Retiring a machine

Why this is per asset

Disposed is deliberately not in the bulk action list on the Assets table. That is the whole design of this area, and it is worth reading before the screens.

Retiring two hundred machines in one click would produce two hundred records with no account of how they left. The account is the thing an auditor asks for, and the evidence is per asset: a method, a tool, a date, a person, a verification. So disposal lives on the record, one machine at a time, and the certificate is generated from what you entered there.

The Actions menu

On an asset record, the toolbar holds Edit and one menu. Everything that changes the record’s state lives in that menu, grouped by what kind of action it is.

The groups, in order:

• Customize Fields…, on its own. Which fields show on this record is a per-view utility rather than a primary action, so it sits above the first divider.
• Reassign Asset…, Record Assignment Acknowledgement when the assignment is waiting on one, and Duplicate Record.
• Mark Verified (Physical Inventory) and Flag for Audit, which reads Unflag for Audit once the asset is flagged.
• Report Lost / Stolen…, Decommission Asset, and Retire / Dispose….
• Delete Asset, in red, below the last divider.

Change Status is not in this menu. It lives on the status badge at the top of the record, which is the more direct gesture, and having it in two places was the older behaviour.

Decommission is not disposal

Two items in the same group, and they do different things. Decommission takes the machine out of service. Retire / Dispose records how it left.

Decommission Asset runs immediately. It moves the asset to a decommissioned state and writes a lifecycle event, and that is the whole of it. Use it when a machine is out of service but you are not yet ready to account for its disposition, or when it is going to a warehouse and the paperwork comes later.

Retire / Dispose… opens a sheet, because the sheet is where the evidence is collected. Nothing is written to the register until you confirm in the sheet.

The disposal sheet

Four groups of fields, in the order an auditor reads them: what the media is, what was done to it, who checked, and where it went.

1. Media

   Asset tag, serial number, make and model, and media type, carried over from the record. Read them here rather than in the table: the certificate prints exactly these values.

2. Sanitisation

   Action level and Method are chosen from the NIST SP 800-88 Rev.1 vocabulary. Tool / version is free text, and is where you name the software that did the work. Sanitised on is the date the wipe or destruction happened, which is not always today.

3. Verification

   Verification is either Verified or Not verified, and Verified by names the person who checked. Leaving it unverified is allowed and is recorded as such.

4. Disposition

   Disposition method and Disposition date. The method is what physically happened to the machine, which is a separate question from what happened to the data on it.

The certificate

A one-page PDF, generated from the record, stored against the asset. It is the audit-grade evidence that closes ISO A.7.14 and the HAM disposal control.

The page is laid out as four labelled grids, in the same order as the sheet: Media, Sanitisation (NIST SP 800-88 Rev.1), Verification & disposition, and then two signature lines. Under the sanitisation grid, the action level’s own description is printed in small type, so the reader does not have to look up what the level means.

The signature lines are Performed by and Verified by. The first is filled from the person who ran the disposal. The second is filled only when the record is verified; if it is not, the line is left blank for a wet signature.

The footer reads Generated by Starkive Manifest · NIST SP 800-88 Rev.1 followed by the generation date. The file is named after the asset tag, for example STRK-0007-sanitisation-certificate.pdf, and it is stored through the same attachment layer as every other document on the record, so it appears in the Documents section.

What the certificate will not do

Three things worth knowing before you rely on it.

• It does not sign itself. The signature lines are lines. Manifest prints the names it has and leaves the rest blank; the signing is yours.
• It does not verify anything. The Verification field records what you told it. If you set it to Verified without checking, the certificate says Verified.
• It does not regenerate. The PDF is generated once, at disposal, and stored. Editing the record afterwards does not change the stored certificate. If you need a corrected one, dispose again or replace the document.

Where the machine goes afterwards

A disposed asset stays in the register. It is not deleted, and it is not hidden.

The record keeps its full history, its documents, and its certificate. It appears in the Lifecycle screen under the disposed phase, and the phase list shows how long it has been there. From that list, Open in Assets takes you to the filtered register if you need the table view.

If you genuinely need the record gone, Delete Asset is the last item in the Actions menu. It is a soft delete: the asset is hidden from the register and its audit trail is kept, because a machine that existed still happened.