You record your systems, service providers and locations once as assets and link them to the business processes that use them. The ISMS module then calculates the required protection of each asset by itself: confidentiality, integrity and data protection come from the information, availability comes from the business impact analysis. This shows you at a glance which systems are critical for your business, and you can justify the required protection in an audit.
Prerequisites
- Every role can create assets. You can edit an asset as its Owner, as a Stakeholder or with the Key User or Admin role.
- The asset categories exist. Key Users and Admins maintain categories under Settings > Categories.
- To add dependencies from a process, you need edit rights on the business process.
Create an asset
Under Secondary assets in the navigation, each asset category of your organization has its own entry, for example software, hardware or suppliers.
- Click the matching category in the navigation.
- Click + Create in the top right.
- Enter a Title and choose the Category. The category is mandatory for assets and cannot be removed.
Manage the life cycle of an asset
Every new asset starts in the Proposed status. Use the … menu on the detail page to move it through its life cycle. This way you always see which systems are still being evaluated and which are in production.
| Status | Meaning | Next action in the … menu |
|---|---|---|
| Proposed | Newly recorded, not yet evaluated | Start evaluation or Discard |
| In evaluation | Being evaluated | Approve for use or Discard |
| In use | In productive use | Take out of use |
| Out of use | End of life, most changes are locked | Reactivate, then back to Proposed |
Add dependencies
Dependencies show which process uses which asset and which information is processed along the way. Only through them does an asset inherit its required protection.
| Direction | Where you add it | Allowed? |
|---|---|---|
| Business process → asset | On the process under Used assets | ✓ |
| Asset → asset | On the asset under Usage ("Add an asset this asset uses") | ✓ |
| Asset → business process | – | no |
| Business process → business process | – | no |
Link a process to an asset
- Open the business process and click + next to Used assets in the sidebar.
- Search for the asset and select it.
- Choose the Dependency mode (see below).
- Tick the information processed via this asset. The counter "n of n information item selected" shows how many you have chosen.
- Click Add dependency.
You add dependencies between two assets, such as a CRM that uses a database server, the same way on the using asset under Usage.
Choose the right dependency mode
The mode defines how strongly an outage of the asset affects availability. Choose it honestly: it determines how quickly the asset has to be back up.
Required
Without the asset, the process stops immediately
Outages propagate immediately without a viable workaround. The asset takes over the availability curve of the process unchanged.
When do I use this?
- The CRM for the "Create quotation" process
- The machine control system in production
Workaround possible
There is a temporary way around it
If the asset fails, you can keep working differently for a while. The availability requirement therefore shifts back by one BIA period.
When do I use this?
- Quotations can be created with a template for a while
- A replacement device is available
Optional
Not needed for availability
The asset is used, but its outage does not endanger the process. Availability is not passed on. The asset still inherits confidentiality, integrity and data protection from the linked information.
When do I use this?
- A reporting tool that is used only occasionally
How the required protection of an asset is derived
Under Required protection, the asset shows its derived protection requirements. You don't rate them yourself, the ISMS module calculates them from your processes and information.
| Information and BIA C, I and data protection on the information, availability from the process BIA | → | Dependency Ticked information and dependency mode | → | Required protection of the asset Calculated, not editable |
| Protection goal | How it is calculated |
|---|---|
| Confidentiality and Integrity | Highest value of all information ticked on the dependencies of this asset (maximum principle). |
| Data protection | Personal data, Art. 9 or Art. 10 GDPR, as soon as at least one of this information has the attribute. |
| Availability | Availability curve from the process BIAs, passed on through the entire dependency chain. Each dependency set to Workaround possible shifts the curve by one period. If several processes use the asset, the highest value per period applies. |
Availability is shown as a time series across the BIA periods. If no process with availability impact is linked to the asset, it shows "No propagated availability impact."
Example
The process "Create quotation" has an MTPD of 24 hours and processes pricing data (C and I severe) as well as customer contact data (personal data). You link the CRM with the mode Required and tick both information items. The CRM then inherits confidentiality and integrity "severe", the personal data attribute and the availability curve of the process.
See connections in the graph
On the detail page of a process or asset, the Dependencies area shows all connections as a graph. You can set the depth, zoom and use Center view to jump back to the middle. This helps you spot critical infrastructure quickly, such as a server that many processes depend on.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article