Vista resources / Downloadable kit
Cryptographic inventory templates
Start a cryptographic inventory with one service. Record each use of encryption, key exchange or signing alongside its owner, evidence and observation date. Use the manual template for that work or the asset template to import systems into Vista.
Two ways to start
Track the work. Or bring your assets into Vista.
Use the manual workbook to connect cryptographic observations, owners and follow-up actions. Use the import workbook when you are ready to create infrastructure records in Vista. They serve different purposes; the manual workbook is not an import file.
The working edition / Excel workbook
Manual tracking workbook
Connect systems and owners to cryptographic evidence. Track collection gaps, evidence age and overdue reviews.
Inventory · Coverage log · Worked example · Dashboard · Official checks
Download manual workbook ↓What’s inside & how to use it
Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.
On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.
Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.
From spreadsheet to infrastructure inventory
Vista asset import workbook
A clean data sheet with Vista’s import column names, environment dropdowns and field guidance. Instructions and a fictional example are on separate tabs; the import sheet contains no sample assets.
Import assets · Read me · Fictional example · Field guide
For the Inventory → Import or Discovery → Command Center → Import from spreadsheet wizard. Use the infrastructure-assets target. This file is not the template for Settings bulk CSV import.
Import once, then build evidence around the assets
- Prepare one row per asset. Keep the Import assets tab first and its headers in row 1. Enter a current Vista class key, or select a class default in the wizard. Most classes require an FQDN, hostname, IP, MAC or serial; service classes need a display name.
- Check the mapping. Upload the XLSX or completed CSV. Review identifiers, class and environment. The workbook formats 100 rows; the wizard accepts up to 1,000 rows per import.
- Review before applying. Inspect the preview and correct invalid rows. After importing, check created, skipped, failed and unresolved outcomes. Resolve identity questions in Discovery → Approvals where indicated.
- Collect cryptographic evidence. Imported records begin without measured cryptography. With permission to test the assets, use the offered Scan now action or supported discovery. Review observations, findings and collection gaps.
- Preserve a baseline. Define a Scope and generate a dated CBOM from Risk & Compliance → Bills of Materials.
Accurate identifiers give Vista a basis for matching and enriching records. You can review the resulting asset, its cryptographic context and linked work in one place instead of copying findings between spreadsheet rows.
Moving from manual tracking to import
For now, transfer asset fields deliberately; there is no automatic parser. Keep the original manual workbook as your planning and evidence register.
| Manual tracking field | Import preparation |
|---|---|
| System/service | Use as Display name where appropriate; select the actual asset Class separately. |
| Endpoint/location | Split into FQDN, Hostname or IP address. Do not put URLs, paths or physical locations in an identifier column. |
| Environment | Use production, staging, development or test. Decide how Lab and Other should map. |
| Business/technical owner | Obtain an Owner email. Keep the fuller responsibility notes in the manual workbook. |
| Repeated cryptographic uses | Create one import row for the asset. Keep its multiple uses as separate manual records. |
| Algorithms, evidence, supplier status and actions | Keep these in manual tracking. Asset import does not turn them into cryptographic observations, findings or tickets. |
Start with one service you can explain
Choose a business service and list its public endpoints, internal connections, identity dependencies, software, devices, and storage. For a customer portal, that might include the CDN, origin web server, API, database connection, certificate automation, and deployment signing. Record expected systems before collecting evidence so missing observations stay visible.
A practical first pass
- Define scope. Record the business service, environments, exclusions, and review owner.
- Collect authorized evidence. Combine configuration review, software inventory, supported discovery, and supplier responses. Note the method and time.
- Separate uses. Use distinct rows when one system uses different cryptography for transport, signing, or storage.
- Record unknowns. Leave the algorithm unknown when evidence is missing; assign a follow-up instead of guessing.
- Review dependencies. Identify who controls upgrades and whether clients, vendors, or hardware constrain changes.
- Preserve a baseline. Save a dated copy, assign actions, and schedule a review after material changes.
Fields that matter
On a narrow screen, scroll the table horizontally to read every column.
| Field group | Record | Why it matters |
|---|---|---|
| Ownership | Business owner, technical owner, action owner | A finding needs someone who can make a decision and someone who can implement it. |
| Cryptographic use | Protocol, algorithm or group, implementation version | The same algorithm has different implications depending on its use. |
| Evidence | Source, timestamp, scope and collection method | An observation must be traceable and its freshness understood. |
| Dependencies | Clients, libraries, appliances, suppliers | Migration often crosses teams and release schedules. |
| Coverage | Expected assets, failed collections, exclusions | A discovery gap is not proof that cryptography is absent. |
Protect the inventory
Store references to certificates and key identifiers, never private keys, passwords, tokens, or raw secrets. Treat a completed inventory as potentially sensitive operational information. These files download directly; Vista does not receive your completed worksheets.
The example is fictional and illustrates one public connection only. Extend it with separate rows for the origin and other dependencies. For automated discovery and scoped evidence, see the first inventory guide and CBOM guide.