ITAM, IT asset management, is the register of every device and every paid seat an organisation holds, kept through each one's life from purchase to disposal. The standards describe it as a management system with policies and roles; in a company of five to two hundred people it is one person, one register and three habits. This page sets out what the ITAM register keeps, the two ways it is kept true, and the reports it exists to produce, for the IT manager or office manager who has just been handed the laptops. It does not describe an enterprise ITAM programme, which is a different scale of problem with a different buyer.
What the ITAM register keeps on every line
A device line carries the model, the serial number, the holder, the location, the cost, the purchase date, the warranty end date and the status. A seat line carries the product, the number of seats, the price per seat, the renewal date and the people counted against it. That is the whole data model for a small organisation, and NIST SP 800-53's CM-8 describes the same inventory at a level of detail proportionate to the organisation. A register with fewer fields than these cannot produce the reports below; one with many more fields is one nobody maintains.
The two ways the register is kept true
Recording every issue, return, transfer and disposal as it happens is the first way, and it depends on the person keeping the register being told. Discovery is the second way, and it does not: an agent report or a scan of the address ranges lists what is actually on the network, and the reconciliation against the register produces the unknown devices and the devices that should have answered and did not. The discovery coverage worksheet on this site works that reconciliation from a scan's figures; CISA's directive to federal agencies sets the cadence at every 7 days, which is a useful picture of what taking it seriously looks like.
The reports the register exists to produce
Who has what, by holder and by location. What is out of warranty, with its replacement value, which the IT asset inventory worksheet here computes from the counts and costs. What renews in the next quarter, by seat. What was disposed of this year and whether its storage was sanitised. And the fixed asset schedule for the devices above the capitalisation threshold, with their depreciation, which is the report the accountant asks for. A register that cannot produce these from its own rows is a list.
Running ITAM without an ITAM team
The enterprise version has a CMDB, a procurement integration, an ITAM manager and a licence compliance function. The small organisation version is the register above, kept by the person who hands out the laptops, reconciled against a discovery pass before each close, with the seat releases done as part of every leaver. NIST SP 1800-5 describes the enterprise build; the small organisation borrows its shape, an inventory, a discovery source and a record of changes, and skips the rest.
Questions people ask about itam asset management
What does ITAM stand for and what is it?
IT asset management: the register of every device and paid seat an organisation holds, kept through each one's life with a holder, a cost, a warranty date and a history.
Is ITAM asset management different from software asset management?
Software asset management is the seat half of ITAM. In a small organisation the two are one register with a device view and a seat view.
What is the minimum an ITAM register needs to record?
Serial number, holder, location, cost, purchase date, warranty end and status for devices; product, seat count, price, renewal date and the people counted for seats. The reports the register exists for need all of them.
Does ITAM include the fixed asset register?
The devices above the capitalisation threshold appear on both. The ITAM register keeps the operational fields; the fixed asset register keeps the cost, the life and the depreciation. One product can keep both from the same line, which is what Depreo does.
Sources
- NIST SP 800-53 Rev. 5, control CM-8, System Component Inventory
- CISA Binding Operational Directive 23-01: automated asset discovery every 7 days across the whole address space
- NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information: the configuration management family, including system component inventories