Adding Physical and Virtual Assets

In this article, you will find:

  • Navigation guidance for accessing the physical & virtual asset register
  • The process of adding physical & virtual assets to the register

Physical & Virtual Asset Register

The Physical & Virtual Asset Register allows you to keep a record of the physical and virtual assets associated with your business. It can be accessed by selecting the Physical & Virtual Asset Register button from within Compliance > ISMS, as shown below:

Physical and virtual asset register navigation guidance

Adding Physical and Virtual Assets to the Register

The Physical & Virtual Asset Register allows you to keep track of important assets within your business, and comply with standards such as ISO 27001 and SOC 2, as they require an up-to-date list of both physical and virtual assets, including things like laptops, servers, virtual machines, cloud resources, and software applications.

Once you have accessed the Physical & Virtual Asset Register, you will be presented with a page similar to the following. To add a new asset, click the Create Asset button on the top right, as shown below:

Recording a physical or virtual asset screenshot

Once selected, a new window will open prompting you to add information about the asset you wish to register. Let's examine each of these areas:

FieldPurposeMandatory?
Asset IDThe name/internal designation of the assetYes
Serial NumberThe serial number if the asset is a deviceNo
StatusThe current status of the asset (E.g., In storage, in use, destroyed)Yes
ImportanceThe associated importance of the assetYes
Asset DescriptionA description of what the asset isYes
Asset PurposeA short explanation of what the asset is used forYes
Data Held on AssetAn overview of the data currently stored on the assetYes
Asset OwnerWho currently owns/is using the assetYes
ClassificationWhether the asset is public, for internal use, or confidentialYes
LocationWhere the asset is currently located, either physically or digitallyYes
AssignedThe date the asset was assigned to the asset ownerNo
Last Checked ByWho the asset was last checked byYes
Last Checked OnThe date the asset was last reviewedYes
ReturnedWhether the asset has been returned to the business (e.g. returning a work phone or laptop)No
Destruction Certificate NumberThe destruction certificate number if the asset has been disposed ofNo

Once this information has been added, the asset will appear in the register, as shown by the two examples above. It's vital that this list is updated regularly, and that reviews of all currently held assets take place frequently. An asset register is required by standards such as ISO 27001 and SOC 2 because it is incredibly difficult to protect something if you are unaware of its existence.

Auditors will want to see these lists to verify that you are aware of all aspects of your business, and that the appropriate steps are taken to ensure security, such as the patching of work devices, or the destruction of redundant hardware like storage drives.

You can also download your data by clicking the Export button, which instantly generates an Excel (.xls) sheet of your entire Physical and Virtual Asset Register. This file provides a complete list of all assets added to the platform, including the Asset ID, Owner, Importance, Status, and when the record was last modified.

Screenshot of Export Button

Auditors will want to see these lists to verify that you are aware of all aspects of your business, and that the appropriate steps are taken to ensure security, such as the patching of work devices, or the destruction of redundant hardware.