Asset Management Procedure

Identifying, classifying, and protecting information assets

Purpose

This procedure establishes how Maelstrom AI identifies, classifies, tracks, and protects information assets throughout their lifecycle.

Level	Definition	Examples	Handling
Restricted	Highest sensitivity	Signing keys, HMAC secrets	Cloudflare KV only, strict access
Confidential	Internal sensitive	API tokens, internal docs	Password managers, team-only access
Internal	Internal use	Team communications, designs	Team access, not public
Public	Can be disclosed	Source code, ISMS docs, APIs	Published openly, GitHub/docs site

Cryptographic Assets (Restricted):

Code & IP (Public):

Infrastructure (Internal/Confidential):

Operational Data (Internal):

See Asset Register for complete inventory.

Maintained by: Security Lead Review frequency: Quarterly Updates: When assets added, changed, or retired

All assets assigned an owner (by role):

Document Information