How do you implement ITAM policies and standards in your organization?

Some best practices for implementing ITAM policies and standards in an organization: - Define your goals and scope a) Identify your ITAM objectives b) Determine the scope of your ITAM program - Develop your policies and standards a) Create clear and concise policies b) Establish robust standards c) Align your policies and standards with industry best practices - Communicate and train your staff a) Importance of ITAM b) Train your staff on the policies and procedures c) Develop resources and support materials - Implement and monitor your policies and standards a) Implement your policies and standards gradually b) Monitor your progress c) Use ITAM tools and technology -Continuously improve your ITAM a) Review b) Feedback c) Stay updated trend

A tip, or trick is to piggy back off Policies/Standards prescribed by Security/Cybersecurity. At times, those functions with teeth hold more "gravitas" than those who can be seen as an overhead. In recent months the noise of DORA has driven organisations to refocus their policies/standards to meet fundamental requirements set out in the name of Operational Resilience that can help drive ITAMs own policy/standards statements. - The principles are the same, Capture Asset details correctly and accurately. - Know where your assets are, who has them, who owns them. - Manage compliance / business risks aligned to asset management - Don't forget the must statements but only use those where you can evidence them.

When looking at the inventory you have, make sure you understand the value that these assets hold and do some of your own research. It takes a lot of time assess the current state, especially in a larger businesses. Ways to combat wasted time is to delegate the task to an employee who knows this side of the business well. Give them a time frame in which to complete the task. This way you won't be sidetracked by the details of going through current inventory, etc.

Implementing ITAM policies and standards requires aligning with ITIL and ISO 19770. Start by defining a governance framework, including roles, responsibilities, and approval workflows. Establish asset lifecycle policies covering procurement, usage, compliance, and disposal. Implement discovery tools (e.g., ServiceNow, Freshservice) for real-time asset tracking. Enforce CMDB integration, license management, and vendor contract alignment. Utilize automation for compliance enforcement, audits, and reconciliation. Regularly review policies for regulatory compliance and optimize based on usage analytics and business needs.

If you are looking to repurpose some old technologies, understand you can get quite a large sum from companies looking to purchased used tech. Look at their case studies and past work. If you are looking to secure more of your assets be vigilant on who you are dealing with and know how high their security standards are. Dealing with data, especially hard drives is not a joke and should be done carefully. Metrics and indicators are necessary, but spending too much time refining these metrics can slow down the process. Make sure to take them up with your partners/team.

Determine what mechanisms you will use. Some ITAM products use automated discovery. Within that discussion, understand what type of discovery will be used as it can be agent based or agentless (just use of credentials by a central scanning device). Also, determine what level of detail you want, you want to define if you are tracking switches, routers, laptops, desktops, servers. But you may find that you don’t want to track things like keyboards, mice. So set a scope of hardware types that you want to track, the information you want track as well as the obvious attributes such as who it is assigned to and when it was last scanned.

ITAD policies will always be changing. In this world of technology, things move quickly. We have had many clients who ask for different requirements all the time. It is the nature of IT. When looking to change or restructure an ITAD policy, don't hesitate. When looking to increase security standards for end of life assets and when disposing of them, don't compromise. There are many companies that don't let assets leave their facility and require on-site data storage shredding.

Policies need to reflect key aspects such as who is responsible for inventory tasks or managing inventory discovery (if using an automated network scanning tool for IP based IT assets). Similarly, you also want to define how often these tasks take place, what should be done when, inevitably, hardware goes unaccounted for. There should also be a regularly recurring task of conducting inventory scans. You also want to make sure that when individuals leave an organization, that there are processes in place to ensure that these critical inventory tasks will continue.

Corporate culture is key. Inventory and ITAM is one area that teams tend to dread. When teams can relate to the importance of these tasks and they don’t feel like they will be stuck with an impossible or intractable task, individuals will be more willing and ultimately have better success in these efforts. I have found that staff are reluctant to take on these tasks because they either cannot find missing hardware or feel responsible for when it goes missing. While tracking may be a responsibility of these teams, generally they are not the primary users and may not have control 24/7. It is important to have procedures in place to hold the correct individuals responsible to avoid this type of reluctance.

Define success metrics, generally this is based on the original baseline. This will also allow you to show the team that their efforts are making a difference and that managers are seeing that. Include the team in discussions about patterns that are seen in the new data. They have hands on insight into what is happening and can add context to patterns in inventory or may be able to demonstrate that one pattern may not have meaning. Keep track of how the team is performing and if they are underperforming, try to understand why and where that blocker is happening. This will help the team feel supported and not like they are the dreaded inventory team that gets stuck with the same problems over and over again.

To successfully implement ITAM policies and standards in your organization, focus on improving and updating them first. For example, if your current policy doesn't address remote work devices, revise it to include guidelines for managing and securing these assets. Regular updates ensure policies remain relevant and actionable, leading to better IT asset management and compliance.