OrgEh - Organisationseinheiten/en

A company consists of organizational units that interact with other kinds of master data: Processes take place in one or several organizational units. Creation and processing of data categories takes place in these organizational units during the individual process steps. It is predominantly IT-supported and done with the use of IT systems. The more vital the organizational unit, the greater the potential damage, and the greater the requirements for availability, confidentiality and integrity of the data or systems.

An organizational unit is a mandatory field in all HITGuard core elements. Every protection needs- and vulnerability/gap analysis, as well as all measures and controls must always refer to an organizational unit that is responsible for them.

The structure of the organizational units is hierarchical.

Important: To be able to use OrgUnits in a management system, they must be activated for the analysis period by ticking a checkbox. The checkbox of the new OrgUnit always inherits the checkbox setting of its parent OrgUnit. If you create a new OrgUnit that has no parent OrgUnit, no checkbox is set automatically. You must therefore activate it yourself under Administration > Management System > Active analysis period.

How HITGuard displays Organizational Units in the structural analysis

Working with organizational units

OrgUnits can be created or edited by administrators and experts via "Administration → OrgUnits". To create a new OrgUnit, click the "Plus" button. To edit an existing OrgUnit, open it by double-clicking the corresponding row.

Organizational structures mask

Form for editing/creating an organizational unit

For each organizational unit, there are several input fields that you can use to further define it:

Abbreviation and designation:
In the designation, you enter the assigned name of the OrgUnit, while in the abbreviation you enter how the OrgUnit should be abbreviated. Please note that HITGuard will use this abbreviation in the structural analysis and when generating abbreviations for other entities.

Sort order: Defines the order in which the OrgUnits are listed, e.g., in a report. (e.g. in a report).

Superordinate OrgUnit: Here you establish the hierarchical structure of the organizational units by specifying where the OrgUnit fits into the hierarchy, for example, which company a department belongs to.

Type: Here, you specify the type of organizational unit: Group, Company, Department, Entity, Branch

Division: Here, you define in which divisions the OrgUnit is active. Divisions are primarily used in the add-on for Audit planning.

Responsible: The person entered here is responsible for the OrgUnit. This could be, for example, the head of a department.

Description: Here, you describe the OrgUnit.

Closed: If an OrgUnit is closed, it is only displayed on this page. It can no longer be selected for new elements. Deactivating has no effect on current assignments, and the OrgUnit can still be selected for reports.

Active from/to Here you define the time period in which the OrgUnit should be active in HITGuard. If the OrgUnit is no longer active, but not closed, it can still be selected anywhere, but is displayed in italics to signal that it is inactive.

ID in third-party systems: HITGuard uses this ID to identify individual OrgUnits during import. It is therefore not possible to store two OrgUnits with the same ID in the third-party system in a HITGuard instance.
If an OrgUnit is imported whose ID matches the ID of an already existing resource, no new OrgUnit is created. Instead, HITGuard enters the import data into the existing OrgUnit. This function enables you to create automated updates. You can find more about this under Data import.

Risks: All risks of the OrgUnit are listed here. It is not possible to assign risks here. More about risks can be found here.

Address: Here you can enter the address of the OrgUnit and tick a checkbox if the organizational unit is located outside the EU. If you are in a data protection management system, you can then record the appropriate safeguards (more on this below).

Delete OrgUnit: To delete an OrgUnit, click on the red trash can in the edit screen. An OrgUnit can only be deleted if nothing is linked to it. This means it must not be activated in any active or past analysis period. In addition, all assigned measures, reviews, and other elements must be assigned to another suitable OrgUnit or deleted. If this is not possible, the OrgUnit can be marked as closed (see above).

Data protection management system

If the active management system is the data protection management system, you can record appropriate safeguards as well as the contact details of the data protection officer of the OrgUnit. These are required for the data protection management system.

If HITGuard does not find a data protection officer when evaluating an OrgUnit, HITGuard will use the officer of the parent OrgUnit. This means: If there is only a single officer in the organizational structure, it only needs to be entered in the highest-ranking Org Unit.

Data Protection Officer

Deviations/measures/controls

In the additional tabs, HITGUard listsgaps, measures and controls that are linked to the entity via review objects. These lists only provide an overview. This means that you cannot assign deviations, measures, or controls here.

Audit information

In the tab "Audit information", youcan record additional information relevant for the context of audits.

• Number of employees: Here you can record the number of employees.
• Local management representative: The LMR is the audit coordinator and contact person who should be defined for each OrgUnit of the type "Company".
• "Proposal to audit this OrgUnit in every audit program": If you set the corresponding checkbox during filtering in the audit calendar or during audit creation, HITGuard will suggest these OrgUnits.
• Certifications: Here you can select and assign standards (from standards and norms) according to which the OrgUnit is certified. For each of these standards, a registration number and a site number can be recorded.

Audit information

Divisions

OrgUnits can be assigned several divisions, depending on their field of activity. You can use these functions in the add-on for Audit planning.

Under "Administration → Divisions", these divisions can be managed.

Divisions

Create/edit division

A new division can be created by clicking the "Plus" button.

By double-clicking on a division, it can be edited.

Edit division

Topic responsibility

Topic responsibilities are used for the bulk creation of measures in the context of dossiers in the case management. In them, you can designate responsibilities for certain topics by organizational units.

To use topic responsibilities, you must first select the checkbox "Topic responsibility" under "Measures → settings". This activates the menu item in the breadcrumb menu under "Administration → OrgUnits". Topic responsibilities allow you to distribute multiple measures to many OrgUnits at once. Here you can prepare the responsible users for each OrgUnit.

You can create a new topic responsibility by clicking the plus button. You can open an existing topic responsibility by double-clicking it in the list.

You can then enter a designation and a description.

Edit topic responsibility

Select the desired organizational units for the respective topic.

Note: Here, all OrgUnits that are activated for the current analysis period are available to you. The others cannot be selected.

For each selected organizational unit, you must then enter a responsible user or team to whom the measures will be assigned for implementation when creating measures in bulk.

For each selected organizational unit, its responsible user (see above) is entered by HITGUard by default. If no responsible person is defined there, this field is empty. If no OrgUnit responsible person is available, a responsible user must be set so that the organizational unit can be selected.

Even if an OrgUnit responsible person is prepared, the responsible person can be manually replaced here for the respective topic by another user or a team (manually set topic responsibles are shown in bold).

Note: This does not change the responsibility in the organizational unit itself. A change in the organizational unit also does not overwrite topic responsibles that have already been manually set here.

The topic responsibilities are then used in case management dossiers for creating measures in bulk .