Asset Risk Assessment
Asset risk management answers one question: what is this information asset worth to us?
The answer is a number and a classification, arrived at by rating the asset on three security dimensions — confidentiality, integrity and availability. Everything else in the module exists to produce that answer consistently and to keep a record of who decided it.
This module does not assess what could happen to an asset. That is information security risk, and it reads this module's answer as its starting point. Here the subject is the asset's own value.
The module holds no asset inventory
Assets come from the asset registry; a record here is an assessment of one of them. There is no "new asset" screen, no asset category list and no asset type list in this module.
That division is what keeps the two jobs apart. The registry answers "what do we have"; this module answers "what is it worth", and the same asset can be re-valued repeatedly without the registry changing at all.
One assessment in force per asset
This is the module's central rule.
An asset carries exactly one assessment in force at a time. The picker for a new assessment therefore offers only operational assets that do not already have one, and attempting it anyway is refused with a sentence explaining why.
The reason is downstream. An information security risk reads an asset's classification and value off the assessment in force. If an asset had two, there would be nothing to say which one the security module should read — so the invariant is enforced rather than left to convention.
A revision is how an asset is re-assessed. During one, the chain briefly holds the round being prepared alongside the round in force, which is expected — what may not happen is two rounds in force.
The building blocks
| Concept | Purpose |
|---|---|
| Asset group | The register assessments are opened in. Owns the code template and the authorization matrix. See Asset Groups. |
| Asset risk assessment | The record: the asset link, the three ratings, the resulting value and band, the classification label. |
| Scoring lists | Confidentiality, integrity, availability and the asset value bands. See Scoring. |
| Classification label | The handling label the asset carries — Public through Strictly Confidential. See Classification Labels. |
The record
- Code — issued from the asset group's code template. Unique within its group, not across the system.
- Asset group — the register this assessment belongs to. Chosen on creation and read-only afterwards.
- Asset — the asset being assessed. Also chosen on creation only.
- Revision number —
0for a first assessment, raised by each revision. - Date — when the assessment was made.
- Responsibles — who is accountable for it. The approval step raises its task from this.
- Confidentiality / integrity / availability — the three ratings. See Scoring.
- Asset value score / band — calculated and stored, never typed.
- Classification label — suggested from the confidentiality rating, then decided by a person.
- Contains personal data / contains sensitive personal data — the two data-protection flags.
- Notes and attachments — free text and supporting material.
A code is unique within its group, not application-wide. Two groups given the same template both start
at 1, which is the obvious thing for an administrator to do and would otherwise fail on the second group's
first record. Where a reader sees a code, the group qualifies it — task titles read group code - record code.
The asset information panel
The record carries a read-only panel showing the asset as the registry currently holds it — its identity, type and status.
This panel is read live, not copied. A rename in the registry shows here at once; there is no refresh to run and nothing to go stale. Reading the panel does not require the right to administer the asset registry either: assessing an asset is not the same permission as maintaining it.
An asset leaving service does not close its assessment. The register shows a warning cell against the row whenever the linked asset is no longer active, and nothing else happens automatically. Standing the assessment down is a decision somebody takes, not a side effect.
The one field copied from the asset
An assessment has no name of its own, so it is labelled from the asset's code and name, and that label is re-derived on every save. It is what a list row, a task title and an Excel export show.
The asset columns in the register and the asset information panel read the registry live, so they never go stale at all — the label is a convenience for places that need a single string.
Improvement is raised elsewhere
There is no measure or CAPA panel on an assessment, and this is deliberate. An asset's value is a property of the asset; no control measure changes it. If the assessment shows something that needs doing, the place to raise it is an information security risk, where the treatment options and the measures live.
Creating an assessment
- Open Asset Risk → Asset Assessments. If you may work in more than one group, pick the group first.
- Choose New. The code field shows the group's template.
- Select the asset. Only operational assets without an assessment in force are offered.
- Name the assessment responsible — this is who the approval task will go to.
- Rate confidentiality, integrity and availability. The value and band appear as you go.
- Accept or change the suggested classification label, and set the personal-data flags.
- Send for approval. There is no separate save — see Lifecycle.
If you have exactly one asset group you may create in, quick assessment entry skips the group picker and fills the field for you. Where you may read several groups but write in only one, you will still see the group list on the way in — the two questions are asked separately on purpose.