The text of the IT Asset Management Policy
Approval #
The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.
| Role | Name | Signature |
|---|---|---|
| Chief Information Officer (CIO) | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change in the federal property or software license rules.
Mandate. Several federal sources require the Organization to know and control every IT asset it owns or uses:
- National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 control CM-8 requires an accurate inventory of system components in every baseline. CM-8(1) and CM-8(3) add to it at the Moderate and High baselines, and CM-8(2) and CM-8(4) at High.
- The Making Electronic Government Accountable By Yielding Tangible Efficiencies (MEGABYTE) Act of 2016 requires the CIO to keep a software licensing policy and a license inventory. Office of Management and Budget (OMB) M-16-12 adds a software manager and a continual license inventory.
- OMB M-26-05 directs every agency to keep a complete inventory of software and hardware.
- Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 23-01 requires automated asset discovery every 7 days and vulnerability enumeration every 14 days.
- The Federal Management Regulation, 41 CFR Parts 102-35 through 102-40, requires a property accountability system, inventories, and disposal of excess property through the General Services Administration (GSA).
- The Federal Information Technology Acquisition Reform Act gives the CIO a significant role in managing and overseeing information technology.
The CIO owns this policy, and the CISO concurs. It sets the rules, and the IT Asset Management Procedure (PROC-ITAM-001) gives the steps. The Configuration Management Policy (POL-CM) keeps the security rules for each system’s component inventory and for unauthorized components. The Derived Governance Requirements at the end of this policy list the source of each rule.
1. Purpose #
The Organization manages its IT assets so that it can:
- Know every asset it owns, leases, licenses, or uses, where the asset is, and who answers for it.
- Protect each asset, and the information on it, from purchase through disposal.
- Spend only on the hardware, software, and services it needs, and stay within license terms.
- Give the security program a complete list of assets to scan, configure, and monitor.
2. Scope #
This policy covers every IT asset the Organization owns, leases, licenses, or subscribes to, wherever the asset is:
- Hardware: desktops, laptops, servers, network and edge devices, printers, monitors, storage devices, and peripherals that store data.
- Mobile devices: phones and tablets, and the applications on them.
- Software: installed software, operating systems, and the licenses and agreements that cover them.
- Cloud services, including software as a service (SaaS), and their subscriptions.
- Internet of Things (IoT) and operational technology (OT) devices on Organization networks.
- Virtual servers and other virtual assets that the Organization runs.
- Government-furnished equipment (GFE) used away from Organization sites, including at telework locations, on travel, and overseas.
- Assets that contractors hold or run for the Organization when the government holds title.
The policy applies to every employee and contractor who requests, buys, receives, uses, moves, or disposes of these assets. Personally owned devices are not Organization assets. The Access Control Policy (POL-AC) sets the rules for using them.
3. Roles and Responsibilities #
| Role | Responsibilities |
|---|---|
| CIO | Owns and approves this policy. Approves IT purchases and the yearly refresh plan. Names the IT Asset Manager and the Software Manager. Reports asset and license data to OMB. Decides what to do about assets still missing after a reconciliation. |
| IT Asset Manager | Keeps the IT asset inventory in the configuration management database (CMDB) in the ticketing system. Receives, tags, records, assigns, and retires assets. Manages spare equipment. Runs the weekly discovery reconciliation, the record reconciliation, and the yearly inventory, and reports the results. |
| Software Manager | Manages the Organization’s software agreements and licenses, and reports to the CIO. Keeps the license inventory and runs the monthly license true-up. Checks existing agreements before any new software purchase. |
| Accountable Property Officer | Keeps the property accountability records. Approves transfers, excess reports, and disposals. Reports excess property to GSA. Completes a report of survey for each lost, damaged, or destroyed item. |
| Property Custodian | Keeps and accounts for the equipment issued to an office or location. Supports the yearly inventory and certifies its results for that office or location. |
| Chief Financial Officer (CFO) | Records capitalized IT property in the financial records. Reconciles those records with the IT asset inventory each year. |
| CISO | Concurs on this policy. Sets the security rules for the component inventory in the Configuration Management Policy. Uses the inventory for vulnerability management and continuous monitoring. Receives reports of lost or stolen equipment through the Security Operations Center (SOC). |
| System Owners | Make sure every asset in their system is in the inventory and assigned to the system. Certify the system’s inventory. Plan the replacement of components before their support ends. |
| Information System Security Officers (ISSOs) | Compare their system’s component inventory with discovery results. Record each gap they cannot close at once as a plan of action and milestones (POA&M) item. |
| Service Desk | Issues, moves, and collects equipment through ticketing system tickets. Tells the IT Asset Manager of each change. |
| Contracting Officer (CO) and Contracting Officer’s Representative (COR) | Put asset reporting, license, and return terms in contracts. Make sure contractors report and return government property. Tell the Service Desk when contractor staff start and leave. |
| Supervisors | Tell Human Resources and the Service Desk when staff arrive, move, or leave. Make sure departing staff return their equipment. |
| All users | Protect the equipment issued to them. Report a lost or stolen device at once. Return all equipment when they leave or no longer need it. |
4. Policy Rules #
4.1 Keeping one authoritative inventory #
- The IT Asset Manager must keep one authoritative inventory of IT assets in the CMDB in the ticketing system. Other tools send data to the CMDB, and none of them replaces it. (NIST SP 800-53 CM-8; OMB M-26-05)
- The IT Asset Manager must record at least the data elements in the table below for each asset. (NIST SP 800-53 CM-8; 41 CFR 102-35.20)
- Each asset must belong to exactly one system, with no duplicate records. The System Owner confirms each assignment. (NIST SP 800-53 CM-8)
- The Service Desk must not issue accountable equipment to a user until the IT Asset Manager has tagged the asset and recorded it in the CMDB. (41 CFR 102-36.10(d))
- Staff who install, move, or remove an asset must update its record in the same ticket. (NIST SP 800-53 CM-8(1))
Data elements for each asset record.
| Data element | What the record holds |
|---|---|
| Property tag | The Organization’s property identification number on the asset’s tag |
| Identity | Manufacturer, model, type, and serial number |
| Network identity | Hostname, Internet Protocol (IP) addresses, and hardware addresses |
| Software | Product name, publisher, version, and the license or subscription that covers it |
| System | The one system the asset belongs to |
| Accountable people | The assigned user, the Property Custodian, and the administrator, by name and role |
| Location | Site, room, telework location, or overseas post |
| Status | In stock, deployed, in repair, missing, lost or stolen, excess, or disposed |
| Acquisition | Purchase order or contract, receipt date, cost, and whether the asset is capitalized |
| Support | Warranty end date and the vendor’s end-of-support date |
| Storage media | Whether the asset stores data, and its sanitization record at disposal |
| Security flags | Critical software flag and a link to the software bill of materials (SBOM), where the Configuration Management Policy requires them |
4.2 Finding assets automatically #
- The vulnerability management team must run automated asset discovery across the Organization’s whole IPv4 address space at least every 7 days. It must start vulnerability enumeration of every discovered asset at least every 14 days. (CISA BOD 23-01)
- The team sends discovery results to the CDM Agency Dashboard through the hardware asset management (HWAM) and software asset management (SWAM) capabilities. (CDM Asset Management fact sheet)
- The IT Asset Manager must reconcile the discovery results with the CMDB every week. Sources include the asset inventory tool, scanner agents, the endpoint detection and response (EDR) tools, the mobile device management (MDM) tool, the cloud platform resource listings, and the on-premises directory. (NIST SP 800-53 CM-8(2))
- When discovery finds an asset with no CMDB record, the IT Asset Manager checks the purchase and change tickets. An approved asset gets its record and stays in service. An asset with no approval is an unauthorized component, and staff handle it under the Configuration Management Procedures (PROC-CM). (NIST SP 800-53 CM-8(3))
4.3 Managing software licenses #
- The Software Manager must keep a continual inventory of software licenses purchased, deployed, and in use, including spending on SaaS subscriptions. (OMB M-16-12, §2)
- The inventory must cover at least 80 percent of software license spending and every enterprise license, and the Software Manager builds it with automated discovery and inventory tools. (Pub. L. 114-210, § 2(b))
- The Software Manager must compare licenses with installations and use every month. The Software Manager removes or reassigns unused licenses, and buys more only with the CIO’s approval. (Pub. L. 114-210, § 2(b); NIST SP 800-53 CM-10)
- Before any new software purchase, the Software Manager checks the Organization’s enterprise agreements and government-wide agreements. (OMB M-16-12, §2)
