In Varmo, people receive their subject-matter permissions exclusively through functional roles. This article explains the standard roles, how you create your own roles and assign people, and which rules apply. It is aimed at ISMS managers and Tenant Admins.

Before you start

  • There are two kinds of roles. The system role (User or Tenant Admin) determines who manages members and access. The functional roles determine which functions a person may use, for example assessing risks or editing policies.
  • People with the corresponding permissions may edit and assign functional roles; by default, the functional role ISMS manager. Every Tenant Admin is automatically ISMS manager.
  • Functional roles are included in all plans. Note the user limit of your plan: anyone with a functional role other than Employees counts as a user, see Inviting members and managing access.
  • Tenant Admin

    automatically

    ISMS manager
  • Every person

    automatically

    Employees
  • User or Tenant Admin

    assigned, never by themselves

    Further functional roles, e.g. Risk analyst
System role and functional roles: subject-matter permissions only come from functional roles

On the left the person or their system role, on the right the functional role. Every Tenant Admin automatically receives the functional role ISMS manager. Every person automatically receives the functional role Employees. Further functional roles are assigned by another person; assigning functional roles to yourself is not possible.

The standard roles

Every organisation starts with these functional roles:

  • ISMS manager: responsible for the ISMS, with all subject-matter permissions except the approvals of top management. Invites members, removes them and assigns their functional roles. The account, access (set expiry, deactivate, unlock, reset password, appoint as Tenant Admin) and assigning the ISMS manager role remain reserved for the Tenant Admin.
  • Top management: approves scope, Statement of Applicability and documents, accepts risks that the risk owner may not accept alone under your risk acceptance criteria, and sees the management review. The policy is approved by the policy's approval workflow: add Top management there (ISO/IEC 27001, clause 5.2).
  • Risk analyst: reviews and assesses reported risks and plans measures.
  • Protection object owner: records and maintains their own assets and carries out the protection requirements assessment and baseline check for them.
  • Data protection advisor: reviews protection requirements assessments with personal data and supports data protection impact assessments.
  • Internal audit & review (read only): insight into all areas and the change log, without edit or approval permissions.
  • Employees: report risks and incidents, comment on risks, read policies.

ISMS manager and Employees are system roles: they cannot be deleted or renamed. The Employees role can only be extended by commenting on measures and exceptions; for further permissions, create a custom functional role. A person can have several functional roles.

How to do it

Checking and adjusting roles

  1. Open ISMS settings › Organisation & roles › Functions & roles.
  2. Open a functional role. Under Permissions, select the permissions. For permissions relating to assets, you also set the scope: All assets or Own assets only.
  3. Click Save permissions.

Creating a custom role

  1. Click Create functional role.
  2. Enter a name and description, for example “Head of IT” or “Data protection”.
  3. Save. You then select the permissions on the role's page under Permissions.

Assigning people

  1. Click Manage people on the functional role.
  2. Under Add people, choose the people and click Add.

Alternatively, you assign functional roles per person under Administration › Members.

Rules that always apply

  • No self-assignment: nobody can assign a functional role to themselves. Another person with the permission to do so must do it.
  • Employees automatically: every new person automatically receives the Employees role. This way, every person can report risks and incidents and know the policies.
  • Extending your own role: if you extend the permissions of a functional role you hold yourself, Varmo asks for a justification. It is recorded as a segregation of duties exception and applies immediately; the approver receives a task to approve it. It is usually better to have another person make the change.
  • Segregation of duties: if a person combines tasks that should be separate, Varmo shows a warning when assigning. You justify the exception or choose someone else.
  • Responsibility gives access: whoever owns an asset or is responsible for a measure sees this object even without a matching functional role.

What happens next

  • New permissions apply immediately. The person sees the additional areas in the menu and receives the matching tasks.
  • If a workflow needs a functional role without members, for example an approver, the workflow waits. Whoever assigns functional roles receives the task Staff functional role “…”.

Frequently asked questions

Can I delete a functional role that is used in a workflow?

Only with a replacement role. The delete dialog shows where the role is used and transfers all uses to the selected replacement role in one step.

I have changed the standard roles and want to go back.

On Functions & roles, choose the action Reset standard roles. Beforehand, you see for each role which permissions are added or removed. Custom functional roles and assignments are kept. If a standard role is missing, Varmo creates it again, without members.

Why can I, as Tenant Admin, only assign the ISMS manager role in another organisation?

Tenant Admins manage access, not subject-matter permissions. In organisations in which you are not ISMS manager, you only assign this role; all other functional roles there are assigned by the ISMS manager.