Chapter 15 — Asset management

Chapter 15 — Asset management

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Building an inventory"]
  N2["15.2 Classification"]
  N3["15.3 Owners and handling"]
  N4["15.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Building an inventory"]
  N2["15.2 Classification"]
  N3["15.3 Owners and handling"]
  N4["15.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Building an inventory]
    |
    v
[15.2 Classification]
    |
    v
[15.3 Owners and handling]
    |
    v
[15.4 Keeping it current]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) build an inventory of information assets; (2) classify assets by sensitivity; (3) keep the inventory current.

15.1 Building an inventory

Aisha helps Ashfield build an inventory of information assets: hardware, software, data stores and services. She starts from purchase records and the IT manager's spreadsheet, then walks through each branch. She finds a forgotten network storage device in a branch cupboard holding old scanned documents. Dr. Carrow notes that inventories often miss such devices, and that walking around physically still finds things records miss, especially in small organisations. Her final inventory lists hardware, software, data stores and external services, with one row per asset and its location.

15.2 Classification

Aisha proposes a simple classification scheme: public, internal, confidential and restricted. Member identity documents and payment card data are restricted; loan records are confidential; staff newsletters are internal; branch opening hours are public. Each class has handling rules, such as encryption for restricted data on laptops. She keeps the scheme to four levels so staff can remember it. Dr. Carrow notes that complex schemes are often ignored in practice. She prints a one-page guide with examples for each class and the handling rules that apply.

15.3 Owners and handling

Each asset in the inventory gets an owner and a classification. The forgotten storage device is assigned to the head of operations, who decides the documents should be moved to the core system and the device securely wiped. Aisha records the decision. She learns that inventory, ownership and classification together make it possible to apply the right controls, because nobody can protect an asset appropriately without knowing what it holds. The wiping is done by a certified supplier, which provides a certificate for the record.

15.4 Keeping it current

Aisha recommends that new purchases be added to the inventory before use and that disposals be recorded with evidence of data destruction. She suggests a twice-yearly check comparing the inventory with devices seen on the network. She learns that an inventory decays quickly without routine updates, and that linking it to purchasing and disposal processes keeps it accurate with little extra effort. The IT manager agrees to add an inventory step to the purchasing form, so nothing new reaches the network without being recorded first.

Worked example

Aisha builds an inventory that finds a forgotten storage device, proposes four classification levels, assigns owners and links the inventory to purchasing and disposal.

Synthetic case. Assets are synthetic.

Errors and limits

Complex classification schemes are often ignored.

Exercises

• EX043 — Forgotten device. What forgotten asset does Aisha find? Rubric: 3 = a network storage device in a cupboard;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX044 — Restricted class. Which data are restricted? Rubric: 3 = identity documents and payment card data;; 2 = partly correct;; 1 = other;; 0 = none.
• EX045 — Inventory upkeep. How is the inventory kept current? Rubric: 3 = link to purchasing and disposal, twice-yearly check;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 15 (chapter 15 of 40)

← Chapter 14 · Course chapter index · Chapter 16 →

Continue to the next authored lesson.