Wissensdatenbanken/en

What is a knowledge base?

• Knowledge bases contain portable know-how for risk identification (through topics, audit questions, threats) and risk treatment (measures and controls).
• This makes it possible to perform deviation analyses guided by this know-how and thus to check and document compliance/fulfillment of requirements.
• In addition to questions on risk identification, they also contain measures and control proposals to reduce, control, or eliminate these very risk situations.
• Furthermore, knowledge bases on a norm or standard basis can be used to check compliance requirements.

Difference to standards and norms:

• Standards and norms provide no usable know-how and are pure "tables of contents" of a standard.
• They are used to evaluate the impact of risks, review results, measures, and controls on a norm or standard.

Options:

• Import knowledge base
• Create a knowledge base
• Editing/user adaptation of knowledge bases
• Successor versions of knowledge bases
• Updating review objects
• Merging knowledge bases
• Translating knowledge bases

Types of knowledge bases

Norm or standard

Norm or standard knowledge bases can only be imported, not exported.

They contain copyrighted content and can not be modified!

The review questions of these knowledge bases map to the respective norm or standard. This allows the degree of compliance with a norm or standard to be determined. The degree of compliance can be viewed under "Risk management dashboard → Compliance Coverage" or in compliance reports.

Manufacturer

These knowledge bases contain copyright-protected content! They can only be imported, not exported.

Although the content is protected, user adjustments can be made!

During user customization, the review questions defined by the manufacturer cannot be customized! If you do not want to handle them, the review question must be set to "unnecessary". However, the knowledge base can be extended with your own topics and review questions without any restrictions.

So customizing a knowledge base makes sense if certain topics or questions are not covered that would be important or interesting for your business, or you do not want to cover certain knowledge base topics.

Manufacturer and standard knowledge bases can be created and exported by owning a manufacturer license.

Self developed

These are knowledge bases created by you. In these, you can maintain and prepare the content yourself. For example, you could create and manage databases for internal audits or for collecting answers to questionnaires.

These knowledge bases, as long as they are not published, can be adapted without further ado. Once published, a successor version must be created for editing.

Other properties

Languages

---

Knowledge bases can be translated into different languages. These language versions can be used in the course of vulnerability analyses and consequently in reports. The language used is the one set by the user at the top right (right next to the logout button).

For translating, see Translating knowledge bases.

Versioning

---

Versioning distinguishes between self developed knowledge bases and user adaptations of vendor knowledge bases.

Self developed

You can maintain multiple versions of self-developed knowledge bases.

If an in-house development no longer meets your requirements, a new version adapted to the requirements can be created. To do this, click on "Create successor version" in the mask for viewing the knowledge base. For more information, see Successor versions of knowledge bases.

Self-developed knowledge base versions consist of only one number. Subsequent versions increase this number by 1.

Vendor knowledge base

The version number X.Y for imported knowledge bases behaves as follows:

• X: imported knowledge bases always have a number. For example 1, 2 or 3 but not 1.1,2.1 or 3.3.
• Y: if a customization of an imported knowledge base is created, the number after the dot is increased by 1.

In the overview is displayed: KB Z in version 5 and KB W in version 2.3. In the knowledge base itself you will then see KB W in version 2 customization no. 3.

Favorite

---

If several versions of a knowledge base are available, it is possible to set one version as the preferred version.

The knowledge base must be published, then in the mask for viewing the knowledge base there is a button labeled "Set as preferred version".

In the overview of knowledge bases, preferred ones are marked with a heart.

Important: Only preferred versions can be selected in gap analyses!

Export

---

Only knowledge bases of the types "Vendor" or "Standard/Norm" tht you have created yourself can be exported. Knowledge bases of the type "Self developed" cannot be exported.

To export, click on "Export" in the knowledge base view screen in published KBs.

The file generated by this can then be imported to other systems as desired.

Copyright

---

If knowledge bases are provided with a copyright, this is displayed in the measures, controls and test questions of the knowledge base. Furthermore, these are also provided with a copyright in the reports.

Updating knowledge bases

If a newer version of an existing knowledge base is imported, all test objects that were created with the older version can be updated to the newer version semi-automatically. For more information, see Updating review objects.

