Asset management starts with a dull but useful question: what do we actually have? For a software company, the answer is broader than laptops and phones. It also includes customer applications, source code, documentation, data, accounts, external services, people with access and intellectual property.
If you do not know which assets exist, you cannot decide who is responsible for them, what information they contain or what should happen when something changes. That is why we maintain an asset register. Not because a spreadsheet is exciting, but because an organisation needs a shared memory.
Six types of assets
We group assets into six broad types:
- SaaS services
- Customer applications
- People
- Hardware
- Intellectual property
- Data & information
The grouping helps because each type raises different questions.
For a customer application, we look at environments, dependencies, data flows and the project's security requirements. For hardware, we look at management, secure configuration and what happens when it is replaced or returned. For people, we look at roles, training, access and changes during onboarding, role changes or leaving.
Each relevant asset has an owner. The asset owner is the role responsible for keeping the record meaningful: purpose, use, classification, changes and eventual retirement. That prevents an asset from being "everyone's responsibility", which too often means nobody is really watching it.
Classification: what needs extra care?
Classification is a fixed part of registration. We look at confidentiality, integrity and availability: does information need to remain private, does it need to remain accurate and trustworthy, and how important is it that the system is available?
These three words are often shortened to CIA. It sounds like we should be wearing sunglasses, but it is simply a practical checklist:
- A system with sensitive customer data needs different controls from a public website page (confidentiality).
- A dataset used for decisions needs extra attention to integrity.
- A service needed for support needs attention to availability.
Classification is therefore not decoration. It guides how we handle access, storage, transfer, backups, logging, review and retirement.
Reviewing new services before use.
Before we start using a new external service, we check whether it fits the information we want to entrust to it. We look at matters such as data location, support for strong authentication, export options, available security assurance, subprocessors, audit features, incident handling and ownership of data.
This is especially important for SaaS and cloud services. They always involve a shared responsibility model. A supplier can provide many security controls, but we remain responsible for selection, configuration, access and use.
In practice: "The supplier handles security" is not a complete sentence.
Material changes also matter. A service may change ownership, features may disappear, certifications may expire or our use may become larger than originally intended. When that happens, the asset needs another look.
Purchasing is part of asset management.
The purchasing procedure also touches asset management. When we buy something, we want to understand what is needed, what it will be used for and whether extra questions should be asked first. If there is uncertainty, we clarify it before ordering, especially when a purchase affects work, security or cost.
After ordering, the administrative side matters too: a business invoice or receipt, preferably as a PDF, with enough information for bookkeeping. For physical goods, receipt, inspection and possible return or repair are part of the process. If the purchase is hardware or a service that processes information or grants access, it also belongs in the asset register.
That way, "buying something" does not sit apart from security. A new device, subscription or tool may be useful, but it also needs to become manageable.
Review and cleanup. Assets change all the time. People join or leave, hardware is replaced, applications gain new integrations and services change. We therefore combine periodic reviews with updates triggered by events such as onboarding, offboarding, replacement, new suppliers, retired applications or important changes. Cleanup is just as important as adding assets:
- accounts need to be revoked
- data needs to be exported or deleted
- devices need to be wiped securely
- the status in the register needs to be correct
Gaps we find in the register or during a review become improvements with an owner, as described in continual improvement, our Quality Day and audits. Here that mostly means closing blind spots: an asset without an owner, a supplier without a review or an account that should have been revoked.
Good asset management makes security less dependent on memory. We know what exists, why it exists, who is watching it and when it needs to be reviewed again.