1. Realising the Value in Information Technology
Ken Doughty CISA CBCP
Senior Manager, Risk Management
ING Australia

2. Presentation Outline Introduction IT Asset Management and ITIL
Organizational IT Asset Management Framework
IT Asset Maturity Model
The Asset Management Lifecycle
Conclusion

3. Introduction
Organisations have failed to realised the value in their investment in IT and manage the operational risks associated with their IT assets.
IT Asset Management (ITAM) is all about being able to cohesively merge the physical, financial and contractual attributes of software and hardware to enable the delivery of cost-efficient, timely business solutions and minimize the operational risks to the organization.
It has a logical connection to Configuration Management

4. Don’t just take our word for it
“Tangible cost savings from IT asset management
will result from better management decisions that bring value to
the business.”
Jack Heine, Gartner Research Note, December 2004
“Internal IT groups are being forced by their businesses to compete for preferred provider status with external suppliers.”
META - IT Product Models: Services, Catalogs, Chargeback Operations Strategies / Service Management Strategies
“It is not uncommon for IT Groups to over-purchase desktop software by as much as 40%. Typical organisations over-purchase by 10 – 15%.”
META Trend: META Delta, 2/18/2003, William Snyder
“An accurate inventory of installed hardware and software forms the foundation of a solid IT asset management program. This baseline identifies which assets need to be redeployed, reused or retired.”
P. Adams, GartnerResearch Note, 30 November 2004

5. 1. IT Asset Management and ITIL®
The ITIL framework provides two service models:
Service Support
Service Delivery
IT Asset Management within the ITIL context is addressed within Configuration Management, but not very well.
Configuration Management largely ignores Asset Management and concentrates on Services and the relationships between IT assets (CI’s).

6. Configuration Management Activities
Control
Plan and
Define
Define purpose, scope, objectives, policies and procedures, and the organisational and technical context
Status
Accounting
Ensure that only authorised and identifiable CI’s are accepted and recorded
Identification
Selecting the configuration structures for all the CI’s, including their ‘owner’, their interrelationships and configuration documentation
Reporting of all current and historical data concerned with each CI throughout its life cycle.
Reviews and audits that verify the physical existence of CI’s and check that they are correctly recorded
Verify and
Audit

7. How do we use Configuration Management
Incident Management
- Up-to-date information on the IT Asset affected
- assists in identifying potential (risks) upstream and downstream
Problem Management
- Root Cause Analysis
Change Management
- What is the Impact
- Who needs to approve
Capacity Management
What relies on What to provide a Service
Service Level Management
Identifying the Service Level Agreements linked to the IT asset and determining the impact services provided by that IT asset.

8. 2. Organizational IT Asset Management Framework
ITAM Policy
Acquisition of the asset
Who can do what
Allowable hardware and software
How information is recorded
Rental and leases
Reuse of assets
Change Management
Unique identification
Deployment
Tracking
Managing
Disposal

9. ITAM Standards IT asset classification system
Standards for each IT asset classification
To minimise the risks to:
Achieve the organizations strategic objectives
Leverage off the investment in information technology
Optimize the availability and performance of IT assets
Secure the IT assets from unauthorized access
Want to expand the value
Look beyond the traditional IT Asset to Information Assets
Start building your Risk Management practice around of this

10. 3. IT Asset Maturity Model
Where is your organisation?
Centre of Excellence
Understanding where your organization is currently positioned in the maturity model, will enable the organisation to map out its path to higher levels of maturity and identify areas to invest in people, process and technology
Proactive
Active
Reactive
Chaos

11. Process Maturity: Chaos
Characteristics
No knowledge of what assets are owned or where they are located
Lack adequate tools to track and manage assets
No centralized purchasing
Contracts in filing cabinets
No repeatable processes or knowledge transfer/storage
Nobody responsible for Asset Management
Chaos

12. Process Maturity: Reactive
Characteristics
Focus on counting assets and doing yearly physical inventories
Spreadsheet to track assets
Discovery tool(s) to Complement
Basic reports with little detail
Responsibility for IT Asset Management is technical
Reactive
Chaos

13. Process Maturity: Active
Characteristics
Managing assets through lifecycle with defined processes which are reviewed and re-engineered when necessary
Inventory linked with contractual and financial to create a centralized view
Asset repository and auto-discovery tools integrated with the IT service desk
The ITAM implementation team is lead by a director-level position
Active
Reactive
Chaos

