IT Security Policy 119 - Electronic Information Resource Accounting

Status: Draft
Last Revision Date: 13 July 2022

Statement of Purpose

To safeguard Electronic Information Resources, Clackamas Community College requires an accurate inventory and accounting of all resources within its operational environment. Maintaining accurate inventories helps prevent unaccounted-for systems from becoming security vulnerabilities and aids in detecting unauthorized or rogue systems.

Policy Summary

Enterprise systems, along with confidential and private information, shall be backed up and recoverable in accordance with Clackamas Community College’s Business Continuity requirements. This policy is subject to and superseded by all applicable regulations and laws.

Policy

  1. Inventory Requirement: All physical Electronic Information Resources shall be documented in an inventory.

  2. Unique Identification: Each physical Electronic Information Resource shall be assigned a unique identifier.

  3. Ownership Labeling: All physical Electronic Information Resources shall be labeled or marked as the property of Clackamas Community College.

  4. Inventory Contents: The inventory shall include, at a minimum:

    • Unique Identifier

    • Manufacturer

    • Manufacturer’s Serial Number

    • Resource Type or Description

    • Location or Responsible Individual for Mobile Hardware

  5. Inventory Management Software Restriction: System and/or network management software (e.g., Active Directory Users and Computers, Cisco Prime, Google Workspace, WYSE Management Suite, etc.) shall not be considered a substitute for a dedicated inventory management system.

  6. Continuous Tracking: Physical Electronic Information Resources shall remain in the inventory until final disposition, including items in storage, surplus, or otherwise not in active use.

  7. Final Disposition Record: The final disposition of physical Electronic Information Systems shall be recorded, and these records maintained as required by policy and applicable regulations.

  8. Receiving and Inventorying: All incoming physical Electronic Information Resources shall be received by the ITS Department and documented in the inventory before being placed into service.

  9. Restricted Space Inventorying: All physical Electronic Information Resources installed in restricted spaces, as defined in Policy 113, shall be regularly inventoried to ensure compliance and security.

Exemptions

None.

Exceptions

Any exceptions to this policy must be pre-approved in writing by the Chief Information Officer (CIO).

Print Article