Asset inventory
Proofroom files the list on its Assets page as monthly evidence: your hardware, your card terminals with their inspections and your storage media, and the software installed on them. It is built in, so it needs no credentials and makes no calls to any other system.
What it collects
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Hardware inventory | snapshot | monthly | Every asset with its kind, ownership, serial number, model, operating system, owner (company-owned assets only), location, scope, sources and when it was last seen or confirmed. Those not seen for 30 days and those not confirmed for 12 months are marked. | PCI DSS 12.5.1; SOC 2 CC6.1 |
| Card terminals and storage media | snapshot | monthly | The card terminals (POI devices) with serial number, model, location and when each was last inspected against your interval, and the storage media. | PCI DSS 9.5.1.1, 9.5.1.2, 9.4.5 |
| Software inventory | snapshot | monthly | Every application on your assets, the versions in use and on which devices, against the current version where you set one, and how many assets have no software list. | PCI DSS 12.5.1; SOC 2 CC6.1, CC6.8 |
Each run files a dated snapshot. It is stored once and never changes, whatever happens to the live list afterwards.
Where the list comes from
The Assets page fills itself from what your other integrations already collect. Nothing here reads a vendor’s system on its own.
- Device managers: Intune, Jamf Pro, Iru and Google endpoint management, from their device inventory.
- Endpoint security tools: CrowdStrike Falcon, SentinelOne and Defender for Endpoint, from their agent list.
- This Proofroom server, from its patch report.
- Vulnerability scans (Qualys, Tenable, Rapid7, or scans you import) add when an asset was last seen. A host that only scans name is not added: it is listed under “Seen only by scans” and counts nowhere.
- You: assets added by hand or uploaded from a CSV (Assets → Upload a CSV; the page has a template), and software lists uploaded as an export from your device manager (Software → Upload a software list). Files are up to 2 MB; split a bigger one.
The same machine seen by several tools shows once, matched by serial number. Serials that are only placeholders (“To Be Filled By O.E.M.”, “0123456789”, “Not Specified”) match nothing, and neither does a serial one tool gives two of its devices. Without a serial number, a machine is matched by its host name only when exactly one asset has that name and it is not a factory default such as “MacBook-Pro” or “DESKTOP-1A2B3C4”. A field a tool does not report stays blank, and what a person sets on an asset is never changed by a tool until they choose Follow the source again.
The list refreshes after every device or scan integration run, every morning, and when someone presses Refresh now on the Assets page. One refresh runs at a time.
What you keep up to date
- Assets no tool reports (added by hand or uploaded): press Confirm it is still here on the asset at least every 12 months. Until then the asset counts as not current, on the Assets page, in the evidence and on Posture.
- Card terminals: record each inspection for tampering on the terminal’s page (Inspected on). Choose how often on the Assets page (every 1, 3, 6 or 12 months; your risk analysis decides, 3 months is a common choice).
- Ownership: mark personal (BYOD) devices. Their owner and last sign-in are kept out of the evidence.
Auditors
Auditors see the snapshots filed to the audits they are on, not the live list: the assets in the audit’s scope (PCI DSS: marked PCI; SOC 2: marked SOC 2) and the software on them, as of a date they choose from the snapshots filed within the audit period, with Compare with another snapshot to see assets and applications added or removed and versions changed. Owners show on company-owned assets only. They change nothing. Admins and analysts can open the same snapshots from the Assets page (“See it as filed on”).
Setting it up
- Integrations → Connect a system, choose Asset inventory, name it and save.
- Switch on the collectors you want and map them to your controls (the suggestions are above).
- Press Run now once to see the first evidence.
When a run fails
Each collector refreshes the list first and files nothing rather than a partial list. It fails when:
- a source could not be read (an integration’s newest records are unreadable or in an unexpected shape): the error names it. Fix or rerun that integration, then run this one again;
- the list is empty (Hardware inventory), there are no card terminals or storage media (Card terminals and storage media), or no software list has been reported or uploaded yet (Software inventory). Add them on the Assets page.
What it does not do
- It does not look up where devices are. Location is what someone typed.
- “Current version” is the version an admin or analyst sets on the Software page. Matching against vulnerability and end-of-life lists comes in a later release.
- No connected tool reports installed applications yet. Until the Proofroom server agent does, upload an export.
- The last public IP, when a tool reports one, is shown to admins only and never filed.