diff --git a/runbooks/asset-change.md b/runbooks/asset-change.md
new file mode 100644
index 0000000..180fedc
--- /dev/null
+++ b/runbooks/asset-change.md
@@ -0,0 +1,6 @@
+# Asset change exercise
+
+1. Record the baseline DNS, certificates, services and fingerprints.
+2. Introduce one approved domain or service change.
+3. Compare ASM discovery time and evidence with the change timestamp.
+4. Restore the baseline and confirm asset retirement.