Managementsysteme/en

Management systems overview

Administrators and Experts can create, edit, and manage management systems via "Administration → Management systems". Experts can only edit the management systems for which they are responsible.

What is a management system?

A management system is a contentwise bundling of elements, meaning measures and progress reports, controls, determinations and gaps, audits and reviews, etc.

The elements are assigned to a team of responsible experts and professionals in terms of monitoring and workflow handling (e.g. information security management team or data protection team). Also, all elements managed in it are historized in terms of analysis periods and thus made comparable.

What purpose do management systems serve?

Management systems have two central functions:

1. They serve to assign measures, controls, risk identifications, etc. from selected departments to subject areas and to define responsible experts who, for example, supervise the progress of the measures.
   Example:
   • Information security management Reporting: Measures from the Information Security Management Audits are managed by Ms. XY
   • Qality management Reporting: Measures from the Quality Management Management Audits are handled by Mr. Mustermann.
     
2. They are used to assign the feedback from the progress evaluations of the various tasks to time periods and to analyze the corresponding key figures and trends.
   Example:
   • Mr. Mustermann collects progress data on ten departments every six months.
   • Ms. XY collects progress data of two divisions quarterly.

That means:

• Measures to deal with risks can be implemented by employees from different areas of responsibility. Experts from the individual management systems can continuously monitor the progress of the measure developments and report periodically over several analysis periods.

• In addition to the measures, controls can also be created for further risk monitoring to ensure the effectiveness and sustainability of implemented measures. Controls are assigned to the employees of the respective area of responsibility, which are reminded of the execution of the control at predefined intervals. The execution of these - if necessary with indication of evidence - is documented in a comprehensible manner.

Deleting a management system:

• The deletion of a management system can only be performed by the responsible expert.
• The deletion of management systems is only possible as long as no active analysis periods are included.

Licenses:

The overview shows how many licenses are currently available and how many are in use. This makes it possible to see at a glance whether one is underlicensed or still has licenses for additional management systems. More information about the licenses can be found under "Administration → Licensing".

Master data

A management system is configured in the master data. The settings made here affect the measures and reports to be created.

Edit master data

Edit master data

• Here, the name, the responsible person(s) and the team members for a management system are defined and entered. There can only be one responsible person per management system. Only professionals and experts can be responsible for a management system. Management systems can only be edited by the responsible person or the administrators once they have been created.

Evaluation schema Evaluation schemas are a way to evaluate reviews according to a different schema, like the target maturity schema.

Possible evaluation schemes are:

• Yes/No/Partial
• CMMI process model
• Grade system (1-4)

This option is not available for selection by default. To get this option for selection, contact our team.

Management system settings

Management system settings

If protection targets are activated here, they are activated by default in the risk policy of risk management. This in turn has an impact on risk assessments and analyses. These protection targets can then be used within the management system. Protection targets can be managed and created by experts under "Risk Management → Risk Policy". (See protection targets)

The standards and norms that are to be used in this management system can be configured here.

Standards that are not selected here are visible in existing mappings, but can no longer be selected or changed in this management system.

For example, if the standard " GDPR " is not selected, it cannot be selected for the evaluation of the compliance spider in the risk management dashboard according to " GDPR ".

• Extent of damage classification (only visible if at least two Extensions of damage classifications exist):

Here, define the classification used in this management system to assess potential damage. If you do not make a selection, the default extent of damage classification will be used.

A use case for your own extent of damage classification would be, for example, to assess potential damage in the data protection management system from the perspective of the affected party.

As a result, the Risk Management dashboard, hazard situations, and structural analysis will by default only display hazard situations and SBA weightings for the associated extent of damage classification.

• Data protection add-on:

This activates the Data Protection module for this management system. Data protection experts, professionals and observers can then create and manage data protection, processing activities, data protection impact assessments and more via the Data Protection menu item.

• Case management add-on:

Specifies whether this management system should be used to report incidents. This makes the Case Management menu item visible to users authorized for case management.

• Audit management add-on:

Specifies whether this management system should be used to manage audits and audit programs. This makes the Audit management menu item visible to users authorized for audit management.

E-mail settings

E-mail settings

• If an email setting is configured here, then all reminders that originate from this management system will be sent via this email address. If you do not use an e-mail account of your own but the one provided by TogetherSecure, the sender address needs to end in @hitguard.at.
• If no email setting is configured here, then all mails will be sent from that address that is stored in the global settings.(see Global e-mail settings)

define interval schema

Define interval schema

The interval schema is used to define whether analysis periods should follow a predefined rhythm.
Analysis periods can be:

• Manually set: Here, the time restriction is defined manually with a from-to date. This is set individually for each period.
• Start date plus interval: Here, a year is divided into three analysis periods. For example, starting with 2/1 to 5/31/2021; 6/1 to 9/30/2021 and 10/1 to 1/31/2022.

