They should map procurement, assignment, reassignment, renewal, and retirement states to joiner-mover-leaver workflows so ownership and access change together. That prevents stale allocations and makes it easier to revoke or refresh assets at the point they leave operational use.
How IT asset management and joiner-mover-leaver should work together
IT asset management becomes much more reliable when it is treated as part of the same lifecycle as joiner-mover-leaver, not as a separate inventory exercise. The practical goal is to keep the asset record, ownership, and access state aligned at every transition, so a person’s role change or exit triggers the right assignment, reassignment, refresh, or retirement action.
That alignment is easiest to sustain when organisations use one authoritative workflow for onboarding, transfer, and offboarding decisions. In practice, this means the asset register should reflect who is responsible for the item, when it was last assigned, and whether it is still approved for operational use, while the Joiner-Mover-Leaver (JML) Guide frames the process side of that lifecycle.
Which asset states should map to joiner, mover, and leaver events?
The most useful mapping is lifecycle-based rather than purely administrative. Procurement and receipt should feed joiner workflows, reassignment and role change should feed mover workflows, and retirement, return, wipe, or disposal should feed leaver workflows. That prevents the common gap where an asset is “closed” in one system but still active in another.
For movers, the key question is whether the asset can safely stay with the person, or whether it should be reissued, reimaged, reclassified, or have its access refreshed. For leavers, the question is whether the item is physically recovered, logically revoked, and removed from any lingering approvals or exceptions.
This is also where IAM and IGA Basics is useful, because asset ownership and entitlement governance should be treated as linked records, not parallel spreadsheets. Where organisations already automate provisioning, the SCIM and Automated Provisioning Guide is a natural companion for keeping the identity side of that workflow consistent.
What good integration looks like in practice
Good integration starts with a shared source of truth for ownership and status, then connects it to business events that actually change that status. A useful pattern is to map asset creation, assignment, reallocation, renewal, and retirement to explicit workflow states, rather than relying on ad hoc tickets or manual follow-up.
Operationally, that means the asset record should answer three questions at any moment: who owns it, who is using it, and whether it is still approved for use. When those answers diverge, the process should force reconciliation before the asset can remain in service.
That discipline matters just as much for non-human assets and shared technical resources as it does for employee endpoints. The NHI Lifecycle Management Guide and Workforce Identity Security Guide both reinforce the same operational idea: lifecycle changes should remove stale access and stale allocation at the same time.
Risk and Threat Considerations
When IT asset management is not tied to joiner-mover-leaver, organisations accumulate stale allocations, orphaned assets, and outdated approvals. That creates both governance risk and security exposure, because the asset may still carry credentials, access paths, software, or data that should have been removed when the user’s role changed or ended.
Failure mechanism: The asset state changes in one system but not the others, so reassignment or retirement happens late, or not at all. Over time, this leaves operational use, ownership, and access misaligned, which is exactly when forgotten devices, tokens, and accounts become easier to abuse.
Impact: Leavers can retain access to assets they should no longer control, movers can inherit excessive entitlements, and retired assets can remain discoverable or usable long after they should have been taken out of service. That increases the chance of unauthorised access, inventory inaccuracy, and avoidable recovery work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Asset lifecycle mapping depends on accurate inventory and ownership state. |
| Recommendation — Maintain authoritative asset inventory and update status at each joiner-mover-leaver change. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | Links asset records to lifecycle state so reassignment and retirement stay accurate. |
| IA-5 — Authenticator Management | Asset transitions often require credential refresh, revocation, or replacement. | |
| Recommendation — Keep component inventory synchronized with onboarding, transfer, and retirement events. Rotate or revoke authenticators when assets are reassigned or retired. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | Requires controlled asset inventory that supports joiner-mover-leaver ownership changes. |
| A.5.18 — Access rights | JML-linked asset changes must trigger access updates to prevent stale access. | |
| Recommendation — Link asset inventory updates to lifecycle workflow changes and ownership changes. Review and update access rights whenever an asset changes owner or use status. | ||
Practitioner Guidance
What to prioritise: Start with the asset types that can carry the most operational or security blast radius, such as laptops, privileged endpoints, shared hardware, software licenses, and any asset that stores credentials or connects to production systems. Those are the points where lifecycle mistakes are most expensive.
What to verify: Before trusting the integration, verify that a move event actually changes assignment, approval, and access status together, and that a leaver event triggers both recovery and revocation steps. If the process only updates inventory, the control is incomplete.
Common mistake: Treating IT asset management as a recordkeeping function while JML is treated as a people process. The better model is one workflow with different data fields, so the organisation can prove who had what, when they had it, and when it stopped being authorised.
Practitioner takeaway: The strongest integration is the one that makes reassignment and revocation inseparable from asset movement, because that is what prevents stale ownership from turning into stale access.
Related resources from NHI Mgmt Group
- How should organisations manage joiner-mover-leaver processes across employees and contractors?
- Why do joiner, mover, and leaver processes become a security problem in larger organisations?
- What should organisations do when developer accounts fall outside normal joiner mover leaver processes?
- Why do service accounts and API keys complicate joiner-mover-leaver processes?