Featured guide
Create and assess a risk
Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.
Read the guideClassify, value and assess an Asset
Review Asset classification, CIA value, lifecycle and applicable Control context, then initiate the structured Risk workflow.
Review the Asset
Open the Asset record and confirm its classification, CIA value, lifecycle status and ownership. Use the related Control and Risk context to understand how the Asset is governed elsewhere in PurpleWASP.
Use the Asset details workspace
The details panel is organised into Overview, Controls, Vulnerabilities and Activity, with persistent Risk Details alongside the workspace. Use Guide this asset for an in-product walkthrough of the current layout.
Review applicable Controls
PurpleWASP can surface Controls that apply to the Asset context. Where you are authorised to maintain Asset-level implementation, record the current state for that Asset rather than treating the organisation-wide Control status as proof of coverage.
Applicability and implementation are separate. Use Control Management when you need the authoritative organisation Control, broader scope or assurance history.
Review technical exposure where integrations are connected
Open the Vulnerabilities tab to review active findings grouped by provider vulnerability identity. Use Details to inspect description, remediation, CVEs, affected port/service, evidence and lifecycle history. Link selected groups to an existing Risk or create a normal Risk from the selected evidence when a new scenario is required.
Evidence is not automatic Risk creation. A scanner observation supports a Risk decision; the Risk record and assessment remain human-governed.
Maintain lifecycle status
Update the asset when it moves between states such as In Use, In Maintenance or Retired. Lifecycle labels support reporting and help teams identify assets that may need reassessment or retirement activity.
Send the Asset to the Risk Register
1
Confirm the CIA valuation
Risk assessment relies on the asset's confidentiality, integrity and availability value. Complete any missing values first.
2
Select Assess Now
Use the asset action that sends the record to the Risk Register.
3
Confirm the risk record
Open Risk Management and verify that the asset appears for assessment with its inherited value and configured matrix.
Understand scale changes
When an administrator changes the organisation CIA model, related Asset and Risk values can be recalculated. Treat this as a governance change: review thresholds, reports and high-priority records after the change.
Common problems
Assess Now is unavailable
Complete required classification and CIA values, then confirm that your role can initiate risk assessment.
The asset does not appear in the Risk Register
Refresh the register, clear filters and confirm that the send action completed successfully.