Organizations should document, purchase, and inventory spare hardware components to swap in the event of a hardware failure.

Control Type: Physical

Control Function: Corrective

Even in the modern golden age of information technology, hardware failures are still all too common. Hard drives fail, memory usage exceeds capacity, monitors dim out, and batteries die. These failures are often simple but cause great disturbances to regular operations. Organizations of all sizes should be proactively preparing for such failures to occur. The longer individual pieces of information technology are in circulation, the greater the risk of failure. The age and level of usage of each piece of tech should be taken into consideration when conducting risk assessments. To reduce downtime, organizations should have a spare parts plan and keep a stock of well-known spares for each critical piece of hardware.

Organizations should start by identifying the exact makes and models of each piece of technology in their environment. This step should have already been taken in the Hardware Asset Inventory step of Stage 1: Identify & Document. Each piece of hardware in said inventory should be further broken down to list all the main components comprising the system. There is a bit of leeway here since not all devices require specific matching components to function. For example, laptops from vendors such as Dell and HP come with specific M.2 SSDs installed. However, the specific model of SSD is not always important. They can be swapped out with different SSD vendors as long as the connector matches. Same with HDDs. What really matters is the HDD capacity and whether it has a SATA connector.

On the other hand, components such as RAM have more specific requirements. Each motherboard requires a specific RAM generation and speed and will not function with drastically different RAM chips installed. Other components such as graphics cards, network cards, cooling systems, and CPUs vary in how specifically they need to match.  Organizations need to fully scrutinize system requirements to ensure that they purchase correct hot spare components.

To achieve a sufficient inventory of hot spare parts, organizations should ensure that all the following components are accounted for on a per model basis (as needed):

  • Monitors
  • Peripherals (keyboards, mice, speakers)
  • Persistent storage (HDDs, SSDs, external drives)
  • RAM
  • CPUs
  • Motherboards
  • Network cards
  • GPUs
  • Network cables
  • Power adapters
  • Internal system cables
  • External system cables (HDMI, DisplayPort, USB-C)
  • Screws and standoffs