Skip to content
FedXchange
Menu

IT Asset Management Procedure

Use this free template to write your agency's IT Asset Management Procedure. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the Configuration Management (CM) family. This copy follows the High baseline with the High Value Asset (HVA) overlay from the Cybersecurity and Infrastructure Security Agency (CISA). It names 22 controls. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 13 federal sources.

Approved by: Chief Information Officer (CIO); Chief Information Security Officer (CISO), concurring

From the document: The CIO owns this procedure, and the CISO concurs. It covers every IT asset in the scope of the IT Asset Management Policy, at every stage of its life. Each step names the person who acts, the action, the tool, the record it leaves, and the NIST SP 800-53 controls it supports.

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

  • AC-02
  • CA-05
  • CM-08
  • CM-08(1)
  • CM-08(2)
  • CM-08(3)
  • CM-08(4)
  • CM-10
  • CM-11
  • IR-04
  • IR-06
  • IR-08
  • MP-06
  • PL-04
  • PM-03
  • PM-06
  • PS-04
  • PS-05
  • PS-07
  • RA-05
  • SA-04
  • SA-22

Every Configuration Management (CM) template

The text of the IT Asset Management Procedure

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Role Name Signature
Chief Information Officer (CIO)
Chief Information Security Officer (CISO), concurring

Revision History #

Date Version Description Reviewer
2026-10-31 1.0 Initial issuance [Reviewer name]

Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change in the federal property or software license rules.

Mandate. This procedure gives the steps for the rules in the IT Asset Management Policy (POL-ITAM-001). It implements National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls CM-8 and CM-10, and the asset steps of SA-22, MP-6, PS-4, and PS-5. It also carries out these federal rules that the policy names:

  • Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 23-01, on asset discovery.
  • Office of Management and Budget (OMB) M-16-12, OMB M-26-05, and the Making Electronic Government Accountable By Yielding Tangible Efficiencies (MEGABYTE) Act of 2016, on software and hardware inventories.
  • 41 CFR Parts 102-35 through 102-40, on property accountability and disposal.

1. Purpose and Scope #

The CIO owns this procedure, and the CISO concurs. It covers every IT asset in the scope of the IT Asset Management Policy, at every stage of its life. Each step names the person who acts, the action, the tool, the record it leaves, and the NIST SP 800-53 controls it supports. The Configuration Management Procedures (PROC-CM) keep the security steps for each system’s component inventory and for unauthorized components. The roles are those in the IT Asset Management Policy, plus the IT Operations Manager, who runs the quarterly software review, and the Media Custodian, who sanitizes media. The Chief Financial Officer (CFO) keeps the financial records for capitalized property.

2. Procedures #

2.1 Requesting and buying IT assets #

Staff request every IT asset through the ticketing system, and nobody buys IT outside this process.

Actor Action Tool Evidence Controls
Requester Opens a request for hardware, software, or a cloud service, with the business need. The ticketing system Request ticket CM-8
Supervisor Approves the business need. The ticketing system Approval in the ticket CM-8
Software Manager For software, checks existing licenses and enterprise agreements first and assigns a spare license when one exists. The ticketing system License check note CM-10
Accountable Property Officer For hardware, checks spare stock and excess property first. The ticketing system Excess check note CM-8
CIO Approves the purchase, or delegates approval within limits the CIO sets in writing. The ticketing system CIO approval PM-3
Contracting Officer (CO) Buys the asset. Adds the asset reporting, license, and return terms to the contract. Contract file Purchase order SA-4

Evidence: the request tickets with their approvals, the license and excess checks, and the purchase orders.

2.2 Receiving and tagging new assets #

The IT Asset Manager records each asset before anyone uses it.

Actor Action Tool Evidence Controls
IT Asset Manager Checks the delivery against the purchase order and the shipping record. Records any difference. The ticketing system Receiving record CM-8
IT Asset Manager Gives the asset a property identification number and fixes the tag to it. Tag printer Tag number in the record CM-8
IT Asset Manager Creates the configuration management database (CMDB) record with every required data element, including warranty and end-of-support dates. The ticketing system CMDB record CM-8, CM-8(1)
System Owner Confirms the system the asset belongs to. The ticketing system Confirmation in the record CM-8
Chief Financial Officer (CFO) Records the asset in the financial records when it meets the capitalization threshold. Financial system Property record CM-8

Evidence: the receiving records, the tag numbers, the new CMDB records, and the CFO’s property records.

2.3 Issuing equipment to a user #

The Service Desk issues equipment by role from the standard equipment list the CIO approves.

