AI ITAM Platform
IT Asset Management Software: The Features That Matter
An asset register in Excel answers “what do we have?” badly and “who approved that change?” not at all. Here is what an ITAM platform must add.
Key takeaways
- Rate C, I and A separately on a simple scale.
- Derive criticality from the highest rating.
- Map confidentiality to your classification scheme.
- Use ratings to prioritize controls, patching and verification.
The method
Rate each asset Low (1), Medium (2) or High (3) for confidentiality, integrity and availability, based on the information it holds and the services it supports. The asset’s criticality is the highest of the three; an asset value — the sum, from 3 to 9 — helps rank assets of equal criticality.
Worked example
| Asset | C | I | A | Criticality | Value |
|---|---|---|---|---|---|
| Core banking database server | High | High | High | High | 9 |
| HR laptop | High | Medium | Low | High | 6 |
| Branch printer | Low | Low | Medium | Medium | 4 |
| Test virtual machine | Low | Low | Low | Low | 3 |
From ratings to classification
Map the confidentiality rating to your classification scheme — for example Restricted, Confidential, Internal and Public — and allow the owner to override with a reason.
Using the ratings
- Prioritize vulnerability remediation on high-criticality assets.
- Require stronger disposal methods for high-confidentiality media.
- Verify high-value assets more often.
- Feed criticality into risk assessments and business impact analysis.
Keeping it current
Review ratings when an asset’s role changes, and make classification a mandatory field so no asset enters service unrated.
Rating guidance
| Rating | Confidentiality | Integrity | Availability |
|---|---|---|---|
| High | Disclosure causes severe harm | Unauthorized change causes severe harm | Outage of hours is unacceptable |
| Medium | Disclosure causes moderate harm | Change causes moderate harm | Outage of a day is tolerable |
| Low | Little or no harm | Little or no harm | Outage of several days is tolerable |
Common mistakes
- Rating everything High, which removes prioritization
- Rating hardware without considering the data it holds
- Never revisiting ratings after a system changes role
- Leaving classification optional
Applying ratings to virtual and cloud assets
Virtual machines and cloud resources inherit the ratings of the applications and data they host. Rate the application once and propagate the rating to its infrastructure through the asset register, so a new virtual machine for a critical application starts life with the right classification instead of a blank field.
Ratings should also drive monitoring: assets rated High for availability belong in continuity plans and should have tested recovery objectives.
How NAZZTEC helps
NAZZTEC AI ITAM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our IT Asset Management services.
Next step: request a demo of NAZZTEC AI ITAM or read more on the product page.
Frequently asked questions
Who should set the ratings?
The asset or application owner, with guidance from security and data governance.
Can AI suggest ratings?
Yes — from the application and environment — but the owner confirms them.
How often should ratings be reviewed?
At least annually and whenever the asset’s purpose changes.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
