GAA cheat sheet

ITAM scope covers hardware, software, cloud, and virtual assets plus the data and contracts tied to them; CMDB holds configuration items and relationships, while the asset repository holds financial and contractual records.

ITIL 4 practice structure separates IT asset management (financial, contractual, lifecycle control) from service configuration management (CI relationships and service models); both share one authoritative data source.

Governance artifacts: asset management policy, asset ownership matrix, lifecycle stage definitions, and RACI assigning accountable owner per asset class.

ISO/IEC 19770-1 defines ITAM processes in tiers (trustworthy data, lifecycle integration, optimization, conformity); ISO/IEC 19770-2 is the software identification (SWID) tag standard, 19770-3 covers software entitlement schemas.

Segregation of duties: the person approving a purchase must not be the sole person recording receipt or approving disposal; audit trails must capture who changed cost center, status, or assignment.

Control objectives typically audited: completeness of inventory, accuracy of financial data, license compliance position, disposal evidence, and reconciliation frequency.

KPI baselines require a defined data owner and review cadence; unowned asset records decay fastest at status change points (receipt, deployment, retirement).

Policy exception process must record requester, risk accepted, compensating control, expiry date, and approver; exceptions without expiry become permanent undocumented risk.

Discovery methods: agent-based (installed on endpoint, richest data, survives off-network), agentless (WMI/SSH/SNMP scan, credential-dependent), network sniffing/passive, and integration feeds from MDM, hypervisor, or cloud APIs.

Reconciliation logic: match on strong identifiers first (serial number, cloud resource ID, MAC), then fuzzy attributes (hostname, IP); IP alone is unreliable because of DHCP reuse.

Three record states in practice: discovered (seen by tool), inventoried (verified and enriched), managed (owned, with lifecycle and financial data).

CMDB health metrics: duplicate CI rate, orphan CI rate, relationship completeness, and percentage of CIs with a valid owner; measure monthly to detect drift.

Authoritative source per attribute (system of record): HR for person identity, procurement/ERP for cost and PO, discovery for technical attributes, contract repository for entitlements.

Reconciliation cadence: daily automated matching, weekly exception review, monthly certification of high-criticality CIs, quarterly full physical or logical verification.

Configuration baselines define approved state per CI class; drift detection compares current configuration against baseline and raises a change or remediation ticket.

Discovery coverage gap analysis compares network range scans, DHCP/AD leases, and endpoint agent check-ins; assets appearing in leases but not in inventory are the highest-priority unknowns.

Lifecycle stages: plan/request, procure, receive, stage and image, deploy, manage/maintain, retire/decommission, dispose or resell, with a financial event recorded at each transition.

Receiving control: three-way match of purchase order, packing slip/advance ship notice, and invoice; serial numbers captured at receipt, not at deployment.

Standard lifecycle durations commonly used for planning: laptops 3-4 years, servers 5-7 years, network gear 5-7 years; refresh driven by warranty end, support cost curve, and OS support dates.

Depreciation methods: straight-line (cost minus salvage, divided by useful life) is the default for IT asset books; a change in useful life is a change in accounting estimate applied prospectively.

Disposal evidence chain: data sanitization certificate (NIST SP 800-88 purge/clear/destroy), asset tag removal record, chain-of-custody document, and certificate of destruction or resale record.

Break-fix versus refresh decision rule: when cumulative repair cost plus residual value exceeds replacement cost per remaining supported year, retire early.

Spare and stock management: define buffer stock by criticality, track loaner pool separately, and reconcile stock counts against the asset repository monthly.

Warranty and support entitlement must be linked to the asset record with start and end dates; unrenewed support on in-service assets is a reportable risk.

Effective license position (ELP) = entitlements (purchased rights, including upgrades, downgrades, second-use rights) minus consumption (installed or accessed), calculated per metric and per manufacturer terms.

License metrics: per device, per named user, per concurrent user, per core (often with a core-factor table for virtualization), per processor, per server, and subscription per user per month.

Consumption evidence hierarchy: publisher-provided usage data, discovery tool metering, then manual attestation; weaker evidence widens the compliance risk band.

Indirect access: users or devices accessing licensed software through an application, API, or automated process may consume licenses even without direct installation.

SaaS/subscription controls: track renewal dates, auto-renew clauses, true-up windows, and assigned-but-inactive seats; reclaim seats unused beyond a defined threshold.

Optimization levers: harvest unused installs, renegotiate tier and volume bands, switch to subscription where usage is elastic, and consolidate duplicate tools by function.

Audit readiness: maintain a license register with contract IDs, entitlement quantities, metric definitions, and evidence of last reconciliation; respond to publisher audits within contractual notice windows.

Open-source obligations: copyleft licenses can require source disclosure for derivative distribution; maintain an SBOM and license scan in the build pipeline.

Cloud resources are ephemeral: tag at creation via policy or infrastructure-as-code, and treat missing mandatory tags as a compliance finding, not a data cleanup task.

