This article shows how you get started with Varmo: which role you have as the first person in your organisation, how setup works and in which order you proceed. It is aimed at Tenant Admins and ISMS managers who are introducing Varmo.

Before you start

  • You have received an invitation by email or an account with a start password. At your first sign-in, you set your own password.
  • As the first person in your organisation, you are Tenant Admin. Tenant Admins manage members, their access and the account. In addition, every Tenant Admin is automatically ISMS manager: this means you see the content of the ISMS and may set it up.
  • All people, including Tenant Admins, receive subject-matter permissions only through functional roles. More on this under Setting functional roles and permissions.

The most important areas

  • Set up ISMS: guides you step by step through the basic settings. Appears in the menu as long as steps are open.
  • My tasks: everything you are supposed to do, for example approvals, reviews and due reviews.
  • Dashboard: the current state of your ISMS with metrics.
  • Administration: Overview, Members, Organisations, Sign-in & security, Support access, Data export, Administration log and Account & contacts. For Tenant Admins.
  • ISMS settings: subject-matter settings, organised into Organisation & roles, Assets, Risks, Incidents, Policies and Integrations.

You can find help at any time via your initials at the top right: Help & support leads to help in Varmo and, on pages with a matching article, Guide to this page leads to the help centre.

How to do it

  1. Sign in. As long as a setup step is open that you have not postponed, Varmo opens the Set up ISMS page after sign-in, otherwise My tasks.
  2. Click Do it now for the next step. At the top of the target page, a notice explains what it is about, why it matters and what you do now.
  3. Enter the details. Whatever is done is ticked off automatically, and the notice guides you to the next step.
  4. In the Invite team step, invite the people who work on the ISMS with you and assign their functional roles straight away. See Inviting members and managing access.
  5. In the Set up approvals step, specify who approves as top management in your organisation. See Regulating approvals with the four-eyes principle.

All steps are described in detail in Setup step by step.

A proven sequence for the first weeks, which you adapt to your organisation. It follows the groups of the setup:

  • At the start: enter the organisation, record internal and external issues and interested parties. You complete these steps on your own, up to and including Define roles and responsibilities.
  • Next: check roles, invite the team and set up approvals. From here on, at least a second person is needed, because approvals follow the four-eyes principle.
  • Then: record the scope and the information security policy as drafts, define objectives, define the risk methodology and create a requirement catalogue.
  • Finally: check the asset structure, record the first assets, set up incident management, plan an internal audit and the first management review.

The scope is approved by top management. The information security policy is approved by the approvers in the policy's approval workflow; top management is not automatically included there. Under ISO/IEC 27001 (clause 5.2), top management establishes the policy: you should therefore add the functional role Top management to the approval workflow of the policy. The setup does not wait for these approvals: they appear as a task for the approver.

What happens next

Once all steps are done, Varmo shows the Your ISMS is set up screen with your next steps in operation, for example obtaining open approvals or setting applicability. The Set up ISMS menu item disappears. From now on, you find everything that needs to be done under My tasks.

Frequently asked questions

Can I have several Tenant Admins?

Yes. Under Administration › Members, you appoint another person as Tenant Admin. There must always remain at least one active Tenant Admin without an expiry date.

I can't see the “Set up ISMS” menu item.

It only appears as long as steps are open, and only for people who may set up the ISMS; by default, the ISMS managers. Once setup is complete, you change settings under ISMS settings.

Can I adopt an existing ISMS?

Yes. In the first step, you state whether you want to adopt already approved ISMS documents. The setup then shows how you adopt existing approvals instead of having everything approved again.