Hauptseite/en

Welcome to the online help of the GRC software HITGuard. This help accompanies you in controlling and monitoring your risks and compliance requirements – understandable for beginners and useful for experienced users.

Do you need support? Our support team will be happy to help you at support@togethersecure.at.

Help and quick start

In the Help menu item you will find:

• First steps – the interactive introduction to the HITGuard interface, which also greets you when you log in for the first time.
• Online help – The online help you are currently on.
• Page introduction – if an info symbol is visible at the bottom left, a click starts a short introduction to the current page.

Are you new to HITGuard or setting up a new module? Here you will find the right starting point:

• First steps in setting up a management system
• First steps with the data protection module
• First steps with the audit management
• First steps with the case management
• First steps with the document management
• First steps with the ESG module
• First steps with the Supplier Risk Management
• Activating mailings after completing the initial tests

Product overview

HITGuard has a modular structure. Which menu items you see depends on your permissions and the activated features of the respective management system. However, the "My Tasks" module exists for every user. If you want to learn more about it, follow this link:

Help for My Tasks
My Tasks

Below you will find explanations of all menu items of the other modules:

Base modules

Risk management, measures, controls, master data and administration are always available in HITGuard and form the basis of the tool.

Module	Description
Risk management	Identification and assessment of risks and opportunities on a central platform for assessments and treatments. The risk policy is freely configurable, and various workflows support you in this. → Risk/Opportunity workflow · For Practitioners
Measures	Implementation of measures to eliminate or reduce risks and security gaps. Tracking via progress reports and effectiveness review. → Measure workflow · For Practitioners
Controls	Management and assessment of controls and their effectiveness. Create control definitions and track execution. → Control workflow · For Practitioners
Master data	Maintenance of company data, resources and assets as well as knowledge bases, questionnaire templates and standards.
Administration	Configuration and adaptation of HITGuard to your requirements: management of user accounts, roles and teams as well as integration into existing systems and processes.

Add-ons

Various extensions cover additional use cases. Add-ons are licensed separately and are usually activated under Administration › Management systems for one or more management systems.

Add-on	Description
Data protection	Support in complying with data protection regulations and guidelines. Activates the "Data protection" menu item. → Processing activity workflow · Working with processing activities
Audit management	Carry out internal and external audits, track results and generate reports. Activates the "Audit management" menu item.
Case management	Processing of security incidents and violations of guidelines and regulations. Activates the "Case management" menu item. → Report workflow · Creating reports · Whistleblower system
Document management	Combines document control, uploaded attachments and the report archive. Activation via your contact person at TogetherSecure. → Document management workflow · Review and approval workflow
ESG Management	Support with the double materiality analysis; extends risk management with new menu items. → More about ESG Management
Supplier Risk Management	Send reviews to suppliers and integrate them into your audit processes; extends administration and reviews. → More about Supplier Risk Management

The HITGuard interface

The HITGuard interface (click to enlarge)

The profile area of the logged-in user is located at the top left, with the main menu below it. Clicking on the profile picture opens the Manage account page, where you can change your data, your profile picture and your password.

The highlighted areas in the image show:

1. Intro for the current page – starts the interactive introduction, if available.
2. Expand/collapse menu – shows or hides the navigation menu.
3. Switch management system – switches between management systems (only visible with permission for several systems; not for Practitioners).
4. Current management tasks, administration, accessibility, language, log out:
   • Envelope symbol → Current management tasks
   • Gear icon → Administration for basic central functions
   • Person symbol → configure accessibility
   • Flag → switch between German and English
   • Log out → log out

Main menu

The menu begins with the personal entries My Tasks and My Dashboards, followed by the module menu items (only visible for authorized modules) and ends with the Help item.

My Tasks

My Tasks

Here you will find all the tasks you have to complete in your role as a Practitioner. A click opens the task dashboard with a summary of all open tasks; a submenu organizes the tasks by type (including those already completed).

• Orange badges show how many tasks you have to process yourself (e.g. requested ((Special:MyLanguage/Fortschrittsmeldungen|progress reports]] or processing activities to be reviewed).
• Blue badges show tasks for which you share responsibility, but which someone else is processing (e.g. controls where your implementation is still being reviewed).

Status of the elements per menu item: Measures · Controls · Reviews · Processing activities · Risks & Opportunities · Reports

My Dashboards

Dashboard with KPIs and reports

Dashboards provide an overview of the management systems based on key performance indicators (KPIs) and make reports available for reporting. By default, there is one dashboard each for KPIs from risk management, measures and controls; the data protection, case and audit management add-ons each have an additional dashboard. You only ever see dashboards, KPIs and reports for which your user is authorized.

Permissions: Access to a dashboard or its KPIs and reports requires the "Expert", "Professional" or "Observer" role in the respective module (e.g. at least "Professional" in risk management for the risk management dashboard).

