About this policy
Policy contact:
Date of last update:
March 02, 2020
Policy statement
The school manages a hardware database used to track IT assets. The following IT assets must be entered into the database within 48 hours of receipt:
- All capital assets
- All computers (including mobile devices)
- Projectors and wall-mounted or conference room displays
- Printers and scanners
- Managed network devices
- Virtual Machines
- Storage devices (RAID, SAN, NAS, etc)
- Security devices (cameras, access control equipment, etc)
- All other networked devices, regardless of value. Devices that are below the $100 value threshold that have the potential to be networked but are expected to never be networked and are difficult to inventory (eg. non-networked Raspberry Pis) do not need to be added to the database. An item is considered to be difficult to inventory if there is no serial number or MAC address visible on the device or the packaging and not otherwise easily obtainable. If such a device is to be connected to the IU network at a later date, it must be added at that time.
- All IT equipment taken off-campus for periods of time in excess of 30 days, regardless of value
- All other IT equipment with a value exceeding $500.
- When assets are added to the database, the following information must be included:
- Make, model, and serial number
- IU tag number (white IU tag or yellow asset tag for capitalized items)
- Building and room number (using Standard Building Codes)
- Device status (in use, available, etc)
- MAC addresses for all networked devices
- DNS name for all devices with static IP addresses
- Help desk issue number for item purchase
- IT-28 status and data for all servers
- Encryption status for all mobile devices (laptops, tablets, phones, etc.)
- Backup and monitoring information for all servers.
Additional database fields are available and entry of this data is recommended but not required. This includes primary user, funding source, and warranty information.
When a device is moved, the location will be updated in the database with 48 hours of being moved.
All locations are reconciled during annual inventory days during the summer to ensure accuracy of the database. Office and lab moves also trigger an immediate reconciliation.
When an item is decommissioned and sent to IU Surplus Stores, the location of the item is changed to Surplus and the status set to Decommissioned. If the device was previously registered for DHCP use on the IU network, that DHCP registration must be removed.
Non-capital IT assets taken to off-campus locations for periods of time in excess of 30 days must be tracked per the Equipment Loan Procedures.
Capital assets must be updated in the Luddy database and the IU Kuali database within 24 hours of being moved. A move of a capital asset must be reported via a footprints help desk ticket.
In the event an item is lost or stolen (procedure for stolen equipment), the location of the device in the database is changed to lost or stolen to reflect the status. A footprints ticket is created to capture all information about the incident and the ticket number added to the database entry for the item. Any item containing sensitive data that is lost or stolen will trigger an incident response report per IT Policy: Incident Response.
Exceptions to policy
- System peripherals (monitors, keyboards, mice, etc) are not inventoried separately unless they have a value exceeding $500.
- Some fields in the database entry may not be known at the time the device is first received (eg. DNS name, IU capital asset tag number). In such cases, the device is still added to the database within 48 hours of receipt and the missing information added once known.
- Unmanaged network devices that do not have a dedicated IP address, such as small desktop switches, are not inventoried unless their value exceeds $500.
- Standard VoIP phones with value less than $500 are not inventoried.
Procedures
The school recognizes that the tracking of networked devices is critical to maintaining the security of the Luddy infrastructure. To facilitate the tracking of network-attached devices, the following additional requirements are in place:
- All devices reachable on any IU network must be inventoried
- Devices with static IP addresses must be added to DNS and the Name field in the database set to the fully qualified domain name (FQDN) corresponding to the DNS PTR record.
- The network hardware MAC addresses must be included in the database for all network-attached devices.
- If a device has multiple DNS A records and/or IP addresses, in addition to the primary IP address and DNS name, these must all be in DNS and must be listed as "FQDN/MAC_Address" in the comments section for the primary database entry. A system with multiple DNS CNAME entries (aka. aliases) need not include these aliases in the database since the primary system is easily determined from the DNS record. Similarly, a system with multiple DNS A records need not be added to the database if the corresponding PTR record for the IP address points to a DNS hostname that is already in the database.
- Apple devices will be enrolled in Apple’s Device Enrollment (DEP) program at the time of purchase and removed from DEP at the time of disposal.
By adhering to these requirements, it is possible to quickly locate any device by IP address, DNS name, or MAC address. This is critical in the event of a security incident report.