Working with assets in Asset Manager

Assets represent things that are of value to your organization. Assets can be tangible, like laptops, servers, and software, or they can be intangible, like third-party business relationships, intellectual property, and policies. By tracking your organization's assets, you protect your organization from fraud, theft, compliance issues, and unacceptable risk.

The Asset Manager app requires a subscription to IT Risk Management or Third Party Risk Management.

How it works

You create assets in the Asset Manager app.

All assets are instances of an asset type. The asset type is a class that defines the format and behavior of its assets: what attributes they have, what workflow they move through during their life-cycles, and who can see them and work on them.

Creating, updating, and deleting asset types

We supply asset types as part of your solution. You cannot create, update, or delete asset types on your own, but you can engage our consulting team to customize your environment.

Managing associations between asset types and risk categories in frameworks

Manage associations between asset types and risk categories in a framework. Then, you can use those associations in a project, where you can assess risks and controls in the context of those assets.

1. Open the Frameworks app.
2. Open the framework you want to associate the asset types to.
3. On the Assessment tab, navigate to a risk category's Records tab.
4. Under Associated asset types, click Manage associations.
5. In the Manage asset type associations panel, select or deselect asset types to create or remove associations between them and the framework.
6. Click Save.

Result You can now create a project using the asset type associations in your framework. If required, you can then add additional associations at the project level.

Importing risk categories from a framework to a project

After associating risk categories to asset types in a framework, you can import the risk categories into a project.

1. From the Launchpad home page (www.highbond.com), select the Projects app to open it.

   If you are already in Diligent One, you can use the left-hand navigation menu to switch to the Projects app.

   The Projects home page opens.

2. Open a project you want to import objectives to.

   The project dashboard opens.

3. Click the Assessment tab.
4. Click Import Risk Category.
5. Select the appropriate framework from the Frameworklist that you want to import risk categories from.
6. Select the risk categories you want to import.
7. Click Import.

   ResultDiligent One imports your selected risk categories.

For more information, see Cloning and importing objectives.

Managing associations between assets and risk categories in projects

After you have associated asset types to risk categories in a framework, you can import those risk categories into a project. Then, in that project, you can choose individual assets from the asset types you associated with those risk categories, and mitigate the risks associated with those assets in your project.

Associating assets to projects

Create associations between assets and risk categories, so you can mitigate the risks associated with those assets in your project.

1. Open the project you want to associate assets with, and click the Scoping & BIA tab.
2. On the Scope tab, click Scope assets.
3. In the Scope assets window, select an asset type and click Continue.
4. Optional. Narrow down the list of assets by filtering by attribute types.
   1. Click Filter. In the Filter side panel, create one or more filters using any attribute types that have dropdown list inputs in Asset Inventory.
   2. Click Apply. Diligent One filters out the assets that don't match your criteria.
5. Select the assets you want to associate with your project and click Continue.
6. Select the risk categories to associate with your project and click Continue.
7. Review and finalize your selected assets and risk categories. You can go back and make changes, or click Save and scope assets to continue with your selected associations.

After associating assets with your project, you can click on the asset names to view more details about them, or to remove the association from your project. You can also navigate to the asset in the Asset Manager by clicking on the asset name in the Asset details panel.

Removing associations between assets and risk categories

You can remove the association between assets and risk categories if the assets are no longer needed, or if they were associated to risk categories accidentally. By removing those associations, you remove the assets from the scope of the project.

1. Open the project you want to remove an associated asset from, and click the Scoping & BIA tab.
2. On the Scope tab, navigate to the asset type associated with the asset you want to remove and click the Expand icon .
3. Click the name of the asset you want to remove.
4. In the Asset details panel that appears, click Remove asset.
5. In the confirmation message that appears, click Remove asset.
6. Repeat steps 1-5 for any remaining asset associations you want to remove from your project.

Result You have removed the associations between the required assets and risk categories from your project.

Creating assets

Add an asset to the Asset Manager app, so you can store and gather information about it, assess the risks that come with it, and take actions to mitigate those risks.

1. Open the Asset Manager app.
2. Click the asset type you want to add your asset to.
3. Click +Add [asset type].
4. In the Add [asset type] panel, enter a name for your new asset.
5. Enter any other details necessary and click one of the following:
   • Add Asset to save the asset and close the panel.
   • Save & Add New to save the asset and add another one.

Result Your assets are created. You can begin to move it through its life-cycle by transitioning it to another status.

Updating asset details

You can update the data associated with an asset to reflect new information when that asset changes.

1. Open the Asset Manager app.
2. Under All Asset Types, click on the asset type of your choice.
3. In the table that contains asset details, click the name of the asset you want to edit. If you have a large number of assets, you can search, sort, and filter to find the right one.
4. In the Details tab, make the required changes, and click Save Changes.
5. Optional. If your asset's status has also changed, you can transition it to another status.

Transitioning assets to another status

Transitioning assets to another status is how you move assets through their life-cycle. Depending on the workflow an asset type uses, different actions can happen during a transition. For example, Diligent One might check that the required fields contain data, or it may trigger a questionnaire to get further information about the asset.

1. Open the Asset Manager app.
2. Navigate to the asset type for the asset you want to transition.
3. In the table that contains asset details, click the name of the asset you want to transition. If you have a large number of assets, you can search, sort, and filter to find the right one.
4. Click the button in the upper right to transition the status of the asset. This will transition the asset to the chosen status.

Note

Different status transitions can require different conditions such as certain attributes being filled in, or they can trigger events like sending questionnaires to gather incomplete information. If you have problems moving your asset to another status, contact a System Admin or your Diligent representative for assistance.

Linking assets to other assets, risks, or controls

You can create custom relationships between assets and other assets, risks, and controls. For more information, see Managing relationships in Asset Manager.

Assessing assets with questionnaires

You can assess your assets by sending questionnaires to users. For more information, see Managing questionnaires in Asset Manager.

Viewing linked discrete assets from Tenable

Follow these steps to view the discrete assets linked to an aggregated asset:

1. Open the Asset Manager app.
2. Select the asset type that contains the asset you want to view.
3. Select the asset that you want to view and select Discrete Assets.

   Result The linked discrete assets are displayed. Each discrete asset contains details about the asset, related findings and CVEs. You can select Show findings to go to the Findings tab, and you can select Show CVEs to view the related CVEs.

Viewing vulnerabilities from Tenable

Follow these steps to view the vulnerabilities (CVEs and Findings) that are related to an asset:

1. Open the Asset Manager app.
2. Select the asset type that contains the asset you want to view.
3. Select the asset that you want to view and select Vulnerabilities
4. Select CVEs or Findings to view the respective items.

   Result The linked items are displayed. In CVEs, you can click on the CVE to view its details in the National Vulnerability Database, and you can click Show findings to go to the Findings tab. In Findings, you can select Show CVEs to view the related CVEs.

Deleting assets

You can permanently delete assets. Generally, unless an asset was created in error, it's better to transition it through its normal life-cycle.

1. Open the Asset Manager app.
2. Click the asset type for the asset you want to delete.
3. In the table that contains asset details, click the name of the asset you want to delete.
4. On the page for that asset, click and click Delete. This prompts a dialog box with a warning message requesting confirmation.
5. Click Delete to confirm. The asset and any associated work is deleted.