Assets
Ten lifecycle states, each a separate permission
A coordinator can move an asset to review. Only an approver can approve it. The separation is enforced by the permission model rather than left to good behaviour.
- Draft, intake, review, approved, active, maintenance, change pending, suspended, retired, disposed
- Confidentiality, integrity, and availability rated independently
- Valuation policies and methods applied per asset
- Company-defined custom fields without a schema change
Draft·asset-coordinator creates
Lifecycle
Transitions are permissioned individually
Submit, send back, send to review, approve, and activate are distinct permissions. That granularity is what makes segregation of duties real rather than aspirational.
- Lifecycle events recorded for every transition
- Asset requests with priority and approval decisions
- Evidence attached at asset level
- Bulk actions reserved to administrator bundles
| Action | asset-viewer | asset-coordinator | asset-approver | asset-admin |
|---|---|---|---|---|
| View | Allowed | Allowed | Allowed | Allowed |
| Create and edit | Not allowed | Allowed | Not allowed | Allowed |
| Submit for intake | Not allowed | Allowed | Not allowed | Allowed |
| Send to review | Not allowed | Allowed | Not allowed | Allowed |
| Send back | Not allowed | Allowed | Allowed | Allowed |
| Approve | Not allowed | Not allowed | Allowed | Allowed |
| Activate | Not allowed | Not allowed | Allowed | Allowed |
| Module settings | Not allowed | Not allowed | Not allowed | Allowed |
Every module ships bundles at this granularity. Segregation-of-duties conflicts are declared as rules, with logged exceptions.
Context
An inventory that connects to the programme
Assets carry typed relationships to each other, named consumers with usage types, and links out to policies, compliance, findings, and controls.
- Category, type, and subtype hierarchy
- Environment, data classification, and hosting model as configurable options
- Consumers with usage type, and asset-to-asset relationships
- Links to policy, compliance, findings, and controls
- PaymentsDomain
- Card acquiringCapability3 risks2 policies
- Merchant settlementService4 controls2 assets
- Daily reconciliationProcess1 risk2 controls1 finding
Every level links out to risks, controls, policies, findings, assessments, and assets
Framework alignment
Works with your control frameworks
This module shares the platform control library. Map national frameworks and global standards alongside jurisdiction-specific authorities.
See asset management in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.