This is a great question and right off the bat, I definitely would stick with at least those three KPAs; however, I would argue that adding “Compliance” would be an additional KPA to include. Regardless of the standards that need to be met around compliance, or the stage in which a company is at, some level of Compliance seems to be something that should always be considered when developing an ITAM; otherwise, you run the risk of being in the “wild, wild, west” situation where anything goes making it increasingly harder and more difficult for your stakeholders who are responsible for wrangling all that in at a later date.