Chapter 4 — Asset and supplier inventory

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Assets across sites"]
  N2["4.2 Classifying information"]
  N3["4.3 Suppliers"]
  N4["4.4 Ownership"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Assets across sites"]
  N2["4.2 Classifying information"]
  N3["4.3 Suppliers"]
  N4["4.4 Ownership"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Assets across sites]
    |
    v
[4.2 Classifying information]
    |
    v
[4.3 Suppliers]
    |
    v
[4.4 Ownership]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) build a reliable asset inventory across sites; (2) identify suppliers with access to data; (3) assign owners and classifications.

4.1 Assets across sites

Elena's inventory exists in a spreadsheet updated when devices are bought. She compares it with the device management system and network records. Several clinics have imaging computers bought directly by dentists and never registered. These run old operating systems because imaging software suppliers have not certified newer versions. Dr. Qureshi notes that unregistered devices often carry the highest risk, because they are excluded from patching, monitoring and backup by default. She finds eleven unregistered imaging computers and adds them to the inventory with their clinic, supplier and operating system version.

4.2 Classifying information

Elena classifies information: patient clinical records and images as restricted, payment data as restricted, staff records as confidential, appointment diaries as confidential and marketing materials as internal. Each class has handling rules, such as encryption on portable devices for restricted data. She keeps the scheme to four levels. ISO/IEC 27002:2022 includes guidance on classifying and labelling information, which she uses as a reference without copying its text. She prints a one-page guide for clinics with examples of each class and the handling rules, and clinic managers display it in staff rooms.

4.3 Suppliers

Moorfield uses suppliers for the patient record system, imaging software, payments, email and IT support at the three clinics with part-time contacts. Elena lists each supplier's access and data. The imaging supplier connects remotely to clinic computers using a shared password known to its support staff. Elena recommends individual accounts, multi-factor authentication and access enabled only during approved support sessions. The imaging supplier agrees after Elena explains Moorfield's insurance requirements, and the change is completed over two months. She records supplier access in a register reviewed each quarter by the security committee.

4.4 Ownership

Each asset and supplier relationship needs an owner. Elena assigns clinic managers as owners of local devices, the clinical lead as owner of patient records and herself as owner of central systems. Supplier relationships are owned by the person who manages each contract. She records owners in the inventory. Dr. Qureshi notes that ownership makes accountability concrete, especially in organisations with many sites. Clinic managers receive a short briefing explaining what ownership means in practice: knowing which devices are in their clinic, reporting changes and confirming access lists during each quarterly review.

Worked example

Elena reconciles inventory with device and network records, finds unregistered imaging computers, classifies information, tightens imaging supplier access and assigns owners.

Synthetic case. Inventories are synthetic.

Errors and limits

Devices bought outside central purchasing often escape patching and backup.

Exercises

• EX016 — Unregistered devices. What unregistered devices does Elena find?
  Show marking criteria

  Rubric: 3 = imaging computers bought by dentists;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX017 — Old systems. Why do imaging computers run old systems?
  Show marking criteria

  Rubric: 3 = suppliers have not certified newer versions;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX018 — Restricted data. Which information is restricted?
  Show marking criteria

  Rubric: 3 = clinical records, images and payment data;; 2 = partly correct;; 1 = other;; 0 = none.
• EX019 — Supplier fix. What does Elena recommend for imaging supplier access?
  Show marking criteria

  Rubric: 3 = individual accounts, MFA, session-only access;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX020 — Records owner. Who owns patient records?
  Show marking criteria

  Rubric: 3 = the clinical lead;; 2 = partly correct;; 1 = other;; 0 = none.