Mandatory tag schema typically includes owner, cost center, environment, application/service, and data classification; tags drive both chargeback and security scoping.

Virtual machine license rules differ by publisher: some license by physical host cores with a core factor, others allow license mobility with active Software Assurance or subscription equivalence.

Containers shift the licensing question from host to image and to the orchestrator node count; track image provenance and per-node entitlements.

Shadow IT detection: compare cloud provider billing or API inventory against the approved CMDB; unlinked accounts and personal credit-card subscriptions are the usual source.

Right-sizing signals: sustained CPU and memory utilization below threshold, unattached storage volumes, idle load balancers, and orphaned snapshots.

Reserved and savings-plan commitments convert on-demand spend to discounted rates in exchange for term commitment; unused commitment is a sunk cost that must be tracked.

Exit and portability: record data residency, egress cost profile, and export formats for each cloud service to avoid lock-in during migration or termination.

Classification drives controls: public, internal, confidential, restricted; each class maps to encryption, access, retention, and disposal requirements.

CIA triad applied to assets: confidentiality (access control, encryption), integrity (hashing, change control), availability (redundancy, support coverage).

Asset criticality tiers feed risk assessment; a business impact analysis assigns recovery time and recovery point objectives per tier.

Data sanitization standards: NIST SP 800-88 categories clear, purge, destroy; cryptographic erase is acceptable where the key is destroyed and the media cannot be re-keyed.

Risk register entry includes asset, threat, likelihood, impact, inherent risk, control, residual risk, owner, and review date.

Access reviews: quarterly for privileged and restricted-data assets, annual for standard; remove access at termination via HR-triggered workflow.

Chain of custody for mobile and removable media: log issue, return, loss, and wipe; lost devices require encryption verification and incident record.

Regulatory hooks: GDPR requires records of processing and erasure; HIPAA and PCI DSS impose retention, encryption, and disposal evidence obligations on assets holding regulated data.

Total cost of ownership includes acquisition, implementation, support, training, energy, downtime, and disposal; comparing only purchase price understates lifecycle cost.

CapEx versus OpEx: owned hardware and perpetual licenses are typically capitalized; subscriptions and cloud consumption are operating expense, which shifts budget timing and approval path.

Straight-line depreciation formula: (acquisition cost - salvage value) / useful life in years; monthly charge is annual divided by 12.

Chargeback allocates actual costs to cost centers; showback reports costs without transferring budget; choose based on organizational accountability maturity.

Procurement controls: approved vendor list, competitive bid thresholds, PO required before order, three-way match before payment, and contract terms review for auto-renewal and price escalation caps.

Cost optimization sequence: eliminate unused, then right-size, then consolidate contracts, then renegotiate; skipping elimination inflates the discount negotiation baseline.

Unit cost metrics: cost per endpoint per year, cost per software title per user, cloud cost per transaction or per customer, support cost as percentage of asset value.

Budget variance analysis splits volume variance (more or fewer assets) from rate variance (price change) to explain overspend accurately.

Metric hierarchy: key performance indicators measure effectiveness against target, key risk indicators measure exposure, and diagnostic metrics explain variance.

Inventory accuracy = verified records / total records sampled; report with sample size and confidence, not a single percentage without method.

License compliance ratio = entitlements / consumption; a ratio below 1.0 indicates exposure quantified by metric (cores, users, devices).

Discovery coverage = assets seen by discovery / assets expected from leases and HR; the gap is the unknown-asset population.

Cost per asset and asset utilization rate (in-service assets / total owned assets) expose idle stock and over-purchasing.

Dashboard design: one page per audience, thresholds with red/amber/green, trend over at least three periods, and a named data owner plus refresh timestamp.

Continual improvement loop: baseline, target, root cause, countermeasure, verify, standardize; record each cycle in a register with owner and due date.

Data quality dimensions to report: completeness, accuracy, timeliness, uniqueness, and validity; track each per asset class.

RACI per process step prevents the common failure where finance, security, and IT each assume another team owns retirement and disposal records.

Audience-tailored reporting: executives need risk exposure and cost trend, finance needs capitalization and variance, security needs unpatched and unmanaged asset counts, auditors need evidence trails.

Change management integration: every change record references affected CIs; unauthorized configuration changes are detected by comparing to baseline.

Incident and problem linkage: incidents resolve against CIs, and repeat incidents on one asset class trigger a problem record and possible refresh decision.

Request fulfillment workflow: catalog item, approval by cost threshold, automated provisioning, asset record creation, and assignment confirmation to the user.

Communication cadence: monthly operational review with asset owners, quarterly governance board with budget holders, annual policy review with internal audit input.

Escalation rules must state trigger, timeframe, and escalation path; unresolved data quality exceptions escalate to the asset owner, not the tool administrator.

Training and awareness: onboarding covers acceptable use and asset custody; offboarding covers return, wipe verification, and access removal within a defined window.