Effective date: 06/21/2021

Last update: 03/04/2024

Service Requirement PDF

Purpose

Asset management is the process of receiving, tagging, documenting, and eventually disposing of equipment. It is critically important to maintain up to date inventory and asset controls to ensure computer equipment locations and dispositions are well known. Lost or stolen equipment often contains sensitive data. Proper asset management procedures and protocols provide documentation that aid in recovery, replacement, criminal, and insurance activities.

This policy provides procedures and protocols supporting effective organizational asset management specifically focused on electronic devices.

Scope

This Service Requirement applies to all students, employees, affiliates or other members of the community making use of Duquesne University electronic devices.

Service Requirement

Asset Types

The following minimal asset classes are subject to tracking and asset tagging:

  1. Desktop workstations
  2. Laptop mobile computers
  3. Mobile Hotspots
  4. Tablet Devices
  5. Printers, copiers, fax machines, and multifunction print devices
  6. Handheld devices
  7. Scanners
  8. Servers
  9. Network appliances (e.g. firewalls, routers, switches, uninterruptible power supply (UPS), endpoint network hardware, and storage)
  10. Voice over Internet Protocol (VOIP) Telephony Systems and Components
  11. Internet Protocol (IP) Enabled Video and Security Devices
  12. Memory/Storage Devices

Asset Value

Assets which cost less than $500 shall not be tracked, including computer components, such as smaller peripheral devices, video cards, or keyboards, or mice. However, assets, which store data regardless of cost, shall be tracked either as part of a computing device or as a part of network attached storage. These assets include:

  1. Network Attached Storage (NAS), Storage Area Network (SAN) or other computer data storage
  2. Temporary storage drives 
  3. Tape or optical media with data stored on them including system backup data.

Asset Tracking Requirements

The following procedures and protocols apply to asset management activities:

  1. All assets must have an internal Duquesne University asset number assigned and mapped to the device's serial numbers
  2. An asset tracking database shall be created to track assets. It shall minimally include purchase and device information including:
    1. Date of purchase
    2. Make, model and descriptor
    3. Serial Number
    4. Location
    5. Type of Asset
    6. Owner
    7. Department
    8. Purchase order number
    9. Disposition
  3. Prior to deployment, Computing and Technology Services (CTS) shall assign an ID to the asset and enter its information in the asset tracking database. All assets maintained in the asset tracking database inventory shall have an assigned owner.

Asset Disposal and Repurposing

Procedures governing asset management shall be established for secure disposal or repurposing of equipment and resources prior to assignment, transfer, transport, or surplus.

When disposing of any asset, sensitive data must be removed prior to disposal. Computing and Technology Services (CTS) shall determine what type of data destruction protocol should be used for erasure. Minimally, data shall be removed using low formatting and degaussing techniques. For media storing confidential information or personally identifiable information (PII) that is not being repurposed, disks should be physically destroyed prior to disposal.

Audit Controls and Management

On-demand documented procedures and evidence of practice should be in place for this operational policy as part of Duquesne University. Satisfactory examples of evidence and compliance include:

  1. Current and historical asset management system checks for various classes of asset records. 
  2. Spot checks of record input and accuracy against tracking database.
  3. Evidence of internal process and procedure supporting this policy for compliance with general workstation computing policies.

Enforcement

The unauthorized or improper use of Duquesne University's technology environment, including the failure to comply with these service requirements, constitutes a violation which may result in the loss of access, University disciplinary actions and/or legal prosecution under federal, state and local laws, where applicable. Users are expected to adhere to TAP 26 - Computing and Ethics Guidelines.

The University reserves the right to amend these service requirements at any time without prior notice and to take such further actions as may be necessary or appropriate to comply with other published policies and with applicable federal, state, and local laws.