Part of Infrastructure hosting standards for the NHS
Asset lifecycle and configuration management
Standards you should meet on the lifecycle management, configuration and visibility of hosted infrastructure assets.
1. NHS organisations should maintain accurate visibility of hosted infrastructure assets and their lifecycle status
Importance of meeting the standard
Without clear visibility of infrastructure assets and their lifecycle status, organisations risk operating unsupported systems, introducing avoidable vulnerabilities and experiencing unplanned failures. Effective asset lifecycle management supports proactive planning, safer operation and sustainable service delivery.
When to meet the standard
- deploying or onboarding new hosted infrastructure
- reviewing risks associated with ageing or unsupported assets
- planning refresh, upgrade or migration activity
- responding to incidents linked to asset failure or obsolescence
How to meet the standard
- hosted infrastructure assets are identified and recorded
- asset records include ownership, location and support status
- lifecycle stages (such as in‑support, end‑of‑life or end‑of‑support) are understood
- asset information is reviewed and kept up to date
- unsupported, end‑of‑life or end‑of‑support assets are identified and actively managed, with plans in place to remove or replace them
- end‑of‑life or end‑of‑support infrastructure assets should not be used to support production services unless a formally documented exception is in place, with defined mitigation and a time‑bound plan for replacement
- asset records should cover physical, virtual and cloud‑hosted infrastructure
- asset information should be accessible to relevant operational and support teams
- changes to asset status should be reflected in a timely manner
2. NHS organisations should ensure infrastructure configuration is documented and understood
Importance of meeting the standard
Accurate configuration information is essential for understanding how systems operate, how they are interconnected and how changes or failures may affect services and supports operational stability and recovery.
Poor configuration visibility increases the risk of inappropriate change, prolonged incidents and recovery errors.
When to meet the standard
- designing, deploying or modifying hosting environments
- implementing changes or upgrades to infrastructure
- responding to incidents or recovery scenarios
- reviewing system dependencies and operational risks
How to meet the standard
- key configuration details for hosted infrastructure are documented
- dependencies between infrastructure components and systems are understood
- configuration information supports impact assessment during change and incident response
- configuration documentation is reviewed and updated following material change
- configuration information should reflect both logical and physical relationships where relevant
- documentation should support dependency sequencing during recovery
- configuration records should align with asset lifecycle records
3. NHS organisations should use asset and configuration information to support planning, change and resilience decisions
Importance of meeting the standard
Asset and configuration data is only valuable if it is actively used. Applying this information to planning and decision‑making supports safer evolution of infrastructure, reduces technical debt and strengthens resilience over time.
When to meet the standard
- planning infrastructure refresh or expansion
- assessing the impact of proposed changes
- reviewing resilience, recovery or continuity arrangements
- evaluating lessons learned from incidents
How to meet the standard
- asset and configuration information informs change and maintenance decisions
- lifecycle status is considered when prioritising investment or remediation
- dependencies are accounted for in recovery and resilience planning
- recurring risks linked to configuration or legacy assets are addressed
- asset and configuration data should be usable for impact analysis
- information should support coordination between infrastructure, service and recovery activities.
Last edited: 18 June 2026 2:09 pm