Asset Management

In relation to Information Security, organizations should track and monitor their IT/OT assets. For organizations that don’t have an asset management tool, a spreadsheet can be used as a starting point to develop an asset inventory. An asset inventory must have key fields such as Asset Name, Asset Location, and Asset Owner –other fields to consider include Commission Date and Decommission Date. 

Expert Opinion - Asset Management


Control Objective

  • Asset management policy (must follow the commission/decommission process)
  • Commission/decommission process should mandate adding asset to the asset inventory
  • Asset inventory should be in place
  • The inventory and policy should be reviewed at least annually


Asset Management - Basic (XLSX)

Asset Management - Advanced (XLSX)