Asset Management
Explain the security implications of proper hardware, software, and data asset management
What you will learn
- Explain why inventory is the precondition for every other control.
- Name the asset lifecycle stages from acquisition to disposal.
- Distinguish data disposal methods and know when wiping is not enough.
- Understand why a certificate of destruction matters.
Everything so far assumes one thing: that you know what you own. Patching assumes a list of systems, monitoring assumes knowing what should be watched, risk assessment assumes knowing the assets. If the inventory is incomplete, every control after it is incomplete by the same amount — which is what makes shadow IT dangerous: not because it is malicious, but because it is unknown.
The asset lifecycle
Acquisition
Purchasing through an approved channel. Buying outside it creates an asset nobody knows about.
Assignment and ownership
Every asset has a named owner. An unowned asset is neither patched nor monitored.
Classification
It sets the protection level — a direct link to objective 3.3.
Monitoring and tracking
A living inventory, not a spreadsheet updated yearly. Automated discovery finds what people forgot to record.
Disposal
The most neglected stage, and the one that leaks the most data.
Data disposal
| Sanitization | Removing the data while keeping the media usable. Overwriting, or cryptographic erase. |
|---|---|
| Cryptographic erase | Destroying the encryption key instead of the data. Very fast, and it requires the disk to have been encrypted from the start. |
| Destruction | Physical destruction: shredding, crushing, incineration. For media that will not be reused and for highly sensitive data. |
| Certification | A signed certificate of destruction from whoever performed it. It is your evidence to an auditor that the data really was destroyed. |
| Data retention | The mandatory retention period. Deleting before it is a breach; keeping after it is risk with no benefit. |
Deleting is not destroying, and formatting is not wiping
Deleting a file removes its pointer and leaves the content on the disk; a quick format does the same. Recovery tools find both in minutes. If a question mentions sensitive data and a device leaving service, the answer is approved sanitisation or physical destruction — not deletion, not formatting.
Real-world example: servers sold on
A company replaced its servers and sold the old ones to a used-equipment dealer after the team formatted the disks. Months later customer files surfaced in a buyer's hands. Nobody's intent was at fault: a quick format does not erase content, no certificate of destruction was required, and the inventory did not know one of those servers still held a forgotten copy of an old database. Three missing links in one stage — all at the end of the lifecycle, not the beginning.
What matters on the exam
- Inventory is the precondition for every other control. If a question asks "where do we start" in a chaotic environment, the answer is knowing what we own.
- Cryptographic erase requires prior encryption. It is not an answer for a disk that was never encrypted.
- A certificate of destruction is evidence, not a procedure. The question may ask what proves compliance after disposal.
- Keeping data past its retention period is risk with no benefit. Data with no reason to remain is deleted.
Quick check
Answer in your head first, then reveal.
Why is inventory called the precondition for every other control?Reveal the answer
Because patching, monitoring and risk assessment all operate on a list. What is not on the list is not patched, not monitored and not assessed — which is exactly what makes it the easiest target.
A sensitive hard disk is leaving service and will not be reused. Which method?Reveal the answer
Physical destruction with a certificate. There is no need to keep the media usable, and destruction removes any possibility of recovery.
When is cryptographic erase an option, and when is it not?Reveal the answer
It is an option when the disk was fully encrypted from the outset, so destroying the key renders the data unreadable immediately. It is not an option for an unencrypted disk — there is no key to destroy.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.