IT Asset Management Norman Pugh-Newby Deloitte

1. IT Asset Management Norman Pugh-Newby Deloitte

2. IT Asset Management — Definition & Objectives • IT Asset Management (ITAM) • The integrated management of an organization’s IT asset inventory, policies, processes, tools, and resources in order to support life cycle management of Information Technology assets • Objectives: • Establish and maintain physical accountability of IT assets • Allocate assets as efficiently and productively as possible • Provideaccurate configuration statusof assets in accordance with defined standards • Maintainfull compliance with software licensing agreements • Establish a centralized and complete asset information repository to • support day-to-day IT operations and maintenance functions, plus IT asset life cycle management ITAM provides visibility of IT assets and how they relate to mission needs.

3. IT Assets – What are They? • IT Assets include all elements of hardware and software found in an enterprise environment • Consist of 6 asset categories with discrete asset contents: • Facilities Cable Plant • Facilities LHI • Network • Server • Storage • End User Devices

4. IT Asset Management - Conceptual Model • 2 core processes (Accountability Management and Asset Operational Management) • 4 interfacing processes (Financial Management, Procurement, Configuration Management and Assurance Management) • The interfacing processes collaborate with each of the core processes • Each of these core and interfacing processes are supported by a number of sub-processes described in the diagram above

5. Core Process: IT Accountability Management • Accountability Management • Discovery • Inventory Operations • Supply Discipline • Asset Database Audit

6. IT Asset Accountability Management • IT Asset accountability management is the process of establishing and maintaining accurate accountability records of the IT assets under your control • Managing IT asset costs requires tracking IT assets across the entire asset lifecycle until they are no longer of capital or regulatory value. • Effective asset accountability management requires the support of automated tools • 3 distinct types of automated tools are typically used to support an effective asset accountability program: • Auto-discovery • Repository • Usage

7. IT Asset Discovery Discovery is the process of identifying all the IT assets that are in the network • Assets are typically comprised of servers, network equipment, storage devices, computers, printers, monitors, external peripherals, cable, and leasehold improvements • The discovery of IT assets can be automated via the use of auto discovery tools which generally work in two distinct methods: • Agentless Tools: Agentless tools discover network devices automatically by scanning an Internet Protocol (IP) address range • Agent-based Tools: Agent-based tools require the installation of an agent on the networked device • One pitfall of auto discovery tools is that they are often encumbered by firewalls or governing security policies

8. Inventory Operations • Inventory is the periodic and systematic counting and verification of the total assets on hand. Some key business management benefits of the inventory function include: • Maximizing use of existing assets resulting in a lower overall inventory cost • Minimizing operating support costs • Maintaining compliancy with regulatory guidance • The inventory is housed in a repository tool which consolidates the physical IUID, serial number, model number, financial (e.g., purchase price, depreciation and book value) and contract (e.g., terms and conditions, warranties, service levels and entitlements) information associated with enterprise IT assets • Inventory repositories facilitate a full-service approach to IT asset life cycle planning, including implementation, management processes, retirement, and disposal • Discovery tools feed information into the repository tool • Repository tool typically integrated with Software Usage Tool (SUT) which maintains an inventory of software usage

9. Supply Discipline / Asset Database Audit Supply Discipline is a process by which IT asset managers hand receipt property down to the lowest level user to establish responsibility and then manually inventory the assets periodically to confirm and sustain accountability. Key roles and responsibilities should include the following: • Asset Managers • Asset Managers have responsibility for ensuring that all personal property is properly maintained, safeguarded, accounted for and accurately reported • Accountable Property Officers • Individuals who, based on their training, knowledge, and experience in property management, accountability and control procedures, are appointed by proper authority to establish and maintain an organization’s accountable property records, systems, and/or financial records • Property Custodians • Individuals who are appointed by the Accountable Property Officer who accepts custodial responsibility for property, typically by signing a hand receipt Asset Database Audit Process • On a regular basis, an audit of the assets in the repository tool data base should be conducted via reconciliation with the Accountable Property Officer records

10. Core Process: IT Operational Management IT Operational Management • IT Operations Management • Service Desk Management • Technical Management • Vendor Management

11. Asset Operational Management • The purpose of Asset Operations Management is to coordinate and carry out the day to day activities associated with IT Asset Management • High level activities include functional management of the following elements involved in making the system in its entirety work together: • People • Processes and procedures • Technology • Data elements

