The purpose of this policy is to define requirements for mapping and properly tracking assets owned, managed, and under the control of Hamurlabs through their lifecycle from initial acquisition to final disposal.
The acting information security officer and team will facilitate and maintain this policy and ensure all employees have reviewed and read the policy.
Hamurlabs will ensure the proper management of assets to maximize information security. The following procedures will be enforced as applicable to Hamurlabs assets to ensure proper maintenance, tracking, monitoring, and handling of assets:
An asset inventory process must be in place to support the technological management of critical business processes and to meet legal and regulatory requirements. The inventory process will also support the discovery, management, and replacement/disposal of all assets. It will further facilitate the identification and removal of any illegal or unauthorized software, asset, or processes found in the Hamurlabs environment. To accomplish these goals, all physical and virtual assets under Hamurlabs management or control will be listed in an inventory that will include:
Hamurlabs will assign an owner to each asset when the asset is created or transferred to Hamurlabs. The asset owner can be an individual or an entity with approved management responsibility to control the whole lifecycle of the asset; the asset owner will not necessarily have property rights to the asset.
The asset owner will be responsible for the proper management of the asset over the asset’s entire lifecycle, or until a new owner is assigned to the asset. The asset owner will:
Hamurlabs leverages a SaaS-based asset management system, Drata, to maintain inventory of all company-owned physical computing equipment, including but not limited to:
All company-owned devices are subject to a complete data wipe if deemed necessary, such as in the case of device infection or repurpose. This data wipe will be carried out by the IT manager.
Hamurlabs uses Drata’s automated system to query across our cloud-based infrastructure to obtain detailed records of all digital assets, including but not limited to:
The records are stored in a database system maintained by Hamurlabs. Records are tagged with owner/project and classification when applicable. All records are kept up to date through automation via Drata.
The information resource owner determines when an asset no longer is needed or is obsolete and can be retired. If the asset to be replaced/retired supports mandatory legal and regulatory requirements of critical business processes, the information resource owner must ensure that any replacement asset can support these processes before the current asset is retired.
Before retiring/replacing any asset that retains data, data retention requirements for all data stored or managed by that asset must be reviewed, and a plan for complying with all applicable data retention requirements must be developed and executed. This is particularly important for assets that manage data subject to legal/regulatory scrutiny. Any data subject to data retention requirements must be migrated to an appropriate destination and tested for appropriateness, completeness, accessibility, and retrievability from the destination before the original data is deleted from the original asset as part of the asset retirement process.
Capacity requirements of systems will be identified in line with the business criticality of a concerned system.
Providing sufficient capacity will be achieved by increasing capacity or by reducing demand. This includes:
For the proper management of removable media, the following steps will be taken, when applicable:
For the protection of media containing information during transport, the following steps will be taken, when applicable:
The steps for the secure disposal of media containing confidential information will be proportional to the sensitivity of that information. The following guidelines will be applied accordingly:
