The asset structure defines how your inventory is organised: into top-level categories, categories and statuses. This determines which checks apply to an asset. This article is aimed at ISMS managers who set up or adjust the structure.

Before you start

  • You need a functional role with the permission to maintain the asset structure; by default, the ISMS managers have it.
  • New organisations start with a prepared structure: the top-level categories IT assets, Buildings, Suppliers and Information & processes, categories such as Information, Process, Application, Cloud service, Server, End device, Network, Service provider and Building, and the statuses Draft, In operation, Under maintenance and Decommissioned. In addition, there is the top-level category “Organisation” with the fixed category “Organisation” for the asset of your organisation; the baseline check is preset for it.
  • You find everything under ISMS settings › Assets › Asset structure.

Top-level categories

A top-level category groups categories and determines which rules apply to its assets. You create another one with New top-level category. In the dialog of a top-level category, you set:

  • Assets in this top-level category have a status field: without the tick, the status disappears from the asset form, for example for buildings, suppliers or information. Such assets can then also not be set to “Decommissioned”.
  • Baseline check required: assets in this top-level category must carry out the baseline check.
  • Contains information and processes: for these assets, the protection requirement is determined with the protection requirements assessment and passed on to linked applications, systems, rooms and service providers.
  • Type: IT assets, Buildings or Suppliers. With this, Varmo suggests matching chapters of the catalogues when you define the requirements.

Whether an asset counts as information is decided solely by the Contains information and processes setting, not by the name. You can therefore rename top-level categories safely. If no such top-level category exists, the page shows a warning, because without it no protection requirement is inherited.

Categories

Each category belongs to exactly one top-level category. The category is required for every asset.

How to create a category

  1. Click New category.
  2. Enter the Name and choose the Top-level category.
  3. If the top-level category requires the baseline check, click Next. In the second step, choose the Baseline check requirements that apply to assets in this category: a whole catalogue, a chapter or individual requirements.
  4. Save with Create or Create with … requirements. If the selection is still unclear, choose Define later. The ISMS managers then receive a task, and assets in this category wait with the baseline check until then.

You change the requirements of existing categories with Define requirements on the category. Varmo suggests chapters there based on the position of the category in the dependency chain and on the type of the top-level category. Adopt suggestion only adds to the selection; it is saved only with Save. A changed selection applies immediately to the owners of the assets in this category.

Where a category sits in the dependency chain (from information down to rooms, buildings and service providers), you set under ISMS settings › Assets › Dependency chain. The position determines where the protection requirement is inherited. Before saving, Varmo shows how many assets are affected.

Statuses

Statuses apply to assets whose top-level category has a status field. You create more with New status. If you tick Only selectable after a completed baseline check for a status, an asset can only receive it after its baseline check has been approved. This is preset for “In operation”. Assets that already have the status keep it.

What happens next

  • Changes take effect immediately in the asset form and in the tasks.
  • If the requirements for a category are missing, the task Define requirements for the baseline check appears, together with an open item on the ISMS settings page.
  • If a category has suggestions that you have not yet selected, you receive the task Review suggested requirements once.

Frequently asked questions

Why can't I delete a category?

Categories used by assets cannot be deleted. First assign the assets to another category. The category “Organisation” is fixed.

What applies to assets without a category?

For older assets without a category, the baseline check applies until they are assigned. The inventory lists them at the top.

How do the asset structure and the baseline check work together?

The top-level category determines whether the baseline check applies, the category which requirements. More on this under Carrying out the baseline check for assets.