Creating and managing assets

This article covers the full life of an asset record: creating it, filling in its details and roles, linking it to the controls, plans, and risks that apply, and archiving it when it goes out of use.

Adding assets

Add an asset from the Assets page. Common systems are available from a predefined list that fills in the description for you.

Starting to add an asset

1. Go to the Assets page via the main menu
2. Click "Add asset" at the top right of the overview
3. The add form opens where you can fill in asset information

Filling in asset information

• Asset name - Choose a clear, recognisable name
• Custom ID - Your own reference number (useful for linking with other systems)
• Asset owner - Select the responsible person from the dropdown
• Description - Explain what this asset does and why it's important

Using the predefined list

For common assets, Tidal offers a predefined list:

Searching the list:

1. Type in the search field of the add form
2. Suggestions appear automatically based on your input
3. Select a suggestion to automatically fill in relevant information

Benefits of predefined assets: For these assets, the description field is already filled with useful information needed for assessing this vendor

Commonly used predefined assets:

• SaaS solutions - Microsoft 365, Google Workspace, Slack, Zoom
• Cloud platforms - AWS, Azure, Google Cloud
• Security tools - Antivirus, firewalls, backup systems
• Business software - CRM, ERP, HR systems

Saving the asset

1. Check all filled information
2. Click "Create" to create the asset
3. The new asset appears in your overview
4. The impact rating is still empty - see Performing asset assessments

Editing and managing asset information

Everything after creation happens in the asset's Details tab: its basic fields, the information types it holds, its attributes, the three roles, and archiving.

Opening asset details

1. Click on an asset name in the overview
2. Select the "Details" tab
3. Here you see all asset information and editing options

Editing basic information

Click any field to edit it directly, then confirm with Update to save.

How to edit information:

1. Click on the input field
2. Adjust the text in the input field
3. An 'Update' button appears - click this button to save changes

Setting information types

What are information types? Information types register what kinds of data this asset contains or processes.

Adding information types:

1. Find "Information types" section in the Details tab
2. Click on the dropdown menu
3. Select relevant types such as:
   • Customer Information - For CRM and sales tools
   • Financial Records - For accounting systems
   • Software Source Code - For development environments
   • Application Secrets - For (cloud) infrastructure

Adding attributes

What are attributes? Attributes are labels that help categorize and filter assets.

Adding an attribute:

1. Find "Attributes" section in the Details tab
2. Click "Add attribute"
3. Fill in a title such as 'category'
4. Fill in a description such as:
   • Critical - For business-critical systems
   • Cloud - For cloud-based assets
   • Vendor - For externally managed systems
   • Test - For development and test environments

Managing attributes:

• Reuse existing attributes for consistency
• Remove attributes by hovering over the attribute and choosing the trash can
• Use short, clear labels for efficient filtering

Assigning roles

Setting owners

What does an owner do? Owners are responsible for the asset and decide on changes, maintenance, and usage.

Owners are automatically assigned as Task Owner to new tasks for this Asset.

Assigning an owner:

1. Find "Owners" section on the right side
2. Click on the user icon
3. Type a person's name and select them from the dropdown list
4. Multiple owners possible - useful for shared responsibilities

Assigning executors

What does an executor do? Executors oversee solving tasks related to the asset.

Executors are automatically assigned as Contributor to new Execution tasks for this Asset.

Setting an executor:

1. Find "Executors" section
2. Select people who perform operational tasks
3. Often IT teams or system administrators

Assigning assessors

What does an assessor do? Assessors evaluate the work of executors and report to owners.

Assessors are automatically assigned as Contributor to new Assessment tasks for this Asset.

Assigning an assessor:

1. Find "Assessors" section
2. Select people with control responsibilities
3. Often managers or quality assurance teams

Archiving or deleting assets

Delete an asset only when it should be gone entirely; archive it instead if you want to keep the history.

When to delete:

• Asset is no longer used
• System has been phased out or replaced
• Vendor stopped providing services
• Hardware permanently taken out of use

When to archive:

• Asset is (temporarily) no longer in scope for compliance
• Deletion is not possible or desirable because historical data needs to be preserved

Archiving / Deletion process:

1. Select one or more assets with the checkboxes on the left in the overview
2. "Archive" and "Delete" buttons appear at the top of the table
3. Click "Archive" or "Delete" to archive or delete all selected Assets

What happens during archiving:

• Asset disappears from daily overviews
• Links are made invisible but remain for audit trails
• Historical data preserved for compliance
• Can be restored later if needed

What happens during deletion:

• Asset disappears from the entire application

Creating and managing links

Each asset has, in its Details tab, a section for Controls, Plans, and Risks that you set yourself, plus separate Issues and Tasks tabs that show what has accumulated against the asset. Changes save automatically.

Linking controls

Why link controls? By linking controls to assets, you establish which security measures apply.

Linking controls:

1. Open an asset and go to the "Controls" section in the Details tab
2. Select relevant controls from the available list
3. Updates are automatically processed

Assigning plans

What are plans? Plans are predefined schedules that enable automatic task creation for testing assets.

Assigning a Plan ensures that tasks are automatically created on this schedule for all controls linked to this Asset. These tasks are assigned to the Asset owners and contributors.

Linking a plan:

1. Go to the "Plans" section in the Details tab of the asset
2. Select relevant plans from the available list
3. Updates are automatically processed

Connecting risks

What are risk links? Risk links indicate which risks are relevant for this Asset.

This again helps determine the controls that should apply to the asset.

Managing risk links:

1. Open the "Risks" section in the Details tab of the asset
2. Select relevant risks from the available list
3. Updates are automatically processed

Monitoring issues

The Issues tab shows every open problem linked to this specific asset.

Issue tracking:

1. Go to the "Issues" tab
2. View open problems related to this asset
3. Follow up on issue status and resolution

Tracking tasks and progress

The Tasks tab shows every task linked to this asset and where each one stands.

Viewing tasks:

1. Open the "Tasks" tab of the asset
2. See linked tasks and their status
3. Monitor progress of tasks assigned for this asset

Best practices for asset management

An asset register stays useful when names and ownership are predictable, and when someone reviews it on a schedule rather than only when something breaks.

Organisational structure

Clear, consistent names and at least one owner per asset are what keep a large register navigable.

Consistent naming:

• Use clear, descriptive names
• Apply standard prefixes for categories
• Avoid technical abbreviations that not everyone understands

Owner assignment:

• Assign at least one owner per asset
• Ensure backup owners for critical assets
• Update ownership during organisational changes

Maintenance workflows

An asset register stays accurate only with a regular review cadence, not just when something changes.

Regular reviews:

• Plan annual asset reviews
• Check link relevance
• Update asset information when changes occur
• Archive unused assets

Documentation consistency:

• Keep descriptions current
• Document important changes
• Link to external documentation where relevant

Next steps

Now that you can create and manage assets:

• Perform assessments for impact and risk assessment
• Monitor compliance status via linked controls
• Track performance through tasks and issues
• Generate reports for management and auditors