# Assets, CMDB, retention and secure disposal

Asset management goes beyond counting devices. Information ownership, application dependencies, device lifecycle and retained copies form one control chain. This guide connects inventory to a usable service map, then addresses retention, legal holds, reuse and evidence-based disposal. Examples are fictional and contain no real personal information or device secrets.

Original SecNet educational content with fictional examples, not publication/endorsement by referenced organizations. Page exercise choices last only for the open session; no real organizational data is collected.

2026.10 · 2026-10-21

## Concepts

**Asset / varlık** — Information, equipment, software, a service or another resource that provides value and needs management.

**ITAM** — Management of acquisition, ownership, cost, licensing, use and disposition across the IT asset lifecycle.

**CI** — A configuration item whose configuration/relationships are controlled to deliver a service; it need not be physical equipment.

**CMDB** — A configuration-management database holding CIs, defined directional relationships and evidence of their validity.

**Retention / saklama** — A rule defining how long a record category is kept, using a justified period and start event.

**Legal hold** — An authorized preservation measure for a defined dispute/obligation, with bounded scope and review.

**Chain of custody** — The trace of who transferred a device/media item to whom, when, under which identity and condition.

**Clear / purge / destroy** — Clear addresses logical access; purge addresses more advanced recovery; destroy makes media unusable for storing data. Choose the method for the media and required assurance.

**Sanitization** — Controlled treatment intended to make target data inaccessible at a defined assurance level; different from ordinary file deletion.

**Cryptographic erase** — A method that denies data access by making the relevant keys unusable, subject to suitable encryption and key-lifecycle conditions.

**Anonimleştirme / anonymization** — Removing linkability to a person; replacing identity with a code alone is generally pseudonymization.

## Process map

### 1. Create the record

Asset owner + procurement

Assign unique identity and ownership to information, equipment, software and services.

Accepted inventory with source and date.

### 2. Connect the service

Service owner + configuration manager

Validate CI relationships, critical dependencies and data-quality rules.

Relationship map with defined types and directions.

### 3. Use and retain

Information owner + legal/privacy + IT

Approve purpose, retention trigger, period and copy scope.

Approved retention matrix and exception/hold record.

### 4. Decide and execute

Business owner + authorized operator

Check preservation constraints; choose reuse/disposal suited to media and risk.

Approval, custody trail, method and execution result.

### 5. Validate and close

Independent reviewer + record owner

Reconcile results, copies, providers and linked records.

Validation, exceptions and completed asset/CMDB updates.

## Why asset management underpins security

You cannot reliably scope patching, backup, access or disposal without knowing what must be protected. Include SaaS tenants, cloud accounts, virtual machines, network/OT/mobile devices, licences, certificates and critical information sets alongside laptops and servers. Choose fields for each category rather than expecting a financial fixed-asset list to answer every security question.

An information owner may decide use/classification; a custodian operates controls; a user accepts custody and usage duties. Do not blur these roles into one name. Reconcile procurement, HR, finance, security and IT records and route unknown/ownerless items for decisions. Use approved discovery suited to the environment, avoiding unauthorized scans or aggressive OT discovery.

- [ ] Asset category, business owner, custodian and critical-service relationship are recorded.

Reference: [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf)

## What belongs in a useful inventory record?

Choose a durable identity such as serial number, hardware UUID, cloud resource ID or organizational asset ID. An IP address alone is not identity because it can be reassigned. Distinguish source, last-seen and last-validated dates. Reconcile duplicates from different tools using defined matching rules and exception review.

A new discovery may not be a new purchase; an unseen item is not automatically disposed. Investigate changes and absences. Protect inventory access itself: do not place passwords, private keys or access tokens in descriptions; use authorized references to secure secret storage. Limit personal custody details to roles that need them.

Minimum data model; adapt for each category

| Field group | Example fields | What it enables |
| --- | --- | --- |
| Identity and scope | Asset/CI ID, type, serial or resource ID | Unique tracking and scope reconciliation |
| Accountability | Business owner, custodian, service | Decision and corrective-action ownership |
| Lifecycle | State, location, custody, warranty/EOL | Renewal, return and disposal planning |
| Protection | Classification, patch, EDR, backup, encryption reference | Service impact of missing controls |
| Trustworthiness | Source, last seen, validator, relationship date | Tracking ownerless, stale and duplicate records |

- [ ] Identity, provenance, freshness and data-quality rules are enforced.

