Under “Documents & evidence”, you store everything that does not belong to the policies: evidence such as minutes, audit reports, contracts and certificates, as well as controlled documents such as work instructions or form templates. Every document is versioned; every file is checked for malware before it is saved.

Before you start

  • People with the corresponding permissions for “Documents & evidence” create documents and upload versions. Controlled documents are approved by whoever has the “Approve documents” permission; by default, the ISMS managers and the functional role Top management.
  • You manage policies, standards and directives with approval workflow and acknowledgement under Policies.
  • Decide which type the document is:
    • Evidence: proves that something has happened. Valid immediately after upload.
    • Controlled document: specifies how something is to be done. Each new version is approved by a second person.

Creating and uploading a document

  1. Choose fileAt most 50 MB.
  2. File checkRuns immediately, with a progress bar.
  3. Upload

    As a new version, e.g. “Upload as v1”.

  4. Valid

    Evidence immediately; controlled document after approval by another person.

Check finds something

The file is not saved; Varmo states the reason and a way forward.

From upload to valid document

You choose a file, Varmo checks it for malware immediately, then you upload it as a version. Evidence is valid immediately; a controlled document is only valid once another person has approved it. If the check finds something, the file is not saved, and you see the reason together with a way forward.

  1. Open Documents & evidence and click New document.
  2. Choose the type (Evidence or Controlled document) and enter the title and description.
  3. Click Create and add evidence or Create and upload first version. Varmo opens the document directly at the upload.
  4. Select the file. The File check runs immediately with a progress bar; after a clean check, it says “Checked – no malware found.”
  5. Click Upload as v1.

For evidence, instead of a file you can also refer to the evidence in your own storage, for example in SharePoint, OneDrive or on the intranet. Controlled documents always need a file.

New versions and approval

  • You upload a new version on the document under Upload new version. Versions cannot be changed; the history is kept in full.
  • Evidence is valid immediately from upload.
  • A controlled document is “In review” after upload. Another person with the “Approve documents” permission approves the version or rejects it with a justification. Whoever uploaded it does not approve it themselves.
  • If there is nobody other than you who could approve, uploading is locked. The page then shows what is missing.

Linking as evidence

Documents prove the implementation of requirements:

  1. Open Requirements › All requirements and choose the requirement.
  2. In the Evidence section, click Link document… next to “Documents & evidence” and choose the document.
  3. You continue to set the implementation status yourself in the “Implementation” section.

Only valid evidence and approved controlled documents count as effective evidence. A requirement can only be marked as “Implemented” if it has a description or effective evidence.

What happens next

  • After a controlled document is uploaded, the people with approval permission receive a task in My tasks.
  • After a rejection, the person who uploaded it receives the task “Upload revised version”.
  • After approval, the document is valid; new versions go through approval again.

Archiving and deleting

You archive approved or valid documents with a justification instead of deleting them. They are then no longer valid and appear under Archived; all versions and approvals are kept as evidence. With Restore, the document is valid again with the state before archiving. When you delete a document, all versions including approvals and the links as evidence on requirements are removed as well.

Frequently asked questions

What happens if the check finds something?

The file is not saved, and you see the reason together with a way forward. In addition to malware, the following are also rejected:

  • encrypted or password-protected files: save without protection (for PDF, e.g. via “Print to PDF”),
  • files with macros: save without macros (e.g. as .docx or .xlsx) or as PDF,
  • PDF files with JavaScript or other active content: save again, e.g. via “Print to PDF”,
  • archives that are too deeply nested or too large when unpacked: upload the contained files individually.

Do attachments to measures or assets also need approval?

No. For files, approvals only exist for controlled documents under “Documents & evidence” and for policies.

Can I change the type of a document later?

You set the type when creating the document. If you need the other type, create a new document.