Benutzer und Benutzerrollen/en

User-roles in HITGuard

Each user role has its own permissions and functions.
User roles can be given seperately for every modul.
That means a user can be an Expert in the Security Assessor but only an Professional or Practitioner in the Progress Monitor.
User-roles in the Progress Monitor, User-roles in the Security Assessor

Admin:

This role is responsible for administration as well as for managing other users. Administrators have no insight into data. So, although administrators can manage and create all management systems, they do not have access to their data, nor can they be defined as responsible persons.

• At the first installation of the software at least one administrator must be defined.
• There can be several administrators.
• Performs purely administrative tasks.

Expert:

In this role you will be responsible for one or more management systems in your company.

• Security Assessor (Risk Management):
  • Can conduct evaluations, assess risk and also administer findings.
  • Responsible for the administration of risk policy
• Progress Monitor (measures and controls)
  • Can create and administer measures and controls.
  • Is responsible for the administration of settings in the progress monitor
• Data Protector ( Privacy)
  • Can create processing activities, assign TOMs, administer external parties and data subjects
• Can create and manage management systems
• Can carry out the access authorizations and basic configurations
• can manage the administration

Professional:

Users of this role support the experts of the management systems in fulfilling their tasks. A Professional has access to all tasks in the management systems to which he is assigned, but has limited editing rights.

• Security Assessor (Risk Management):
  • Can conduct evaluations, determine risks and also administer findings.
• Progress Monitor (measures and controls)
  • Can create and administer measures and controls.
• Data Protector (Privacy)
  • Can create processing activities, assign TOMs and manage externals

Practitioner:

This role has detailed information and implementation competencies that are required from the management system. It is essential that practitioners share their knowledge with the HITGuard experts in order to have a functioning management system.

• has an overview of all his assigned measures, controls, processing activities and assessments to answer
• is reminded to carry out his duties
• is the default role that each user has across all modules.

User Administration

Creating a new user is divided into 3 steps:

1. Create user including initial password:

   There are 2 ways to create a user

   • Option 1: User list

   Administration → User

   In the user list, on the right hand side, click on the plus button "Add user" and create the user with the relevant data (see Profile).

   • Possibility 2: Quick entry

   In the context of use, you can activate Active Directory integration, through which a new user with minimal permissions for the active module can be created via a person selection mask. E.g. during the creation of measures

2. Assign user roles:

   User roles can only be assigned by administrators or experts.
   Assign the respective roles for the desired user under "Administration → User Role Assignment".
   Note: Only administrators can assign the Expert role.
   Important: Experts and professionals must then be assigned to a management system in order to be able to perform their tasks. (see Assign Users to Management Systems)

3. Change password:

   Change your own password:

   1. Click on the profile picture or the profile name
   2. click on "Change password" at the bottom right
   3. enter old and new password and confirm

   Change/reset a password as administrator or expert:

   1. Under "Administration → User" select the desired user
   2. click on "Change password" at the bottom right
   3. enter new password and confirm

4. To consider: Only administrators can reset expert passwords. Experts can create and authorize users and they can reset passwords for professionals and practitioners. The administrator role can also be assigned to multiple users.