Asset Management Policy
Management and protection of the organization's information assets
Purpose
Establish a framework for managing and protecting the organization's assets, ensuring efficiency, security and compliance with regulations and standards.
Scope
- Applies to all of the organization's assets, physical or digital.
- All employees, contractors and third parties must comply with this policy.
Asset Types
Physical Assets
- Register all assets in the Inventory with a unique identifier.
- Store and maintain them securely; report damage or loss to IT immediately.
- Limited non-commercial use, in accordance with the IT Security Policy.
- Disposal or reassignment coordinated with IT, ensuring data security and documentation.
Data Assets
- Implement access controls according to authorization.
- Regularly back up and recover critical data.
- Retention and deletion in accordance with internal policies and legal requirements.
Software Licenses
- Maintain a License Register to validate and renew licenses.
- Follow installation guidelines, complying with rules and avoiding security risks.
Acceptable Use of Information and Assets
- Access and use assets only for business purposes, following security protocols.
- Personal use, illegal activities or actions that harm the organization are prohibited.
- The organization may monitor use to ensure compliance.
- Violations may lead to disciplinary or legal measures.
Information Lifecycle Management
- Access according to classification and associated risks.
- Keep records of authorized users, asset assignments and disposal methods.
Storage and Marking
- Store assets according to the manufacturer's specifications and internal standards.
- Media containing sensitive information must be clearly marked and handled only by authorized staff.
Disposal and Deletion
- Carry out only with authorization, ensuring the complete and secure deletion of sensitive information.
Asset Ownership
- All assets are the exclusive property of the organization.
- Unauthorized sale, transfer or lending is prohibited.
Provisioning and Return
- Use assets responsibly, following security and organizational policies.
- IT oversees assignment according to needs and security.
- Employees must return assets when employment ends or when they're no longer needed.
Changes to the Asset Inventory
- IT may propose and implement changes to the inventory.
- Major changes require complete documentation; minor changes are recorded in the document's history.
Monitoring and Review
- All interested parties must ensure compliance.
- Periodic audits led by IT ensure asset integrity, inventory accuracy and adherence to the policy.