Reports for risk management
Weitere Optionen
HITGuard offers the possibility of generating various risk management reports under "Risk management → Reports".
To create a report, first choose a type of report. Subsequently, choose which data to include in the report (e.g. risks or reviews). Most reports also have additional report options which allow further specification of the report's contents.
Knowledge bases can be made available in different languages due to stored translations for used knowledge bases. For example, to generate a report with the English texts, the language must be changed using the flag icon at the top right of the screen, next to the logout button. This will load all content for the reports in the desired language, provided that a translation in that language is available for the knowledge base.
Download options:
The reports are available for download as PDF or DOCX files. Click the pink button to generate and download a report. Then, choose whether the report should be downloaded as a PDF or DOCX.
Additionally, there is the option to generate and archive the reports including revision information. In doing this, the report can be viewed, generated anew, or downloaded again by an expert under "Administration → Report archive". More information about this can be found under "Administration → Report archive".
When generating reports with revision information in the archive, there is also the option to send the report by e-mail to various recipients right away. More information about this can be found in the report archive and under "Administration → Report archive".
Remembering report options:Some of the report options can be found for various reports. For these, the selected options are remembered within the management system and for the individual user, and then also applied for other reports with that same option. For example, if the option "Table of contents" is selected, then it will already be selected when accessing any other report pages that use this option.
Licenses:
If no valid license for HITGuard is available, this will be displayed in the footer of the report! To change this, an expert or administrator has to request/upload a license under "Administration → Licensing".
The following reports are offered in the risk management section of HITGuard:
Risks and opportunities
General risk/opportunity report
In this report, details on risks and opportunities are presented. In addition, the risks and opportunities are positioned in a risk matrix according to their criticality. The measures and controls to be taken or already taken can be displayed for the individual risks and opportunities. Furthermore, the development of the risks and opportunities over time can be displayed.
Caution:Users with the Compliance Manager role will also see measures and controls from all other management systems.
Example risk management report: Risks without M/C details incl. temporal development
Generate risk/opportunity report
To generate a risk/opportunity report, you have to navigate to "Risk Management → Reports → Risks & opportunities → General". There you have several options to generate the report:
- Risks and opportunities: You can generate a risk/opportunity report for one or more risks. However, you can only generate reports in management systems to which you are assigned.
- Structural elements: You can list all the risks and opportunities assigned to the selected structural elements.
- Responsible person(s) (compliance manager only): You can generate a risk/opportunity report in which all risks and opportunities are listed for which a specific team or a person is responsible.After that, just click on the pink download button to generate the report.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Gaps | Lists all gaps linked with the risk/opportunity. |
| Measures | Dictates whether open AND/OR suspended AND/OR completed measures are printed. Determines whether the progress overview AND/OR progress protocol AND/OR remarks are printed for the measures. |
| Controls | Dictates whether active AND/OR suspended AND/OR deactivated controls are printed. Determines whether the statistic AND/OR execution protocol AND/OR remarks are printed for the controls. Determines control executions of which status are included in the execution protocol. |
| Temporal development | Lists the entries of the temporal development of the risk/opportunity in a chapter of their own. |
| Appendix with explanations | Adds an appendix with various explanatory texts to the report. |
Gross-net report
This report lists details about the development of a risk or opportunity. The focus of the report, therefore, lies on the aspect of the gross-net-risk/opportunity, which is managed with measures and controls. All to-be-implemented as well as already implemented measures and controls are listed for the individual risks or opportunities. The gross risk/opportunity as well as the possible net scenarios can be displayed separately. If desired, the development over time of the risk/opportunity can also be displayed.
Caution: The measures and controls from other management systems are only visible for users with the role "Compliance manager".
Example gross-net-risk report: Gross and net risk with matrices, no details for M/C
Create gross-net report
To generate a gross-net report, you have to navigate to "Risk Management → Reports → Risks & opportunities → Gross-net". There you can generate the report for a selected risk or opportunity with different characteristics. Reports can only be created for risks or opportunities in management systems one is authorized for. (The exception are compliance managers, who can generate reports for all risks and opportunities in all management systems.)
