2 cissp ® Official Study Guide Eighth Edition

Hardware Inventories
Many organizations use databases and inventory applications to perform inventories and 
track hardware assets through the entire equipment lifecycle. For example, bar-code sys-
tems are available that can print bar codes to place on equipment. The bar-code database 
includes relevant details on the hardware, such as the model, serial number, and location. 
When the hardware is purchased, it is bar-coded before it is deployed. On a regular basis, 
personnel scan all of the bar codes with a bar-code reader to verify that the organization 
still controls the hardware.
A similar method uses radio frequency identification (RFID) tags, which can transmit 
information to RFID readers. Personnel place the RFID tags on the equipment and use the 
RFID readers to inventory the equipment. RFID tags and readers are more expensive than 
bar codes and bar-code readers. However, RFID methods significantly reduce the time 
needed to perform an inventory.

---

Securely Provisioning Resources 
711
Before disposing of equipment, personnel sanitize it. Sanitizing equipment removes all 
data to ensure that unauthorized personnel do not gain access to sensitive information. When 
equipment is at the end of its lifetime, it’s easy for individuals to lose sight of the data that it 
contains, so using checklists to sanitize the system is often valuable. Checklists can include 
steps to sanitize hard drives, nonvolatile memory, and removable media such as compact discs 
(CDs), digital versatile discs (DVDs), and Universal Serial Bus (USB) fl ash drives within the sys-
tem. NIST 800-88r1 and Chapter 5 have more information on procedures to sanitize drives. 
Portable media holding sensitive data is also managed as an asset. For example, an orga-
nization can label portable media with bar codes and use a bar-code inventory system to 
complete inventories on a regular basis. This allows them to inventory the media holding 
sensitive data on a regular basis.