During an incident, a responder traces an attacker's foothold to a web server at 10.20.4.37. Nobody on the team recognizes it. It turns out to be a test box a developer built three years ago, still running a web framework that hasn't been patched since, and it never appeared in a vulnerability scan because the scanner's target list was built from the asset inventory.
That server is the reason asset management is a security topic and not just an accounting one. On the CompTIA Security+ SY0-801 exam it sits under objective 4.2, which expects you to explain why careful tracking of hardware, software and data, from the first purchase to final disposal, matters for security. This lesson walks through the life cycle stages of planning, procurement, assignment and monitoring, and shows how exam scenarios point to the stage that failed. Disposal and decommissioning get their own lesson next.
You can't protect, patch or monitor an asset you don't know you have
An asset is anything of value the organization has to protect: hardware such as laptops, servers, switches, phones and IoT sensors; software such as operating systems, applications, libraries and SaaS subscriptions; and data such as customer records, source code and financial files. Cloud resources count too. A virtual machine, a storage bucket or an API key is an asset even though nobody can put a sticker on it.
Almost every other security process starts from the inventory. Vulnerability scanners and patch tools only cover the systems they're pointed at. The SIEM only receives logs from systems that were configured to send them. Incident responders need to know who owns a host before they can isolate it, and risk assessments can't weigh the impact of losing a system nobody listed. An asset missing from the inventory is missing from all of these at once.
That is why frameworks put inventory first. The first two CIS Critical Security Controls are an inventory of enterprise assets and an inventory of software assets, and the NIST Cybersecurity Framework opens its Identify function with asset management.
The life cycle has five stages. Planning and scoping decide what you need and what the program covers. Acquisition and procurement buy it with security requirements attached. Assignment and accounting give it an owner and a record. Monitoring and tracking keep that record accurate while the asset is in use. Disposal and decommissioning retire it safely. A failure at any stage leaves a gap that later stages can't fully close.
Planning and scoping decide what you need and what you'll track
Planning starts before anything is bought. The organization works out what it actually needs, such as how many laptops for next year's hires or which application will replace an aging system, and what that purchase must satisfy to be secure and supportable for its whole life.
Security requirements belong in this stage, because they're cheap to state up front and expensive to retrofit. Typical examples:
- Hardware must have TPM 2.0, support full-disk encryption and Secure Boot, and run the company's endpoint agent.
- The vendor must publish security updates for at least five years and announce end-of-life dates in advance.
- Network gear must support centralized authentication and send logs to the SIEM.
- Software must support single sign-on and multifactor authentication.
Scoping decides what the asset program itself will cover. A small company might begin with endpoints and servers. A mature program also tracks network devices, mobile phones, IoT and OT equipment, cloud resources, SaaS subscriptions, software versions and the data stores that hold sensitive information. Anything left out of scope on purpose should be a documented decision, not an oversight, because an unscoped asset class will grow without anyone watching it.