- Staff must use software only as its license and copyright allow. Staff install software only as the Configuration Management Policy allows. (NIST SP 800-53 CM-10)
- The Software Manager analyzes software use each year and reports the savings to the CIO. The CIO reports them to OMB when OMB asks. The MEGABYTE Act’s yearly savings report to OMB covered fiscal years 2017 through 2022. (Pub. L. 114-210, § 2(c))
- The Software Manager trains the staff who manage licenses. (Pub. L. 114-210, § 2(b))
4.4 Managing each asset through its life cycle #
- Request. Staff request IT assets through the ticketing system. The CIO approves IT purchases under the IT Governance and Investment Management Policy, and the Accountable Property Officer checks for excess property before a new purchase. (Federal Information Technology Acquisition Reform Act; 41 CFR 102-36.10(a))
- Purchase. The CO buys through the Organization’s acquisition process. Software and hardware purchases also follow the Software and Hardware Assurance Policy (POL-SWHW-001). (OMB M-26-05)
- Receipt and tagging. The IT Asset Manager checks each delivery against the purchase order and the shipping record, tags the asset, and records it before anyone uses it. (41 CFR 102-35.20)
- Assignment. The Service Desk issues equipment by role, from the standard equipment list the CIO approves. The user acknowledges receipt in the ticketing system. (NIST SP 800-53 CM-8(4))
- Transfer. The Service Desk updates the record whenever an asset moves to another user, office, or system. (NIST SP 800-53 CM-8(1))
- Loss or theft. Users report a lost or stolen device at once. The SOC handles the report as a possible incident. (NIST SP 800-53 IR-6)
- Refresh. The IT Asset Manager reports each quarter on assets due for replacement, by age, warranty, and support dates. The CIO approves a yearly refresh plan. (NIST SP 800-53 SA-22)
- End of support. System Owners replace each component before its vendor support ends, or record an approved alternative source of support. Edge devices follow the End-of-Support Edge Device Plan (PLAN-EOS-001). (NIST SP 800-53 SA-22; CISA BOD 26-02)
- Return. Staff return all equipment when they leave or transfer, before their last day. (NIST SP 800-53 PS-4; NIST SP 800-53 PS-5)
- Sanitization. Staff sanitize every asset that stores data before reuse, release, or disposal, under the Media Protection Procedures (PROC-MP). (NIST SP 800-53 MP-6; NIST SP 800-88 Rev. 2)
- Disposal. The Accountable Property Officer offers unneeded property to other offices first, then reports it to GSA as excess. Staff abandon or destroy property only after a written determination that it has no commercial value or would cost more to keep than to sell. A second official approves the determination. (41 CFR 102-36.10(e); 41 CFR 102-36.165)
4.5 Counting and reconciling assets #
- The IT Asset Manager reconciles the CMDB with discovery, device management, directory, purchase, and financial records every month. (NIST SP 800-53 CM-8)
- The IT Asset Manager runs a wall-to-wall inventory of all accountable equipment each year. Staff count equipment at Organization sites by scanning tags. They confirm remote equipment, including telework and overseas equipment, by electronic means. (41 CFR 102-35.20)
- For each reconciliation, the IT Asset Manager records each difference, its cause, the action taken, and the result. (41 CFR 102-35.20)
- The IT Asset Manager reports items still missing after a reconciliation to the Accountable Property Officer and the CIO. The Accountable Property Officer treats each one as lost. (41 CFR 102-36.10(d))
4.6 Keeping records #
Staff keep IT asset inventories and barcode records under General Records Schedule (GRS) 3.1, item 020. They keep property inventories and reports of survey under GRS 5.4, item 010, and excess property records and destruction certificates under GRS 5.4, item 040. The Agency Records Officer may set longer periods for business use. (GRS 3.1, item 020; GRS 5.4, item 010; GRS 5.4, item 040)
4.7 Measuring and reporting #
Each year, the CIO answers the asset questions in the CIO metrics under the Federal Information Security Modernization Act (FISMA). They cover hardware assets, device scanning, end-of-life and end-of-support assets, cloud services, and the software inventory. (FY 2026-2027 CIO FISMA Metrics) The IT Asset Manager reports these measures to the CIO each month:
| Measure | Target |
|---|---|
| Assets found by discovery that match a CMDB record | At least 98 percent |
| Accountable equipment counted in the yearly inventory | 100 percent |
| Software license spending covered by the license inventory | At least 80 percent |
| Assets past vendor end of support without an approved alternative | None |
| Lost or stolen devices reported to the SOC on the day of discovery | 100 percent |
4.8 Exceptions #
The CIO may approve an exception to a rule in this policy that the Organization set for itself, with the CISO’s concurrence. The CIO cannot waive a rule that a law, regulation, OMB memorandum, or CISA directive sets. The ISSO records each exception and its end date in the governance, risk, and compliance (GRC) system.
