Assets and asset groups

Assets in the sidebar is the inventory: systems, services, repositories, databases, devices — whatever your controls need to be true of. It is a quieter register than vendors or risks, and it earns its keep in exactly one place: scoping.

Why it matters more than it looks

A control like “production databases are encrypted at rest” is a claim about a set of things. Without an inventory, an automated test either covers everything of a matching type or nothing, and neither answers the auditor’s question — which systems, and how do you know that is all of them.

An asset carries an identity, a type, a source (manual, or a connector that ingested it) and metadata, plus its linked controls and its own audit trail.

Groups, and the two kinds

Asset groups are how you address assets in bulk, and there are two ways to build one:

• Explicit — you add members by hand. Right for a small, stable set that has no rule behind it.
• Rule-based — a predicate decides membership, and the group re-resolves as assets are added, changed or archived.

Prefer the rule where one exists. An explicit group is a list somebody has to maintain, and the failure is silent: next quarter’s new production database is simply not in it, the control’s test passes over a set that no longer matches reality, and nothing anywhere says so.

Scoping a control

A control’s Scoping tab attaches asset groups to it. Left empty, a run covers every asset of a matching type across the organization; with groups attached, it covers what those groups resolve to — and the tab shows you the resolved asset list before you save, so “which servers does this actually test” is answered on screen.

See Working with controls.

Narrow scope is a claim you have to keep true

Scoping a control to three asset groups says the rest are out of scope. If a new system lands outside every group, it is untested — and an untested asset looks exactly like a passing one on the control register. Rule-based groups are the defence; a quarterly look at what falls outside every group is the backstop.

Archive, don’t delete

Assets are archived, not removed. A decommissioned server was in scope for the period an auditor is examining, and the evidence collected against it has to keep making sense. The register filters to active by default, so archiving keeps the working list clean without rewriting history.

Getting them in

Add them by hand for a handful. Beyond that, use the importer — assets are one of the registers the import wizard covers — or let a connector ingest them, which keeps the inventory current without anyone maintaining it. See Integrations.