Information Assets

The register of the information your organisation holds — each entry carrying a confidentiality classification, a lifecycle status, a data category and a retention period.

An information asset is anything that holds or processes data worth protecting: a customer database, a payroll spreadsheet, a document store. This register is where you write those down and grade how sensitive each one is, so that risk and data-protection work can point at real, named things. It sits in the Assets (CMDB) group of the left menu, alongside machines, software, services and external services. CMDB stands for Configuration Management Database: the record of what your organisation runs and relies on.

This register is maintained by hand. There is no discovery agent and no import file for information assets today — you add each one through the form on this screen, and correct it through the same form.

Who uses it

Everyone with access to the CMDB module can read the register. What you may change depends on your role:

What's on this screen

The screen is one long page: a header, a row of three filters, the table, and a pagination row beneath it. There is no side panel and no separate detail page — an asset's full record opens in a dialog when you edit it.

• Header — the title Information Assets above the line "Manage information assets and their confidentiality classification in your CMDB." On the right sit two buttons: an outlined Refresh, which re-runs the current query, and the blue Add Information Asset, which opens the create form.
• Filter row — a Search information assets... box and the All Classifications and All Statuses dropdowns.
• The table — columns Name, Classification, Status, Data Category, Last Updated and Actions. Classification renders as a coloured pill; the Actions column appears only if you may edit. Rows are sorted by name.
• Pagination row — the total on the left ("2 information assets" here), and Previous, Page 1 of 1, Next on the right. The register pages in blocks of twenty.
• Empty state — when no asset matches the filters, and on a register that holds nothing yet, the table and the pagination row are replaced by a single panel reading "No information assets found. Adjust your filters or add a new asset."

The capture below is a staging tenant holding two placeholder records, Test and Test 2 reporting — enough to show the table, the badges and the row actions, but not a real register. Walk the screen in this order to get your bearings:

1. Open the Assets (CMDB) group in the left menu and choose Information Assets. The group expands to show the sibling inventories — CMDB, Software, CMDB Services, External Services and SBOM — with this page highlighted.
2. Look to the top right for Add Information Asset — the only way to create one. If you cannot see it, your role does not carry the create permission.
3. Read a row left to right: name, classification pill, status, data category, and the date the record last changed. The Edit button at the end reopens that asset in a form.
4. Below the table, the count tells you how many assets match the filters now applied, not how many exist. Clear the filters to see the whole register.
5. To the right of the count, Previous and Next move through the pages, with Page 1 of 1 between them. Both are greyed out when everything fits on one page, as here.

Add an information asset

The create form opens as a dialog over the register. Only the name is required; everything else can be filled in later through Edit.

1. Select Add Information Asset. A dialog titled Add Information Asset opens with the fields laid out in two columns.
2. Type the asset's Name — the placeholder suggests the style, "e.g. Customer Database". Use the name your colleagues use; the register sorts on it.
3. Choose the Classification. It opens on Internal; the other choices are Public, Confidential and Restricted.
4. Choose the Status. It opens on Active; use Inactive, Archived, Decommissioned or Unknown where the asset is no longer in daily use.
5. Fill in Data Category — a free-text label for the kind of data held, such as "Customer PII". It is a text field, not a list, so agree your vocabulary first.
6. Enter Retention period (days) as a whole number of days: five years is 1825. Anything that is not a whole number is refused with "Retention period must be a whole number of days". Leave it blank if no period has been agreed.
7. Add Tags as a comma-separated list, for example gdpr, critical. Tags are searchable, so they group assets that share a treatment.
8. Write the Description and any Notes. Both are free text; the description is searched, so put the identifying detail there.
9. Select Add Information Asset at the foot of the dialog. The dialog closes, the register reloads, and the new asset takes its place in name order — on a register longer than one page, that may be a page you are not looking at. Choosing Cancel instead discards everything you typed.

Correct an asset

Editing uses the same form, opened over the row you chose and pre-filled from the saved record.

1. Find the row and select Edit at the end of it. A dialog titled Edit Information Asset opens with every field carrying its current value; tags appear as a comma-separated list.
2. Change what needs changing — usually the classification after a review, or the status when an asset is retired. Nothing is written until you save, so closing the dialog leaves the record as it was.
3. To clear a value, empty the field. Clearing Tags or Retention period (days) in the editor removes the stored value rather than leaving the old one in place.
4. Select Edit at the foot of the dialog to save. The dialog closes, the register reloads, and the row's Last Updated date moves to today. If you have renamed the asset to a name another asset already uses, the dialog stays open and shows "An information asset with this name already exists".

Find an asset in the register

The three filters combine — a search term, a classification and a status all narrow the same query. Changing any of them returns you to the first page.

1. Type into Search information assets.... The list refreshes shortly after you stop typing, matching on name, description and data category, and on an exact tag.
2. Open All Classifications and pick one level to see only assets graded at it.
3. Open All Statuses and pick a lifecycle value — for example Decommissioned, to review what has been retired.
4. If the empty-state panel appears, your combination matched nothing. Widen the filters or clear the search box to bring the rows back.
5. Select Refresh to re-run the current query without changing it — worth doing if a colleague has been editing the register while you have had it open.

Classification and status

Two columns use a fixed vocabulary. Classification answers "how sensitive is the data in this asset?"; status answers "where is this asset in its life?"

Tips and limits

• No delete button. Managers and Admins hold the delete permission, and the interface (the API) supports it, but this screen offers no way to remove an asset. To take one out of use, set its status to Decommissioned or Archived.
• No detail page. The description, the notes, the tags and the retention period are visible only inside the edit dialog. The table carries the other five fields: name, classification, status, data category and the last-updated date.
• No AI assist on this screen. Classification is a judgement your organisation makes; nothing here suggests or changes a grade for you.
• Adding and changing assets is recorded. Creating and editing an asset writes an entry to the audit log, naming who did it and when.
• Twenty rows to a page. If an asset you expect is missing, clear the filters first, then check Next.
• Free-text fields drift. Data Category and Tags accept anything you type, so "Customer PII" and "customer pii" become two labels. Agree the wording once and keep to it.

Where this connects

• CMDB — the machine inventory and the entry point to this area.
• Software, CMDB Services and External Services — the other registers in this group.
• Risks — where an asset's classification helps you weigh how serious a risk to it would be.
• GDPR — where data categories and retention periods matter for your data-protection records.
• Audit log — who added or changed which asset.
• Roles overview — what each role may do.