Why it matters
Asset records feed almost every IT decision: security (what needs patching?), support (who has which laptop?), finance (what to replace next year?) and compliance (are we licensed?). The 2021 Log4Shell vulnerability showed the problem: many organisations spent days simply finding which systems used the affected library. If you do not know what you have, you cannot fix it quickly.
The asset lifecycle
| Stage | Key actions |
|---|---|
| Plan | Define needs, standards and budget |
| Procure | Quote, order, record purchase and warranty |
| Deploy | Image, configure, tag, assign to a user, record location |
| Operate and maintain | Patch, repair, track changes, review usage |
| Retire | Recover, wipe data, record disposal, update the register |
What to record
| Field | Example | Why |
|---|---|---|
| Asset tag | ITS-0042 | Unique identity linking label and record |
| Type, make, model | Laptop, vendor, model | Planning and support |
| Serial number | Printed on device | Warranty claims, theft, audits |
| Purchase date, vendor, cost | Invoice reference | Depreciation, refresh planning |
| Warranty or AMC end | Date | Avoid unplanned repair bills |
| Assigned user and department | Name or role | Accountability and leaver process |
| Location | Office, floor, rack/U position | Find it fast |
| OS or firmware version | Version and last update | Patch and risk review |
| Network identity | IP or MAC (if static) | Troubleshooting |
| Status | In use, spare, in repair, retired | Reporting |
Never store passwords or licence keys in the register. Store a reference to the secure vault entry instead.
How to discover what you have
- Network scan of subnets (managed switches, DHCP leases and ARP tables help find devices)
- An agent or device-management tool on each PC and laptop
- Active Directory, Microsoft Entra ID or Google endpoint data
- Cloud consoles for subscriptions and virtual machines
- A physical walk-through. Tags and photos find what scans miss
- Compare sources regularly; differences reveal shadow IT
Software and licences
- Record every product, edition, quantity owned, renewal date and where it is installed
- Compare entitlements with installed counts quarterly
- Retire unused licences before renewal
- Use genuine, supportable software. It is also a security control
Process matters more than tools
- Assign an owner for the register
- Make 'record it' part of purchase and deployment
- Run a joiner / mover / leaver checklist (devices, accounts, VPN, email, access cards)
- Reconcile quarterly and fix differences
- Report: ageing devices, warranties ending, unassigned assets, licence gaps
Retiring equipment responsibly
- Wipe storage using a recognised method such as the approaches in NIST SP 800-88, or destroy the media. Keep a record
- Remove from the domain, MDM, monitoring and the register
- Hand e-waste only to authorised recyclers or dismantlers, in line with India's E-Waste (Management) Rules, 2022
- Keep disposal certificates with the asset record
Key takeaways
- Start with discovery, then tag and assign
- A simple register that is kept current beats an elaborate one that is not
- Link assets to warranties, licences and leavers
- Wipe, document and dispose through authorised channels
An illustrative inventory scenario. During a planned firewall upgrade, a scan of a 40-user office found 11 devices nobody recognised: two old switches, three printers and a forgotten test server still running an unsupported OS. A baseline register, tags and a quarterly scan turned that surprise into a routine check. (Illustrative scenario, not a client case study.)
References and further reading
General information for orientation; it is not legal or professional advice. Specifications, products and regulations change, so verify current details before acting. Product names belong to their owners and are mentioned only as examples.