5. Related Documents #
- IT Asset Management Procedure (PROC-ITAM-001): the steps for each rule in this policy.
- IT Governance and Investment Management Policy (POL-ITGOV-001): how the CIO reviews and approves IT acquisitions and investments, including software licenses.
- Configuration Management Policy (POL-CM) and Configuration Management Procedures (PROC-CM): the security rules for each system’s component inventory and for unauthorized components.
- Vulnerability Management Policy (POL-VM-001): scanning and remediation.
- End-of-Support Edge Device Plan (PLAN-EOS-001): edge devices that lose vendor support.
- Software and Hardware Assurance Policy (POL-SWHW-001): what the Organization requires before it buys software and hardware.
- Media Protection Procedures (PROC-MP): sanitization.
- Incident Response Plan (PLAN-IR-001) and Breach Response Plan (PLAN-BR-001): lost and stolen devices.
6. Derived Governance Requirements #
- Keep a comprehensive inventory of software licenses, including enterprise licenses, and use it to track and maintain licenses across the Organization. (Pub. L. 114-210, § 2(b))
- Analyze software use to make cost-effective license decisions, and have the CIO report the resulting savings as OMB requires. (Pub. L. 114-210, § 2(b))
- Appoint a software manager to oversee enterprise-wide software license management. (OMB M-16-12, §3)
- Have the CIO keep a comprehensive software licensing policy that names who manages enterprise software license agreements and commercial software licenses, and that covers each license from requisition through disposal. (Pub. L. 114-210, § 2(b))
- Keep a continual agency-wide inventory of software licenses purchased, deployed, and in use, including spending on software as a service subscriptions. (OMB M-16-12, §2)
- Give the CIO a significant role in the management, governance, and oversight of information technology, including the Organization’s IT assets. (Pub. L. 113-291, § 831)
- Keep a complete inventory of software and hardware, current with the Organization’s risk determinations. (OMB M-26-05)
- Keep a system for property accountability, and monitor personal property to prevent and detect nonuse, improper use, unauthorized disposal, or destruction. (41 CFR 102-36.10(d))
- Inventory accountable property by physical count, electronic means, or statistical methods, and keep an audit trail for each item from receipt to final disposition. (41 CFR 102-35.20)
- Offer property no longer needed to other offices first, then promptly report it to GSA as excess, and keep caring for it until it leaves the Organization. (41 CFR 102-36.10(e))
- Abandon or destroy excess property only when an authorized official decides in writing that it has no commercial value or would cost more to keep than to sell. A reviewing official who is not accountable for it approves. (41 CFR 102-36.165)
- Adjust property and financial records to show the final disposition of property the Organization sells. (41 CFR 102-38.15(e))
- When reporting excess electronics and other property with special handling needs, identify the property and all related hazards and handling requirements. (41 CFR 102-40.15)
- Keep property and equipment inventories, and reports of lost, damaged, missing, or destroyed property, for 3 years or longer if business use requires. (GRS 5.4, item 010)
- Keep inventories of IT assets and equipment control records, such as barcode databases, under the IT operations and maintenance records schedule. (GRS 3.1, item 020)
Other sources: FY 2026-2027 CIO FISMA Metrics; NIST SP 1800-5, an example architecture for IT asset management.
7. References #
These are the sources this document cites, with a link to each official text.
- 41 CFR Part 102-35: Disposition of Personal Property, December 16, 2025.
- 41 CFR Part 102-36: Disposition of Excess Personal Property, December 16, 2025.
- 41 CFR Part 102-38: Sale of Personal Property, December 16, 2025.
- 41 CFR Part 102-40: Utilization and Disposition of Personal Property With Special Handling Requirements, December 16, 2025.
- CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
- CISA BOD 26-02: Mitigating Risk From End-of-Support Edge Devices, February 5, 2026.
- Continuous Diagnostics and Mitigation (CDM) Program: Asset Management, January 2022.
- Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
- Federal Information Technology Acquisition Reform Act (Pub. L. 113-291), December 19, 2014.
- FY 2026-2027 CIO FISMA Metrics, August 3, 2026.
- Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act) (Pub. L. 114-210), July 29, 2016.
- NARA General Records Schedule 3.1: General Technology Management Records.
- NARA General Records Schedule 5.4: Facility, Equipment, Vehicle, Property, and Supply Records, May 2024.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
- NIST SP 1800-5: IT Asset Management, September 2018.
- OMB M-16-12: Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software Licensing, June 2, 2016.
- OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.