Assets

Overview

Assets are organized into Asset Classes, linked with Entitlements for access reviews, and can undergo Reviews similar to risks. Together, they ensure that resources are systematically identified, assessed, and managed with clear accountability and oversight.

Asset Management

Assets connect directly to controls, locations, roles, and risk management activities. Each asset includes detailed fields to describe ownership, classification, and security attributes.

Fields Explained

Labels

Labels are free-form, color-coded tags you manage centrally under Collections → Labels and attach to an asset to capture cross-cutting groupings the structured fields don't — a data-sensitivity class, an environment (production/staging), an owning team, or a project. An asset can carry any number of labels, and the asset list offers a Labels filter to narrow to everything sharing a tag. The same labels can be applied to risks and vendors, giving you one consistent vocabulary across the product.

CIA Triad in Risk Management

Assets use the CIA Triad to assess security properties:

• Confidentiality: Ensures sensitive information is accessible only to authorized parties.
• Integrity: Ensures information remains accurate, consistent, and unaltered.
• Availability: Ensures information and systems remain accessible when needed.

In risk management, the CIA Triad helps quantify asset criticality and define security requirements. For example, a financial database may have Confidentiality: 10, Integrity: 10, Availability: 8, requiring strong encryption and redundancy.

When an Asset Class is assigned, its CIA ratings combine with the asset’s ratings. The final score is an average of the two, ensuring both the general class properties and the specific asset details influence the result.

Assessment Matrix

Assets → Assessment Matrix plots the inventory by its CIA ratings, on the same shell as the risk matrix, in three readings switched with the tabs above it:

• Heat map — one row per dimension (confidentiality, integrity, availability), one column per rating bucket (1–2 up to 9–10), each cell showing how many assets are rated there and its severity band. Select a cell to list those assets in the inspector. The strip below gives the distribution of overall sensitivity and how many assets are still unrated.
• Triad — the ternary plot: where each asset's C:I:A balance sits between the three corners, with assets at the same balance merged into one bubble. Hover a bubble for its assets.
• Plot — confidentiality against integrity on continuous axes, bubbles tinted by the asset's most sensitive rating, with the high sensitivity count and the top exposures beside it.

Overall sensitivity is the highest of the three ratings: Low (1–3), Medium (4–6), High (7–8) and Critical (9–10). Critical is the top of the high band, so "rated 7 or higher" always matches the High figure elsewhere. Assets without any rating are counted as unrated and left off the plots.

About Access Management

Access management ensures that assets are available only to the right people.

• Memberships define which roles have access to an asset.
• Retention periods specify when access should expire or be reviewed.

These connect directly to Access Reviews, allowing organizations to periodically validate who has access to which assets.

Import and Export

Assets can be imported/exported in CSV format:

slug,name,status,ownerId
aws,AWS,ACTIVE,{ownerId}
github,Github,ACTIVE,{ownerId}
slack,Slack,ACTIVE,{ownerId}
datacenter-eu,European Data Center,ACTIVE,{ownerId}

Asset Classes

Asset Classes categorize assets with similar security and risk properties, streamlining assessments and standardizing CIA definitions across your organization.

Fields Explained

When applied, the asset class CIA ratings combine with the specific asset’s CIA scores to produce a final average.

Import and Export

Assets classes can be imported/exported in CSV format:

slug,name
cloud,Cloud
vendor,Vendor
hardware,Hardware
software,Software

Access Reviews

Access Reviews validate who has access to which assets through structured onboarding, offboarding, and periodic reviews.

Fields Explained

Review Types

• Onboarding: Grants access to assets during a new member’s onboarding.
• Offboarding: Revokes access to assets during employee departure.
• Periodic Review: Periodically validates asset access to ensure users have the correct level of access.

During entitlement reviews, assets are displayed in a snapshot view. Each entry can be Approved, Skipped, or Withdrawn. Once completed, the review is locked and can generate a formal report.

Reviews

Each review lists all assets according to the chosen scope. Any changes made during the review are tracked and displayed as diffs, allowing you to compare against the latest version or earlier cycles. A split view can be enabled for easier side-by-side comparison.

Each review item must be explicitly approved. If necessary, items can also be withdrawn. Once all review items are approved, the review can be closed by selecting Finish Review. This locks the review and prevents further modifications.

Reviews also integrate with the Reports feature through Generate Report, allowing you to export finalized review results for audits, compliance evidence, or internal governance tracking.

Tasks

Each asset's detail view has a Tasks tab for the work attached to it — hardening a system, updating a data-flow diagram, following up after a review. Use Add task and it is attached to the asset automatically. These tasks appear in the central Tasks worklist and, with a deadline, on the Roadmap.

Comments

Assets, asset classes, access reviews and asset reviews each have a Comments tab on their detail view for discussing it in place, so the reasoning behind a decision stays attached to the record instead of living in a chat thread nobody can find later.

Write a comment with light formatting (bold, italic, underline, lists), reply to any comment (replies cannot be nested further), and edit or delete your own. Deleting a comment that has replies leaves a placeholder so the conversation still reads in order.

Type @ to mention a colleague. They are notified in the app and by email, and can adjust how often they hear about comments under Account → Notifications.