Operations and Business Resilience · Topic 1 of 8
IT Components and Asset Management
Hardware, software, network and cloud components for IS auditors, the IT asset inventory, CMDB, ownership, software licenses and secure disposal.
- 3 min
- An accurate inventory underpins patching, licensing and recovery.
- A CMDB records configuration items and their relationships.
- Every asset has an owner and a classification.
What it is
IT components are the building blocks the business runs on: hardware, operating systems, networks, middleware, databases, applications and cloud services. IT asset management keeps an accurate record of those assets, who owns them and where they are in their life cycle, so they can be protected, supported, licensed and retired properly.
How it works
Components the auditor should understand
| Component | Audit interest |
|---|---|
| Servers and end-user devices | Configuration, patching, physical security |
| Operating systems | Privileged accounts, security settings, supported versions |
| Networks | Segmentation, firewalls, remote access |
| Middleware | Message queues and integration platforms that move data between systems |
| Databases | Access to data, integrity controls, administrator activity |
| Applications | Application controls, user access |
| Cloud services (IaaS, PaaS, SaaS) | Shared responsibility, contracts, configuration |
| Virtualization and containers | Hypervisor security, image control |
Software and hardware that have reached end of life or end of support no longer receive security fixes and are a recurring audit finding. They should be replaced, or isolated with extra controls and a formal risk acceptance until replaced.
The asset inventory
An accurate inventory is the foundation of most IT controls: you cannot patch, protect, license or recover what you do not know you have. Each record typically holds the asset, its owner, location, configuration, criticality and life cycle status. A configuration management database (CMDB) extends this with relationships between assets, for example which servers support which business service.
Keeping the inventory accurate
- Automated discovery tools find devices and software on the network.
- Discovery results are reconciled with the inventory and with purchase records.
- Unknown devices are investigated; they may be shadow IT or unauthorized equipment.
- Changes go through change management so the CMDB stays current.
Ownership and classification
Every asset has a named owner responsible for its protection. Assets are classified by the sensitivity of the data they hold and the criticality of the services they support; the classification drives backup, access and recovery requirements.
Software asset management
Software license compliance needs an inventory of installed software matched to purchased licenses. Unlicensed software brings legal and financial risk; unused licenses waste money.
Disposal
Retired assets must be sanitized before reuse, sale or disposal, with a method suited to the media (overwriting, cryptographic erasure, degaussing or physical destruction), and records such as certificates of destruction matched to asset tags.
When a question asks which control should come first for a security or patching program, an accurate asset inventory is often the answer.
How the exam asks about this
- "Discovery finds 40 devices not in the inventory." Investigate and reconcile; the inventory process is weak.
- "Which evidence BEST shows disks were destroyed?" Destruction certificates matched to asset tags.
- "An unsupported operating system runs a key application." Plan replacement; until then isolate it and document risk acceptance.
What to remember for the exam
- An accurate inventory underpins patching, licensing and recovery.
- A CMDB records configuration items and their relationships.
- Every asset has an owner and a classification.
- End-of-support systems need replacement or compensating controls.
- Sanitize media before disposal and keep evidence.
Relying only on purchase records for the inventory misses assets bought outside IT, such as cloud subscriptions on a credit card.
Common mistakes
Treating the inventory as a one-time project. It must be reconciled continuously.
Ignoring cloud and virtual assets. They are assets too.
Disposing of devices without sanitization records.
Check yourself
What does a CMDB add to a simple asset list?
Configuration details and the relationships between assets and the services they support.
Why is an accurate inventory essential for patch management?
Systems that are not known cannot be patched or monitored.
What evidence best supports secure disposal of drives?
Sanitization or destruction certificates matched to asset tags.
Topic 1 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.