12. IT Operations Mgt. / Service Desk Management • IT Operations Management is responsible for the execution of operational processes that are necessary to manage the IT asset lifecycle. • The processes below are responsible for monitoring business requirements and coordinating the appropriate resources to meet organizational needs: • Software License Management • Change Management • Problem Management • Capacity Management • Availability Management • Service Desk management is the primary point of contact for users when there is a disruption in the operation of an IT asset • The Service Desk also serves as a point of coordination between different IT groups in an organization when the need arises

13. Technical Management / Vendor Management • Technical Management • Responsible for making sure IT assets ate placed into service with the most resilient and cost effective technology available • Diagnose and resolve complex technical issues beyond the capability of the service desk • Serve as guardian of technical knowledge for design, testing, operation and optimization of IT assets • Vendor Management • Responsible for making sure that appropriate access is available to contract support for all IT assets to include replacement equipment for assets reaching end of life • Responsible for ensuring that contractual performance requirements are met

14. Interfacing Process: IT Financial Management Financial Management • Expense Forecasting • Investment Decisions • Charge-back • Policy Compliance • Cost Allocation/Tracking • Depreciation • Business Case Analysis

15. Financial Management Financial Management • The process used to plan and manage cost allocations across departments for asset procurement, maintenance, and related services • It enables control and accountability for spending at the organizational and departmental levels, based on actual need • Aids in reducing waste and increasing efficiencies in spending and usage associated with assets and services Financial Management includes: • Expense Forecasting – labor and asset resources needed for baseline plan • Investment Decisions – based on framework of costs vs. benefits • Charge-back – charging IT costs back to the using departments • Policy Compliance – e.g., DoD FMR Vol 4, Ch 6, Accounting for PP&E • Cost Allocation/Tracking – Supports cost control and governance. • Depreciation – Allocates cost over useful life of assets • Business Case Analysis – Foundational analysis for justifying IT investment $$$

16. Interfacing Process: IT Procurement Management • Procurement Management • Contract Management • Strategic Sourcing • Software License Management • Requirements Determination • Acquisition Process • Ordering

17. Procurement Procurement • The procurement function involves the acquisition of network components and services with the following considerations to benefit the network operators and customers: • Best possible total cost of ownership • Right quantity and quality • Right time • Right place • Right source • The procurement process typically involves risk in either the cost or benefits and is a good business practice to make use of economic analysis methods such as cost-benefit-analysis or cost-utility analysis • An Information Services Procurement Libraryis a best practice library for the management of IT related acquisition processes which enables: • The customer and supplier organization to achieve the desired quality • Constructing the request for proposal • Constructing the contract and delivery plan • Monitoring the delivery phase

18. Ordering • Procurement personnel should select an ordering management capability that delivers requisition, quotation, vendor, purchase order, and contract information to allow them to proactively plan work and systems deployments • Streamline the ordering, payment, and invoicing process and utilize a common data model so that data can be shared among order and invoice tools and applications • Order and Invoice tools should also provide a process for working and updating Order Modifications • Asset managers should understand this process and be able to use the system to validate that the right number of type of components were ordered

19. Requirements Determination • Requirements determination is the process of determining the business justification, requirements, specifications and approvals needed to proceed with the procurement process • Requirements determination involves processes such as organizing project teams, using cost-benefit analysis or other analytic techniques to justify alternatives, assessing relative risk and benefits defining specifications, and obtaining necessary approvals to proceed with the procurement process • Key requirements planning issues that need to be addressed include: • How should project teams be configured for different types of acquisitions (appropriate internal and external resources, project leader, etc.)? • What are the important costs versus budget considerations? • What will be your process for separating requirements from wants? • How will you capture performance specifications and other outputs for use in later phases such as quality management?

20. Acquisition Process • The acquisition process involves evaluating and selecting appropriate suppliers and completing procurement arrangements for the required products and services • The acquisition process includes identifying sourcing alternatives, generating communications (such as RFPs and RFQs) to suppliers, evaluating supplier proposals, and negotiating contracts with suppliers • Key considerations for the acquisition process include: • Which acquisition processes can be automated or minimized? • Which tools can you use to automate and optimize the procurement process (e.g., Electronic Data Interchange (EDI), Autofax)? • What are the appropriate roles of users, legal, purchasing and information security in the procurement process? • Should any or all of the procurement process be outsourced?

