Security Operations · Topic 6 of 14
Asset Management Life Cycle
Security+ asset management life cycle: planning, procurement, assignment, tracking and safe disposal using sanitization, degaussing and destruction.
- 5 min
- The life cycle is planning and scoping, acquisition, assignment and accounting, monitoring and tracking, and disposal.
- Security requirements belong in planning and in the purchase, not only after deployment.
- Every asset needs an owner and a classification.
What it is
Asset management means knowing what hardware, software and data the organization owns, who is responsible for it and what happens to it from the day it is planned to the day it is retired.
You cannot protect what you do not know about. An accurate inventory is the base for patching, monitoring, vulnerability scanning and incident response.
How it works
The asset management life cycle
| Stage | Security aim |
|---|---|
| Planning and scoping | Define what is needed, what data it will hold and what security requirements apply |
| Acquisition and procurement process | Buy from trusted sources and write security requirements into the purchase |
| Assignment and accounting | Record an owner, a location and a classification for each asset |
| Monitoring and asset tracking | Keep the inventory current and detect unknown or missing assets |
| Disposal and decommissioning | Remove the asset safely and protect the data on it |
Ownership matters because someone must be accountable for patching and for the data. Classification tells how strictly to protect the asset.
Planning and scoping
Security starts before anything is bought. Planning sets the scope: which business need the asset meets, which data it will store or process, and which rules apply, such as encryption or support life. Choosing a product that will soon reach end of support creates a problem before the asset arrives.
Acquisition and procurement
The procurement process should use approved suppliers and include security requirements in contracts. Check that devices arrive sealed and unaltered, and that software comes from the official source. Record each new asset at once, so that it is never unmanaged.
Assignment and accounting
Assignment links each asset to a person or team. Accounting keeps the record of what exists, where it is and who holds it. When staff join, move or leave, their assigned assets are issued, transferred or returned.
Monitoring and asset tracking
Tracking keeps the record true over time. Methods include management agents on devices, network discovery scans, and tags or barcodes on physical items. Software tracking covers licenses and versions, so that unsupported or unapproved software is found.
Enumeration is the active discovery of assets, for example scanning a network to find devices. It helps to find shadow IT, which is technology used without approval, and forgotten systems that nobody patches.
Data assets
Data assets need an owner, a classification and a retention period. Retention rules state how long data must be kept and when it must be deleted. Keeping data longer than needed raises risk and cost.
Disposal and decommissioning
When an asset leaves service, the data on it must not be recoverable by the next holder.
| Method | Description |
|---|---|
| Sanitization | Removing data so that it cannot be recovered, while the device may be reused |
| Overwriting | Writing patterns over the data |
| Cryptographic erase | Destroying the encryption key so the data cannot be read |
| Degaussing | Using a strong magnetic field to erase magnetic media |
| Destruction | Physically damaging the media, such as shredding, pulverizing or incinerating |
| Certification | A record, such as a certificate of destruction, that proves the step was done |
Media sanitization guidance is published by the National Institute of Standards and Technology (NIST) in Special Publication 800-88. Choose the method based on the data's sensitivity and whether the media will be reused.
Decommissioning also removes the asset from monitoring, access lists, firewall rules and directory accounts. Cloud storage and virtual machines need the same care, such as deleting volumes and keys.
How the exam asks about this
- "A solid state drive with sensitive data is being retired and reused." -> Cryptographic erase or a sanitization method suited to flash, not degaussing.
- "A network scan finds servers that are not in the inventory." -> Asset tracking and enumeration revealing shadow IT.
- "Proof is needed that old drives were destroyed by a vendor." -> A certificate of destruction.
What to remember for the exam
- The life cycle is planning and scoping, acquisition, assignment and accounting, monitoring and tracking, and disposal.
- Security requirements belong in planning and in the purchase, not only after deployment.
- Every asset needs an owner and a classification.
- Enumeration is active discovery, which helps find unknown assets.
- Sanitization removes data from media. Destruction damages the media physically.
- Cryptographic erase deletes the key to make encrypted data unreadable.
- Degaussing works on magnetic media, not on solid state drives.
- A certificate of destruction provides evidence that disposal happened.
For a solid state drive that holds sensitive data, favor cryptographic erase or physical destruction. Degaussing does not work on it.
Common mistakes
Deleting files and calling it sanitization. A normal delete leaves recoverable data.
Degaussing flash storage. Magnetic erasure does not work on solid state media.
Ignoring software and data in the inventory. Assets include licenses, applications and data, not only hardware.
Forgetting to update monitoring after disposal. A removed system should leave inventory, access lists and monitoring.
Starting security at deployment. Products chosen without security requirements may be unsupported or unfit from day one.
Resold or donated equipment must be sanitized first. Skipping this step has caused many public data leaks.
Check yourself
Which life cycle stage records an owner and classification for each asset?
Assignment and accounting.
Why is degaussing unsuitable for a solid state drive?
Degaussing works on magnetic media, and flash storage does not store data magnetically.
What does a certificate of destruction provide?
Evidence that media was destroyed or sanitized as required.
Topic 6 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.