The value of IT asset management lies in knowing what the organization owns, who uses it, what rights apply, and when to stop paying for or remove an asset. When contracts, deployment information, and personnel changes are kept separately, even a large inventory may not support sound decisions.
Who it applies to and when to start
Consider ISO/IEC 19770-1 when hardware and software portfolios grow, cloud services are purchased across teams, subscriptions continue after staff changes, or license and cost reviews become difficult. The organization need not be large, but procurement, IT, and user departments need a way to work together.
Common business challenges
An inventory tool identifies software but not the applicable license terms; purchasing records the number of seats while deployment and use data sit elsewhere; a departing employee returns a device but the subscription renews; or equipment retirement and data erasure are never jointly confirmed.
Approach and applicable requirements
The ISO catalogue lists ISO/IEC 19770-1:2017 and Amendment 1:2024 as requirements for an IT asset management system. It applies to different types of IT assets and organization sizes. It is not an accounting rule or a specification for a particular inventory tool, and it does not establish conformity with ISO 55001.
Possible work topics include asset classification and ownership; inventories and contract data; acquisition and deployment; changes in use; transfer and retirement; and reconciliation of license entitlements with actual use. Keep asset records, usage rights, and information security responsibilities distinct; a list of hardware serial numbers alone is not complete management.
Support and work stages
Confirm the assets and management purpose
Select the hardware, software, or subscription scope. Define the cost, licensing, or operational issue to address, then set the data fields and responsibility list.
Compare inventories, contracts, and use
Identify the identifiers and discrepancies used across systems. Record what can be reconciled and where evidence is missing, producing an asset-data gap list.
Walk through one lifecycle
Trace a request through purchase and deployment to transfer or retirement. Check who confirms rights, users, and continuing costs, and test exception handling and handoffs.
Establish ongoing reconciliation
Set inventory and discrepancy reviews according to the rate of change. Track duplicate subscriptions, unlocated assets, and outdated information. Outputs may include process recommendations, reconciliation records, and management indicators.
Information to prepare
Prepare hardware and software inventories, cloud usage information, purchasing and license agreements, deployment and change records, fees and renewal details, and exit, retirement, and exception processes. Preserve original contract wording where terms are unclear and have it reviewed by the appropriate person.
Assessing schedule and fees
Asset types, number of data sources, contract complexity, and historical discrepancies affect the schedule. Tool procurement, integration development, legal interpretation of contracts, or supplier license disputes require separate confirmation; management planning does not automatically include them.
Frequently asked questions
Is an existing asset inventory enough?
Records also need to connect assets to ownership, rights, use, and changes, with a process for updates and discrepancies.
Must we buy new software?
First clarify data and process needs. Replacement may not be necessary if existing tools can support them.
Should cloud subscriptions be included?
Relevant assets and usage rights can be included within the management boundary. Pay particular attention to renewals, accounts, and actual use.
Does a difference between asset and license counts prove a breach?
First clarify the measurement method, contract terms, and actual deployment. A numerical difference alone is not a legal conclusion.
Can this system replace information security management?
The systems can share asset data, but information-security risks and controls have their own requirements.
Does certification to this standard mean certification to ISO 55001?
No such conclusion follows automatically. Assess the scope and requirements of each standard separately.
Related services and enquiries
For service operations, see ISO/IEC 20000-1; for information risk, see ISO/IEC 27001. When you discuss asset management with Captain International, you can start by describing the three data sets that are hardest to reconcile.