Featured guide
Create and assess a risk
Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.
Read the guideAssess controls and send an asset to risk
Maintain asset control and lifecycle information, then initiate a structured risk assessment from the asset record.
Review the asset
Open the asset record and confirm its classification, CIA value, lifecycle status and ownership. Related controls and risk details are presented in the same workspace.
Update applicable controls
PurpleWASP can present controls that apply to the asset type. Update each control to reflect its current implementation status. These values can influence compliance and the context available to risk assessors.
Maintain lifecycle status
Update the asset when it moves between states such as In Use, In Maintenance or Retired. Lifecycle labels support reporting and help teams identify assets that may need reassessment or retirement activity.
Send the asset to the Risk Register
1
Confirm the CIA valuation
Risk assessment relies on the asset's confidentiality, integrity and availability value. Complete any missing values first.
2
Select Assess Now
Use the asset action that sends the record to the Risk Register.
3
Confirm the risk record
Open Risk Management and verify that the asset appears for assessment with its inherited value and configured matrix.
Understand scale changes
When an administrator changes the CIA matrix from 3×3 to 5×5, or back again, asset and risk values recalculate automatically. Treat this as a governance change: review thresholds, reports and high-priority records after the change.
Common problems
Assess Now is unavailable
Complete required classification and CIA values, then confirm that your role can initiate risk assessment.
The asset does not appear in the Risk Register
Refresh the register, clear filters and confirm that the send action completed successfully.