An asset is anything that has value for your organisation and must be protected: information, processes, applications, IT systems, rooms, buildings and service providers (ISO/IEC 27001, Annex A 5.9). This article shows how you record assets in the inventory, assign an owner and map dependencies between assets. It is aimed at ISMS managers and everyone who creates assets or is responsible for them.

Before you start

  • To create assets, you need a functional role with the permission to create assets. If you may only create your own assets, you automatically become the owner.
  • The asset structure (top-level categories, categories, statuses) is prepared for new organisations. See Adjusting the asset structure.
  • If possible, set up the checks for assets (approval workflow of the protection requirements assessment, catalogue of the baseline check) beforehand. Each owner then receives the right task straight away.
  • Your organisation itself has been recorded as an asset since setup. The name and category of this asset cannot be changed, and it cannot be deleted.

Work from the top down: first the most important information and business processes (e.g. customer data, payroll), then the applications, IT systems, rooms and service providers they use. The protection requirement is determined for the information and passed on to the systems that process it. A system can only submit its protection requirements assessment once the assessments of its information have been approved.

How to do it

  1. Open Assets › Inventory and click New asset.
  2. Enter the Name and optionally a Description.
  3. Choose the Category. It is required and determines which rules apply, for example whether a status is kept and whether the baseline check is needed. If a prerequisite for a check is missing, the form already shows a notice here.
  4. Choose the Owner. If you do not yet know who it will be, tick Assign owner later. You are then the provisional owner.
  5. If the category requires it, choose the Status (preset are, for example, Draft, In operation, Under maintenance, Decommissioned).
  6. Under Linked assets, specify what the asset is connected to, for example which information an application processes or which server it runs on.
  7. Optional: add a Reference and a Document (PDF).
  8. Save with Save and open or use Save and add another to record the next asset straight away.
  1. Information: Customer datahigh

    Result of the protection requirements assessment

    linked: passes on the protection requirement
  2. Processes and services: Customer servicehighlinked: passes on the protection requirement
  3. Applications: CRMhighlinked: passes on the protection requirement
  4. IT systems and networks: Serverhighlinked: passes on the protection requirement
  5. Rooms, buildings and service providers: Server roomhigh
Dependency chain: criticality is inherited downwards

Example across the five levels of the dependency chain: information Customer data with a high protection requirement, process Customer service, application CRM, IT system Server, room Server room. Through the links, the assets at the lower levels receive the highest protection requirement of the information as their criticality (maximum principle). Varmo passes nothing upwards or on the same level.

You later see the links of an asset in the Links tab on the asset page.

Importing many assets at once (from the Starter plan)

From the Starter plan, you can import a list from Excel or a CSV file.

  1. In the Record first assets step of Set up ISMS, use Download template to get a suitable template (identifier, name, category, owner by email) and start with Import from Excel/CSV. Later, this is also possible via ISMS settings › Integrations with Add integration and Import data.
  2. Map the columns. Before the import, a preview shows what will be created.
  3. Imported assets are suggestions at first. A person reviews each asset and clicks Accept asset on its page. Only then can it go into operation. The inventory shows at the top which assets are still waiting.

You can undo an import as long as the assets have not been changed. Details are in the guide to CSV import. Anyone with the corresponding functional role may import; by default, the ISMS managers.

What happens next

  • If you enter another person as owner, they receive the task Accept responsibility as asset owner. If they decline with a justification, the asset has no owner, and whoever may edit all assets and is responsible for assets without an owner (by default the ISMS managers) receives the task Assign owner.
  • After acceptance, the checks that apply to the category follow: for information and processes the protection requirements assessment, for systems, buildings and service providers the baseline check. If information is linked to such an asset, its own protection requirements assessment comes first. The asset page shows at the top under “What happens next?” what is due.
  • If you assigned the owner later, you receive the task Assign definitive owner. Until then, the asset cannot go “In operation” (for top-level categories with a status field).
  • If you link information to a system, the system needs a new protection requirements assessment. The owner receives a task for this.

Frequently asked questions

Why can't I delete an asset?

Assets with assessments, submissions, evidence or a DPIA are kept as evidence. Set the status “Decommissioned” instead. This is only possible for top-level categories with a status field, preset for IT assets. Buildings, Suppliers and Information & processes have no status field by default; whoever maintains the asset structure can turn it on for the top-level category (see Adjusting the asset structure).

Who may change the owner?

People who may edit all assets, for example the ISMS managers. Owners with permission for their own assets only cannot change it themselves.

Why can't the status “In operation” be selected?

The status is only possible once a definitive owner has been assigned and, if required, the baseline check has been approved. If the top-level category has no status field, the status does not appear in the form at all.

I only see “My assets”.

Without the permission to see all assets, Varmo only shows the assets you own.