Actor Action Tool Evidence Controls
Supervisor or Contracting Officer’s Representative (COR) Enters the start date of the new employee or contractor, which opens an equipment ticket. The ticketing system Onboarding ticket PS-7
Service Desk Prepares equipment from the standard equipment list for the person’s role, and sends any other item for approval. The ticketing system Equipment list in the ticket CM-8
Service Desk Enrolls the device in the mobile device management (MDM) tool and confirms that the endpoint detection and response (EDR) tools report from it. The MDM tool Enrollment record CM-8(2)
User Signs for the equipment and agrees to the rules of behavior. The ticketing system Signed receipt PL-4
IT Asset Manager Records the user, location, and status in the CMDB. The ticketing system Updated CMDB record CM-8(4)

Evidence: the onboarding tickets, the enrollment records, and the signed receipts.

2.4 Moving or reassigning equipment #

Staff update the record in the same ticket that moves the asset.

Actor Action Tool Evidence Controls
Requester Opens a move or reassignment ticket that lists each asset and where it goes. The ticketing system Move ticket CM-8(1)
Service Desk Moves the equipment. Sorts what moves with the user, what stays, and what is already at the new location. The ticketing system Completed move tasks CM-8
IT Asset Manager Updates the user, location, and system for each asset. Removes the user from equipment left behind. The ticketing system Updated CMDB records CM-8(1), CM-8(4)
System Owner Approves a move of an asset to another system. The ticketing system Approval in the ticket CM-8

Evidence: the move tickets and the CMDB change history.

2.5 Returning equipment when staff leave or transfer #

This step works with the account steps in the Personnel Security Procedures (PROC-PS), which end the person’s access.

Actor Action Tool Evidence Controls
Human Resources or COR Enters the departure or transfer date, which opens a return ticket. The ticketing system Separation ticket PS-4, PS-5
Service Desk Lists the assets assigned to the person from the CMDB. The ticketing system Asset list in the ticket PS-4
User Returns every listed asset by the last day of work, or the transfer date. The ticketing system Signed return receipt PS-4, PS-5
Service Desk Locks or wipes a device that is not returned, and tells the supervisor and the Security Operations Center (SOC). The MDM tool Lock or wipe record PS-4
IT Asset Manager Returns the assets to stock, or sends them for sanitization, and updates their records. The ticketing system Updated CMDB records CM-8
Accountable Property Officer Treats each asset still missing after the Service Desk’s follow-up as lost. The ticketing system Report of survey CM-8

Evidence: the separation tickets, the signed return receipts, and any lock, wipe, or survey records.

2.6 Reporting lost, stolen, or damaged equipment #

Users report a lost or stolen device to the Service Desk and the SOC at once, even when they expect to find it.

Actor Action Tool Evidence Controls
User Reports the loss or theft to the Service Desk and the SOC at once. Reports a theft to the police and gives the report number. The ticketing system Incident ticket IR-6
SOC Handles the report as a possible incident under the Incident Response Plan (PLAN-IR-001). The ticketing system Incident record IR-4, IR-6
Service Desk Locks or wipes the device and disables its certificates and access. The MDM tool Lock or wipe record AC-2
Privacy Officer Decides whether personally identifiable information was on the device. If so, the Senior Agency Official for Privacy (SAOP) follows the Breach Response Plan (PLAN-BR-001). The ticketing system Breach assessment IR-8
IT Asset Manager Sets the asset’s status to lost or stolen. The ticketing system Updated CMDB record CM-8
Accountable Property Officer Completes the report of survey. The ticketing system Report of survey CM-8

Evidence: the incident tickets, the lock or wipe records, the breach assessments, and the reports of survey.

2.7 Reconciling discovery results every week #

The vulnerability management team and the IT Asset Manager run this reconciliation every week.

Actor Action Tool Evidence Controls
Vulnerability management team Runs automated discovery across the whole IPv4 address space at least every 7 days, and starts enumeration of all assets at least every 14 days. The asset inventory tool, the vulnerability scanner Discovery and scan logs CM-8(2), RA-5
IT Asset Manager Each week, compares discovery results from every source with the CMDB. The ticketing system Weekly reconciliation report CM-8(2)
IT Asset Manager Checks the purchase and change tickets for each asset with no record. Creates a record for each approved asset, and retires records of assets confirmed gone. The ticketing system Correction tickets CM-8(1)
Information System Security Officer (ISSO) Handles each asset with no purchase or change approval as an unauthorized component under the Configuration Management Procedures (PROC-CM). The ticketing system Unauthorized component ticket CM-8(3)
ISSO Records a gap that cannot be closed at once as a plan of action and milestones (POA&M) item. The governance, risk, and compliance (GRC) system POA&M item CA-5

Evidence: the discovery logs, the weekly reconciliation reports, the correction tickets, and the POA&M items.