21. Contract Management • Contract management can be summarized as the process of systematically and efficiently managing contract creation, execution, and analysis for the purpose of maximizing financial and operational performance and minimizing risk • Contract management should ensure that products and services covered under the contract are provided in the required quality and quality, and within the prescribed timeframes • Understanding, predicting and being able to effectively mitigate risk are critical to effective contract management • Help yourself to mitigate risk by creating a historical database with details of critical issues associated with previous contracts such as: • Real costs and duration versus budget and planning schedule • Problems/solutions to include contract decision point challenges • Effectiveness of suppliers and delivery plans • Quality of supplies and services

22. Strategic Sourcing • Strategic sourcing is an objective-driven procurement process that can systematically improve and evaluate purchasing activities • A strategic sourcing methodology contributes to optimization of the procurement process by taking the following steps: • Analyzing current spends (what is procured and where) • Identifying internal requirements (quality requirements, product specifications, service expectations) • Analyzing the market (market conditions, supply base, emerging products) • Develop/Implement strategy (best suppliers given supply/demand/risk factors, managed negotiations, contract award, track performance metrics)

23. Software License Management • The effective procurement and management of software licenses is an important special area of procurement management • Software license management requires an understanding of where licenses are consumed, identifying potential savings, and aggregating costs • An important goal of Software License Management is to eliminate software overbuying and illegal use • Failure to harvest licenses for reuse or to ensure license compliancy leads to software overbuy and/or illegal deployment • Reports available in the IT Asset Management repository tool should include software compliance

24. Interfacing Process: IT Configuration Management Configuration Management • Software Deployment • Monitoring • Install/Move/Add/Change • CMDB Maintenance • Support Operations

25. Configuration Management Database (CMDB) Software Deployment Management Monitoring Install/Move/Add/Change (IMAC) • Center piece of effective configuration management. • Provides centralized asset and configuration information to support the configuration management process • Involves transmitting the right software applications, updates and patches to the right devises • Application dependencies should be tracked and managed in a CMDB to determine the risk of any software change being proposed • As IT assets become incorporated into an IT infrastructure, IT operations systems continually monitor the health of these systems, support problem root cause identification, initiate service and support activities as needed, and validate their effective implementation • Monitoring continues over assets’ lifecycle • IT assets are sometimes moved, upgraded, changed, and even repurposed over their lifecycle • These changes have a configuration impact and a cost impact • Accurate and up-to-date information in the CMDC facilitates financial optimization of IMAC activities Configuration Management • Centralized configuration management provides IT system managers with control over the operating system and application settings of each end-point system and is a key element of network security and compliance • Key sub-processes include:

26. Interfacing Process: IT Assurance Management Assurance Management • Security Management • Information Assurance • Compliance

27. Security Management Information Assurance Compliance • Ensure any and all security risks that have been identified are managed effectively, to include resistance and recovery from hacker attacks • Ensure any and all enterprise information resources are used appropriately. • Prove strategic direction for all security related activities. • Various organizations have their own Information Assurance Certification & Accreditation processes • Ensure the IT systems meets security requirements necessary to connect to the organizations network • “Authority to Operate” provided by an “Operational Designated Approval Authority” (ODAA) • ITAM systems are required to be compliant with a variety of derectives, regulations and orders. Examples of these include: • Federal Information Processions Standards (FIPS) • National Institiute of Standards & Technology (NIST) • Defense Information Systems Agency (DISA) IT Assurance Management • The purpose of all assurance functions and activities is to instill confidence in the infrastructure that it is securely employed for all computerized transactions and exchanges of data • Each function within assurance seeks to accomplish this by putting in place a series of checks, audits, process, and procedures in order to safeguard the confidentiality, integrity, and availability of information

28. IT Asset Management - Review • 2 core processes (Accountability Management and Asset Operational Management) • 4 interfacing processes (Financial Management, Procurement, Configuration Management and Assurance Management) • The interfacing processes collaborate with each of the core processes • Each of these core and interfacing processes are supported by a number of sub-processes described in the diagram above

29. How Effective is Your ITAM Program? • ITAM effectiveness normally correlated to ITAM maturity • ITAM maturity measured using Gartner ITAM Maturity Model • Maturity model defines five levels of ITAM maturity • Basic • Reactive • Proactive • Service • Value Creation • Gartner facilitate an understanding of each level by defining the characteristics of each level with regard to people, processes, and technology. • Reaching the Value Creation maturity level requires an iterative approach of continuous improvement over the course of many years • The proper planning and considerations need to be in place to leverage the requisite ITAL tools and strategies

30. How Effective is Your ITAM Program?

31. Questions? Please Contact: Norman Pugh-Newby, CPPA, PMP Manager Deloitte(M) 571-212-5084 npughnewby@deloitte.com