Management Systems

Administrators and Experts can create, edit, and manage management systems via "Administration → Management systems". Experts can only edit the management systems for which they are responsible.

What is a management system?

A management system is a contentwise bundling of elements, meaning measures and progress reports, controls, determinations and gaps, audits and reviews, etc.

The elements are assigned to a team of responsible experts and professionals in terms of monitoring and workflow handling (e.g. information security management team or data protection team). Also, all elements managed in it are historized in terms of analysis periods and thus made comparable.

What purpose do management systems serve?

Management systems have two central functions:

They serve to assign measures, controls, risk identifications, etc. from selected departments to subject areas and to define responsible experts who, for example, supervise the progress of the measures.
Example:
- Information security management Reporting: Measures from the Information Security Management Audits are managed by Ms. XY
- Qality management Reporting: Measures from the Quality Management Management Audits are handled by Mr. Mustermann.
They are used to assign the feedback from the progress evaluations of the various tasks to time periods and to analyze the corresponding key figures and trends.
Example:
- Mr. Mustermann collects progress data on ten departments every six months.
- Ms. XY collects progress data of two divisions quarterly.

That means:

Measures to deal with risks can be implemented by employees from different areas of responsibility. Experts from the individual management systems can continuously monitor the progress of the measure developments and report periodically over several analysis periods.

In addition to the measures, controls can also be created for further risk monitoring to ensure the effectiveness and sustainability of implemented measures. Controls are assigned to the employees of the respective area of responsibility, which are reminded of the execution of the control at predefined intervals. The execution of these - if necessary with indication of evidence - is documented in a comprehensible manner.

Deleting a management system:

The deletion of a management system can only be performed by the responsible expert.
The deletion of management systems is only possible as long as no active analysis periods are included.

Licenses:

The overview shows how many licenses are currently available and how many are in use. This makes it possible to see at a glance whether one is underlicensed or still has licenses for additional management systems. More information about the licenses can be found under "Administration → Licensing".

Master data

A management system is configured in the master data. The settings made here affect the measures and reports to be created.

Edit master data

Here, the name, the responsible person(s) and the team members for a management system are defined and entered.

Every management system can have one or more experts or teams made up of experts be responsible. The members of the management system team must be experts, professionals, or observers.
Management systems can only be edited by the responsible person(s) or the administrators once they have been created. Evaluation schema Evaluation schemas are a way to evaluate reviews according to a different schema, like the target maturity schema. Possible evaluation schemes are:

Yes/No/Partial
CMMI process model
Grade system (1-4)

The third option is not available for selection by default. To get this option for selection, contact our team.

Management system settings

If protection targets are activated here, they are activated by default in the risk policy of risk management. This in turn has an impact on risk assessments and analyses. These protection targets can then be used within the management system. Protection targets can be managed and created by experts under "Risk Management → Risk Policy". (See protection targets)

The standards and norms that are to be used in this management system can be configured here.

Standards that are not selected here are visible in existing mappings, but can no longer be selected or changed in this management system. They are also not considered when further mapped norm chapters are included in reports (e.g., Compliance report by Standard or Norm).

For example, if the standard "GDPR" is not selected, it cannot be selected for the evaluation of the compliance spider in the risk management dashboard according to "GDPR".

Extent of damage classification (only visible if at least two Extensions of damage classifications exist):

Here, define the classification used in this management system to assess potential damage. If you do not make a selection, the default extent of damage classification will be used.

A use case for your own extent of damage classification would be, for example, to assess potential damage in the data protection management system from the perspective of the affected party. As a result, the Risk Management dashboard, hazard situations, and structural analysis will by default only display hazard situations and SBA weightings for the associated extent of damage classification.

Caution: Changing the extent of damage classification potentially affects the meaningfulness of previously evaluated risks as well as protection needs analyses made in the management system.

Data protection add-on:

This activates the Data Protection module for this management system. Data protection experts, professionals and observers can then create and manage data protection, processing activities, data protection impact assessments and more via the Data Protection menu item.

Case management add-on:

Specifies whether this management system should be used to report incidents. This makes the Case Management menu item visible to users authorized for case management.

Audit management add-on:

Specifies whether this management system should be used to manage audits and audit programs. This makes the Audit management menu item visible to users authorized for audit management.

