Key drivers for implementing Hardware Asset Management (HAM) and Software Asset Management (SAM) include:
- Security assurance – effective patch management depends on complete and accurate hardware and software inventories. Having a detailed list of hardware and software is crucial if you want to be sure that all software on all devices gets updated to the latest version and any security patches are applied.
- Asset valuation – determining the current value of assets for accounting purposes – such as for negotiating a price during mergers and acquisitions or for end-of-year valuation purposes.
- Software licence compliance – beginning the discussion on HAM and SAM in direct response to vendor accusations or investigation by the Federation Against Software Theft (FAST).
- Response to an audit – could be an internal or external audit, but generally where SAM and HAM identified deficiencies need corrective actions, or as a preventative response to known under-licensing risks.
- Budgeting and cost centre allocation – calculating the costs per business unit of IT services for cross-charging purposes.
HAM and SAM are crucial aspects in the implementation of security standards. Capturing information about corporate assets and maintaining inventory accuracy is essential, and achieved in several different ways, for example:
- Use of data from existing services such as Active Directory, anti-virus solutions, DHCP and other sources of data within the organisation
- Connecting remotely to individual assets to assess the current state of the asset and capture information about software installations
- Deploy background agents to gather continuous telemetry to update software and hardware inventory records
- Maintain the inventory manually
Agents may not exist for all asset types, and a combination of the above is likely to maintain data over time. These operational dependencies must be understood early, as they directly influence rollout timelines and ongoing SAM and HAM data accuracy. If an asset requires an agent, you will need an initial inventory as a starting point.
Information security, risk management, internal audit, and governance professional with over 25 years of post-graduate experience gained across a diverse range of private and public sector projects in banking, insurance, telecommunications, health services, charities and more, both in the UK and internationally – MORE