Asset management means identifying, classifying, and administering assets throughout their life cycle. Assets include devices, systems, software, data, and intellectual property; visibility must also extend to cloud resources and third-party dependencies. Without knowing what exists and matters most, an organization cannot protect it effectively. section 6.2 section 6.0
Apply security requirements at each stage:
- Plan requirements, responsibilities, risk assessments, and controls before acquisition. section 6.2
- Check purchases and suppliers against those requirements; develop custom assets using secure coding practices. section 6.2
- Configure deployed assets, limit access to what users need, monitor usage, and train users. Maintain assets through updates, patches, audits, and vulnerability work. section 6.2
Turn an inventory into a decision
After outdated equipment disrupted patient care, a medical technology provider set targets of full hardware and software accountability, zero unaccounted assets, and critical classifications for 90% of hardware and 70% of software. Its dashboard showed 80% of hardware and 50% of software classified as critical—10 and 20 percentage points below those respective targets. An inventory audit and automated tracking helped address visibility; the classification gaps identify where to review priorities rather than treating asset counts alone as proof of safety. section 6.2.2
Figure 6.2 The left side shows TechMed Solutions’ asset management dashboard before managing hardware and software assets. The right side shows the dashboard after implementing hardware and software asset management.
Compare the before-and-after asset dashboards to see how hardware and software tracking makes gaps visible. section 6.2.2
Use the inventory to inform risk assessment and focus security effort on assets whose failure or compromise would matter most to operations. Revisit the inventory and its controls as assets and threats change. section 6.0 section 6.6
