Appearance
Assets & Inventory
Where to find it: Regulatory Compliance, then Assets & Inventory (/inventory).
The asset register answers one question: what exists?
Its business reference is AST-YYYY-NNNN.
The asset boundary
The asset register is technology and infrastructure inventory only
It holds applications, servers and endpoints, databases, network security devices, cloud workloads and subscriptions, SaaS platforms and identity security systems.
It does not hold business services, third parties, departments or legal entities. Those are first-class canonical records in their own right and are never duplicated as pseudo-asset rows.
This boundary is worth defending. Registers that admit anything become a second-rate copy of every other register — a "third party" row in an asset inventory has no contract, no engagement, no criticality determination and no due diligence, and yet looks authoritative.
Scopes link directly to canonical subjects, so a scope containing three applications, two vendors and a department contains them as what they are.
Asset types
| Type | Examples |
|---|---|
application | Business applications |
server_endpoint | Servers, workstations |
database | Database instances |
network_security | Firewalls, gateways |
cloud_workload | Cloud compute and subscriptions |
saas | Software-as-a-service platforms |
identity_security | Identity and access management systems |
other | Anything genuinely outside the above |
What an asset record carries
| Field | Purpose |
|---|---|
| Business reference | AST-YYYY-NNNN, immutable |
| Name and description | Identification |
| Asset type | The classification above |
| Business service | The service it supports |
| Owner and custodian | Who is accountable, and who operates it |
| Environment | production, staging, development, dr, corporate |
| Criticality | Critical, High, Medium, Low |
| Data classification | Public, Internal, Confidential, Restricted |
| Hosting location | Where it runs |
| Status | active or decommissioned |
| Source | Provenance origin (manual, or scanner:<vendor> e.g. scanner:tenable_sc, scanner:azure) |
| Discovery review status | unassigned, reviewed, merged, or ignored for auto-discovered assets |
| Last seen at | Timestamp of most recent scan or discovery observation |
| Attributes | Custom fields |
Owner and custodian
These are different roles and separating them matters.
- The owner is accountable for the asset: its purpose, its criticality, its data.
- The custodian operates it: patching, backup, availability.
An application owned by the Head of Retail Products and operated by Infrastructure has two people with two different sets of obligations. Recording one name loses that.
Decommissioning
Decommissioning is a soft operation: the status moves to decommissioned and the record remains.
Decommissioning an asset does not remove it from scope
Scope membership is effective-dated separately. Removing a decommissioned asset from a scope is a deliberate act that sets the membership end date.
Until you do it, the asset remains in the scope population and continues to be counted in coverage denominators — where it will show as uncovered, because nothing is collecting evidence from a decommissioned system.
That behaviour is intentional. Decommissioning is a technology event; leaving a compliance scope is a governance event. Making the second automatic would let scope silently shrink.
Where assets are used
| Consumer | Use |
|---|---|
| Scope Registry | Assets participate as effective-dated scope members |
| Indicators | Scope populations form the coverage denominator |
| Evidence assertions | Assets are assertion subjects |
| BIA and resilience | Assets are service dependencies |
| Audit engagements | Assets are scoped into engagements |
| Incidents | Assets are affected objects |
Discovered assets & review workflow
Assets can be automatically discovered and reconciled from Security Tool Integrations (e.g. Tenable, Nessus, Nipper, Qualys) and Cloud & Identity Discovery (e.g. Azure, AWS, GCP, vSphere).
Identification ladder
When a scanner or cloud provider reports a host or resource, OrviQ resolves it to an existing asset record using a progressive ladder of natural keys:
$$\text{Scanner UUID / Cloud ID} \longrightarrow \text{MAC Address} \longrightarrow \text{FQDN} \longrightarrow \text{IP Address} \longrightarrow \text{Hostname}$$
Many external identities link to one canonical Asset via AssetDiscoveryIdentity records. If Tenable and Nipper inspect the same firewall under different identifiers, both are reconciled to the same AST-YYYY-NNNN record without creating duplicate assets.
The review queue
To prevent automated pipelines from silently admitting unverified infrastructure into governed compliance scopes, newly discovered assets enter the review queue:
- Discovered assets initially carry
discovery_review_status = "unassigned". - Authorized operators review unassigned assets and choose one of three actions:
- Reviewed / Approved (
reviewed): Confirms the asset into active governed inventory and allows it to be assigned owners, criticality, and compliance scopes. - Merged (
merged): Unifies the record with an existing asset where natural keys did not automatically match. - Ignored (
ignored): Marks the record as ignored (e.g. transient test instances, out-of-scope ephemeral nodes).
- Reviewed / Approved (
Protection of human governance fields
Automated integrations populate blank technical attributes (IP address, MAC, operating system, FQDN, hardware model).
Scanners and cloud discovery never overwrite human-governed attributes:
ownerandcustodiancriticalitydata_classificationenvironmenthosting_location
Scanner absence is not decommissioning
If an asset is not seen in subsequent scans, its discovery presence changes to stale or missing. The asset is never automatically decommissioned by scanner absence. Decommissioning remains a deliberate human governance action.
Building the inventory
Start from what you already have. Most organisations hold an asset list in a configuration management database, a cloud inventory or a spreadsheet.
Get subject identity right. The identifier by which an asset is known here must be the identifier your evidence sources report, or coverage will read zero while the collectors report success. This is the single most consequential detail in the whole setup.
Record the business service. An inventory that does not connect systems to services cannot answer the resilience question.
Do not aim for total completeness first. An accurate inventory of what is in your compliance scopes is more useful than a complete inventory of everything that is 70% accurate.
Permissions
| Action | Permission |
|---|---|
| View assets and scopes | scope.read |
| Create and edit assets, decommission | scope.manage |
| Review, approve, merge or ignore discovered assets | asset.discovery_review |
The Scope Registry and Assets are core infrastructure, available across tiers and not separately licensed. Reviewing discovered assets requires asset.discovery_review under the integrations_security_tools or cloud_discovery entitlement.
Example
A bank's inventory holds 1,847 assets.
| Type | Count | In compliance scopes |
|---|---|---|
application | 312 | 208 |
server_endpoint | 1,104 | 1,040 |
database | 187 | 154 |
cloud_workload | 168 | 168 |
saas | 51 | 22 |
network_security | 19 | 19 |
identity_security | 6 | 6 |
Not in the register: the 94 third parties, the 41 business services, the 22 departments and the 4 legal entities. Each lives in its own canonical register and participates in scopes directly.
The gap between saas count and scope inclusion — 51 registered, 22 in scope — was the finding that came out of building the register. Twenty-nine SaaS platforms were in use with no compliance scope covering them, several holding confidential data.
Troubleshooting
"Coverage is zero although collectors succeed." Subject identifiers do not match between the evidence source and the asset record. This is the most common setup problem in the platform.
"A decommissioned asset still counts in coverage." Scope membership was not ended. Decommissioning and scope removal are separate acts.
"I want to add a vendor to the asset register." Add it to the third-party register and link it into the scope directly. Do not create a pseudo-asset.
"Assets & Inventory is not visible." Requires scope.read.