IT Resource Lifecycle and Asset Management: A CGEIT Exam Guide
IT Resource Lifecycle and Asset Management: A Complete CGEIT Guide
This guide is for candidates preparing for ISACA's Certified in the Governance of Enterprise IT (CGEIT) exam. It covers the IT Resources domain topic of lifecycle and asset management.
1. Why IT Resource Lifecycle and Asset Management Is Important
IT resources are often among the most expensive and strategically critical assets an organisation holds. They include hardware, software, data, infrastructure, cloud services, licences and people.
Without disciplined lifecycle and asset management, organisations face several problems:
- Wasted spend: unused licences, duplicate purchases and over-provisioned infrastructure.
- Compliance risk: software licence audits, regulatory penalties and data retention breaches.
- Security exposure: unknown or unpatched assets, shadow IT and improperly disposed media that leaks data.
- Poor decisions: leadership cannot make sound investment, replacement or divestment choices without accurate asset information.
- Misalignment: resources stop supporting business objectives and the strategic plan.
From a governance perspective, the board and executive management are accountable for ensuring IT resources are optimised. This is one of the core governance objectives in COBIT, alongside benefits realisation and risk optimisation.
Asset management is therefore not just an operational inventory exercise. It is a governance mechanism that ensures value is delivered and risk is managed across the full life of every resource.
2. What It Is
IT Asset Management (ITAM) is the set of business practices that combines financial, contractual and inventory functions. Its purpose is to support lifecycle management and strategic decision-making for the IT environment.
The IT resource lifecycle is the sequence of stages a resource passes through, from the moment a need is identified until the resource is retired and disposed of.
Key concepts include:
- Asset: anything of value to the enterprise. Examples are hardware, software, information, services, facilities and people/skills.
- Configuration item (CI): a component that must be managed to deliver an IT service, recorded in a Configuration Management Database (CMDB).
- Asset register / inventory: the authoritative record of assets. It typically holds ownership, location, cost, status, warranty, licence and contract information.
- Total Cost of Ownership (TCO): the full cost of an asset across its life. This includes acquisition, implementation, operation, maintenance, support, training, energy and disposal.
- Asset ownership: each asset should have a clearly assigned owner who is accountable for it.
Relevant frameworks and standards:
- COBIT 2019: BAI09 Managed Assets, BAI10 Managed Configuration, APO07 Managed Human Resources, APO10 Managed Vendors, BAI03 Managed Solutions Identification and Build, and EDM04 Ensured Resource Optimisation.
- ISO/IEC 19770: IT asset management standards.
- ISO 55000: general asset management.
- ITIL: IT Asset Management and Service Configuration Management practices.
3. How It Works: The Lifecycle Stages
Stage 1: Planning and Requirements
- Identify the business need and link it to the enterprise strategy and the IT strategic plan.
- Develop a business case covering expected benefits, costs (TCO), risks and alternatives.
- Obtain approval through the investment governance process, such as portfolio management or an IT steering committee.
- Consider enterprise architecture standards so the resource fits the target architecture.
Stage 2: Acquisition and Procurement
- Choose a sourcing approach: buy, build, lease, subscribe (SaaS/cloud) or outsource.
- Select vendors through a defined process, such as RFI, RFP, evaluation criteria and due diligence.
- Negotiate contracts covering SLAs, licensing terms, right-to-audit clauses, exit clauses and data ownership.
- Record the asset in the register at the point of receipt.
Stage 3: Deployment and Implementation
- Install, configure, test and accept the asset.
- Register it as a CI in the CMDB with relationships to services.
- Assign an owner, custodian and users.
- Apply security baselines and tag the asset.
Stage 4: Operation and Maintenance
- Monitor performance, utilisation, capacity and availability.
- Apply patches, upgrades and maintenance under change management.
- Track licence compliance and contract obligations.
- Measure benefits realised against the original business case.
- Conduct periodic reconciliation, comparing physical or discovered inventory with the asset register.
Stage 5: Review and Optimisation
- Periodically reassess value, cost, risk and alignment.
- Decide among several options: continue, optimise, consolidate, upgrade, renew or retire.
- Use portfolio management techniques to rebalance resources toward the highest-value initiatives.
Stage 6: Retirement and Disposal
- Plan decommissioning, including data migration and archiving according to retention policy.
- Securely sanitise or destroy data-bearing media, for example by degaussing, cryptographic erasure or physical destruction. Retain certificates of destruction.
- Address environmental regulations, such as WEEE and e-waste rules.
- Terminate licences and contracts, and recover reusable assets.
- Update the asset register and CMDB.
Governance Enablers Supporting the Lifecycle
- Policies and standards: asset management policy, acceptable use, procurement, disposal and data retention.
- Roles and responsibilities: board oversight, an IT steering committee, asset owners, the asset manager and procurement.
- Processes: procurement, change, configuration, licence, capacity and vendor management.
