The asset inventory lists what you need to protect: laptops and servers, software, cloud services, important data, networks and sites. NIS2 and ISO 27001 both expect you to know your assets and who is responsible for them.
How to add an asset
- Open Assets in the menu, then Add asset.
- Give the Asset a name, for example "Customer database" or "Microsoft 365", and add a Description.
- Choose the Type: Hardware, Software, Cloud service, Data, Network, Site or building, or Other.
- Choose the Criticality (Low to Critical) and the Classification (Public, Internal, Confidential or Restricted).
- Set the Owner, the Location and the Status (In use or Retired).
- Optionally set a Next review date.
- Click Save asset. It gets a number such as A-3.
How to link risks
On the asset's page, under Risks that affect it, choose the risks from your risk register that affect this asset and click Save links. You then see which risks threaten your most important systems.
How to work with the inventory
- Search, filter by type, criticality or status, and sort by reference, most critical first, name or next review.
- Start with your most important systems, cloud services and data; you do not need to list every mouse and cable.
- When an asset is no longer used, set its status to Retired instead of deleting it, so you keep a record of it.
What members can do
Members see the inventory and can add assets. Changing and deleting assets needs an owner or admin (or a custom role with that permission).
Tips
- Assets with a Next review date appear in Tasks as Asset review. When the date has passed, the asset's owner gets one reminder (or the owners and admins if no owner is set). Retired assets are left alone.
- Every change is shown under History and kept in the audit log. Numbers are never reused.
- Package limits: Free 25 assets, Supplier 50, Professional and higher unlimited.