Chapter 2 — Building a trustworthy inventory
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Sources of truth"]
N2["2.2 Recording support status"]
N3["2.3 Coverage before conclusions"]
N4["Lab — Support status by clinic"]
N5["2.4 Reading the result"]
N6["Keeping the inventory current"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Sources of truth"]
N2["2.2 Recording support status"]
N3["2.3 Coverage before conclusions"]
N4["Lab — Support status by clinic"]
N5["2.4 Reading the result"]
N6["Keeping the inventory current"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 Sources of truth]
|
v
[2.2 Recording support status]
|
v
[2.3 Coverage before conclusions]
|
v
[Lab — Support status by clinic]
|
v
[2.4 Reading the result]
|
v
[Keeping the inventory current]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) combine sources into one inventory; (2) record support status; (3) measure coverage honestly.
2.1 Sources of truth
Kestrel has three partial lists: the supplier's management console, a purchasing spreadsheet and the imaging vendor's install records. CIS Controls v8 Safeguard 1.1 asks for a detailed enterprise asset inventory, and 2.2 asks that software be supported or documented as an exception. Priya merges the lists by serial number, since names change when machines are reimaged. Each list misses something: the console lacks machines never enrolled, purchasing records include machines already retired, and the vendor records cover only imaging PCs. Merging by serial number lets Priya see which source is wrong for each mismatch, and she records the reason beside each corrected row.
2.2 Recording support status
For each workstation she records operating system, version, the vendor's support end date and the business role. The support date comes from the vendor's published lifecycle page, recorded with the date she checked it. Workstations whose role is imaging are tagged, because their upgrade path depends on another vendor. Recording the date of each lifecycle check matters because vendors sometimes extend or shorten support, and an auditor will ask when the status was last confirmed. Priya also notes who uses each machine and how often, since a little-used spare is easier to replace than the main imaging PC in a busy surgery.
2.3 Coverage before conclusions
Before counting unsupported systems, Priya checks that every clinic is represented. One clinic's machines were missing from the console because they had never been enrolled; she visits and records them by hand. Only then does she trust totals. Unenrolled machines are exactly the ones least likely to be patched or monitored, so missing them would understate the problem. Priya's visit adds them to the merged list and to the supplier's enrolment queue. She also asks clinic managers to confirm the counts for their own sites, which catches a spare PC kept in a store cupboard. Her method notes record both checks, so later counts can be compared on the same basis.
Lab — Support status by clinic
"""Count workstations by support status across clinics from a synthetic inventory (stdlib only)."""
inv = {"North": (10, 3), "Harbour": (12, 4), "Mill": (9, 1), "Quay": (11, 2), "Ridge": (8, 2), "Vale": (10, 0)}
tot = sum(a for a, _ in inv.values()); eol = sum(b for _, b in inv.values())
for c, (a, b) in inv.items(): print(f"{c:8} workstations {a:2d} unsupported OS {b}")
print(f"total {tot}; unsupported {eol} ({eol/tot*100:.0f}%)")
print("clinics with none:", [c for c, (a, b) in inv.items() if b == 0])
Run with python3 lab_eol.py. Verified output:
North workstations 10 unsupported OS 3
Harbour workstations 12 unsupported OS 4
Mill workstations 9 unsupported OS 1
Quay workstations 11 unsupported OS 2
Ridge workstations 8 unsupported OS 2
Vale workstations 10 unsupported OS 0
total 60; unsupported 12 (20%)
clinics with none: ['Vale']
2.4 Reading the result
The lab shows 12 of 60 workstations, 20 percent, on an unsupported operating system, concentrated in Harbour and North, with Vale having none. Most of the twelve are imaging or cephalometric machines. This tells Priya that the problem is mostly a vendor-dependency problem, not neglect of ordinary desktops. That reading changes the plan: ordinary desktops can follow a normal upgrade cycle, while the imaging machines need vendor negotiations, licence decisions and probably exceptions. Priya reports the count by clinic so that the operations manager can see where the work will concentrate.
Keeping the inventory current
An inventory decays the moment it is finished. New workstations arrive, machines are reimaged under new names, and vendors move support end dates. Priya therefore asks the supplier to run a monthly comparison of the management console against the purchasing list and to flag any serial that appears in only one of them. She also subscribes the operations mailbox to the lifecycle announcements of each operating system and imaging vendor, so a changed support date is updated in the inventory within a week. Each monthly comparison is saved with its date, which gives auditors evidence that the inventory is maintained rather than produced once for the project.
Worked example
Merging three lists of 58, 61 and 14 rows by serial number produces 60 unique workstations, with one retired machine still in purchasing records and removed.
Synthetic case. The inventory and counts are synthetic.
Errors and limits
Matching on hostname double-counts reimaged machines; matching on serial is more reliable but fails for virtual machines, which Kestrel does not use at clinics.
Exercises
- EX006 — Choosing a join key. Why join on serial number rather than hostname? Rubric: 3 = explains renaming and reimaging;; 2 = says serials are unique;; 1 = no reason;; 0 = none.
- EX007 — Dating the evidence. Why record when you checked a vendor's support date? Rubric: 3 = explains dates change and audit traceability;; 2 = one reason;; 1 = vague;; 0 = none.
- EX008 — Interpreting concentration. What does the concentration of unsupported systems in imaging suggest about the fix? Rubric: 3 = links to vendor dependency and planning with the vendor;; 2 = mentions imaging only;; 1 = no inference;; 0 = none.
- EX009 — Coverage check. Describe one test that the inventory covers every clinic. Rubric: 3 = compares counts per clinic to an independent source;; 2 = visits one clinic;; 1 = vague;; 0 = none.
- EX010 — Safeguard mapping. Map the inventory work to two CIS Controls v8 safeguards. Rubric: 3 = 1.1 and 2.2 explained;; 2 = correct numbers only;; 1 = one;; 0 = none.
Synthesis
A merged, checked inventory turns a vague worry into a count of twelve, located by clinic and role.
Continue studying — chapter 02 of 12
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →