About

Assets is your inventory of the things you need to protect: workstations, servers, firewalls, facilities and other items. Each asset has an owner, a status, a priority, a type and impact ratings, and you can link it to risks and vulnerabilities. Keeping this list current gives your risks and your compliance scope something concrete to point to.

Assets also arrive on their own when you connect a tool, so the list fills in without typing. You can add and import assets yourself for everything else.

Open the asset inventory

Use either of these routes:

• In the sidebar, select Manage › Assets. The page is titled Asset Inventory and has two tabs: Assets and Types.
• From the LaunchPad, select Quick create › Asset (shortcut /a) to open the form for a new asset from anywhere.

Manage › Assets and Monitor › Assets

ControlMap has two places called Assets, and they show the same assets for different jobs:

• Manage › Assets is your inventory, the master list you maintain. It holds the facts about each asset: owner, status, priority, type, department, classification, impact ratings and linked risks.
• Monitor › Assets shows the assets your connected tools found, with the results of the compliance checks run against each one, and which integration it came from.

An asset found by a tool is one record. It appears in both places with the same ID and Ext-ID, and selecting its name in Monitor opens its record in Manage › Assets. The switch that stops checks counting for an asset is in Monitor. Deleting an integration in Monitor also deletes the assets it found, along with their compliance status.

Browse the list

The Assets tab lists your assets in a table, loading more as you scroll. At the end of the list it reads "All assets loaded".

These columns are shown by default:

• ID, Name, Ext-ID (the identifier the source tool gave the asset), Owner and Type.
• Status, Priority, PII and CUI.

Select an ID or a name to open the asset. Hold Ctrl or Cmd while you select to open it in a new tab. To sort, select a column header. PII, CUI and Description can't be sorted.

You can change some values without opening the asset:

• Status: choose Active, Inactive or Under Construction from the dropdown. It saves at once.
• PII and CUI: choose Yes or No from the dropdown. It saves at once.

Search and filter

Type in Search assets to search the list. Select Filter to narrow it by:

• CUI assets only
• Status
• Employee owner
• ControlMap owner
• Asset type
• Priority

Each filter you choose appears as a chip above the list. Select Clear filters to remove them all.

Choose columns

Select Display to change the columns. You can switch on these extra columns:

• Description
• User
• Department
• Value
• Classification

Select Reset to default to go back to the standard set.

Group assets

To gather the list under headers, select Display › Group by and choose None, Type, Region, Status, Owner or Department. Select a group header to collapse or open that group. An asset with no value for the field you chose is placed in a group such as "No type", "No status", "Unassigned" or "No department". ControlMap remembers your grouping in this browser. Reset to default turns it off.

Open an asset

An asset's record opens as its own page. Use the Prev and Next arrows to step through the assets in the order of your list, or the back arrow to return to the inventory.

The record has these tabs:

• Properties: the asset's details. Select a value to edit it. You can set Asset name, Description, Status, Priority, Employee owner, ControlMap owner, Responsible team, Asset types, Region, Data classification, Retention period (days), Department, Personal data (PII), CUI and Tags. Last updated and Last seen are read-only.
• CIAA Matrix: impact ratings on a 1 to 3 scale (Low, Medium, High) for Confidentiality (C), Integrity (I), Availability (A) and Authenticity (A), plus an asset value and an overall rating.
• Risks: the risks linked to this asset.
• Vulnerabilities: the vulnerabilities linked to this asset.
• Additional Information: the details a connected tool sent about the asset.
• Watchers: who is notified about the asset.
• Activity: the history of changes to the asset.

Employee owner is a person from People, ControlMap owner is a ControlMap user, and Responsible team is a team. In the list, the Owner column shows the employee owner and the User column shows the ControlMap owner.

Set impact ratings

When an asset has a type, the CIAA Matrix tab has a box, Inherit CIAA values from asset type, that copies the ratings from the type. While it is ticked, you can't edit the ratings. Untick it to set ratings for this asset only. Ticking it again overwrites them with the type's ratings.

Add an asset by hand

1. Select Add Asset › Add Asset. A form opens above the list.
2. Type a name in Name the asset. The name can be up to 255 characters, and it is the only required field.
3. Optional: add a description in Add description..., and set the Owner, status, priority and Asset types chips. A new asset starts as Active with a Medium priority. You can choose more than one asset type.
4. Select Save, or press Cmd or Ctrl + Enter. Select Cancel or press Esc to close the form without saving.

The new asset appears in the list with the next ID. Open it to fill in the remaining details, such as department, classification and impact ratings.

The form opens above the list, so you can see the existing assets while you add a new one.

Add many assets from a file

1. Select Add Asset › Upload CSV. A side panel opens, titled "Import assets from a delimited file", with three steps: Upload File, Map Fields and Import.
2. Upload File: choose your CSV file and the delimiter (comma or pipe). Select Download sample file to get a template that lists the fields.
3. Map Fields: match each column in your file to an asset field. Required fields must be mapped. Select Validate to check the file.
4. Import: any errors found by the check are listed. Select Start Import to run the import.

Assets found by integrations

When you connect a tool that reports devices, those devices are added to your inventory automatically. These assets work like any other:

• The Ext-ID is the tool's own identifier for the device.
• The record's Additional Information tab holds what the tool sent. The tab notes that additional information can come from integrations.
• The record heading shows "(External system ID: …)" after the name.
• The list has no column for the source tool. To see which integration an asset came from, open Monitor › Assets, which has an Integration column.

Change several assets at once

1. Tick the assets you want to change. Tick the box in the header to select every asset that matches your current search and filters, not only the rows you have scrolled through. A message confirms this and offers Clear selection.
2. Use the bar that appears: Set type, Assign owner, Set status, Add tags, Export selected or Delete Asset.
3. Confirm. Set type, Set status and Add tags ask you to confirm the update first, and Set type warns that it moves the selected assets to the chosen type. A message tells you how many assets were updated.

Delete asks "Delete selected assets?" and says the action cannot be undone.

Link an asset to a risk or vulnerability

You can link an asset to a risk from either side. Both routes make the same link:

• From the asset: open its record, select the Risks tab, then Map risk, and search for the risk. You can also create a new risk from here, with the asset already attached.
• From the risk: open the risk's Mappings tab and use its Assets and Asset Types sections.

The Vulnerabilities tab works the same way for vulnerabilities. To remove a link, use the unlink control on the row and confirm "Unlink risk?".

An asset's Risks tab also lists risks linked to its asset type. You can't unlink those from the asset. Remove the link from the type or the risk it comes from instead. If a risk applies to every asset of one kind, link it to the asset type rather than to each asset.

Asset types

An asset type is a category of asset, such as Workstation or Physical Facilities. A type has its own impact ratings and linked risks, and its assets can inherit them. Select the Types tab to see them.

Each type is a card with an icon, a risk level, the type name, and counts of its assets and risks. Type Search asset types to find one. Select a card to open the type, which has four tabs: CIAA Matrix, Assets, Risks and Vulnerabilities.

To add a type:

1. On the Types tab, select Add Asset Type.
2. Enter the Asset type name (up to 150 characters) and save.
3. Open the type to set its impact ratings and to map risks and vulnerabilities.

Use the menu on a card to rename a type with Edit, or to remove it with Delete. Delete warns that assets assigned to the type may be affected.

Export assets

Select Export to download your assets as a file. Use Export selected in the selection bar to export only the assets you ticked.

Assets and your framework scope

On CMMC-type frameworks, the framework's Scope picks assets from this inventory, and its Assets tab links to the same records. Adding an asset to a scope doesn't change the asset itself.