IT Asset and Equipment Management Policy
Purpose The purpose of this policy is to establish enforceable standards for the lifecycle management of Colorado College’s IT assets. It ensures that all college-owned technology equipment is inventoried, secured, maintained, and disposed of in a way that protects institutional data, promotes accountability, and addresses regulatory safeguards. Scope This policy applies to all faculty, staff, contractors, and students who are assigned or use college-owned IT assets. It covers all computing devices, mobile devices, servers, network equipment, peripherals, and other technology hardware purchased, leased, or otherwise acquired by Colorado College.
Scope
All financial and administrative policies involving community members across campus, including volunteers are within the scope of this policy. If there is a variance between departmental expectations and the common approach described through college policy, the college will look to the campus community, including volunteers to support the spirit and the objectives of college policy. Unless specifically mentioned in a college policy, the college’s Board of Trustees are governed by their Bylaws.
Policy
Policy Statement
Colorado College requires all IT assets to be tracked, protected, and disposed of in accordance with this policy. The following sections define enforceable requirements across the asset lifecycle.
1. Asset Inventory
- All IT assets must be recorded in the official ITS asset inventory system upon acquisition.
- Assets shall not be deployed or issued to end users until properly tagged and entered in the inventory.
- ITS shall reconcile the physical asset inventory against records periodically
- Untracked or “rogue” IT assets are unsupported and may be disconnected from enterprise college networks.
2. College-owned IT Equipment
ITS must purchase all college-owned IT equipment, even if the equipment is entirely funded by a department or research account. ITS will handle purchasing, receiving, distributing, and decommissioning these devices.- IT equipment is defined as physical computing or printing devices (examples: computers, docking stations, monitors, tablets, printers, telephones, projectors, large speakers, servers, routers). A good rule of thumb is that IT equipment costs more than $100 each.
- ITS will not support any IT equipment that ITS did not purchase
- IT peripherals are not included in this policy and can be purchased by departments directly. These are physical devices that are used to interact with IT equipment (examples: keyboards, mice, webcams, small computer speakers, cables). They usually cost less than $100 each.
All IT equipment and IT peripherals purchased with Colorado College funds, including research, startup, grant, and department funds, are the college's property and must be returned to ITS on the last day of employment.
- The supervisor is responsible for creating a “New or Departing Employee” ticket to account for a departing employee’s returned equipment, or the department will be charged for lost or missing college assets
ITS will utilize management software, including, but not limited to, set systemwide configurations, automatic updates, central logging, vulnerability scanning/management, printing methods, and other similar settings on IT equipment.
- Do not remove, or tamper with, the management software
Devices for printing, scanning, copying, and faxing are centrally provided to campus constituents and managed by ITS
- Do not move these devices yourselves, contact ITS to request a move
- Employees or departments shall not purchase and/or install their own individual devices for these services for college business
- Standard consumables (toner and 8.5 x 11 plain white paper) are centrally purchased and will be delivered to devices as needed
- You may purchase non-standard paper consumables (legal size, different colors, different weights of paper, etc.) to use on the devices
- Printserver or Papercut Hive are the only methods of printing over the network for security, support, and printer management reasons
- ITS will work to meet all needs (not necessarily conveniences) for print services
- ITS will not support any such devices that ITS did not purchase
ITS will responsibly decommission and dispose of all college-owned IT equipment
- ITS will ensure that all data assets are wiped from College devices according to the Secure Disposal of Assets section of the Information Security and Data Protection Classification and Retention Policy.
- ITS will responsibly dispose of the hardware according to the Secure Disposal of Assets section of the Information Security and Data Protection Classification and Retention Policy.
3. Physical Security
- Servers, networking equipment, and other critical assets must be housed in secured facilities with physical and technical access controls, including, but not limited to CCTV live and recorded video, and electronic door locks with central logging/auditing
- Portable devices containing College data assets must not be left unattended in unsecured public areas.
- All devices storing Confidential or Sensitive data assets must employ encryption, according to the Encryption Requirements in the Information Security Data Protection Classification Retention Policy.
- Lost or stolen equipment must be reported to ITS immediately for incident response and remote wipe, if possible.
4. Maintenance & Support
- ITS is responsible for ensuring devices receive regular software updates, patches, and antivirus protection.
- Devices outside vendor support lifecycles must be retired or isolated from the enterprise campus networks.
- Unauthorized system modifications (e.g., adding drives, altering system boards, changing records in a database) are prohibited.
Review & Update
This policy will be reviewed regularly.
Procedures
See AboveDefinitions
- IT Asset: Any hardware device owned, leased, or managed by Colorado College (computers, servers, mobile devices, networking equipment, peripherals).
- Asset Inventory: Centralized system of record for tracking IT assets and assignments.
- Decommissioning: Formal retirement of an asset, including secure data removal and certified disposal.