Asset Management Policy

Last updated: October 22, 2026

Every asset that stores or accesses company or customer data is inventoried, has an owner, and is securely disposed of at end of life.

Scope

Laptops, mobile devices used for work, GCP projects and resources, SaaS accounts, source code repositories and domains.

Policy

1. Inventory. The Security Officer keeps an inventory covering: hardware (laptops, with serial number, owner, encryption status), cloud (GCP projects per region, with owner and data classification), and SaaS tools (owner, data held, vendor review status).
2. Ownership. Each asset has a named owner responsible for its security and its classification under the Data Management Policy.
3. Cloud resources. GCP resources are created through infrastructure as code where practical and labeled with owner, environment and region. Untracked resources found in monitoring are tagged or removed.
4. Configuration baseline. Laptops follow the baseline in the Acceptable Use Policy, verified twice a year and when a laptop is issued. GCP projects follow the baseline in the Operations Security Policy.
5. Return. Departing personnel return all company devices on or before their last day; the return is recorded in the offboarding checklist.
6. Disposal. Devices are wiped using a secure erase or factory reset before reuse or disposal. Cloud resources are deleted per the retention rules in the Data Management Policy.
7. Review. The inventory is reconciled against the device checks, GCP and the identity provider at least once a year.