Asset Management Policy

Policy owner Effective date
@knolleary 2023-06-01

Purpose

This policy establishes how the organization identifies, manages, and protects its assets. Its purpose is to ensure that information and equipment receive appropriate protection and to prevent unauthorized disclosure, modification, removal, or destruction of organizational data.

Scope

This policy applies to all organizational assets owned or managed by FlowFuse, including information, equipment, and devices. It also applies to all employees and third parties who use or handle these assets.

## Policy

Inventory of Assets

Identify all assets that store, process, or transmit confidential information, and maintain an up-to-date inventory of these assets.

Ownership of Assets

Assign each asset in the inventory to a specific individual or group responsible for its management and protection.

Acceptable Use of Assets

Follow the acceptable use rules defined in the Information Security Policy.

Loss or Theft of Assets

Report the loss or theft of any device that stores FlowFuse data or provides access to FlowFuse systems immediately. This includes devices such as computers, hardware tokens, and personal mobile phones.

Return of Assets

Return all FlowFuse assets in your possession when your employment or contract ends, following the off-boarding process.

Handling of Assets

Employees and users who are issued or handle FlowFuse equipment are expected to use reasonable judgment and exercise due care in protecting and maintaining the equipment.

Employees are responsible for ensuring that company equipment is secured and properly attended to whenever it is transported or stored. Equipment must be secured in accordance with the Access Control policy and must not be left unattended in public locations.

All mobile devices shall be handled in accordance with the Information Security Policy.

Exceptions

Submit requests for exceptions to this policy by email to the CEO or CTO for approval.

Violations & Enforcement

Report any violations of this policy to the CEO or CTO immediately.

Violations may result in suspension of system access and disciplinary action in accordance with company procedures, up to and including termination of employment.


This policy is adapted from the following sources: