Asset classes
Group similar assets so they share default ratings and record the same details, such as a serial number and a calibration date for measuring equipment.
An asset class is a kind of asset: laptops, cloud accounts, customer databases, measuring equipment. Every asset can belong to one class. The class does three things:
- Its confidentiality, integrity and availability ratings are the defaults for its assets. A rating set on the asset wins.
- Its Fields add details that only assets of this class record. A laptop does not need a calibration date, and a caliper does not need a processing purpose.
- The risk gap analysis crosses asset classes with threat classes to show which threats no risk covers yet.
The tasks below follow the order of the work:
Scripts and integrations: see API below.
Add an asset class
- Open Assets → Asset Classes and choose Add asset class.
- Enter a Name, such as "Object storage buckets". The Slug fills in from the name.
- Add a Description of what belongs in the class.
- Set the Confidentiality, Integrity and Availability ratings that fit most assets of this class. Leave one unset if the class has no typical value.
- Choose Create.
Then pick the class on each asset, under Classification. Assets without a class show up on the overview as No asset class.
Start from a preset
A preset creates one asset class with its fields already defined. It creates no assets.
- Open Assets → Asset Classes and choose the arrow next to Add asset class.
- Choose a preset. The form opens with the name, the description and the fields filled in.
- Change what you like and choose Create.
The three presets:
- Processing activity: the record of processing activities under GDPR Art. 30 and the Swiss nFADP Art. 12.
- AI system: the inventory of AI systems you provide or use, for ISO/IEC 42001 and the EU AI Act.
- Measuring equipment: instruments to calibrate or verify under ISO 9001 7.1.5.
The presets leave out owner, retention and vendors, because every asset has those already.
Define the fields
- Open the asset class and go to the Fields tab.
- Choose Add field. Enter the label and choose the type: Single line, Paragraph, Numeric, Date, Pick one, Pick several or Yes or no.
- For Pick one and Pick several, type the options, separated by semicolons.
- Switch on Required if every asset must fill it. Use the arrows to change the order.
- Choose Save fields.
The fields appear under Details in the asset form and on the asset's page. Each field is also a column in the CSV export of the asset list.
A saved field keeps its type. To change the type, remove the field and add a new one. Removing a field hides its stored values. It does not delete them.
Watch out: Required is checked when someone saves a value in the app. An import or an API call that leaves the field out still creates the asset.
Calibration due dates
For measuring equipment, link the calibration or verification certificate as evidence, with its validity date. The Next expiry column of the asset list (choose it under View) then shows the earliest validity date of the current files on the asset's evidence. That is the next calibration due date.
A calibration can also be a process run. Set the process to This process is about: An asset. After a run, an admin opens it under Processes → Submissions and chooses Pick an asset. The run then shows under Process Runs on the asset's page.
Archive or delete an asset class
Archive a class you no longer use. Its assets stay in the class, and you can restore it later. Archived classes are left out of the gap analysis.
Watch out: deleting a class takes it off all its assets. They lose the class ratings and fields, and the overview lists them as No asset class. The class's expected threats in the gap analysis are deleted too.
Reference
Fields of an asset class
| Field | Required | Notes |
|---|---|---|
| Name | yes | Shown on each asset of the class. |
| Slug | yes | Lowercase, unique in your organization. |
| Description | no | What belongs in the class. |
| Confidentiality, integrity, availability rating | no | Whole numbers 1 to 10. The default for assets that have no rating of their own. |
| Fields | no | Up to 50 fields. Labels up to 200 characters, up to 50 options per field. |
Owners and admins manage asset classes. Members and auditors read them. See permissions.
API
| Call | Endpoint | Organization id |
|---|---|---|
| List | GET /asset-classes/ | query, required |
| Create | POST /asset-classes/ | body, required |
| Read | GET /asset-classes/{id}/ | not used |
| Update | PATCH /asset-classes/{id}/ | not used |
| Replace the fields | PUT /asset-classes/{id}/fields/ | not used |
| Archive | POST /asset-classes/{id}/archive/ | not used |
| Restore | POST /asset-classes/{id}/restore/ | not used |
| Delete | DELETE /asset-classes/{id}/ | not used |
The calls for expected threats are on the gap analysis page.
PUT /asset-classes/{id}/fields/ replaces the whole list. Each field has label, type (text, textarea, number, date, select, multiselect or checkbox) and, for select and multiselect, options. New fields get an id from the server. A field that keeps its id keeps its stored values. Changing the type of a saved field returns 400. With "purgeRemoved": true, the call deletes the stored values of removed fields on the assets that are in the class at that moment.
An asset sends its field values as fieldValues on POST /assets/ and PATCH /assets/{id}/, an object keyed by field id.
How is this guide?
Assets
Keep one inventory of the systems, data and equipment you protect, rate how sensitive each one is, and see which ones still need a class, a risk, a control or a review.
Access reviews
Check, asset by asset, that the right roles have access when someone joins, when someone leaves, and on a regular schedule, and keep a record an auditor can follow.