Retiring a machine

Why this is per asset

Disposed is deliberately not in the bulk action list on the Assets table. That is the whole design of this area, and it is worth reading before the screens.

Retiring two hundred machines in one click would produce two hundred records with no account of how they left. The account is the thing an auditor asks for, and the evidence is per asset: a method, a tool, a date, a person, a verification. So disposal lives on the record, one machine at a time, and the certificate is generated from what you entered there.

The Actions menu

On an asset record, the toolbar holds Edit and one menu. Everything that changes the record’s state lives in that menu, grouped by what kind of action it is.

The groups, in order:

• Customize Fields…, on its own. Which fields show on this record is a per-view utility rather than a primary action, so it sits above the first divider.
• Reassign Asset…, Record Assignment Acknowledgement when the assignment is waiting on one, and Duplicate Record.
• Mark Verified (Physical Inventory) and Flag for Audit, which reads Unflag for Audit once the asset is flagged.
• Report Lost / Stolen…, Decommission Asset, and Retire / Dispose…. Reporting a loss is covered in Lost or stolen below.
• Delete Asset, in red, below the last divider.

Change Status is not in this menu. It lives on the status badge at the top of the record, which is the more direct gesture, and having it in two places was the older behaviour.

Decommission is not disposal

Two items in the same group, and they do different things. Decommission takes the machine out of service. Retire / Dispose records how it left.

Decommission Asset runs immediately. It moves the asset to a decommissioned state and writes a lifecycle event, and that is the whole of it. Use it when a machine is out of service but you are not yet ready to account for its disposition, or when it is going to a warehouse and the paperwork comes later.

Retire / Dispose… opens a sheet, because the sheet is where the evidence is collected. Nothing is written to the register until you confirm in the sheet.

Lost or stolen

A missing machine stays on the books until an admin says otherwise. Losing it and writing it off are two separate things.

There are two ways to record a loss.

• Set the status to Lost or Stolen, from the status badge on the record, the edit form, or Change Status on a selection in Assets.
• Report Lost / Stolen… in the Actions menu opens an incident in Compliance and moves the machine to Decommissioned. A decommissioned machine already drops out of book value and Finance, so nothing more is asked.

A machine marked Lost or Stolen still counts in book value and in Finance, because a missing laptop often turns up a few days later. When an owned machine moves to Lost or Stolen, an admin is asked Remove from book value?

• Remove from book value stops its cost and depreciation counting in book value and Finance. Lease rent and support still count, because losing the hardware does not end those contracts.
• Keep on the books, or closing the question, changes nothing. The status you set stays.

Machines treated as leases are not asked, because their cost is the rent. Change the status on a selection and the question is asked once for all of them, for example Remove 12 assets from book value?

A written-off machine’s Book value section reads Not counted in book value or Finance, with a Write-off row reading Written off, the date, and the admin who did it. That is all it records: the date and the name. There is no reason field. The write-off also goes in the audit trail.

When a written-off machine comes back into service, you are asked Return to book value?, with Return to book value and Keep written off. You can also put it back any time with the button in the record’s Book value section. On a lost or stolen machine that is still on the books, the same button reads Remove from book value.

The disposal sheet

Four groups of fields, in the order an auditor reads them: what the media is, what was done to it, who checked, and where it went.

1. Media

   Asset tag, serial number, make and model, and media type, carried over from the record. Read them here rather than in the table: the certificate prints exactly these values.

2. Sanitisation

   Action level and Method are chosen from the NIST SP 800-88 Rev.1 vocabulary. Tool / version is free text, and is where you name the software that did the work. Sanitised on is the date the wipe or destruction happened, which is not always today.

3. Verification

   Verification is either Verified or Not verified, and Verified by names the person who checked. Leaving it unverified is allowed and is recorded as such.

4. Disposition

   Disposition method and Disposition date. The method is what physically happened to the machine, which is a separate question from what happened to the data on it.

What the Retire sheet also asks

Four more optional fields on Retire / Dispose…, for the questions NIST 800-88 and a gain-or-loss calculation ask.

• What came back: Proceeds (optional), the money recovered from resale, and ITAD vendor, picked from your vendors. Together they give the gain or loss and the chain of custody.
• Under NIST 800-88 detail, once Data sanitised is on: Tool version (optional), because NIST SP 800-88 asks for the version on its own, and How it was verified (optional).

The Disposal Record card on the machine then shows Proceeds and ITAD vendor, the tool with its version, and the verification method. Proceeds often arrive after the machine has gone, so a disposed machine’s editor has a Disposal Outcome section where you can add them later.

The certificate

A one-page PDF, generated from the record, stored against the asset. It is the audit-grade evidence that closes ISO A.7.14 and the HAM disposal control.

The page is laid out as four labelled grids, in the same order as the sheet: Media, Sanitisation (NIST SP 800-88 Rev.1), Verification & disposition, and then two signature lines. Under the sanitisation grid, the action level’s own description is printed in small type, so the reader does not have to look up what the level means.

The signature lines are Performed by and Verified by. The first is filled from the person who ran the disposal. The second is filled only when the record is verified; if it is not, the line is left blank for a wet signature.

The footer reads Generated by Starkive Manifest · NIST SP 800-88 Rev.1 followed by the generation date. The file is named after the asset tag, for example STRK-0007-sanitisation-certificate.pdf, and it is stored through the same attachment layer as every other document on the record, so it appears in the Documents section.

What the certificate will not do

Three things worth knowing before you rely on it.

• It does not sign itself. The signature lines are lines. Manifest prints the names it has and leaves the rest blank; the signing is yours.
• It does not verify anything. The Verification field records what you told it. If you set it to Verified without checking, the certificate says Verified.
• It does not regenerate. The PDF is generated once, at disposal, and stored. Editing the record afterwards does not change the stored certificate. If you need a corrected one, dispose again or replace the document.

Where the machine goes afterwards

A disposed asset stays in the register. It is not deleted, and it is not hidden.

The record keeps its full history, its documents, and its certificate. It appears in the Lifecycle screen under the disposed phase, and the phase list shows how long it has been there. From that list, Open in Assets takes you to the filtered register if you need the table view.

If you genuinely need the record gone, Delete Asset is the last item in the Actions menu. It is a soft delete: the asset is hidden from the register and its audit trail is kept, because a machine that existed still happened.