2.8 Truing up software licenses every month #

The Software Manager runs the true-up each month.

Actor Action Tool Evidence Controls
Software Manager Exports installation and use counts for each licensed product, and software as a service (SaaS) subscription counts. The asset inventory tool, the cloud platform Use report CM-10
Software Manager Compares the counts with the licenses held and the license terms. The ticketing system True-up worksheet CM-10
Software Manager Removes or reassigns unused licenses, and removes installations that have no license. The ticketing system Change tickets CM-10, CM-11
Software Manager Asks the CIO to approve any added licenses before the renewal or purchase. The ticketing system CIO approval CM-10
Software Manager Records savings and cost avoidance for the yearly report to the CIO. The document management system Savings log PM-3

Evidence: the use reports, the true-up worksheets, the change tickets, and the savings log.

2.9 Reconciling inventory records #

The IT Asset Manager reconciles the CMDB with the other records every month.

Actor Action Tool Evidence Controls
IT Asset Manager Compares the CMDB with discovery, the MDM tool, the EDR tools, the on-premises directory, purchase records, and the CFO’s property records. The ticketing system Reconciliation report CM-8
IT Asset Manager Lists each difference, its cause, the action taken, and the result. The ticketing system Reconciliation report CM-8
System Owner Certifies that the system’s part of the inventory is accurate. The ticketing system Certification CM-8
IT Asset Manager Sends the report to the CIO and the CISO, and lists items still missing for the Accountable Property Officer. The document management system Report and missing-item list CM-8

Evidence: the reconciliation reports, the System Owner certifications, and the missing-item lists.

2.10 Running the yearly wall-to-wall inventory #

The IT Asset Manager runs the inventory once each fiscal year, and finishes it before the yearly Federal Information Security Modernization Act (FISMA) report.

Actor Action Tool Evidence Controls
IT Asset Manager Announces the inventory dates and gives each Property Custodian a list of the equipment on record for that office or location. The ticketing system Inventory notice and lists CM-8
Property Custodian Scans the tag on each item at Organization sites and checks its record. Fixes small differences at once. Tag scanner Scan results CM-8
IT Asset Manager Confirms remote, telework, and overseas equipment by electronic means, from the latest check-ins to the MDM tool and the EDR tools. The MDM tool Electronic confirmation report CM-8
User Brings in, or confirms, any remote item that has not checked in since the last reconciliation. The ticketing system Confirmation ticket CM-8
Property Custodian Certifies the count for the office or location. The ticketing system Signed certification CM-8
IT Asset Manager Reconciles the results and reports them to the CIO, the CISO, and the CFO. The document management system Yearly inventory report CM-8

Evidence: the equipment lists for each office, the scan results, the electronic confirmation report, the custodian certifications, and the report of the yearly inventory.

2.11 Tracking end of support and planning refresh #

Edge devices that reach end of support follow the End-of-Support Edge Device Plan (PLAN-EOS-001). These steps cover every other asset.

Actor Action Tool Evidence Controls
IT Asset Manager Each quarter, lists hardware and software that has reached, or will reach within 12 months, the end of its warranty or vendor support. The ticketing system Quarterly end-of-support report SA-22
IT Operations Manager Each quarter, reviews the approved software list and the scanner results for software past end of support, or not on the list. The vulnerability scanner Review minutes and action items SA-22, CM-11
System Owner Plans the replacement of each component before its support ends, or records an approved alternative source of support. The ticketing system Replacement plan SA-22
ISSO Records each unsupported component without an approved alternative as a POA&M item. The GRC system POA&M item SA-22, CA-5
CIO Approves the yearly refresh plan and its funding. The document management system Approved refresh plan PM-3

Evidence: the quarterly end-of-support reports, the review minutes, the replacement plans, the POA&M items, and the approved refresh plan.

2.12 Sanitizing and disposing of assets #

Staff sanitize every asset that stores data before it leaves the Organization’s control, including assets returned to a lessor or vendor.

Actor Action Tool Evidence Controls
Asset holder Opens a ticket when an asset is no longer needed. The ticketing system Excess ticket CM-8
IT Asset Manager Offers the asset to other offices first. The ticketing system Internal offer record CM-8
Media Custodian Sanitizes every asset that stores data under the Media Protection Procedures (PROC-MP), and verifies the result. Sanitization tool Sanitization certificate MP-6
Accountable Property Officer Reports excess property to the General Services Administration (GSA) on Standard Form 120 through GSAXcess, and identifies electronics and their handling needs. GSAXcess Excess report CM-8
Accountable Property Officer Abandons or destroys an asset only after a written determination that it has no commercial value, or that its care would cost more than its sale would return. An official not accountable for the asset approves it. The document management system Determination and destruction certificate CM-8, MP-6
IT Asset Manager Sets the final status and disposal date in the CMDB. The CFO adjusts the financial records. The ticketing system Closed CMDB record CM-8

Evidence: the excess tickets, the sanitization certificates, the excess reports to GSA, the written determinations, and the closed CMDB records.

