Asset inventory

The asset catalogue records systems, services, information, and other resources that risks can affect or depend on.

Browse assets

  1. Open Assets.
  2. Search by name, code, or description.
  3. Filter by type, sensitivity, owner, review status, or lifecycle status.
  4. Open an asset to review its owner, custodian, business unit, classification, history, and linked risks.

Operational filters can identify Restricted or Critical assets, overdue classification reviews, missing owners, and retired assets.

Image needed: Asset Inventory showing search, sensitivity filters, lifecycle status, and an asset row with its owner.

Understand access

  • View assets permits browsing and linked-asset context.
  • Manage assets permits creating, editing, retiring, restoring, and reviewing requests.
  • Classify sensitivity permits Restricted and Critical classifications.
  • Request assets permits asking an asset steward to create a missing record.

Some tasks need more than one capability. For example, reviewing requests requires both view and management access.

  1. Open the risk in Edit.
  2. Find the linked-assets picker in the relevant assessment section.
  3. Search for the asset.
  4. Select a relationship: Affects, Depends on, Processed by, Owned by, or Other.
  5. Add optional notes.
  6. Save the section.

Linking a Restricted or Critical asset adds a sensitivity advisory to the risk. It does not automatically change the risk score.

Request a missing asset

  1. Open the asset picker from a risk.
  2. Search carefully to avoid a duplicate.
  3. Choose the request-new-asset action.
  4. Supply the requested name, type, owner, and business context.
  5. Submit the request.

An asset steward can approve and create the asset, link it back to the risk, or reject the request with a reason.

Classification and review

The standard sensitivity levels are Public, Internal, Confidential, Restricted, and optionally Critical. Reclassification uses a dedicated action and records history. Authorized users can mark the current classification reviewed; the review cadence is configurable.

Create an asset

  1. Open Assets and select New asset.
  2. Enter a unique, recognizable name and code.
  3. Choose the asset type and lifecycle status.
  4. Add a description that helps risk owners distinguish it from similarly named assets.
  5. Select the owner and optional custodian.
  6. Choose the business unit and classification tags.
  7. Set the initial sensitivity and explain the classification.
  8. Set the next classification-review date when required.
  9. Save and reopen the record to verify it.

Creating or approving a Restricted or Critical asset requires the sensitivity-classification capability in addition to ordinary asset management.

Image needed: Asset Create page showing identity, ownership, business unit, sensitivity, justification, and review date sections.

Edit or reclassify an asset

Use normal Edit for descriptive, ownership, or lifecycle details. Use the dedicated reclassification action for sensitivity so RiskVault records the before-and-after level, justification, actor, and time consistently.

  1. Open the asset.
  2. Choose Reclassify.
  3. Select the new sensitivity.
  4. Enter a clear justification.
  5. Set the next review date.
  6. Confirm the change and review classification history.

Changing sensitivity can affect the advisory shown on every linked risk. It does not automatically rewrite those risks' scores.

Complete a classification review

  1. Filter Assets for Classification review due.
  2. Open an asset and verify its owner, purpose, data, dependencies, and current sensitivity.
  3. Reclassify if the level is no longer appropriate.
  4. Otherwise select the action that confirms the current classification.
  5. Set the next review date and save.

Review asset requests

Asset requests originate from risk users who cannot find the asset they need.

  1. Open the asset-request queue.
  2. Review the requested name, type, business context, and source risk.
  3. Search the catalogue again to avoid creating a duplicate.
  4. If an existing asset fits, resolve the request using that record when the page permits it.
  5. Otherwise approve and complete the new asset's ownership and classification.
  6. Confirm the asset is linked back to the requesting risk.
  7. If rejecting, give a reason that tells the requester what to do next.

Retire and restore assets

Retire an asset when it should no longer be selected for new work but must remain in history.

  1. Open the asset and review linked risks.
  2. Choose Retire and enter the required context.
  3. Confirm it no longer appears in ordinary active-asset selection.

Authorized managers can include retired assets in the Assets view and restore one if it returns to service. Retirement does not erase its history or remove existing risk links.

Resolve common asset problems

The asset does not appear in the risk picker
Clear search filters, check whether it is retired, and confirm you can view it. Submit an asset request only after checking for alternate names and codes.
I can edit an asset but cannot set Restricted or Critical
Those classifications need the separate classification capability.
A sensitivity advisory appeared on a risk
A linked asset is Restricted or Critical. Review the asset and its relationship; score the risk based on assessment rather than treating the advisory as an automatic rating.
My update was rejected as a conflict
Another person changed the asset after you opened it. Reload, compare, and reapply the intended change.