General

How can I edit my profile?

Users can navigate to their profile by clicking on their profile picture as well as by clicking on their name (or the little arrow below) and then on "Profile". Find more onm your profile here.

Although I am an expert, only the menu items My tasks and Administration are displayed to me

You must be a team member or responsible of a management system to get the menu items Risk Management, Measures, Controls or Data Protection displayed. Contact the person responsible for the management system in question so that they can add you to their team. For more information, see "Administration → Management systems". If necessary, you can also create a new management system for yourself there.

I only see an empty page when I log in

There are two possibilities as for why a page can look empty. You may either be seeing the text "You do not have user permissions for the modules of HITGuard. Contact your administrator or your organization's service manager." Then you would have user credentials but your user rights were revoked. In this case, you should get in touch with your organization's service owner for HITGuard.

Or you see the text "Now, add KPIs." That means you are currently on a newly created dashboard that has not yet had KPIs added to it. You can add KPIs yourself or do this together with your team.

How can I change my password?

When using local login, you need a username and password. You can change your password in your profile. For this, either click on your profile picture or on the small arrow beneath your name and "Profile". On the new page, you have a "Change password" button. Find more on your profile options here.

If you are using local login and have forgotten your password, you can have it reset by an expert or administrator.

What e-mail settings are there?

You can find an overview of the various e-mail settings here.

My Tasks

Why does an orange number appear next to my controls, actions, etc. under My Tasks?

This can have several meanings:

These controls are to be performed by you.
These controls are to be checked by you. In this case, an additional indicator is also displayed.
These measures are overdue, that is, the measures have exceeded their planned date. This case is also indicated by an additional flag.

For controls, the columns "To be performed by me" and "To be checked by me" can be displayed as an additional option.

Risk management

Why do colleagues from the other management systems see my risks?

If you want to hide the exposure from the other management systems, you must mark it as "Private". To do this, place a check mark next to "Private" in the top right-hand corner of the risk. For more information on risks, see "Risk Management → Risk Assessment".

I can't get any further than step 2 in the gap analysis

Did you remember to create a review object?

In order to be able to answer review questions in step 3, a review object must first be created or selected. For an initial assessment using a knowledge base, a knowledge base must be selected for this via the dropdown. Review objects can then be created from this knowledge base. To do this, click on the "plus" buttons of those chapters that you want to answer. For more information, see "Initial assessment using knowledge base".

Can't create a review object for the selected topic or no plus is displayed?

The plus for creating a review object is only displayed for topics that contain review questions. If none is displayed, then this topic is only used for structuring. You can expand these topics by clicking on the arrow (to the left of it) to display the subordinate topics. For more information, see "Initial assessment using knowledge base".

How do I perform a gap analysis or maintain a review result?

For information on reviews (gap analysis and review result) and how to perform them, see "Risk management → Vulnerabilities".

I have created a protection goal but cannot use it

Did you remember to activate the protection goal for your management system?

You will only be offered the protection goals in a management system that are also activated for the management system. This activation can only be performed by the person responsible for the management system. To do this, he must activate the desired protection target under "Administration → Management systems". Only when this has been done can you use the protection target.

I have added a second extent of loss classification to the risk policy - why is it not suggesting the new classification to me?

Did you remember to select this classification in the management system?

A management system can have only one damage extent classification. If you have created a new classification and want to use it, it must also be selected under "Administration → Management systems" in the "General Settings" item for the desired management system. This can only be done by the person responsible for the management system!

Why do I not always see all resources in the structure analysis when I combine different views?

Have you selected all levels of the resource view?

If a view other than the resource view is the main view, only those resources that are on the "application level" are displayed by default. To see the other layers as well, expand the resource view and select the desired layers. Then click on "Apply". For more information on structure analysis, see "Risk management → Structural analysis".

Measures and controls

Why can't I assign my measures and controls to a newly created organizational unit?

Did you remember to activate the organizational unit for your management system?

In order to use an organizational unit for a management system, it must be assigned to the active analysis period. This assignment is done by the person responsible for the management system. This person can manage the organizational units under "Administration → Management systems" in the "Active analysis period" tab for the active analysis period.

Data protection

I am in the Privacy Management System, but I do not see the menu item Privacy

Have you made sure that you have at least the "Professional" privilege for Privacy?

Experts can manage this under "Administration → User role assignment".

Have you ensured that the management system is also registered as a data protection management system?

Experts can manage this under "Administration → Management systems".

I am in the Privacy Management System, but I don't see the Affected Categories menu item

To see this menu item, you need expert rights.

Experts can manage this under "Administration → User role assignment".

How can I extend the authorization of professionals in the processing register to individual organizations?

Have you created an organization register for the organization and entered the desired Professional as the controller?

Professionals generally only see the processing activities for which they are also responsible. In order for a Professional to see all processing activities of an organization, they must be responsible for the organization register of the organization. Only one person or team can be responsible for each organization register. This means: If you want to make more than one person responsible for an organization register, you must first assign them to a team and then enter the team as responsible for the organization register. For more information, see "Data Protection → Processing register".

Case management

I want to report something or ask a question, how can I reach my organization's whistleblower system?

You receive the link to the whistleblower system from your organization's HITGuard service manager. The default way to reach the whistleblower system for the anonymous reporting of incidents is to add the suffix /cmwb to your regular HITGuard URL. If your URL is examplecompany.hitguard.at, then you can reach the whistleblower system under examplecompany.hitguard.at/cmwb.

Tips, Tricks & Best Practice