2.13 Measuring and reporting #

The IT Asset Manager reports to the CIO each month, and the CIO reports to OMB each year.

Actor Action Tool Evidence Controls
IT Asset Manager Reports the measures in the IT Asset Management Policy to the CIO each month. The ticketing system Monthly measures report PM-6
IT Asset Manager Gathers the hardware, end-of-support, cloud, and software inventory answers the CIO FISMA metrics ask for. The ticketing system Metric worksheet PM-6
CIO Reviews and submits the asset answers in the FISMA report. CyberScope Submitted report PM-6
CIO Reports software license savings to OMB when OMB asks for them. The document management system Savings report PM-3

Evidence: the monthly measures reports, the metric worksheets, and the submitted FISMA report.

3. Recurring Schedule #

Activity How often Who
Automated asset discovery At least every 7 days Vulnerability management team
Vulnerability enumeration of all assets At least every 14 days Vulnerability management team
Discovery reconciliation with the CMDB Every week IT Asset Manager
Software license true-up Every month Software Manager
Measures report to the CIO Every month IT Asset Manager
Inventory record reconciliation Monthly IT Asset Manager
End-of-support report and software review Every quarter IT Asset Manager and IT Operations Manager
Wall-to-wall inventory Every year IT Asset Manager and Property Custodians
Refresh plan Every year CIO

4. Records #

Staff keep these records in the ticketing system and the document management system:

  • The CMDB records and their change history, and the barcode records, under General Records Schedule (GRS) 3.1, item 020.
  • The equipment lists for each office, the reports from each reconciliation and yearly inventory, and the reports of survey, under GRS 5.4, item 010.
  • The excess reports, the written determinations, and the destruction certificates, under GRS 5.4, item 040.
  • The sanitization certificates, as the Media Protection Procedures require.

Evidence: the records above, found by asset tag or ticket number.

5. Derived Governance Requirements #

  • Keep a comprehensive inventory of software licenses, including enterprise licenses, and use it to track and maintain licenses across the Organization. (Pub. L. 114-210, § 2(b))
  • Analyze software use to make cost-effective license decisions, and have the CIO report the resulting savings as OMB requires. (Pub. L. 114-210, § 2(b))
  • Appoint a software manager to oversee enterprise-wide software license management. (OMB M-16-12, §3)
  • Have the CIO keep a comprehensive software licensing policy that names who manages enterprise software license agreements and commercial software licenses, and that covers each license from requisition through disposal. (Pub. L. 114-210, § 2(b))
  • Keep a continual agency-wide inventory of software licenses purchased, deployed, and in use, including spending on software as a service subscriptions. (OMB M-16-12, §2)
  • Give the CIO a significant role in the management, governance, and oversight of information technology, including the Organization’s IT assets. (Pub. L. 113-291, § 831)
  • Keep a complete inventory of software and hardware, current with the Organization’s risk determinations. (OMB M-26-05)
  • Keep a system for property accountability, and monitor personal property to prevent and detect nonuse, improper use, unauthorized disposal, or destruction. (41 CFR 102-36.10(d))
  • Inventory accountable property by physical count, electronic means, or statistical methods, and keep an audit trail for each item from receipt to final disposition. (41 CFR 102-35.20)
  • Offer property no longer needed to other offices first, then promptly report it to GSA as excess, and keep caring for it until it leaves the Organization. (41 CFR 102-36.10(e))
  • Abandon or destroy excess property only when an authorized official decides in writing that it has no commercial value or would cost more to keep than to sell. A reviewing official who is not accountable for it approves. (41 CFR 102-36.165)
  • Adjust property and financial records to show the final disposition of property the Organization sells. (41 CFR 102-38.15(e))
  • When reporting excess electronics and other property with special handling needs, identify the property and all related hazards and handling requirements. (41 CFR 102-40.15)
  • Keep property and equipment inventories, and reports of lost, damaged, missing, or destroyed property, for 3 years or longer if business use requires. (GRS 5.4, item 010)
  • Keep inventories of IT assets and equipment control records, such as barcode databases, under the IT operations and maintenance records schedule. (GRS 3.1, item 020)

6. References #

These are the sources this document cites, with a link to each official text.

Sources on the governance tracker

The FedXchange governance tracker follows each source this document cites and records each change to it.

Related templates

Change history

  1. : First published in the library. Template version 783d0494946e.