Click the pink download button to generate the report.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Treatment of the current risk/opportunity | Determines whether the measures and controls for the treatment of the current risk/opportunity are included in the report. |
| Gross risk/opportunity | Determines whether the evaluation of the gross risk/opportunity is included in the report. |
| Treatment of the gross risk/opportunity | Determines whether the measures and controls for the treatment of the gross risk/opportunity are included in the report. |
| Ability to control | Determines whether the ability to control of the already implemented sets of measures and controls are included int he report. |
| Net risk/opportunity | Determines whether the evaluation of the net risk/opportunity is included in the report. |
| Best case AND/OR Most likely case AND/OR Worst case | Determines whether and which scenarios of the net risk/opportunity are included in the report. |
| Matrices | Determines whether, in addition to textual information, the evaluation of the gross risk/opportunity and the scenarios of the net risk/opportunity are included in the report as images. |
| Measures | Determines for the measures whether the progress overview AND/OR the progress protocol AND/OR remarks are included in the report. |
| Controls | Determines for the controls whether the statistic AND/OR the execution protocol AND/OR remarks are included in the report. Determines as well whether irrelevant control executions are to be considered in the report. |
| Time evolution | Lists the entries of the risk/opportunity's time evolution in a separate chapter. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
ESG
Reports on fields of action can be created here. In addition to the fields of action, detailed information on the risks, opportunities and effects of the fields of action is also printed. The report can be configured with a variety of reporting options so that risks, opportunities and impacts are presented according to your needs.
Create ESG report
To create an ESG report navigate to "Risk management → Reports → ESG". Then, choose the topic followed by the fields of action for which you want to generate a report, and configure it via the report options.
To generate the report click the pink download button.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Fields of action without score | If this option is selected, fields of action that do not have a score are printed in the report. Otherwise, the report only contains fields of action that have a gross and/or net score. |
| Tabular description | If this option is selected, all fields of action are additionally printed in the form of a table at the beginning of the report. This is to give an overview of all fields of action selected from the list. |
| Content from underlying fields of action | With this you determine whether linked risks, opportunities, and impacts from lower levels of the hierarchy are printed with fields of action from higher levels of the hierarchy. |
| Non-material fields of action | If this option is selected, non-material fields of action can be included in the report. Whether a field of action is seen as material or not is configured under "Risk management > Settings". Example: If the threshold for the financial materiality is set as 15, a field of action must have a financial materiality of 16 or higher, unless the option is selected. The same principle applies to the impact materiality. |
| Detailed description | With this you determine if and which details for the fields of action are to be included in the report: - gaps |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Protection needs
In this report, the results of either one or multiple protection needs analyses are displayed. Choices can be made regarding the summary of the results as well as their details. Additionally, it's possible to add an appendix with explanations for the basis of the assessment in the protection needs analysis.
Generate protection needs report
To generate a protection needs analysis, you have to navigate to "Risk management → Reports → Protection needs". Then, choose which protection needs analysis to generate the report for and configure this via the report options.
To generate the report click on the pink download button.
| Report options | |
|---|---|
| Extent of damage | This option determines which resources are included in the report. The report includes all resources that have at least one evaluation of the selected extent of damage or worse. |
| Table of contents | This option determines whether a table of contents is included in the report. |
| Summary | If a report contains multiple protection needs analyses, this option can add a summary of all results in the form of a crosstab to the report. |
| Summary details | Prints a list of all interviews included in the data basis of the report above the crosstab. |
| Interview results | Adds the rationale for the assessments of the individual protection needs and the crosstab for each interview to the report. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Gap analyses
In this report, the results of either one or multiple gap analyses are displayed. When choosing the reviews, take note that they are limited by the chosen analysis period. An array of report options allow you to configure the reports to be displayed the way you need them.
