GAA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ITAM versus CMDB

ITAM manages financial, contractual, and lifecycle data for assets; the CMDB records configuration items and their relationships for service delivery. Both should draw from one authoritative data source.

ISO/IEC 19770-1

International standard defining IT asset management processes organized into tiers, from trustworthy data through lifecycle integration to optimization and conformity. Used as a governance maturity benchmark.

SWID tag

Software identification tag defined by ISO/IEC 19770-2. Embedded by publishers in installation packages, it carries product, version, and entitlement identifiers that discovery tools can read for accurate software inventory.

Segregation of duties in ITAM

Control principle that no single person both approves and records the same transaction. In asset management it separates purchase approval, receipt recording, and disposal authorization to prevent fraud and undetected loss.

Policy exception register

Log of approved deviations from asset policy, each recording requester, risk accepted, compensating control, approver, and expiry date. Exceptions without expiry become permanent undocumented risk.

Agentless discovery

Inventory technique that scans network devices using remote protocols such as WMI, SSH, or SNMP with service credentials. It reaches unmanaged devices but misses assets that are off-network or block credentials.

Reconciliation matching keys

Order of identifiers used to merge discovery records: serial number and cloud resource ID first, then MAC address, then hostname. IP address alone is unreliable because DHCP reassigns it.

Orphan configuration item

A CI record with no valid owner, no parent service, or no matching asset record. High orphan rates indicate broken reconciliation and undermine the reliability of impact analysis.

Configuration baseline

Documented approved configuration for a CI class, including OS version, patch level, and installed agents. Current state is compared to baseline to detect drift and trigger remediation.

Discovery coverage gap

Assets appearing in DHCP leases, HR rosters, or procurement records but absent from inventory. This population represents unknown and potentially unmanaged devices and is the priority for reconciliation.

Three-way match

Receiving control comparing purchase order, packing slip or advance ship notice, and supplier invoice before payment. Quantities, part numbers, and serial numbers must agree, and assets are recorded at receipt.

Straight-line depreciation

Annual charge equals acquisition cost minus salvage value, divided by useful life in years. Monthly charge is that figure divided by twelve; changing useful life is applied prospectively, not retrospectively.

NIST SP 800-88 categories

Data sanitization standard defining clear (logical overwrite), purge (stronger, media may be reused), and destroy (media rendered unusable). Disposal records should cite the category applied per device.

Refresh decision rule

Retire hardware early when cumulative repair cost plus remaining residual value exceeds the cost of replacement per remaining supported year, or when vendor support and OS updates end.

Disposal evidence chain

Documents proving secure retirement: sanitization certificate, asset tag removal record, chain-of-custody log, and certificate of destruction or resale. Auditors require this for every retired regulated-data asset.

Effective license position

Entitlements purchased minus consumption in use, calculated per license metric and per publisher terms. A negative position quantifies compliance exposure in users, devices, or cores.

Indirect access licensing

Rule under which users or devices consume licenses by accessing software through an application, API, or automated process, even without installing the product locally. Common source of unbudgeted liability.

Core factor

Multiplier published by some software vendors that converts physical processor cores into licensable core counts, often varying by CPU generation. Used to calculate virtualized and host-based license requirements.

License true-up

Contractual reconciliation, usually annual, where the customer declares actual consumption and purchases additional entitlements to cover any shortfall. Missing the window can trigger penalties or audit.

Software bill of materials

Machine-readable inventory of components and licenses in a software product or container image. It supports open-source obligation tracking and rapid response when a vulnerable dependency is disclosed.

Mandatory tag enforcement

Cloud control that blocks resource creation when required tags such as owner, cost center, environment, and data classification are absent. Prevents untraceable spend and unowned assets.

Shadow IT detection

Comparing cloud provider billing accounts and API inventories against the approved CMDB to find subscriptions and services outside governance. Personal credit-card accounts are a frequent source.

Right-sizing signal

Evidence that a cloud resource is over-provisioned: sustained low CPU and memory utilization, unattached volumes, idle load balancers, or orphaned snapshots. Triggers a resize or decommission decision.

Cloud commitment coverage

Proportion of eligible on-demand spend covered by reserved instances or savings plans. Under-coverage wastes discount opportunity; over-coverage creates sunk cost in unused commitment.

Cryptographic erase

Sanitization method that destroys the encryption key protecting data on media, rendering the ciphertext unreadable. Accepted as purge-level sanitization when the key cannot be recovered or reissued.

Asset criticality tier

Classification assigned from business impact analysis that sets recovery time and recovery point objectives, redundancy requirements, and review frequency for an asset or service.

Residual risk

Exposure remaining after existing controls are applied, recorded with an owner and review date in the risk register. Acceptance of residual risk requires accountable management sign-off.

CapEx versus OpEx

Capital expenditure covers owned assets depreciated over useful life; operating expenditure covers subscriptions and cloud consumption charged in period. The classification changes budget timing and approval route.

Showback versus chargeback

Showback reports consumption costs to budget holders without moving money; chargeback debits cost centers for actual usage. Chargeback creates stronger accountability but requires accurate allocation data.

Cost optimization sequence

Order of action: eliminate unused assets and licenses, right-size remaining, consolidate contracts, then renegotiate pricing. Negotiating before elimination inflates the baseline and hides waste.

Inventory accuracy metric

Verified asset records divided by records sampled, reported with sample size and method. A percentage without stated sampling confidence cannot support audit or compliance conclusions.

Asset utilization rate

In-service assets divided by total owned assets. A low rate signals idle stock, over-purchasing, or failed retirement processing, and directly informs procurement and refresh planning.