Drata, you should adjust this section to mention the name of the asset management system you are using.]

All company-owned devices are subject to a complete data wipe prior to repurposing, return, or disposal, particularly in the event of device compromise or infection. This data wipe will be carried out by the IT manager.

[IT Manager is a suggested role in this instance. You can change this role to whoever will be performing this function at your organization.]

[COMPANY NAME] uses Drata’s automated system to query across our cloud-based infrastructure to obtain detailed records of all digital assets, including but not limited to:

The records are stored in a database system maintained by [COMPANY NAME]. Each record is tagged with the asset owner, associated project, and applicable classification to facilitate accountability and data governance.. All records are kept up to date through automation via Drata.

[If you use a system that is not Drata, you should adjust this section to mention the name of the asset management system you are using.]

The information resource owner determines when an asset is no longer needed or is obsolete and can be retired. If the asset to be replaced/retired supports mandatory legal and regulatory requirements of critical business processes, the asset owner must validate that any replacement asset continues to meet the business, legal, or regulatory requirements supported by the original asset before the original asset is retired.

Before retiring/replacing any asset that retains data, data retention requirements for all data stored or managed by that asset must be reviewed, and a plan for complying with all applicable data retention requirements must be developed and executed. This is particularly important for assets that manage data subject to legal/regulatory scrutiny. Any data subject to data retention requirements must be migrated to an appropriate destination and tested for appropriateness, completeness, accessibility and retrievability from the destination before the original data is deleted from the original asset as part of the system retirement process.

[This section is saying that in the event you have to retire an asset, such as a database, server, etc. You will evaluate whether the data on that device is subject to specific retention requirements. For instance, if you have PHI data on the device, you may be required to retain those records on another asset in order to comply with state-specific retention requirements related to PHI records.]

Baseline Configurations for Endpoints

The following baseline security requirements will be implemented for protection of endpoint assets including company-issues laptops, workstations and mobile devices as applicable:

[This section describes the baseline security controls required for all company-issued endpoint devices (e.g., laptops, workstations, and mobile devices). Technical controls (e.g., antivirus software, encryption, and automatic updates) are in place to ensure endpoint devices are protected against malware and unauthorized access.]

Baseline security configuration standards for all system components will be documented in accordance with industry-accepted system hardening standards or vendor hardening recommendations. These standards will be updated as needed when vulnerabilities are identified and verified to be in place before or immediately after a system component is connected to a production environment.

Device Best Practices and Hardening Standards

[The CIS benchmarks are a suggestion in this instance. You may have other hardening standards you wish to apply to assets instead of CIS. These may be external hardening standards or you may develop internal best practices.]

[This section describes how the [COMPANY] secures its systems by following industry best practices for hardening devices (e.g., removing vulnerabilities, and disabling insecure features). The goal is to reduce the risk of unauthorized access and maintain a secure system environment.]

Infrastructure Virtualization Security

[This section outlines security controls for managing virtual machines (VMs) and backups to protect sensitive data and ensure consistent security across both physical and virtual environments.]

Infrastructure Configuration and Maintenance

[If you are using containers, it may make more sense to change these bullet points to reflect your process for updating the base image used to deploy containers and how containers will be redeployed.]

[This section describes managing updates and patches for internal workstations, servers, and infrastructure devices to keep systems secure.]

Capacity requirements of systems will be identified in line with the business criticality of a concerned system.

Providing sufficient capacity will be achieved by increasing capacity or by reducing demand. This includes:

[This section may be adjusted if you manage capacity in other ways, such as by enabling auto-scaling policies. Similarly you perform monitoring through other methods such as enabling monitoring on a pool of resources/nodes instead of monitoring at the individual resource level.]

Removable Media

For the proper management of removable media, the following steps will be taken, when applicable:

[If you do not handle or store ePHI, you can remove the bullet points related to it.]

[This section outlines how removable media (e.g., USB drives) should be managed to protect sensitive data]

Return of Assets Upon Termination

[This can be performed through either a manual process, by examining logs, or can be implemented through technical controls, such as implementing Data Loss Prevention (DLP) or restrictions on removable media.]

Media Sanitization

[This section is specifically for NIST SP 800-53]

Media Sanitization procedures are in place to ensure that when data is removed it could not be retrieved or reconstructed:

Sanitization procedures and equipment will be reviewed and tested <FREQUENCY> to ensure that the intended sanitization is being achieved.