1. Purpose

The purpose of this policy is to establish guidelines for the effective management, protection, and utilisation of information assets within AppCan Ltd. Proper asset management ensures the confidentiality, integrity, and availability of critical resources.

2. Scope

This policy applies to all employees, contractors, and third parties who interact with our information assets.

3. Definitions

• Information Assets: Any tangible or intangible resource used to create, process, store, or transmit information. Examples include hardware (servers, laptops, mobile devices), software, data, intellectual property, and network infrastructure.
• Asset Owner: The individual or department responsible for an asset’s management, maintenance, and security.
• Asset Custodian: The person responsible for day-to-day management, maintenance, and protection of a specific asset.

4. Responsibilities

4.1 Asset Owners

Asset owners are responsible for:

• Identifying and classifying assets based on their criticality and sensitivity.
• Ensuring proper access controls are in place.
• Regularly reviewing asset inventories and updating ownership details.
• Approving changes to asset configurations.
• Monitoring asset performance and compliance.

4.2 Asset Custodians

Asset custodians are responsible for:

• Safeguarding assets against unauthorized access, loss, or damage.
• Implementing security controls (physical and logical) to protect assets.
• Reporting any incidents or vulnerabilities related to assets.
• Maintaining accurate records of asset locations, configurations, and maintenance schedules.
• Coordinating with asset owners for disposal or decommissioning.

5. Asset Lifecycle

5.1 Acquisition

• Asset acquisition must follow established procurement processes.
• Asset owners must approve acquisitions based on business needs.
• Proper documentation (purchase orders, invoices) should be maintained.

5.2 Deployment

• Assets must be deployed securely, following configuration standards.
• Asset custodians ensure proper installation and setup.

5.3 Usage

• Users must adhere to acceptable use policies for assets.
• Regular monitoring ensures assets are used efficiently and effectively.

5.4 Maintenance

• Regular maintenance (patching, updates) is essential for asset health.
• Asset custodians schedule and perform maintenance tasks.

5.5 Disposal

• Assets must be disposed of securely (data wiping, physical destruction).
• Asset owners authorize disposal based on end-of-life or obsolescence.

6. Inventory Management

• Maintain an accurate inventory of all assets.
• Conduct periodic audits to verify asset existence and status.
• Retire or decommission assets promptly when no longer needed.

7. Security Controls

• Apply appropriate security controls to protect assets.
• Encrypt sensitive data on storage devices.
• Implement access controls based on the principle of least privilege.
• Regularly assess and address vulnerabilities.

8. Compliance

• Ensure asset management practices comply with legal, regulatory, and contractual requirements.
• Document and retain evidence of compliance.