Hardware Asset Management Policy

Download the full Hardware Asset Management Policy.

Policy

All IT hardware must be purchased through IT, irrespective of the funding source. This includes equipment funded from departmental budgets, research grants, charitable funds or any other source. Hardware procured outside IT will not be supported, connected to the University network or recorded in the asset register.

IT will procure hardware from approved suppliers in accordance with the University’s procurement regulations. Requests for non-standard hardware must include a business justification and the approval of the relevant head of department or dean.

Ownership and asset registration

All IT hardware procured by or on behalf of the University is and remains the property of the University, regardless of the funding source.

All hardware assets must be recorded in the University’s asset register. The register must record the full lifecycle of each asset, including asset type, serial number, date of procurement, assigned user, location, warranty status, any transfers or reassignments and the date and method of disposal. The asset register will be maintained by IT and reviewed periodically to ensure accuracy.

Standard allocation

Each member of staff is allocated a single laptop as standard, provided to the University’s current standard specification. A desktop may be requested as an alternative where the individual does not take advantage of hybrid working arrangements.

Where a laptop is allocated, IT will also provide a docking station, monitor, keyboard and mouse to support office-based working. Standard devices will be within their warranty period and will run the University’s managed operating system build.

Students are not provided with personal IT equipment. Students should make use of the University’s student computing labs, library facilities and open-access workstations. Where a student participates as a member of a funded research project that requires dedicated equipment, the project sponsor may provide a device funded by the project budget. The project sponsor is accountable for the equipment and must ensure it is recorded in the asset register, subject to University security controls and returned to IT at the end of the project or the student’s affiliation.

Security requirements

All University hardware assets must comply with the following security requirements. It is expected that allocated devices will be in regular use, as this is necessary to receive security patches, operating system updates and policy changes. Devices that remain disconnected for an extended period may be disabled or quarantined.

• Full disk encryption must be enabled on all laptops and portable devices. Encryption must not be removed or disabled.
• Devices must run the University’s managed build, including centrally deployed anti-malware, firewall and endpoint detection and response software.
• Users must not disable, remove or alter security controls on University devices, including encryption, anti-malware, screen locks or endpoint management agents.
• Users must not install software, operating system components or drivers on managed devices without authorisation through the IT Service Desk or a security exception.
• Devices must be physically secured when unattended. Laptops and portable devices must not be left unsecured in public or shared spaces.

Where a user has a legitimate business need for elevated privileges, augmented technical controls or a deviation from the standard security configuration, they may apply for a security exception. Requests must be submitted to the Information Security Manager with a documented business justification and will be subject to a risk assessment. Approved exceptions are time-limited and subject to periodic review.

Loss, theft and damage

Users must report the loss, theft or damage of any University hardware asset to the IT Service Desk immediately. In the case of theft, users must also report the incident to the police and provide IT with the crime reference number. Where a lost or stolen device may hold personal data or sensitive information, the incident will be assessed by the Information Assurance Team alongside IT to determine the risk and whether notification to the Information Commissioner’s Office or affected individuals is required under the UK GDPR.

Users may be held responsible for damage caused by negligence or misuse. The University reserves the right to recover reasonable costs in such circumstances.

Return and transfer of assets

All University hardware must be returned to IT when no longer required, when the user’s role changes or when the user’s affiliation with the University ends. The user’s line manager is accountable for ensuring that hardware is returned as part of the leaver or transfer process.

University hardware must not be retained for personal use, sold, gifted or disposed of by the user. Devices can only be repurposed or reassigned by IT.

Secure disposal

Before any University hardware is disposed of, sent for repair or transferred to another user, all data must be securely erased in accordance with the University’s procedures. Secure erasure must meet or exceed the standards set out in NCSC guidance on secure sanitisation.

The University does not sell, donate or gift IT equipment to staff, students or third parties. All end-of-life hardware must be disposed of through IT in accordance with applicable environmental regulations, including the Waste Electrical and Electronic Equipment (WEEE) Regulations. IT will maintain records of all asset disposals, including the method of data destruction, for audit purposes.

Warranty and replacement cycle

Standard devices are replaced cyclically at the end of their warranty period. Devices that are out of warranty remain the property of the University and will be replaced through the standard process. Users should request a replacement via the IT Service Desk.

Users must respond promptly to IT requests to return or replace hardware. Devices that have reached end of life or are no longer supported may develop security vulnerabilities that place University data and systems at risk. Where a user fails to respond to replacement requests within a reasonable timeframe, IT reserves the right to disable or quarantine the device to protect the University’s network and information assets.

Peripheral devices such as monitors, docking stations and keyboards are replaced on failure. These items are not part of the standard replacement cycle.

