IT operations and asset management
Keep your asset inventory next to your controls and risks
Record the assets your controls protect and check them against published vulnerabilities. When a control fails, create a Jira ticket from it. The inventory sits in the same workspace as your controls and risk register, so a question about scope has one answer.
In short
An auditor will ask how you know what is in scope. In Certifyi the asset inventory sits beside your controls and risk register and is checked against the National Vulnerability Database, and you can create Jira tickets from failing controls. A known vulnerability on a critical system then shows up as a risk with an owner.
Asset inventory
ISO 27001 Annex A 5.9 asks for an inventory of information and other associated assets, each with an owner. Most other frameworks ask for the same thing in different words. Every other control depends on it: you cannot show access reviews, patching or backups for systems nobody has listed.
In Certifyi each asset has an owner and sits in the same workspace as the controls and risks that apply to it.
Published vulnerabilities, matched to your assets
Certifyi checks the assets in your inventory against the National Vulnerability Database (NVD) on a schedule, using CPE (Common Platform Enumeration) identifiers to match products and versions. Each match is linked to the asset it affects and to the risk register, so it has an owner and a severity.
- Vulnerability record
- The CVE identifier, its CVSS score and the assets it affects.
- Waivers
- Formal risk acceptance for a vulnerability you cannot fix yet, with a justification and an expiry date.
Change, patch and configuration
Auditors tend to test these together. ISO 27001 covers them in Annex A 8.8 (technical vulnerabilities), 8.9 (configuration management) and 8.32 (change management). Expect to show an approved configuration baseline, evidence that patches went in on time, and who approved each change.
There is more on each in change management and patch and configuration management. If a control fails along the way, raise a Jira ticket from it and the engineers who own the system pick it up in their own queue.
| Change | Type | Impact | Status | Approver |
|---|---|---|---|---|
| Upgrade PostgreSQL 14 to 16 | Standard | Medium | Approved | A. Singh |
| Open port 8443 on the edge firewall | Normal | Low | In review | M. Chen |
| Retire the legacy sign-in service | Major | High | Scheduled | J. Taylor |
| Rotate production TLS certificates | Standard | Low | Completed | K. Patel |
An illustration of change records with their type, impact and approval status. Example data, not a customer record.
What auditors ask about assets
Questions that come up in most ISO 27001 audits, and in plenty of others.
-
Who owns this?
Every asset in scope needs a named owner, and the owner should know it.
-
Is the list complete?
Auditors pick systems from your cloud console or network and check they appear in the inventory.
-
What is unpatched?
Expect to show critical vulnerabilities on in-scope assets, and when each was fixed or formally accepted.
-
What changed?
For a sample of changes: who asked for each one, who approved it and how it was tested.
Related modules
The other modules refer to your assets. Vulnerabilities are matched against them, continuity plans depend on them and changes are made to them.
How Certifyi helps
Asset records that sit with your compliance work
Your inventory, vulnerability matches and remediation tickets in the same workspace as your framework controls and risk register.
-
Asset inventory
Record assets with an owner, beside the controls and risks that apply to them.
-
NVD matching
Assets checked against published vulnerabilities on a schedule.
-
Linked to risk
Vulnerability matches are linked to the risk register.
-
Jira tickets
Create Jira tickets from failing controls.
Questions
Asset management questions
What do we record for each asset?
Each asset has an owner and sits beside the controls and risks that apply to it. For vulnerability matching to work, record the product and its version.
How are vulnerabilities matched to assets?
Certifyi checks your inventory against the National Vulnerability Database, using CPE identifiers for the product and version. The results are only as good as the versions recorded in the inventory.
Does Certifyi replace a vulnerability scanner?
No. A scanner probes your systems directly. Certifyi matches your recorded inventory against published vulnerabilities and links each match to the asset and the risk register. Keep running your scanner.
How does the Jira integration work?
From a failing control you create a Jira ticket for the team that owns the asset. The fix is done in Jira, and the control stays in Certifyi, where your auditor will look for it.
Why keep assets in the GRC platform?
Because most controls are about assets. With the inventory, the risk register and the controls in one workspace, you are not reconciling three spreadsheets before every audit.
See your inventory next to your risk register
In a demo we match an example inventory against the NVD, follow one finding into the risk register and raise a Jira ticket from a failing control. Book one and judge whether the inventory you keep today would hold up to the same test.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them