Asset Management
Ten lifecycle states, each a separate permission
A coordinator can move an asset to review. Only an approver can approve it. The separation is enforced by the permission model rather than left to good behaviour.
- Draft, intake, review, approved, active, maintenance, change pending, suspended, retired, disposed
- Confidentiality, integrity and availability rated independently
- Valuation policies and methods applied per asset
- Company-defined custom fields without a schema change
In the application · Govern
- Asset register
- Asset requests
- Approvals
- Types & taxonomy
- Relationships
- Consumers
Draft·asset-coordinator creates
Lifecycle
Transitions are permissioned individually
Submit, send back, send to review, approve and activate are distinct permissions. That granularity is what makes segregation of duties real rather than aspirational.
- Lifecycle events recorded for every transition
- Asset requests with priority and approval decisions
- Evidence attached at asset level
- Bulk actions reserved to administrator bundles
| Action | asset-viewer | asset-coordinator | asset-approver | asset-admin |
|---|---|---|---|---|
| View | Allowed | Allowed | Allowed | Allowed |
| Create and edit | Not allowed | Allowed | Not allowed | Allowed |
| Submit for intake | Not allowed | Allowed | Not allowed | Allowed |
| Send to review | Not allowed | Allowed | Not allowed | Allowed |
| Send back | Not allowed | Allowed | Allowed | Allowed |
| Approve | Not allowed | Not allowed | Allowed | Allowed |
| Activate | Not allowed | Not allowed | Allowed | Allowed |
| Module settings | Not allowed | Not allowed | Not allowed | Allowed |
Every module ships bundles at this granularity. Segregation-of-duties conflicts are declared as rules, with logged exceptions.
Context
An inventory that connects to the programme
Assets carry typed relationships to each other, named consumers with usage types, and links out to the risks, controls, policies and findings on each. A vulnerability links to the asset instance it affects.
- Category, type and subtype hierarchy
- Environment, data classification and hosting model as configurable options
- Consumers with usage type, and asset-to-asset relationships
- Links to policy, compliance, findings, controls, threats and vulnerabilities
- PaymentsDomain
- Card acquiringCapability3 risks2 policies
- Merchant settlementService4 controls2 assets
- Daily reconciliationProcess1 risk2 controls1 finding
Every level links out to risks, controls, policies, findings, assessments, and assets
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
Solutions by role
Built for your team
See asset management in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.