Security
Separate organisations, sign-in and support access.
FEATURES · ROLES & APPROVALS
Everyone sees what they need.
Permissions depend on functional roles and on responsibility: whoever owns an asset can see it, even without a role permission. Approvals always follow the four-eyes principle, and segregation of duties is checked.
WHAT YOU GET
- Functional roles with “all” or “own” permissions
- Need-to-know: responsibility grants access
- Four-eyes principle in all approvals, never self-approval
- Several organisations under one account (from Pro)
Functional roles with fine-grained permissions
Standard roles such as ISMS manager, risk analyst, top management, data protection advisor or internal audit are set up in advance; you create your own functional roles yourself. Every permission applies to all entries or only to your own.
- All employees automatically receive the “Employees” role
- Nobody can assign a functional role to themselves
- Replace a role without interrupting workflows
Four-eyes principle without exception
Whoever submits something never approves it themselves. If nobody other than those involved could approve, submission is blocked and Varmo names the missing approver, so that no case gets stuck. At the top of every workflow page you can see who is up next.
- Designated person among the approvers of policies: the approver remains the functional role, and if you wish you can name one person from it who signs first
- If they do not respond within the deadline (14 days by default) or hand over, the other members of the same functional role step in
Segregation of duties and access reviews
Varmo checks conflicts based on permissions and tasks, not on role names. Exceptions are recorded with a justification. Once a year, the organisation confirms the permissions it has granted.
- Conflict rules under ISO/IEC 27001 A.5.3
- Access review under A.5.18
- Administration log of all changes
Several organisations, import and export
From the Pro plan, you run several organisations under one account, such as subsidiaries, sites or departments, with strictly separated data. From Starter, you import risks, measures, exceptions, assets, findings and custom catalogues by CSV with a preview, conflicts and undo; you export lists as CSV or print them as PDF.
- Full data export as a ZIP file, confirmed by the ISMS manager
- Plan change directly in the software
- Sign-in with a second factor or passkey, single sign-on from Pro
Related
Guided setup & tasks
How roles and tasks work together.
Frequently asked questions
What happens if a role in a workflow is not filled?
The workflow waits, and whoever may assign functional roles receives the task to fill the role. Nobody steps in automatically, so responsibilities stay clear.
Do all employees count as users?
No. People who only report incidents and risks and read policies do not count. Users are people with further permissions.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.