Reference: [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf)

## Why CMDB is distinct and useful

Inventory answers what equipment exists and who holds it. CMDB uses configuration-item relationships to explain which services a change affects. CIs can include servers, application services, databases and business services. An asset and CI are not always one-to-one. ITAM may manage financial value/custody while CMDB manages operational dependencies.

Model a fictional order service through application → database → storage and application → identity/DNS/key services. Define meaning and direction instead of vague “connected” relationships: runs on, reads from, authenticates through, backed up by. Have the service owner validate the map. Then maintenance impact, recovery order, vulnerability priority and change approval can use the same service model.

Fictional service relationships

| Source CI | Relationship | Target CI / impact |
| --- | --- | --- |
| Order service | delivered by | Order API · transaction capacity |
| Order API | reads/writes | Order DB · consistency and RPO |
| Order API | authenticates through | Identity service · access dependency |
| Order DB | recovered from | Backup set + key · restore dependency |

- [ ] Relationships include type, direction, source and validation date.

Reference: [ServiceNow · CI relationships in the CMDB](https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/c_CIRelationships.html)

## How to maintain and measure CMDB quality

Start with a few critical business services. Define classes, required attributes, relationship vocabulary, authoritative sources and update owners. Discovery can supply observed technical data; procurement validates licensing/warranty; service owners validate business relationships. Specify authority per field when sources conflict instead of assuming the newest arrival is correct.

Installation, relocation, change, incident, return and disposal workflows should include their CI updates before closure. Track missing required fields, ownerless critical CIs, relationships beyond validation thresholds, duplicate identities and unmapped assets. Report discovery blind spots separately; do not hide an unknown population in an apparently complete percentage.

- [ ] Data-quality issues have owners, deadlines and a defined measurement population.

Reference: [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf), [ServiceNow · CI relationships in the CMDB](https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/c_CIRelationships.html)

## Lifecycle from acquisition to return and disposition

Connect need → security requirements → purchase → acceptance → custody/deployment → operation/change → return/quarantine → reuse or disposal. At acceptance verify hardware identity, support lifetime, secure configuration and required licences. During employee exit check accounts, tokens, certificates and remote-management status as well as physical return.

Failed drives, leased equipment and warranty/RMA returns can expose data. If sanitization is impossible before return, use controlled retention, a drive-retention agreement, authorized destruction or another approved solution. The accountable owner should decide warranty-versus-data-risk trade-offs. Do not mark CMDB/financial records disposed before evidence exists.

- [ ] Returns/RMA and leased assets are included in disposition procedures.

Reference: [NIST SP 800-88 Rev. 2 · September 2025](https://csrc.nist.gov/pubs/sp/800/88/r2/final)

## How to define a retention period

For each record category identify purpose, applicable country/sector obligations and the event starting the clock. It may begin at creation, contract termination, account closure or another approved trigger. Assess minimum duties, purpose-based necessity, limitation periods and excess-retention risk together; “keep everything ten years” is not a defensible schedule.

A schedule needs category, scope, owner, legal/business rationale, trigger, duration, review, copies, holds, method, operator and evidence. Expiry can affect applications, shared folders, email attachments, analytical derivatives and supplier copies. Assign approval and validation as well as technical execution; handing deletion to IT does not complete governance.

Illustrative retention schedule; the organization validates and approves durations

| Category | Start event | Determining duration | Closure evidence |
| --- | --- | --- | --- |
| Candidate application | Recruitment process closes | Separate recruitment purpose, applicable claims and any talent-pool decision | Operation record covering copies and recipients |
| Security event log | Event recording or approved case closure | Assess investigation needs, sector duties and proportionate access | Policy version, deletion job and sample validation |
| Contract / financial record | Defined contract or accounting event | Determine applicable law and record-specific duties | Approval, hold check and result |
| Backup copy | Copy creation and rotation schedule | Design recovery purpose, versions and retention/access boundaries together | Rotation and deletion-rule reapplication after restore |

- [ ] Duration has a rationale, start event and copy scope.

