Asset Tagging Strategy
Asset tags are the core organizational mechanism within the Qualys platform. They enable asset grouping, workflow automation, access scoping, reporting, and risk prioritization.
Recommended Tag Taxonomy
Build your taxonomy around the dimensions your teams use to manage and report on risk:
Tag Category |
Sample Values |
| Environment | Production, Staging, Development, QA |
| Business Unit | Finance, HR, Engineering, Operations |
| OS Family | Windows Server, Linux, macOS, Network Device |
| Cloud Provider | AWS, Azure, GCP, On-Premises |
| Cloud Account | Account ID or subscription name per provider |
| Owner | Team or individual responsible for remediation |
| Compliance Scope | PCI-DSS, HIPAA, SOX, ISO-27001 |
| Criticality Tier | Tier1-Critical, Tier2-High, Tier3-Medium |
Naming Conventions
Consistency keeps your inventory queryable and your reporting clean. Adopt these rules before you create your first tag:
- Use a clear Category:Value pattern (for example, Environment:Production).
- Use a consistent naming standard across all tags (for example, Business Unit:France and Cloud Provider:AWS). Avoid variations such as Prod, PROD, and Production.
- Standardize abbreviations across all tags and document them.
- Map every business-critical asset to an owner tag so remediation routing is unambiguous.
Best Practice: Use Dynamic Tags: Configure dynamic tags using rule-based criteria such as IP range, OS, installed software, or hostname pattern. New assets are then classified automatically on discovery. Static tags require manual maintenance and quickly become stale. Use static tags only for exceptions that no rule can capture.