An asset is anything an organisation relies on to deliver its work and meet its goals. In IT and cyber risk this covers information assets such as customer records and source code, technology assets such as laptops, servers, phones, virtual machines and cloud buckets, and service assets such as SaaS subscriptions, licences and domain names. People, sites and critical suppliers can also be treated as assets when planning for risk and continuity. Good asset management means keeping an inventory or Configuration Management Database (CMDB) that records what each asset is, a unique identifier such as a serial number or account ID, where it lives, who owns it, how important it is, and how it is configured. Useful fields include data classification, business criticality, dependencies on other assets, support contracts, and recovery needs such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO). Clear ownership and lifecycle tracking from purchase to secure disposal help with patching, change control, licence and cost management, incident response and impact analysis. Accurate records also reduce blind spots from shadow IT and make audits and compliance simpler.
