Risk management
Assess and treat the risks to your assets.
FEATURES · ASSETS & PROTECTION REQUIREMENTS
Know what needs protecting, and why.
Information, processes and systems in one inventory, each with a responsible person. Protection requirements are determined in a traceable way, approved and passed on to the systems through their dependencies.
WHAT YOU GET
- Inventory with owners and dependency chain
- Protection requirements analysis with approval workflow
- Protection requirements inherited by applications and systems
- Baseline check per system, e.g. with NIST SP 800-53 or the ICT baseline protection (Switzerland)
An inventory with clear owners
Assets are organised in your own categories and parent categories. Whoever is named as owner confirms the responsibility or declines it with a reason, so that ownership does not just exist on paper.
- Your own categories and position in the dependency chain
- Responsibility accepted by the owner
- Links between information, processes and systems
Protection requirements analysis with approval
For information and processes, the protection requirements are determined and justified per security objective using guiding questions. The analysis is submitted and approved through a defined approval workflow, never by the person who submitted it.
- Confidentiality, integrity and availability assessed separately
- Personal data and sensitive personal data recorded
- Confirmation by data protection where personal data is involved
Protection requirements for systems
Systems inherit their protection requirements from the information they process. If a piece of information changes, the system owner sees that their analysis needs to be reviewed.
- Inherited through the dependencies
- Requirements of the information also apply to the systems
- Notice when information has changed
Baseline check per system
For each asset category you define which requirements apply, for example the NIST SP 800-53 baseline that matches the protection requirements, or the chapters of the ICT baseline protection that match the type of system. The owner answers them, backs up the implementation with evidence and submits the result for approval.
- Implementation status and PDF evidence per requirement
- Deviations are handled with a measure or an approved exception
- Validity period with a reminder before it expires
Related
Data protection & DPIA
Personal data per system and the data protection impact assessment.
NIST SP 800-53
Controls by protection requirements.
ICT baseline protection (Switzerland)
The Swiss federal minimum requirements per system.
Frequently asked questions
Do we have to apply the BSI IT-Grundschutz?
No. The approach is based on BSI Standards 200-2 and 200-3, but the requirements per asset category come from the frameworks you choose, for example NIST SP 800-53, the ICT baseline protection (Switzerland) or your own requirements.
Who may approve a protection requirements analysis?
The approvers in the approval workflow your organisation defines. The person who submitted the analysis cannot approve it themselves.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.