# Asset Management Policy

Last updated: October 22, 2026

Every asset that stores or accesses company or customer data is inventoried, has an owner, and is securely disposed of at end of life.

## Scope

Laptops, mobile devices used for work, GCP projects and resources, SaaS accounts, source code repositories and domains.

## Policy

1. **Inventory.** The Security Officer keeps an inventory covering: hardware (laptops, with serial number, owner, encryption status), cloud (GCP projects per region, with owner and data classification), and SaaS tools (owner, data held, vendor review status).
2. **Ownership.** Each asset has a named owner responsible for its security and its classification under the Data Management Policy.
3. **Cloud resources.** GCP resources are created through infrastructure as code where practical and labeled with owner, environment and region. Untracked resources found in monitoring are tagged or removed.
4. **Configuration baseline.** Laptops follow the baseline in the Acceptable Use Policy, verified twice a year and when a laptop is issued. GCP projects follow the baseline in the Operations Security Policy.
5. **Return.** Departing personnel return all company devices on or before their last day; the return is recorded in the offboarding checklist.
6. **Disposal.** Devices are wiped using a secure erase or factory reset before reuse or disposal. Cloud resources are deleted per the retention rules in the Data Management Policy.
7. **Review.** The inventory is reconciled against the device checks, GCP and the identity provider at least once a year.