Appearance
Asset Intelligence
Where to find it: Regulatory Compliance, then Assets & Inventory (/inventory). Each asset opens into a single view that brings its details, ownership, dependencies and linked records together.
See it in the product
See how the asset register connects to the rest of the platform in OrviQ Asset Intelligence.
Asset Intelligence answers the questions a governance function keeps having to answer by hand: what do we run, who is accountable for it, what does it support, what has changed, and which risks, controls and evidence depend on it?
It is part of the OrviQ platform, built on the same governed data model as the rest of the GRC record. It is the asset register extended with discovery, ownership, change governance and linkage, not a separate system.
The principles
Asset data informs decisions. It does not make them.
- Observed is not approved. What a source reports and what the organisation has approved are held separately. The difference is shown, never silently overwritten.
- People decide. Where the platform cannot be sure, for example an ambiguous match between two sources, it asks a person and records the reason.
- No automatic conclusions. Asset data does not decide control effectiveness, risk or compliance by itself. Those determinations follow the normal governed workflows.
- Unknown stays unknown. Missing coverage or missing ownership is reported as unknown or missing, never assumed healthy.
What it provides
| Capability | What it gives you |
|---|---|
| Governed register | One record per technology asset with a stable business reference, classification and criticality. Business services and third parties are never duplicated as assets |
| Accountable ownership | Named owner and custodian roles that the person accepts, with periodic attestation |
| Reconciled discovery | Feeds from several kinds of source keep their own provenance. Ambiguous matches wait in a review queue for a person to decide |
| Change governance | Observed changes are raised as explainable signals on the asset for human review |
| Dependencies and impact | Relationships between assets, and between assets and the business services they support |
| Coverage and exceptions | Expected security-tool coverage with explained gaps, and time-boxed exceptions that need independent approval |
| Linked to GRC | Reviewed associations between assets and existing risks, controls, requirements, findings, evidence and action plans |
How it connects to the rest of OrviQ
| Related area | Connection |
|---|---|
| Assets & Inventory | The register itself, its fields and its boundary |
| Scope Registry | Assets can be members of declared scopes, with effective dating |
| Business Impact Analysis | Dependencies feed the picture of what a business service relies on |
| Security Tool Integrations | A source of the discovery and coverage signals |
| Cloud & Identity Discovery | Another source of discovered assets |
| Workbench | Reviews and ownership actions arrive as work for the person who must act |
| GRC Calendar | Governance dates such as attestation and exception expiry appear alongside other obligations |
What it does not do
- It does not decide that an asset is compliant, or that a control is effective.
- It does not create findings, risks or actions on its own.
- It does not replace the governance records it links to. It adds the asset context to them.
Access
Visibility follows role permissions and organisational scope, and every governed action is attributed to a named person. See User Roles & RBAC.
Availability
Asset Intelligence capabilities are introduced progressively. Ask your OrviQ administrator which capabilities are enabled for your tenant.