14. Process Maturity: Proactive
Characteristics
PCs, servers, networking equipment and telecom in a common repository
Service levels are created to meet broader business goals
Metrics are in place and reports are run frequently
Requisition, procurement and ERP are integrated
IT Asset Management is a defined discipline
Proactive
Active
Reactive
Chaos

15. Process Maturity: Center of Excellence
Characteristics
Audit efficiency and effectiveness of established business processes across all assets in the enterprise
Charge-back to BU
Asset Management system seamless integration with ERP, HR, Account receivable/payable, system management, Service desk, change management etc.
Center of
Excellence
Proactive
Active
Reactive
Chaos

16. 4. Asset Management Life Cycle
Planning
Aligning the need for the IT assets with the key business processes, which are being serviced from either an existing IT asset or proposed to be delivered from a new IT asset
How do you actually get the money for that Desktop refresh?
Acquisition of the asset
Looking at the most cost effective way to acquire the IT assets.
Deployment
How to deploy – pilot, staged, big bang!!
Automate the process where possible

17. Asset Management Life Cycle
Operation / Maintenance
Ensuring that not only all the financial obligations associated with maintaining the asset are met, but also the operational risks associated with the IT asset namely, Change Management, CMDB, etc.
Disposal
IT Asset Value - maintaining a history of the IT asset throughout its lifecycle will assist in the replacement decision.
Ecologically Asset Disposal – today there is legislation in many countries that governs the ecologically responsibility of the disposal of IT assets.
Contractual Obligations - that need to be met if the organization does not want the IT asset, for example leasing, renting etc.
Maintaining - the accuracy and completeness of IT asset records including the financial records.

18. The Starting Point Physical Audit
A physical audit can actually be a combination of reconciling records that already exists with the results of a physical audit.
Most organizations, no matter what their level of maturity will have some IT asset information stored either in spreadsheets, databases or even paper based.
Many organizations undertook massive physical audits as part of their preparation for Y2K and promptly on the 1st January 2000 forgot about maintaining them.

19. Automated Discovery tools
The advantage of software discovery tools is that they can automatically discover the hardware and software that is being run across the network.
Regardless, of the automated discovery tool at times an inspection of the asset will have be undertaken to physically locate the IT asset
The drawbacks are:
If the IT asset is not connected to the network, it cannot be discovered.
That discovery tools do not have the ability to connect the asset with its owner or the process (service) it is delivering/supporting.

20. Information Collection
After the initial discovery, lock down the production environment and only allow moves, additions or changes that have been through proper Change Management. This will assist in preventing the security risk occurring through poorly applied security standards across the production environment.
At this stage the organization has two key elements to ITAM i.e. physical IT asset inventory linked to associated financial and contractual details.

21. Software Discovery
The next level of automated discovery is that of discovering the software that is running across the IT infrastructure. This should cover not only packaged, commercially purchased software but also in-house developed applications.
Contract Scrape - Objectives are to identify the currency of maintenance contracts for IT assets and to determine if the organization is paying the correct amount for maintenance.
Process Integration - Integrate the processes that discover, audit, procure, and manage, etc., the IT Assets.

22. IT Asset Security
Any IT asset with a piece of wire or wireless capability is a potential point of entry into the organizations network.
This lack of security framework is often indicted by a number or all of the following:
No dedicated resource/s for information security
Little or no information security policies
Little or no hardware and software security configuration standards
No security awareness program
No deployment of security software and hardware to facilitate security violation logging, monitoring and reporting

23. Data Management
IT Asset Optimization - IT asset optimization is concerned with making sure you are getting the optimal use of the organization’s IT assets. Asset optimization will allow the organization to harvest under utilized assets and leverage from them to minimize current operational expense and minimize future capital expenditure.
Software Licensing – Integrating IT assets information with the financial information through the discovery processes of what is installed.
Service Support – Being able to define Business Services and map the relationship of the underlying infrastructure you are supporting one of the key requirements to achieving a high level of maturity across the ITIL Service Support processes.

24. Conclusion
Organizations have failed to not only effectively manage their IT assets, but also to leverage of this investment to build and sustain their competitive edge.
Organizations need to continue to renew their investment in IT assets. However, in absence of an ITAM framework and its supporting processes, for some organizations Chaos will continue and the pain that goes with it.

25. Questions & Answers
Thank you for attending session!