IT Asset Management is a process in which all of a company’s IT resources are effectively identified, inventoried, managed, and optimized. This includes hardware such as computers, servers, and network devices as well as software licenses and digital content.

An example of IT Asset Management is when a company uses a central database or system (CMDB) to track all its IT assets (configuration items), including their configurations, maintenance plans, and license information.

Both worlds (IT and non-IT) of asset management benefit from each other. Through joint planning and effective management, organizations can reduce costs, increase efficiency and productivity, and ensure they have the resources they need to achieve their business goals.

The protection requirements analysis in the ISMS is an important part of IT Asset Management. It helps to prioritize IT assets and thus determine an appropriate level of security for IT resources. A top-down approach is recommended: starting with management processes, through core processes to supporting processes, primary assets are identified first and then the supporting secondary assets are determined. Further “down” in this asset structure, elements of the existing CMDB can then be integrated if required.

Assets are information values that represent a potential or actual value for an organization and are used in the context of business activities.

An asset is therefore any financially valuable component that can contribute to the provision of an IT product or IT service. A distinction is made between primary and secondary assets.

Primary assets comprise all values and processes that contain information and must therefore be protected. Primary assets can be established processes or know-how, but also physical objects such as documents, prototypes, or models. Purely digital assets are also possible (files, databases, etc.). The actual value lies in the primary asset.

Secondary assets, on the other hand, refer to systems (logical and physical), digital components, inventory items, or similar that are required for the processing, storage, or provision of primary assets. These can be servers, applications, or data centers, for example.

The protection requirements analysis is used to allocate protection requirements for each individual asset in a structured manner. Economic efficiency must always be taken into account, as too little protection entails risks, while overprotection causes unnecessary costs. Protection requirement analyses are carried out regularly, as the assessment criteria or the initial situation can change over time. For example, new compliance or legal requirements may apply, new processes may be introduced or new technologies may be used that have an impact on existing assets.

The aim of the protection requirement analysis in OMNITRACKER Asset Management is now to interrupt the strict inheritance of an overly expensive protection requirement by, for example, fulfilling requirements that selectively reduce the protection requirement: The role and authorization concept of an OMNITRACKER application can, for example, ensure "very high" confidentiality, as unauthorized access is prevented based on the logged-in role. A further inheritance of "Very high" confidentiality to other supporting assets below the OMNITRACKER application is therefore not necessary.