Reminders via e-mail

The current setting for progress message reminders is displayed here. This setting ensures that an implementer of a task is reminded of its implementation via e-mail before the period expires.

This setting must be made directly in the database!

If you want to change this setting, please contact our team.

Analysis period and History:

Active analysis period

Purpose

Analysis periods are used in risk management, measures and control administration or data protection to assign results to individual periods and thus make them evaluable and comparable. This makes it possible to track and analyze the progress of measures over several periods.

In a management system, measures are determined, processed and also implemented within an analysis period.

For these measures progress reports can be requested at any time.

At the end of an analysis period, at least one progress message must exist for each active measure. Only then can the analysis period be transferred to the next analysis period. Before the editorial deadline, the person responsible is therefore requested via e-mail to obtain progress reports for the active measures.

If all progress messages have been accepted, the analysis period can then be carried over and the process starts again.

By comparing the analysis periods on the measures dashboard, it is possible to track the progress of measures.

Analysis periods can be created in two different ways. (see Define interval scheme)

Active analysis period

Editorial deadline::

• Relevant for the the measures and control management.
  The date by which all progress reports on all measures in an analysis period should be completed.
  Progress reports can also be requested manually at any time via "Measures → Progress reports".

Target maturity level:

• The target maturity level describes the target status for all gap analyses.
  If you are below a target maturity level in an analysis, the answered test question is recognized as a deviation.
  The identified deviations should be assigned risks in the next step and treated by measures and controls.
  If the evaluation schema is changed, the target maturity level needs to be adapted.

Included OrgEhs:

• Organizational units are required to report in the analysis periods to which they are assigned.
  This means: they must submit progress reports on the measures assigned to them by the editorial deadline.
  An organizational unit can also report simultaneously in several management systems or analysis periods.
• If new organizational units are created during an analysis period, they are automatically added to the analysis period if their parent organizational unit is assigned to that analysis period. However, if the organizational unit does not have a parent organizational unit assigned to this analysis period, then it must be added manually.

Transfer to subsequent analysis period:

• When transferring an analysis period to the next one in connection with the tasks and control management, all tasks that do not have the status "completed" are transferred to the new analysis period and adabted according to the respective status. The completed measures will of course not be followed up in the next period.

Delete an analysis period

• The deletion of an analysis period can only be triggered by the responsible expert.
• The deletion of analysis periods is only supported as long as no progress messages have been created.
• Only the current period to analyze can be deleted at any one time; completed periods can no longer be deleted.

History

• The history lists the analysis periods which have already been completed with start, end and editorial deadline.

History

Vergangene Analysezeiträume

• In der Historie werden die Analysezeiträume, die schon abgeschlossen wurden, mit Beginn, Ende und Redaktionsschluss aufgelistet.

Kürzel Generierung

Hier kann festgelegt werden, ob und für welche Elemente bei der Erstellung automatisch ein Kürzel generiert werden soll. Die Zusammensetzung des Kürzels kann ebenfalls hier festgelegt werden. Die Einstellung wird beim Erstellen des Managementsystems aus den Globalen Einstellungen übernommen, kann hier jedoch jederzeit verändert und angepasst werden.

• Das allgemeine Präfix wird bei allen selektierten Elementen vorangestellt.
• In der ersten Spalten kann für alle Elemente, die mit einem automatischen Kürzel generiert werden sollen, ein Häkchen gesetzt werden.
• Präfix: eine Buchstaben-, Zahlen-, oder Sonderzeichenfolge, die das Element deutlich kennzeichnet (z.B. M für Maßnahme). Der Default-Eintrag kann verändert werden.
• OrgEh Kürzel: entscheidet, ob das Kürzel des Elements auch das Kürzel der Organisationseinheit enthalten soll. Bei Elementen, die keiner Organisationseinheit zugewiesen sind, ist diese Option deaktiviert (z.B. Gefährdungslagen oder Prozesse).
• OrgEh Suffix: ein Trennzeichen zwischen dem OrgEh Kürzel und der laufenden Nummer (z.B. _ oder -).
• Minimale Präzision: die Mindestzahl von Stellen der fortlaufenden Nummer. Es kann mindestens 1 und maximal 10 eingetragen werden. Bei einer Anzahl von 4 wären die resultierenden Nummern bspw. 0001, 0026 oder 0184.