C.5 Asset Management Policy

Version: April 2025
Applies to: All employees, contractors, and third-party partners
Aligned with: ISO/IEC 27001:2022 (A.5.9, A.5.11, A.5.32, A.8.1, A.8.8)

Purpose
To establish full visibility and control over all IT assets — including hardware, software, and data systems — in order to enhance cybersecurity, reduce risk, and ensure regulatory compliance.

1. Scope
Covers all:
- Hardware (workstations, servers, mobile devices)
- Software (applications, licenses, virtual machines)
- Network components and data repositories
- Users responsible for asset ownership, use, or management

Mandatory for all internal and third-party users. Exceptions require prior written approval.

2. Core Asset Management Requirements

ID Requirement
AST-01 Maintain a single centralized asset inventory for all logical IT systems
AST-02 Track all endpoint devices (desktops, laptops) — both on-site and remote
AST-03 Track all server systems (physical/virtual) — both on-site and remote
AST-04 Track all mobile devices (phones, tablets)
AST-05 Record key technical info: name, MAC address, IP address
AST-06 Record business info: asset owner, criticality, business unit, approval
AST-07 Use an automated asset discovery platform for real-time updates
AST-08 Define an internal approval process for onboarding new assets
AST-09 Define a process to identify and remove unauthorized or rogue devices

3. Enforcement & Sanctions
Non-compliance may lead to:
- Training or warnings
- Loss of access or privilege
- Contract termination or legal actions (if criminal behavior is involved)

Sanctions are enforced proportionally and fairly by HR and Security teams.

Direct URL:
Navigation
Back to Appendix C: Guidelines Policy Overview