Asset management policy

How we keep track of our information and equipment, who owns each asset, and how equipment is returned, protected outside the office and disposed of. It applies to all employees and to all assets in the scope.

Annex A controls: 5.9, 5.11, 7.9, 7.10, 7.14.

Inventory and ownership (5.9)

• Information assets: each SaaS product (Appsemble, Pro6PP, ITSLanguage) with its production data and backups, source code in GitLab, documents in Nextcloud, email, and secrets in Vaultwarden and OpenBao. The information asset list in the ISMS registers names the owner of each: the Project lead for a product, Infrastructure for the shared systems.
• Systems: the infra repository describes every server and service, and a new one gets its page there when it is set up (new infrastructure).
• Office machines are numbered in the machine registry, with their serial numbers and full hardware listing.
• Equipment: the asset pages of the office wiki list each company’s laptops, monitors, phones, drives and other equipment with serial number, purchase date and supplier, user and location.
• Personal laptops used for company work are in the inventory with their user.
• Cloud services and subscriptions are listed per company in the office wiki and in the supplier register (supplier management).
• Every year Office & HR checks that each item in the equipment inventory is found, with its user and location.

Return of assets (5.11)

• When someone leaves, the offboarding takes back the company laptop and other equipment, the office key and building tag under the returned-key agreement, and the digital office access (door lock app, Wi-Fi), and disables all accounts.
• Company information on a personal device is handed over and then deleted from it; the leaver confirms this.
• Office & HR updates the inventory with the returned items. A change of role follows the same steps for the assets the new role does not need.

Equipment off-premises (7.9)

• A device that holds company information follows the device rules wherever it is used: full disk encryption, a locked screen when you leave it, a firewall and automatic updates (security, operations security).
• Remote working rules are in the people security policy.
• Company equipment used at home or elsewhere, such as monitors on loan, is in the inventory with its user and location.
• A lost or stolen device is reported immediately as a security event (incident management).

Storage media (7.10)

• Company information lives on our servers, not on removable media: documents in Nextcloud or GitLab, code in GitLab, secrets in Vaultwarden (backup strategy). Files are shared through Nextcloud or the temporary file transfer service (file sharing), not on USB drives.
• Removable media (USB drives, external disks) that hold internal or confidential information (classification) are encrypted and listed in the inventory with their user.
• Disks in office machines are encrypted. Backups on our own backup storage are encrypted by the backup tool.
• Media that is no longer needed is disposed of as described below.

Secure disposal or re-use (7.14)

• Before a disk or a device with storage leaves the company, or goes to another user or role, its data is erased: overwritten (for example with shred) or, for an encrypted disk, reinstalled with a new encryption key (infrastructure teardown). A disk that cannot be erased is physically destroyed.
• A laptop is wiped and reinstalled before it goes to another user.
• The inventory records for each disposed or re-used item the date and how it was erased.
• Disposal of the hardware behind cloud services is the hosting supplier’s responsibility, covered by its certification (supplier management).

Responsibilities

• Office & HR maintains the equipment inventory, takes back assets at offboarding and runs the yearly inventory check.
• Infrastructure maintains the infra repository and the machine registry, and erases or destroys server disks and storage media.
• Project leads own the information assets of their product and keep their entries in the asset list current.
• Employees keep the equipment they use in the inventory up to date and report lost or stolen devices.

Review: yearly by the Information Security Officer.