Asset governance

Maintain the register of systems, services and data stores your controls depend on, and relate them to risks and evidence.

The problem it solves

Controls are described in the abstract while risk lives in specific systems. Without an asset register, scope arguments during an assessment cannot be settled with a record.

How it works

1
Register what matters
Record the systems, services and data stores in scope, with owners and classification. The register is maintained by people who know the environment.
2
Relate to controls and risks
Assets link to the controls protecting them and the risks affecting them, which makes scope discussions concrete.
- Manual asset register with ownership and classification — available now
- Automated asset discovery — planned, not available today
3
Keep the register honest
Assets carry review dates so decommissioned systems leave the register instead of quietly inflating scope.

Capabilities

Asset register

Systems, services and data stores with owners.

Classification

Sensitivity recorded to drive control selection.

Relationships

Links to the controls and risks that apply.

Review cadence

Scheduled confirmation that the register is current.

What you remain responsible for

Confirming what is genuinely in scope
Classifying assets appropriately
Retiring register entries when systems are decommissioned

Related capabilities

Controls and control testingDefine what each control is expected to do, who owns it, how often it is tested, and whether the last test passed.Risk managementRecord risks with owners, assess them consistently, assign treatment, and capture acceptance as an explicit decision.

See NOVA against your own compliance obligations

Explore the governed Free access path, or walk through your framework, evidence and reporting requirements with us.

NOVA accelerates your launch preparation, but final decisions remain human.

Start Free Book a demo