Assets

What the screen is for#

The "Assets" tab holds it. The inventory comes from one source, chosen once for the whole installation:

• the app's light register: you enter the assets in the app;
• JSM Assets: the app reads the objects of a JSM Assets schema, with your rights in Assets.

Risks cite these assets (ISO 27001 6.1.2).

Who can do what#

A reader sees the light register alone, even when the inventory is kept in JSM Assets: the screen says so.

Step by step#

Choose the source#

1. In the "Source of the inventory" block, choose "Light register of the app" or "JSM Assets".
2. For JSM Assets: click "Load the schemas", choose the "JSM Assets schema", and if you want the owner, give the "Owner attribute": the name of the user-type attribute that holds it in Assets. Without it, the objects read have no known owner.
3. Click "Save the source", then "Lire les objets". The screen counts the objects read. If the reading stops, start it again: nothing is lost.
4. In the Standard edition, choosing JSM Assets carries the "Édition Advanced" label: loading the schemas and reading the objects are refused. The light register stays usable.
5. If the site does not have JSM Assets, or you may not use it, the screen says so: keep the light register.

Changing the source deletes nothing: the light register assets and the objects already read are kept.

Keep the light register#

1. Click "New asset".
2. Fill in the "Name", the "in your own words: laptop, SaaS application, database…", the ""Publique", "Interne", "Confidentielle", "Restreinte": Public, Internal, Confidential, Restricted", the "Owner" and, if you like, the "Description" and the "Last review of the asset".
3. Click "Save". If someone else changed the asset in the meantime, the screen offers "Reload the asset"; your input is then lost.

Read an object from JSM Assets#

An object read from JSM Assets is edited in Assets: the asset panel says so and offers "Open JSM Assets". The app keeps only its identifier, key, name, type and the date it was read. Its classification is not read ("Non lue par l'app", Not read by the app).

An object that is no longer in the last complete reading shows as "Object not found": it was deleted, or recreated with another identifier. The risks that cite it still cite it. In the panel, choose the "Object that replaces it", then click "Link to this object".

Read the indicators and filter#

• "Actifs": the number of assets. "No owner": those no person carries.
• "Covered by an open risk": how many assets at least one open risk cites.
• "Freshness of the inventory": "Up to date", "To review", "Never reviewed" or "Unreadable dates". The inventory is as fresh as its oldest asset: every asset must have been reviewed less than 365 days ago.
• Filter by "Type", "No owner" and "Classification".

Mark the inventory as reviewed#

Click "Marquer l'inventaire comme revu" after reading the list. The app records the date and the person, and leaves a line in the audit log. The "asset-inventory-reviewed" monitor in monitoring relies on this freshness; it is off by default.

Link assets to a risk#

In the Risks tab, open a saved risk, then the assets section: search, choose, click "Save the assets". This save is separate from the form's: save the form first.

Import the light register#

"Import" and "Download the template" fill the light register from an Excel workbook (name, type, classification, owner, description). See Import and export with Excel templates. Objects read from JSM Assets do not go through here.

What the auditor gets from it#

A dated inventory, with an owner for each asset, its classification, its open risks and the date of the last review. The actifs.csv file of the audit pack reproduces it. Every source change, creation, edit, reading, link and review is in the log, with no free text.

Known limits#

• The light register does not let you remove an asset.
• The assets cited by an Annex A control are not shown in the control's panel.
• Assets objects are shown only to people who can edit risks and assets (administrators, compliance managers, risk and asset managers).
• Reading Assets depends on your Jira Service Management subscription and your rights in Assets.