- Tools: automated discovery, the CMDB, Software Asset Management (SAM) tools and cloud cost management (FinOps).
- Metrics: asset utilisation, licence compliance rate, register accuracy, TCO versus budget, the share of assets past end-of-support, and benefits achieved.
People as Resources
CGEIT treats human resources and competencies as IT resources too. Lifecycle thinking applies to them as well:
- workforce planning
- recruitment
- skills development
- performance management
- succession planning
- knowledge retention at exit
Cloud and Modern Considerations
- In cloud environments, assets are often services rather than physical items. Consumption-based costs require continuous monitoring.
- Shadow IT and SaaS sprawl make discovery and governance harder.
- Contracts must address data location, portability and exit strategy to avoid vendor lock-in.
4. How to Answer Exam Questions on This Topic
CGEIT is a governance exam, not a technical one. Questions typically ask what the best, most important, first or primary action or consideration is. Approach them from the viewpoint of a senior governance professional advising the board or executive management.
Step-by-step approach:
1. Identify the role you are playing. Usually it is a governance advisor, CIO or steering committee member, not a technician.
2. Identify the lifecycle stage in the scenario.
3. Ask which option best ensures alignment with business objectives, value delivery, risk optimisation and resource optimisation.
4. Eliminate overly technical or operational answers unless the question explicitly asks for them.
5. Prefer answers that establish structure: policy, accountability, frameworks and measurement.
6. Look for root-cause and preventive solutions over reactive fixes.
Sample reasoning patterns:
- Q: An organisation discovers significant unused software licences. What should the governance professional recommend FIRST?
Good answer: establish or enforce an asset or software asset management policy with clear ownership and periodic reconciliation.
Weaker answers: immediately cancelling licences, or buying a discovery tool.
- Q: What is the PRIMARY purpose of maintaining an accurate IT asset inventory?
Good answer: to support informed decision-making and optimisation of IT resources, aligned with business needs.
Weaker answers: narrow ones such as passing audits or tracking locations.
- Q: When evaluating whether to replace a legacy system, the MOST important input is:
Good answer: a business case comparing TCO, benefits, risks and strategic alignment of the options.
Weaker answer: the age of the system alone.
- Q: The GREATEST risk during asset disposal is:
Good answer: unauthorised disclosure of sensitive data from improperly sanitised media.
5. Exam Tips: Answering Questions on IT Resource Lifecycle and Asset Management
Tip 1: Think value, risk and resources. The best answer usually ties the resource to business value and strategic alignment, not just cost or technology.
Tip 2: Lifecycle means cradle to grave. If an option considers the whole lifecycle (TCO, disposal, exit strategy), it is usually stronger than one focused only on acquisition price.
Tip 3: Accountability comes first. Answers that assign clear asset ownership or establish policy are often correct for FIRST or BEST questions. Remember that the board sets direction, management executes, and owners are accountable.
Tip 4: Business case before investment. No acquisition should proceed without an approved business case linked to strategy. It must also be revisited throughout the life of the investment.
Tip 5: Inventory is a prerequisite. You cannot manage, secure or optimise what you do not know you have. Accurate inventory and a CMDB are foundations for licence compliance, security and capacity planning.
Tip 6: Prefer preventive and systemic solutions. Policies, processes, frameworks and metrics beat one-off fixes or tool purchases. Tools enable a process; they do not replace governance.
Tip 7: Disposal equals data protection. For retirement questions, prioritise secure data sanitisation, data retention compliance and documented evidence of destruction.
Tip 8: Contracts protect the lifecycle. Look for right-to-audit, SLAs, exit and transition clauses, data ownership and licence terms. These are especially important for cloud and outsourced resources.
Tip 9: Measure and monitor. Ongoing performance and benefits monitoring, using KPIs, KGIs and balanced scorecards, is how governance confirms resources keep delivering value.
Tip 10: Include people. Human resources, skills and knowledge are IT resources. Succession planning and knowledge transfer are lifecycle controls for people.
Tip 11: Watch qualifier words. FIRST usually points to assessment, policy or understanding the current state. PRIMARY or MOST important points to alignment and value. GREATEST risk points to the highest business impact.
Tip 12: Map to COBIT. Know the key objectives: EDM04 for resource optimisation, APO06 for budget and costs, APO07 for people, APO10 for vendors, BAI09 for assets and BAI10 for configuration. Recognising these helps you pick framework-aligned answers.
Tip 13: Avoid the technician trap. Answers about specific technical configurations, brands or tools are rarely correct in CGEIT unless the question is explicitly operational.
Summary
IT resource lifecycle and asset management ensures every IT resource is planned, acquired, deployed, operated, optimised and retired in a way that delivers business value, controls cost and manages risk.
For the CGEIT exam, always adopt the governance lens. Choose answers that emphasise:
- strategic alignment
- clear accountability
- full-lifecycle thinking (TCO)
- policy-driven processes
- accurate inventory
- secure disposal
- continuous measurement of value