Reference: [GDPR · Articles 5 and 17, official EUR-Lex text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)

## KVKK and GDPR: distinguish different clocks

Under the KVKK disposal regulation, the periodic-disposal interval for the policy framework is at most six months; this is not a six-month retention rule for all data. A three-month rule applies after the obligation arises for controllers not obliged to prepare that policy. Disposal-operation records have an at-least-three-year rule, apart from other legal duties. The 30-day data-subject response clock is separate. Verify applicability and current Board decisions.

GDPR Article 5(1)(e) limits identifiable-data storage to the necessary purpose. Article 17 erasure also has exceptions. The regulation does not assign one number of years to every employee, log or customer record. Make documented, category-specific decisions for applicable sector/country duties and legal preservation.

- [ ] Retention duration, disposal interval and request-response deadline are managed separately.

Reference: [KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği](https://www.kvkk.gov.tr/Icerik/5441/KISISEL-VERILERIN-SILINMESI-YOK-EDILMESI-VEYA-ANONIM-HALE-GETIRILMESI-HAKKINDA-YONETMELIK), [GDPR · Articles 5 and 17, official EUR-Lex text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)

## Legal holds, backups and cloud copies

A legal hold is not unlimited general archiving authority. Record the authorized request, matter ID, data scope, owner, access, review and release decision. Suspend deletion only within the relevant scope, not all copies indefinitely. Reassess normal retention/disposal when the basis ends.

Immutable backups may not allow immediate record-level deletion. Assess obligations, access restrictions, rotation expiry and reapplication of deletion lists after restore; “it stays in backup” does not close the obligation. For SaaS verify active data, recycle bins, versions, snapshots, subprocessors and key copies using contractual and technical evidence.

- [ ] Hold scope, review and release authority are defined.

Reference: [GDPR · Articles 5 and 17, official EUR-Lex text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)

## Deletion, sanitization, anonymization and destruction

File deletion or quick format does not prove safe media disposition. Choose clear, purge or destroy according to sensitivity, media, next use, control boundaries and verifiable methods. Assess re-linking for anonymization and encryption coverage, all key copies and prior plaintext copies for cryptographic erasure. NIST SP 800-88 Rev. 2, published September 2025, is the current program reference.

SSD/flash wear levelling and inaccessible areas defeat simplistic overwrite assumptions; degaussing is not a flash solution. Use methods supported for the media and verifiable by the organization. Do not report failed or uncertain media as successfully sanitized. Implementation belongs to authorized trained teams using approved procedures, not destructive commands run on an unidentified device.

Media-specific decision checks; not product instructions

| Media | Control question | Evidence |
| --- | --- | --- |
| HDD / magnetic tape | Does the chosen method suit this media and reuse boundary? | Identity, method, tool result and validation |
| SSD / NVMe / flash | Are the supported sanitization/cryptographic method and scope validated? | Media support details, result and acceptance rationale |
| Mobile / printer / network device | Are storage, accounts, tokens and management records covered? | Reset/sanitization and access-revocation evidence |
| Cloud / SaaS / snapshot | Are copy, version, key and provider boundaries understood? | Scoped job result, provider evidence and exceptions |
| Paper / removable media | Is there custody evidence through secure collection and authorized destruction? | Batch, quantity/identity, witness and handover record |

- [ ] Method fits the media; execution result and acceptance are recorded.

Reference: [NIST SP 800-88 Rev. 2 · September 2025](https://csrc.nist.gov/pubs/sp/800/88/r2/final), [NIST SP 800-88r2 · official FAQ](https://csrc.nist.gov/files/pubs/sp/800/88/r2/final/docs/sp800-88r2-faq.pdf)

## How to establish custody and disposal evidence

Open a justified request, check retention/holds, obtain owner approval and quarantine the identified item. On handover record serial/asset ID, package/seal, time, sender/receiver and exceptions. Outsourcing does not remove accountability. A generic destruction certificate that does not reconcile to the serial list does not close this asset.

After execution retain method, operator, results, failed items, verification and acceptance. Distinguish checking execution from accepting the outcome. Reconcile CMDB relationships, inventory, custody, licensing, access and financial records. Manage e-waste duties separately: data sanitization does not prove environmental disposition, and a recycling receipt does not prove data sanitization.

- [ ] Identity-based traceability runs from approval through custody and validation.

Reference: [NIST SP 800-88 Rev. 2 · September 2025](https://csrc.nist.gov/pubs/sp/800/88/r2/final), [NIST SP 800-88r2 · official FAQ](https://csrc.nist.gov/files/pubs/sp/800/88/r2/final/docs/sp800-88r2-faq.pdf), [KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği](https://www.kvkk.gov.tr/Icerik/5441/KISISEL-VERILERIN-SILINMESI-YOK-EDILMESI-VEYA-ANONIM-HALE-GETIRILMESI-HAKKINDA-YONETMELIK)

## Assurance questions, measures and implementation

Sample in both directions: physical/discovered items to records and records to actual items/scope. Trace a critical service through dependencies, backup and deletion work. Follow a closed disposal record through approval, custody, outcome and record updates. A written policy is not evidence the control operated.

Begin with critical-service scope and a minimum data model; reconcile sources, approve retention schedules and test a small controlled return/disposal batch end to end. Surface ownerless critical assets, unvalidated relationships, overdue disposal, open holds and unmatched serials. Complete workpapers in the organization’s controlled environment; do not upload real personal data to this educational page.

- [ ] Findings have owners and closure tests; unknown scope is reported separately.

Reference: [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf)

## Decision examples and explained answers

### Retention expires on a drive under hold

The scheduled period expired, but a validated legal hold covers the same data. What should happen?

**Destroy immediately because the period expired** — Revisit

This bypasses an active preservation decision. Validate scope with authorized legal/record owners, preserve only relevant data under control and set a review date.

**Validate scope, suspend relevant deletion and review** — Supported approach

This creates a documented bounded exception. Do not retain everything forever; resume normal retention/disposal assessment after release.

### An SSD was quick-formatted

A device will leave organizational control. The team calls a quick format secure disposal. What evidence is sufficient?

**Screenshot of an empty folder** — Revisit

A logical view does not cover inaccessible blocks or all copies. An appropriate supported method, execution outcome and validation are needed for the SSD.

**Appropriate method and acceptance tied to device identity** — Supported approach

This is the right direction. Validate method support, sensitivity and next-use conditions; treat uncertain/failed outcomes as exceptions.

### CMDB records are current but relationships missing

The server list is accurate, but the order API’s identity dependency is absent. Is recovery order demonstrated?

**Yes, the devices were counted** — Revisit

Accurate inventory does not prove service dependencies. Missing identity, DNS or key dependencies can prevent recovery.

**No; dependency validation and end-to-end testing are missing** — Supported approach

Define relationship type, direction and provenance, validate with business/technical owners, then test the recovery plan.

## Official references

- [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf) — Context for identifying and managing assets supporting a service.

- [ServiceNow · CI relationships in the CMDB](https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/c_CIRelationships.html) — A vendor-primary example of CI relationships, not a product recommendation.

- [NIST SP 800-88 Rev. 2 · September 2025](https://csrc.nist.gov/pubs/sp/800/88/r2/final) — Sanitization-program reference; Rev. 1 is not the current edition.

- [NIST SP 800-88r2 · official FAQ](https://csrc.nist.gov/files/pubs/sp/800/88/r2/final/docs/sp800-88r2-faq.pdf) — Method-selection and assurance context; the worked examples are original SecNet material.

- [KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği](https://www.kvkk.gov.tr/Icerik/5441/KISISEL-VERILERIN-SILINMESI-YOK-EDILMESI-VEYA-ANONIM-HALE-GETIRILMESI-HAKKINDA-YONETMELIK) — Articles 7, 11 and 12; distinguish each deadline’s purpose and scope.

- [GDPR · Articles 5 and 17, official EUR-Lex text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) — Storage limitation and erasure; does not prescribe one period for all records.