Asset and Third-Party Playbooks

Use these playbooks when managing assets, asset groups, vendors, third-party risk, and linked controls or risks.

Onboard an Asset

1. Open Assets.
2. Click Create Asset.
3. Enter asset name, type, owner, department, location, and lifecycle status.
4. Set criticality and data classification.
5. Link vendor, controls, policies, or risks when applicable.
6. Set review date.
7. Save.
8. Review whether the asset should change risk scoring through criticality.

Review an Asset Group

1. Open Asset Groups.
2. Confirm group name, owner, and purpose.
3. Review included assets.
4. Check whether critical assets have owners and review dates.
5. Confirm linked risks and controls are current.
6. Escalate missing ownership or criticality gaps.

Onboard a Vendor and Assess Third-Party Risk

1. Open Vendors or Third Parties.
2. Create vendor profile with owner, service, criticality, contact, and relationship status.
3. Identify data, process, or asset dependency.
4. Request due-diligence evidence or questionnaire.
5. Review responses and missing evidence.
6. Create risks or issues for gaps.
7. Approve, approve with conditions, reject, or pause.
8. Set next review date and evidence renewal dates.

Screenshots

Vendors

Assets

FAQ

Question	Answer
Why does asset criticality matter?	Critical assets can increase effective risk priority and management attention.
Should every asset have an owner?	Yes. Unknown ownership weakens risk, incident, and audit response.
When should vendor risk be reassessed?	After contract change, service scope change, data exposure change, incident, failed evidence review, or scheduled review.
Should terminated vendors stay visible?	They should be offboarded with closure evidence, not left active.