IT Asset Management Cybersecurity Standard

Appropriate management of IT assets is a fundamental requirement of any Information Security Management System (ISMS). [Company Name] must employ robust IT asset management processes to ensure IT assets are identified, inventoried, and maintained.

In the context of this standard, an IT asset is that Company-owned or managed data link, physical device, o/s firmware, application, database, middleware (collectively known as a service) that connects to the enterprise. This document does not address information assets such as data or process documentation which should be inventoried within the appropriate management system (i.e. SharePoint, EDW), classified and handled in line with the Data Classification Standard and Handling Guidelines.

The System Owner is the individual (manager) and entity (organization e.g. [Company Name] IT communication unit, HR, Finance) that has approved management responsibility (business owner) for the support of the asset. The Business Owner is the individual (i.e. CTO / Chief Digital Officer / CFO / HoS / Directors) and entity (organization e.g. [Company Name] IT, HR, Finance) that has property rights (financial) of the asset.

Asset Examples:

Project Management, Design, Implementation, Support and ISMS processes rely upon an accurate, asset inventory in order to operate effectively. These processes include, but are not limited to, the following:

Nowadays, with the digitalization of our society, the need for data protection became more important. The latest IT Security Standards involve the application of technology to broader social and institutional contexts, and thereby contributes to the servitization of companies, and affects how they compete and interact. This document contains security technology solutions to protect data classified as “Highly Sensitive”, “Sensitive”, “Private” or “Public” as per the Data Classification Standard and Data Handling Guidelines. Specifically: