it_asset_management v1.0.0

name: it_asset_management description: "Track IT assets through their whole life: build a register you can trust from procurement and assignment records, reconcile software licence counts against actual installs into an effective licence position, time refreshes from warranty, support, and repair cost instead of age alone, dispose securely with NIST SP 800-88 Rev. 2 sanitization evidence, and run the audit that finds ghost assets still on the network and unknown assets that were never registered. Ships an asset register template, a licence reconciliation worksheet, a reconciler script, and a worked refresh and disposal cycle. Use when asked to set up or clean up IT asset management, run a hardware or software audit, reconcile licences before a renewal or vendor audit, plan a refresh, or retire equipment."

IT Asset Management

Purpose

Keep one register that matches reality, from purchase to disposal. The register answers four questions at any date: what do we own, where is it and who has it, what software are we entitled to run versus what is actually installed, and what is due to be refreshed, returned, or destroyed next.

Scope boundary: financial depreciation schedules belong to the depreciation skill. SaaS subscription cost audits belong to the SaaS subscription audit skill. This skill covers the operational asset record, licence compliance counting, and the physical lifecycle.

Workflow

1. Build the register first, before buying tooling. Copy assets/asset-register.csv and keep one row per asset for its whole life. Required fields are asset tag, serial, hostname, type, make and model, owner, department, location, status, purchase date, warranty end, approved flag, and last seen date. Those fields follow CIS Controls v8 Safeguard 1.1, which asks for network and hardware addresses where they apply, machine name, owner, department, and whether the asset is approved to connect, with a review at least twice a year. Never delete a row. Close retired rows with disposal evidence so cost, custody, and loss questions stay answerable years later.
2. Record every lifecycle move as a status change with a date and a name. Use a small fixed status set: in stock, assigned, in repair, loaned, retired, disposed, lost. Procurement creates the row at receipt, before deployment, with purchase order, cost, and warranty end on the record, not only in a vendor portal. Assignment, reassignment, and return each update owner, location, and last seen. Offboarding and leaver processes trigger a return task for every assigned row that person holds.
3. Feed the register with discovery, and treat discovery as evidence, not truth. Run active discovery and collect DHCP or IP address management logs and endpoint agent reports into a discovery file with serial or hostname, IP, MAC, and last seen. Discovery tells you what is on the network now. It does not tell you what you own: a powered off laptop in a drawer and a remote laptop offline for weeks are still assets.
4. Reconcile licences into an effective licence position. Copy assets/licence-reconciliation.csv. For each product, by version and edition, record the licence metric, entitlements with evidence (agreement, purchase record, subscription count), and deployments counted under that product's own metric after use rights are applied. Compute variance as entitled minus deployed. Label each row surplus, compliant, or shortfall, with quantity, unit cost, counting rule, and evidence, so another person can reproduce the count. See references/licence-reconciliation.md for metric traps: per user versus per device, core and virtualization counting, downgrade and failover rights, and non production carve outs.
5. Plan refresh from triggers, not age alone. Flag an asset for the refresh queue when any trigger fires: warranty ends within 90 days or has ended while the asset is still active, the operating system or vendor support has ended or ends before the next cycle, repair cost in the last 12 months approaches replacement value, or the asset hits the age policy your organization set for its type and role. Starting defaults people commonly use are 36 to 48 months for laptops in heavy or travelling roles, 48 months for standard laptops, and longer for desktops, servers, and network kit, but set them in your own policy and record the policy on the report. Link the old and new asset rows when a replacement ships.
6. Retire and dispose with sanitization evidence. Before an asset leaves control, decide reuse inside the organization, return to a lessor, resale or donation, or destruction. Sanitize storage following NIST SP 800-88 Rev. 2: Clear, Purge, or Destroy, preferring Purge over Clear when the media supports it. Record a certificate per device with manufacturer, model, serial, property number, media type, source, method, technique, tool and version, verification method, and the verifier's name, title, date, location, and signature. Detail and media specific cautions are in references/disposal-and-sanitization.md.
7. Run the ghost and unknown audit on a fixed cadence. Run python3 scripts/reconcile.py --register <register.csv> --discovery <discovery.csv> --licences <licences.csv> --as-of YYYY-MM-DD. Work the output in this order: unknown assets found by discovery but not in the register, shortfall licence rows, ghost assets, then the refresh queue. Ghost means active in the register but not seen by discovery and not accounted for by a person, a location, or a repair record. Unknown means on the network but never registered. Follow references/audit-playbook.md for disposition of each class: register and approve, quarantine or remove, recover, correct the record, or retire with evidence.
8. Report with counts that tie back to files. Every report states the as of date, the register row count, the discovery count, how many rows matched, and the counts and value of each finding class. A finding without an owner and a due date is a note, not a finding. Keep the register, discovery snapshot, reconciliation worksheet, and report together so the next audit can rerun the same comparison.

Output Contract

• An asset register CSV using the columns in assets/asset-register.csv, one row per asset, retired rows closed with disposal method, date, and certificate reference instead of being deleted.
• A licence reconciliation worksheet CSV using the columns in assets/licence-reconciliation.csv, one row per product and edition, with entitled, deployed, variance, position, unit cost, exposure or surplus value, counting rule, and evidence.
• A reconciliation report from scripts/reconcile.py listing unknown assets, ghost assets, licence shortfalls and surpluses, and the refresh queue, each with asset tag or product, owner where known, and the evidence used.
• A refresh plan grouped by quarter, built from warranty, support, repair, and age policy triggers, with old and new asset tags linked for completed replacements.
• For every disposed storage device, a sanitization certificate record with the NIST SP 800-88 Rev. 2 fields listed in step 6, filed against the asset row.
• An audit close out note: what was corrected in the register, what was recovered or removed, what was bought or retired to fix a shortfall, and what remains open with an owner and a date.

Operating Rules

1. One register, one row per asset, for life. Duplicate rows and deleted retired rows are how ghost assets are created. Merge duplicates by serial, keep the surviving tag, and note the merged tag in the record.
2. No entitlement without evidence. If a licence count cannot be tied to an agreement, purchase record, or subscription export, it goes in as an unknown, not as a number. Auditors do not accept counts they cannot verify, and neither should you.
3. Count deployments under the product's own metric. Raw install counts mislead for per user, per core, concurrent, and subscription products. Write the counting rule on the row before you trust the variance.
4. Prefer Purge over Clear when the media supports it, per NIST SP 800-88 Rev. 2. Standard overwrite alone does not reliably reach all data on flash storage because of wear levelling and over provisioning, so use the device sanitize command or cryptographic erase for solid state media, or destroy it. Deleting files or reformatting is not sanitization.
5. Address unauthorized assets on a weekly rhythm. CIS Safeguard 1.2 expects a process that removes, denies remote connection to, or quarantines unauthorized assets weekly. An unknown asset that sits in a report for a month is a policy failure, not a backlog item.
6. Refresh is a trigger decision, not a birthday decision. Age policy starts the conversation. Warranty, support status, failure and repair history, and whether discovery still sees the asset decide it. Do not fund replacements for assets discovery and the owner cannot account for: find them first.
7. Separate the counter from the buyer. The person who builds the effective licence position should not be the only person who approves the purchase that fixes a shortfall. A second check on counting rules catches the expensive errors.
8. Test the tooling on the worked example before trusting it on a real estate. Verified in this skill: scripts/reconcile.py on the assets in assets/ reports exactly 1 unknown asset, 1 ghost asset, 1 licence shortfall, and a refresh queue containing the warranty and age triggered rows described in assets/worked-refresh-disposal.md. If your run does not match that on the sample files, fix the inputs or the script before running it live.