Asset Inventory & Device Management Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

This Policy protects and preserves Safire’s technology assets and ensures the confidentiality, integrity, and availability of Safire’s Information Systems and data.

It is critical for Safire to maintain visibility into the location and status of all computers, devices, and equipment used to access corporate resources. To achieve this, Safire maintains up-to-date inventory lists and asset controls. Because lost or stolen equipment often contains sensitive data, proper asset management procedures-including documentation to support recovery, replacement, and insurance claims-are mandatory. This Policy defines the responsibility of all personnel to ensure asset inventories are current and that effective controls are in place to identify, track, manage, and dispose of assets properly.

Scope

This Policy applies to all Safire technology assets, hardware, and software. All Safire employees, contractors, third-party service providers, and any individuals in possession of Safire equipment are required to comply with this Policy.

Policy

Asset Classification: Safire tracks all technology assets including, but not limited to

End-User Hardware: Desktop workstations, laptops, tablets, and mobile handheld devices (smartphones).

Peripherals : Printers, copiers, fax machines, multifunction print devices and scanners.

Software : Operating systems, applications, and SaaS subscriptions.

Infrastructure : Servers (physical and virtual), network devices (firewalls, routers, switches), UPS units, and storage arrays.

Portable Storage : External hard drives and USB thumb drives (where authorized).

Asset Tracking and Management: The IT Department is responsible for maintaining a central asset tracking database (e.g., SSP Hardware Inventory List and SSP Software Inventory List).

Tagging and Logging: All assets must be logged in the database with the following minimum criteria:

Asset Type (Hardware/Software)

Make, Model, Serial Number/Service Tag

Assigned Owner (Individual or Department)

Physical Location

Current Status (Active, In-Stock, Out for Repair, Retired)

Lifecycle Updates: All information must be entered into the tracking database prior to the deployment of a new asset. Records must be updated immediately upon the transfer of an asset to a new owner or location.

Licensing Compliance: Safire must own, be fully licensed, and remain in full compliance with licensing entitlements for all software to minimize legal and regulatory risk.

Shadow IT and Unauthorized Assets: The use of “Shadow IT” (hardware or software not procured or vetted by IT) is prohibited. A discovery process to identify unauthorized assets will

be undertaken periodically. If unauthorized hardware or software is discovered, immediate action will be taken to quarantine the device and remediate the situation.

Asset Disposal and Repurposing: To prevent data leakage, strict procedures for the secure disposal or repurposing of equipment must be followed.

Sanitization: No asset may be sold, donated, transferred, or disposed of until all sensitive data has been sanitized.

Data Destruction: A data destruction protocol compliant with industry standards (such as NIST 800-88) must be executed.

Repurposing: Storage drives must be securely wiped before being reassigned to a new user. Disposal: Physical media storing Confidential, Sensitive, or Personally Identifiable Information (PII) must be physically destroyed (shredded/degaussed) if it is not being securely wiped for reuse.

Chain of Custody: A record of disposal (Certificate of Destruction) must be maintained for audit purposes.

Compliance

Compliance Measurement

The policy owner will verify compliance to this policy through various methods, including but not limited to periodic walk-throughs, video monitoring, business tool reports, internal and external audits.

Compliance oversight and ownership are provided by the CISO, IT, and Compliance functions; these areas have oversight and ownership, but not authority to impose discipline or grant exceptions. Enforcement and disciplinary outcomes remain with management as described in the Non-Compliance section.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy-including the theft of assets, failure to return assets upon termination, or the installation of unauthorized software-may be subject to disciplinary action, up to and including termination of employment and potential legal action for asset recovery.

SSP Hardware Inventory List

SSP Software Inventory List

Revision History

2026-08-20 — Darren Rush: Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page