E-mail settings

If an e-mail setting is configured here, then all reminders that originate from this management system will be sent via this e-mail address. If you do not use an e-mail account of your own but the one provided by TogetherSecure, the sender address needs to end in @hitguard.at.
If no e-mail setting is configured here, then all e-mails will be sent from that address that is stored in the global settings.(see Global e-mail settings)

Define interval schema

The interval schema is used to define whether analysis periods should follow a predefined rhythm.
Analysis periods can be:

Manually set: Here, the time restriction is defined manually with a from-to date. This is set individually for each period.
Start date plus interval: Here, a year is divided into three analysis periods. For example, starting with 2/1 to 5/31/2021; 6/1 to 9/30/2021 and 10/1 to 1/31/2022.

Reminders via e-mail

The current setting for progress message reminders is displayed here. This setting ensures that an implementer of a task is reminded of its implementation via e-mail before the period expires.

This setting must be made directly in the database!

If you want to change this setting, please contact our team.

Analysis period and history:

Purpose

Analysis periods are used in risk management, measures and control administration, or data protection to assign results to individual periods and thus make them evaluable and comparable. This makes it possible to track and analyze the progress of measures over several periods.

In a management system, measures, for example, are determined, processed and also implemented within an analysis period.

For these measures, progress reports can be requested at any time.

At the end of an analysis period, at least one progress message must exist for each active measure. Only then can the analysis period be transferred to the next analysis period. Before the editorial deadline, the person responsible is therefore requested via e-mail to obtain progress reports for the active measures.

If all progress messages have been accepted, the analysis period can then be carried over and the process starts again.

By comparing the analysis periods on the dashboard, it is possible to track the progress of measures.

Analysis periods can be created in two different ways. (see Define interval scheme)

Active analysis period

Begin and end:

An analysis period can be as short or as long as the organization requires. In principle, the begin and end date can be on the same day; however, the begin date must not be after the end.

Editorial deadline::

Relevant for the the measures and control management. The date by which all progress reports for the measures in an analysis period should be completed. Progress reports can also be requested manually at any time via "Measures → Progress reports". This date must be set before or on the date of the analysis period end.

Target score:

The target score describes the target status for all gap analyses. If you are below a target score in an analysis, the answered review question is recognized as a gap. The identified gaps should be assigned risks in the next step and treated by measures and controls. If the evaluation schema is changed, the target score needs to be adapted.

Included OrgUnits:

Organizational units are required to report in the analysis periods to which they are assigned. This means, they must submit progress reports on the measures assigned to them by the editorial deadline. An organizational unit can also report simultaneously in several management systems or analysis periods.
If new organizational units are created during an analysis period, they are automatically added to the analysis period if their parent organizational unit is assigned to that analysis period. However, if the organizational unit does not have a parent organizational unit assigned to this analysis period, then it must be added manually.

Transfer to subsequent analysis period:

When transferring an analysis period to the next one in connection with the measure and control management, all tasks that do not have the status "completed" are transferred to the new analysis period and adapted according to the respective status. The completed measures will of course not be followed up in the next period.

Delete an analysis period

The deletion of an analysis period can only be triggered by the responsible expert.
The deletion of analysis periods is only supported as long as no progress reports have been created.
Only the current period to analyze can be deleted at any one time; completed periods can no longer be deleted.

Past analysis periods

The history lists the analysis periods which have already been completed with start, end and editorial deadline.

Code generation

Here you can set the default of whether an automatic code should be created for any new elemtents, and for which ones. The structure of the code can also be configured here. Upon creation of a management system, the configuration is taken automatically from the global settings, but it can be changed and adapted here at any time.

The general prefix is used at the beginning of the code for all selected elements.
The first column allows you to select all elements that are to be generated with an automatic code.
Prefix: a string of letters, digits, or special characters that clearly labels the element (e.g., M for measure). The default entry can be changed.
OrgUnits abbr.: decides whether the element's code also includes the code of the organizational unit. Elements that aren't directly associated with any organizational unit do not have this option activated (e.g., hazard situations or processes).
OrgUnit abbr. suffix: a delimiter between the OrgUnit code and the final digit string (e.g., _ or -).
Minimum precision: the minimum number of digits to be included in the resulting string. At least 1 and at most 10 can be entered. With a number of 4, the resulting strings would be, for example, 0001, 0026, or 0184.