My dashboards: You can create additional dashboards. Standard dashboards delivered with HITGuard are marked with a tool icon; they can be edited and reset to their original state, but not deleted. Dashboards you create yourself can be configured as "Private" (only for you) or open (for all authorized members) or can also be deleted.

Mark dashboard as favorite

Favorite: Using the star next to the dashboard configuration, you mark one dashboard per management system as a favorite – it is ranked first and displayed after logging in.

Further reading: Creating/editing dashboards · Risk management · ESG · Measures · Controls · Data protection · Case management · Audit management

Reports on dashboards correspond in content to the reports of the respective menu items (see there for explanations) and additionally offer:

• Prepare several versions: Using the "Filter" button, different configurations of a report can be saved – e.g. a "Risk report – details" with measure and control details for risk owners and a concise "Board report risks" for the board.
• Set as default report setting: On non-private dashboards, Experts and Professionals can set one configuration as the default per report type. This is used automatically in overview lists (e.g. under Risk management › Risk assessment), but remains individually adjustable on the report page itself. Settings already set individually are not overwritten by the default. The default report is marked on the dashboard with a star on the report icon.

AI features

AI functions via the "asterisk" button

In HTML-editable fields (fields with text formatting) you will find an "asterisk" button, via which you call up AI functions. With it you can, for texts:

• summarize
• proofread
• expand
• shorten
• change the style
• change the tone
• translate between German and English

Using your own prompts, you can also ask the AI questions and generate your own texts. There is a special feature in the deviation analysis and in the review result: there, the AI functions can also be used in the non-HTML-editable field of the justification.

Current management tasks (the envelope)

Management tasks

The envelope at the top right informs Professionals and Experts about tasks that have been reported as completed and are waiting for closure/review. Clicking on the envelope opens the list, which shows them these tasks and expired analysis periods. However, the list only shows the tasks from the current management system. Tasks only appear to users who are authorized to process them (e.g. answered processing activities only to users with Professional/Expert rights in data protection).

Section	Description
Progress reports	Answered progress reports on measures.
Risks	Risks that have been newly submitted or returned.
Protection requirement analyses	Answered protection requirement analysis.
Vulnerability analyses	Answered vulnerability analyses.
Reports assigned to me	Open reports assigned to you.
Unassigned reports	Reports not yet assigned to any user. Only visible to team members if a support team is stored.
Processing activities	Answered processing activities.

HITGuard module overview

Below are all menu items of the individual modules. Only modules and items for which you are authorized and which have been activated in the management system are visible.

Risk management

• Structure analysis
• Protection requirement
• Vulnerabilities
• Threats
• Risks & Opportunities
• Impacts
• Fields of Action
• Treatment R&O
• Reports
• Settings

Audit management

• Audit calendar
• Audit planning
• Audit execution
• Audit treatment
• External auditors
• Audit cluster
• Functions
• Reports
• Settings

Case management

• Report incident
• Deadlines
• Reports
• Files
• Reports
• Settings
• Whistleblower system

Measures

• Current measures
• Progress reports
• History
• Evaluations
• Reports
• Settings

Controls

• Control definitions
• Reports

Data protection

• Processing register
• DPIA
• External parties
• TOMs
• Data subject categories
• Reports
• Settings

Document management

• Documents
• Uploaded attachments
• Report archive

Master data

• Organizational units
• Resources
• Data categories
• Processes
• Suppliers
• Standards and norms
• Knowledge bases
• Uploaded attachments
• Report archive

Administration (top right)

• Users and user roles
• Teams
• Management systems
• Global settings
• Risk policy
• AI prompt management
• Text modules
• Data import
• Licensing
• Jobs

Guides & references

FAQ & glossary

• FAQ
• Glossary

Working with HITGuard

• User profile
• Functionality and symbols of the tables
• Icons and buttons in HITGuard
• Tips, tricks & best practice

Guides by role

Experts or Professionals

• Create/edit audit
• Create/edit audit program
• Create/edit reviews (deviation analyses/review results)
• Record/edit risk
• Create/edit measure
• Create/edit controls
• Request progress reports
• Create/edit external parties

Administrators or Experts

• Manage risk policy
• Manage settings for measures and controls
• Create/edit data subject categories
• Import data

Administrators

• REST API: data import/export interface

External users

• HITGuard portal for suppliers

Workflows at a glance

• Measure workflow
• Control workflow
• Review workflow
• Processing activity workflow
• Risk/Opportunity workflow
• Report workflow
• Document management workflow
• Procedure for a protection requirement analysis

Release Notes

Release notes from the years 2017 and 2018 have been incorporated directly into the help.

Login & authentication

• Login options
• Passkeys
• Two-factor authentication

Installation help

• Installation help