Purpose

The purpose of this policy is to ensure that all IT hardware owned, leased or managed by the University is procured, recorded, allocated, secured, maintained and disposed of in a controlled and consistent way. It establishes that all hardware, regardless of funding source, remains University property and is subject to the University's managed security controls, and it defines the obligations of IT, line managers and users throughout the asset lifecycle. In doing so, the policy protects University information, supports operational continuity, ensures an accurate and auditable asset register, and enables the University to meet its legal, regulatory and contractual obligations, including UK GDPR and the WEEE Regulations.

Scope

This policy applies to all IT hardware assets owned, leased or managed by the University, regardless of how they were funded. This includes equipment purchased from departmental budgets, research grants or central IT budgets.

This policy applies to all staff, contractors and any other persons to whom University hardware is issued. It covers the full lifecycle of hardware assets from procurement and allocation through to return, repurposing and disposal.

Personal devices may only be used in accordance with the BYOD Policy.

Principles

This policy sets out the principles governing the procurement, allocation, management, security and disposal of University-owned IT hardware. It ensures that hardware assets are recorded, protected, maintained and disposed of in a manner that safeguards information, supports operational continuity and meets the University’s legal, regulatory and contractual obligations.

Roles and responsibilities

Chief Information Officer (CIO)

Accountable for the University’s hardware asset management strategy and for ensuring that appropriate controls are in place to protect hardware assets throughout their lifecycle.

IT department

Responsible for procuring, configuring, deploying, maintaining, tracking and disposing of University hardware in accordance with this policy. IT maintains the asset register and ensures that all devices meet the University’s security standards before deployment.

Information Security Manager

Provides advice on the security requirements for hardware assets, conducts security assessments for non-standard device requests, manages the security exception process and oversees compliance with the security provisions of this policy.

Line managers and supervisors

Ensure that hardware is requested in a timely manner for new starters and that team members comply with this policy. Line managers are accountable for ensuring that all University hardware is returned as part of the leaver or transfer process and must confirm with IT that assets have been received.

All users

Responsible for the care, physical security and proper use of University hardware allocated to them. Users must comply with all security requirements, report loss, theft or damage immediately (including reporting theft to the police and providing a crime reference number) and return hardware when it is no longer required or when their affiliation with the University ends.

Research supervisors and project sponsors

Responsible for ensuring that hardware requests for research students are properly justified, funded and procured through IT. Project sponsors are accountable for equipment provided to students and must ensure it is recorded in the asset register, subject to University security controls and returned to IT at the end of the project.

Procedure

Requesting hardware

All hardware requests must be submitted through the IT Service Desk or the IT self-service portal. For new starters, IT must be notified at least two weeks before the agreed start date. Requests for non-standard equipment must include a business justification and the appropriate approval. Where non-standard equipment is approved, delivery times may vary.

Device build and deployment

All devices will be configured with the University’s managed build, including the standard operating system, productivity software, security controls and endpoint management. Users requiring specialist software must specify this at the time of request. Software will be installed only where the University holds a valid licence.

Security exceptions

Users who require elevated privileges, additional software or modifications to the standard security configuration must apply for a security exception through the Information Security Manager. Requests must include a business justification and will be assessed against the risk to the University. Approved exceptions are time-limited and recorded in the exceptions register. The Information Security Manager will report active exceptions to the IGSC.

Monitoring

Compliance with this policy will be monitored through the asset register, endpoint management reporting, periodic audits and the University’s information security assurance activities. Non-compliance may be identified through audit, incident investigation or management review.

Advice and guidance

IT Service Desk

The first point of contact for hardware requests, faults, replacements and queries about this policy.

Information Security Manager

Provides advice on security requirements for hardware, non-standard device assessments, security exceptions and compliance.

IT Product Catalogue

Current standard device specifications and approved hardware options are published in the IT Product Catalogue, available via the IT self-service portal.

Users are encouraged to contact the IT Service Desk if they are uncertain about any aspect of hardware procurement, allocation, security or return.

Failure to comply

Users

Failure to comply with this policy may result in withdrawal of access to University systems, mandatory retraining or other corrective measures. Serious or repeated breaches, including failure to return hardware, procurement of hardware outside IT, or deliberate circumvention of security controls, may lead to disciplinary action under the relevant University procedures. Users may be held responsible for costs arising from negligence or misuse.

Legal and regulatory obligations

Where a breach involves personal data, security-sensitive materials or other unlawful activity, it may be reported to external authorities including the Information Commissioner’s Office or law enforcement.

Academic freedom and lawful expression

Actions taken under this policy will be applied consistently with the University’s duties under the Higher Education (Freedom of Speech) Act 2023. Disciplinary or corrective measures will not be imposed for lawful academic expression or research activity.

Review

This policy shall be reviewed at least annually or following significant changes in technology, procurement arrangements or organisational structure. Updates require approval by the Information Governance and Security Committee.