Adopting requirement catalogues and keeping them up to date

Requirement catalogues contain the target specifications against which you align your ISMS, for example ISO/IEC 27001 Annex A, the NIS2 Directive or NIST SP 800-53. This guide shows how you import standard catalogues, create custom catalogues, adopt applicability and evidence from existing catalogues and deal with new versions of a catalogue.

Before you start

• Standard catalogues are imported by people with the permission to maintain mappings between catalogues. By default, this is the functional role ISMS manager.
• Custom catalogues are created by people who may manage catalogues and requirements.
• Plan: in the Free plan, only custom catalogues are available. From the Starter plan, you can import ISO/IEC 27001 Annex A; from the Pro plan, all standard catalogues. Importing custom catalogues from a CSV file is possible from the Starter plan.

You see catalogues that are not included in your plan under More standard catalogues with name, description and structure as well as the badge “From Starter” or “From Pro”.

1. Import

   “Import standard catalogue” under Requirements › Catalogues.

2. Adopt (from Pro)

   Applicability, measures and evidence from existing catalogues.

3. Set applicability

   For the remaining requirements.

↩ New version

Notice on the catalogue page: adopt everything or a selection, postpone the update or do not adopt it.

↩ New edition

Comes as a separate catalogue. When switching, you transfer requirements step by step or all at once.

Three steps: import a standard catalogue; from the Pro plan, adopt applicability, measures and evidence from existing catalogues; then set the applicability of the remaining requirements. If Varmo changes the catalogue, you adopt a new version in full or in part, postpone it or do not adopt it. A new edition comes as a separate catalogue to which you switch.

Importing a standard catalogue

1. Open Requirements › Catalogues.
2. Click Import standard catalogue.
3. Select one or more catalogues and confirm with Import.
4. Varmo creates the catalogue in your organisation. If you have imported exactly one catalogue, the catalogue page opens; there, “What happens next?” shows the next step. For several catalogues, the confirmation offers the Set applicability link.
5. If you already keep other catalogues (from the Pro plan), first adopt from these catalogues, see the next section. Then set the applicability of the remaining requirements. Applicability is only adopted as long as a requirement is still “Not assessed”.

The content of a standard catalogue is fixed: the identifiers, titles and texts of the requirements are maintained by Varmo. You decide on applicability, implementation, owners and evidence. Your own additional requirements belong in a custom catalogue.

Adopting from existing catalogues

From the Pro plan: if a catalogue is added to your existing ones, you do not have to record equal requirements again. You adopt applicability including justification, linked measures and evidence (policies, documents, internal controls) via the mappings between the catalogues. People who may manage catalogues and requirements may do this. Only those who may also edit all measures may link measures.

1. Open the new catalogue under Requirements › Catalogues. If requirements correspond to ones from your other catalogues, the catalogue page shows a notice. Click Adopt there.
2. The Adopt from existing catalogues page shows, for each requirement, the corresponding requirements of your other catalogues and what can be adopted: applicability, measures, evidence.
3. Everything is preselected for “Equal” and “Subset of”; there, the existing requirement fully covers the new one. For “Superset of” and “Intersects with”, you decide yourself. Each tick box can be deselected individually.
4. Varmo only adopts applicability for requirements that are still “Not assessed”, and from exactly one source per requirement.
5. Click Adopt selected. Then set the applicability of the remaining requirements as usual.

Under Previous adoptions, you undo an adoption with Undo. Requirements that you have changed since then remain unchanged.

Creating a custom catalogue

1. Open Requirements › Catalogues and click Create custom catalogue.
2. Enter the name and description.
3. Choose how you record the requirements: Enter manually (type requirements in individually) or Import file (CSV file or paste from Excel, from the Starter plan). One requirement is enough to start with.
4. Save. In the catalogue, you later add further entries with Add requirement and Add category.

Custom catalogues are suitable for industry-specific specifications, customer requirements or internal standards.

New versions and new editions

Varmo continues to maintain its catalogues. There are two kinds of changes:

• New version (revision): individual requirements are new, changed or removed. The catalogue page shows the notice “New version … available from Varmo”. With View impact, you see the change note from Varmo and the impact on your ISMS, for example affected implementations and evidence. You can adopt everything or a selection, Postpone update (until a date) or Do not adopt update (with a justification).
• New edition: a fundamentally revised catalogue, for example a new version of a standard. It is created as a separate catalogue. When you Switch, you transfer requirements step by step or all at once; applicability, implementation and evidence come along where the new requirement corresponds to the old one. You can also postpone the switch or decide against it. Switching concerns the old and new edition of the same standard; adopting from existing catalogues, by contrast, uses the mappings to other standards.

Nothing is deleted in the process. Removed requirements become inactive, and requirements that you should review after the update are marked (To review after the update).

What happens next

• After importing, you set the applicability. Continue with Setting applicability and approving the SoA.
• If a new version or a new edition is available, the ISMS managers receive a task in My tasks. If you have postponed it, the task returns on the chosen date.
• Marked requirements appear as a task for the people who manage requirements.

Frequently asked questions

Can I adapt the texts of a standard catalogue?

No. So that mappings between catalogues work reliably, the content remains unchanged. Record your interpretation in the implementation of the requirement or create supplementary requirements in a custom catalogue.

Can I adopt a rejected update later after all?

Yes. Adopting or switching is possible at any time, even after “do not adopt”.

What happens when switching to a smaller plan?

Standard catalogues outside the new plan remain readable and exportable but can no longer be changed. Approved Statements of Applicability are kept.

How are several catalogues connected?

Standard catalogues are mapped to each other. From the Pro plan, fulfilment via these mappings applies partly automatically, and you can adopt applicability, measures and evidence from existing catalogues (see above). More on this in Using mappings between catalogues.