In this situation I typically recommend that customers start at a higher level, for instance based on organizations (departments) or groups. This is known as strategic scoping versus operational scoping. Operational scoping is at a lower level such as by individual CI.
With that said, if you absolutely want to track compliance or risks by individual CIs that do not exist yet, you have a couple of options. First, you can use your implementation as an opportunity to start building out the CMDB, focusing first on business critical CIs. Or second, you can manually create individual Entity records that are standalone, that is, not based on any underlying table. Do this by navigating to All entities and selecting New, then uncheck the box Refers to existing record.
The risk of course with both of the above approaches is that as your CMDB gets built out in the future, there can be a disconnect between the risk and compliance information that you have collected if the entities that you create do not align with the actual CIs that get built. You'll have to weigh the pros/cons of accepting this risk versus the risk of waiting on your CMDB.
Please mark as Helpful if this helped to answer your question.
