Keep an inventory of what you protect, organized into asset classes you define, each asset with an owner, CIA ratings and an active or retired status. The inventory is the scope your controls apply to, so coverage is measured against a real estate rather than an assumed one.
One inventory of asset classes you define, each asset owned and rated, that your controls apply to.
Add assets into asset classes you define, whether that’s cloud, repositories, databases or endpoints, each asset with an owner, CIA ratings and an active or retired status. You decide what belongs in scope, so nothing important sits unaccounted for.
Every asset has an owner and CIA ratings for confidentiality, integrity and availability, so the people accountable and the sensitivity of each asset are clear instead of buried in a long list.
Your controls apply to the assets in this inventory, and retiring an asset takes it out of scope. What you protect is defined here, so coverage means coverage of a real estate, not an assumed one.
Your controls map to the assets in this inventory, so when coverage says a control is met, it’s met against the estate you actually track, not a list you hope is complete.
Four choices behind how the inventory works here, each one something you can check, not an adjective.
Your controls map to the assets you track here, so coverage is measured against a real estate rather than an assumed one.
You organize the inventory into your own asset classes, whether that’s cloud, repositories, databases or endpoints, instead of being boxed into a fixed set of types.
Each asset carries an owner, CIA ratings and an active or retired status, so who’s accountable and what’s still in scope is clear rather than guessed.
Mark an asset retired and it drops out of your control scope, so the inventory reflects what you run today instead of drifting out of date between audits.
Hosted in Switzerland by default, in German and English, with on-premise possible. Your data is yours, with CSV export of your inventory and no lock-in.
Assets are one module; the inventory is the scope the rest of the workspace builds on, from the risks an asset carries to the coverage measured against it.
Tie a risk to the assets it threatens, scoped from this inventory.
Connect the third parties behind the assets you track.
See control coverage measured against the assets in your inventory.
Attach proof to the asset the control applies to.
You define your own asset classes, so the inventory holds whatever fits your estate, whether that’s cloud, repositories, databases or endpoints. Each asset has an owner, CIA ratings and an active or retired status.
No. Assets are tracked in the inventory by you, so what’s in scope is what you’ve decided is in scope. There’s no automatic AWS, Azure or GCP sync, and that’s deliberate: your control scope reflects the estate you’ve accounted for, not whatever a scan happened to find.
The inventory is the scope your controls apply to. When coverage reports a control as met, it’s met against the assets you actually track, so coverage reflects a real estate rather than an assumed one.
In a spreadsheet, an asset is a row disconnected from the controls meant to protect it. Here, the inventory is the scope your controls map to, each asset has an owner, CIA ratings and an active or retired status, so what you protect and what your controls cover stay the same list.
Swiss-hosted by default, in German and English, with on-premise possible. Your data is yours, and you can export your inventory to CSV, so there’s no lock-in.
Track your assets in one inventory, organized into classes you define, each owned and rated, and let your controls apply to a real estate. Coverage you can stand behind starts with the assets you actually track.