Asset Inventory & Business Impact Summary (for Humans)

In order to protect what matters most in the business our data, systems, and vendors we need to know what we have, what it’s used for, and how important it is. That starts by creating an inventory of:

Hardware (like laptops, servers, and phones)
Software (like Slack, Salesforce, or GitHub)
Vendors and third parties (like AWS, ADP, or Ironclad)

We store all this information in Compyl, but much of it already exists in the tools we use every day — like Google Workspace, accounting systems, procurement tools, HR platforms, or contract management software. So wherever possible, we integrate with those tools to pull the data in automatically. That way it stays up to date with what's actually happening in the business, without anyone having to track it manually.

What is BIA and the CIA Triad?

To understand how critical something is, we use a simple method called the Business Impact Assessment (BIA). Every asset — whether it’s a server, a software tool, or a vendor — is scored based on the CIA Triad, which stands for:

Term	What it Means	Ask Yourself...
Confidentiality	Keeping data private	Does this contain sensitive info that only certain people should see?
Integrity	Keeping data accurate	What would happen if someone changed this data by mistake or on purpose?
Availability	Keeping systems running	What’s the impact if this system or vendor goes offline or becomes unavailable?

💡
Note
Each asset gets a High / Medium / Low rating for each of those three areas. This helps us focus on the most important things first — the crown jewels of the business.

💾 Software Assets (Specific Tech Tagged by Type)

This list below can be used to make sure we integrate all of these things into Compyl and run baselines.

Software	Type (Tag)	Integration Source	Purpose	Owner	CIA Example Rating
Slack	Business App	Google Workspace / Okta	Internal communication	IT / Ops	C: Med / I: Low / A: High
Notion	Business App	SSO / Manual	Knowledge management	Ops	C: Med / I: Med / A: Med
Salesforce	Business App	Okta / Manual	CRM / Sales pipeline	Sales	C: High / I: High / A: High
Jira	Business App	Directory / SSO	Task + issue tracking	Engineering	C: Med / I: High / A: Med
GitHub	Dev Tool	Okta / GitHub Admin	Code + CI/CD	Engineering	C: High / I: High / A: High
CrowdStrike	Security Tool	EDR Agent / Compyl	Endpoint protection	Security	C: High / I: High / A: Med
1Password	Security Tool	Directory / Manual	Secrets & password storage	Security	C: High / I: High / A: High
Zoom	Business App	Google Workspace / Okta	Video conferencing	All Teams	C: Low / I: Low / A: High
Figma	Creative Tool	SSO / Manual	UI/UX design	Design	C: Med / I: Med / A: Med

💼 Vendors, Third Parties, and Suppliers (Named & Tagged)

We can make sure we have all the vendor records like contracts, NDA, MSA and that we are performing Third Party Risk Management.

Vendor Name	Vendor Type (Tag)	Integration Source	Purpose	Owner	CIA Example Rating
AWS	IT Vendor, Critical Vendor	Finance / Cloud Console	Infrastructure provider	IT	C: High / I: High / A: High
GitHub	Dev Tool Vendor	SSO / Finance	Code repository	Engineering	C: High / I: High / A: High
ADP	HR Vendor	HR / Finance	Payroll + employee data	HR	C: High / I: High / A: High
Ironclad	Legal Vendor	Contract Platform	Legal contracts	Legal	C: Med / I: High / A: Med
Okta	Security Vendor	SSO Platform	Identity and access management	IT / Security	C: High / I: High / A: High
Fastly	Infrastructure Vendor	Network Monitoring / Finance	CDN and edge security	DevOps / IT	C: Med / I: High / A: High
Greenhouse	HR Tech Vendor	HR / Manual	Recruiting platform	HR	C: High / I: Med / A: Med

🖨️ Physical & IT Assets

We can pull low level hardware information from the integration data.

Asset Type	Examples	Integration Source	Metadata to Capture
Servers	On-prem / cloud VMs	AWS, Azure, GCP	IP, OS, Environment, Owner, BIA, Criticality
Laptops	MacBook, ThinkPad	JAMF, Kandji, Intune, Google MDM	Assigned To, Serial #, Owner, Last Seen, BIA
Mobile Devices	iPhones, Androids	Google Workspace MDM, Intune	OS, Compliance Status, Owner, BIA
Printers	Office printers	Network Scan / Manual	Location, Owner, Use Case, BIA
Projectors	Conference room gear	Manual	Location, Owner, Use
Networking Gear	Switches, Firewalls	Asset Discovery	Model, Location, Owner, BIA

🏷️ Suggested Tags (for Easy Filtering in Compyl)

You can apply multiple tags per item in Compyl to make searching, filtering, and reporting easier:

Business App
Security Tool
Creative Tool
Dev Tool
Finance Tool
HR Tool
IT Vendor
HR Vendor
Legal Vendor
Infrastructure Vendor
Critical Vendor
Third Party Processor

📋 Ownership & Review Best Practices

For each asset or vendor:

Assign a clearly responsible owner
Set a review cadence (quarterly, annually, etc.)
Use Compyl to automate notifications when reviews are due
Flag:
- Orphaned items (no owner assigned)
- High-risk vendors (e.g. touching sensitive data)
- Unused software (possible cost savings)
- Critical systems with weak controls