Elements of a knowledge base

The knowledge base is divided into five key elements:

• Topics
• Audit questions
• Measures
• Controls
• Justification templates
• Threats

These elements are related to each other as follows:

• A knowledge base contains a set of topics. These topics can be structured hierarchically among themselves. A topic does not have to contain review questions if, for example, it is only intended to structure topics. However, topics at each level of the hierarchy can contain review questions.
  

• The review questions, when answered (yes/no/partly, unnecessary, score), are used to identify whether there is a potential vulnerability in this area. Gaps (answers with no, partly, or a score deviation) need to be investigated in more detail in the risk assessment step.
  

• When a gap is detected, it is usually addressed by a specific threat to a greater or lesser extent. Therefore, it should be treated with measures or secured with controls in the long term. Therefore, one or more threats, measures and controls are assigned to a review question within the knowledge base.

• For review questions that are normally justified with a standard answer, justification templates can be created and subsequently used in reviews.

Links

In order to make the finding of the previous occurrence of a review question, measure, control, or threat visible, there is the link "Links" at the respective element in the edit form, provided that the element has at least one link.

Link tab

Links

Topics

Topics contained in the knowledge base are used to structure a knowledge base. They are the units within a layer (e.g. IT systems, networks). They describe technical components (such as cabling) or organizational procedures (such as emergency preparedness concept).

Test questions can be assigned to each topic.

To create topics, see Create topics.

Review questions

Review questions serve to determine possible vulnerabilities in the context of a review. A review question can be assigned to several topics. Review questions can be structured hierarchically by using structure questions.

To create a review question, see Create review question.

Measures, controls and threats can be assigned to a review question. This ensures that if the answered question deviates from the desired target state, measures and controls are suggested to address the associated potential risk.

Structural questions

• Review questions that are assigned to topics can be extended by sub-questions in the knowledge base. If a question has one or more sub-questions, the main question becomes a structural question and is only used for structuring. That is: a structural question answered with "No" or "Partly" represents no deviation!
  
• Depending on the answer to the structural question, different review questions can be displayed. For example, two specific review questions may be displayed in case of a "Yes" answer and three other specific review questions may be displayed in case of a "No" answer. However, a negative answer to sub-questions will result in gaps.

Sub-question options
Looks different depending on the type of question (For technical questions, Yes/No/Partly/Unnecessary would be shown)

If a superordinate question is created, the options "Will be displayed if" and "Answer if not displayed" are available.

• The option "Will be displayed if" defines which answer the superordinate question must have in order for the sub-question to be offered for answering. This means that if only the option "Yes" is selected for the review question under "Will be displayed if", this sub-question will only be displayed for answering if the superordinate question is answered with "Yes".
• The option "Answer if not displayed" defines which answer the sub-question should receive if it is not displayed for answering. If no selection is made here, the review question will not be answered automatically in this case.

In reports, structural questions are formatted in italics and their corresponding sub-questions are indented below them.

Measures

Measures in a knowledge base are possible measures that can be selected on the basis of the gap identified during a review in the context of the risks to be addressed. They are intended to help reduce or eliminate one or more gaps.

To create a measure, see Create measure.

Controls

Controls in a knowledge base are possible controls that are available for selection based on the identified gap for the assigned risk. They are intended to help monitor the risk or to control the execution of implemented measures.

To create a control, see Create control.

Justification templates

If a review question is normally justified with a standard answer, a justification template can be created for this question, which can then be used for reviews.

To create a justification template, see Create justification template.

Threats

Threats are mainly used for analyses. For example, a report can be generated in which all deviating review questions are listed for a threat.

To create a review question, see Create threat.

Tips, tricks & best practice

• Knowledge bases can reference one ore more standards, thereby allowing one question to address the meeting of requirements of multiple standards at once.
• Proper/self-developed knowledge bases can be created, such as a checklist or an audit questionnaire used on a regular basis.
• Used knowledge bases should be extensively tested in order to make sure that all desired (norm) requirements are addressed accordingly. KPIs, such as "Compliance fulfillment", and the risk management report for Conformity by Standard/Norm can be of help in this.