Example gap report: reviews without proposals ZR 5
Example gap report: responsible with proposals ZR 3
Example gap report: organizational unit all audit questions without proposals ZR 2
Generate gap analysis report
To generate a deviation report navigate to "Risk management → Reports → Gap analyses". There, you have several options to generate such a report depending on your role:
- Reviews: This report contains all information about the selected reviews. The selection shows only reviews from the current management system in the selected analysis period (with the report options to the right).
- Responsible(s) (Compliance manager only): This report contains all reviews the selected person(s) or team(s) is/are responsible for.
- Organizational unit (Compliance manager only): This report contains all reviews that have been created for an organizational unit. The selection shows only organizational units for which reviews exist in the current management system and within the selected analysis period.
It is possible to create a report for several analysis periods. For this, change the analysis period among the report options to the right. Then, the reviews of the chosen analysis period are made available.
Caution: If you select a new analysis period, the reviews from the previous ones will no longer be displayed, but will remain selected.
After that, click on the respective pink download button to generate the gap report.
| Berichtsoptionen | |
|---|---|
| Selection of the analysis period | This option determines which analysis period the report elements come from. |
| Selection of the target score | For reports including review questions, this option determines when they are counted as a gap. If the answer is below the set vgalue, it is a gap. |
| Target score on the cover page | Steuert, ob der gewählte Target Score am Deckblatt des Berichts angedruckt wird. |
| Table of contents | This option determines whether a table of contents is included in the report. |
| Review | Header data: if activated, all available information on the review is printed in the header data. If not, the report only shows the reviewed organizational units, beginning an dend of the review, as well as the participants, if filled in. The remining options determine whether review remarks are printed, and whether and which graphics are included in the report (bar chart AND/OR compliance spider charts). |
| Review object | Header data: if activated, all available information on the review object is printed in the header data. If not, the report only shows name of the review object. The remining options determine whether and which graphics are included in the report (donut charts AND/OR scoreline). |
| Treatment plan by determination type | Prints the treatment plan (meaning the measures and controls) clustered by determination type at the beginning of the report. This is only possible, if the determination type for reviews is activated in the audit management module. Note: The treatment plan does not include positive determinations (model implementation). Find out more on determination types here. |
| Tabular evaluation of review questions | Prints an overview of the review questions and results with their answers in the form of a table. The cells containing the answers are colored as per the target score. Unnecessary review questions/results are grey. Not answered review questions/results are colorless and marked with "-". Anwered information gatherings are marked with "answ.". All OR Only positive OR Only negative: Determines for the table whether all evaluations, only positives as per the target score, or only negatives as per the target score are included. Information gatherings AND/OR Unnecessary AND/OR Not answered: Determines the inclusion of information gatherings and those review questions/results marked as unnecessary or unanswered in the table. |
| Detailed evaluation of review questions | Prints a detailed overview of the review questions and results with various additional information in the report. All OR Only positive OR Only negative: Determines for the detailed evaluation whether all evaluations, only positives as per the target score, or only negatives as per the target score are included. Information gatherings AND/OR Unnecessary AND/OR Not answered: Determines the inclusion of information gatherings and those review questions/results marked as unnecessary or unanswered in the detailed evaluation. Answer AND/OR Justification AND/OR Description AND/OR Protection targets AND/OR Measures & controls: Determines the inclusion of these elements in the detailed overview of the review questions/results. Move to appendix: If this option is selected, the detailed evaluation of the review questions and results is moved from the main body of the report into the appendix. |
| List attachments/evidences | Prints the file names of attachments/evidences in the report.. |
| Embed image attachments | Image files (.jpg or .png) attached to review questions and/or review results are also embedded in the report as images. The file names of the respective images are printed below them. If available, the timestamp of the capture is also printed. Consequently, the file size of the report is larger and generation can take a little longer. |
| Attachments/evidences as zip-file | The report is downloaded in a zip-folder along with any attachments/evidences. Links are listed in a .txt file. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Conformity
Here, you can generate reports to show the conformity with a standard or norm as well as the results of gap analyses.
These reports show a distinct average score for each requirement or norm chapter.
Weightings of review questions are not considered.
Evaluation by standards and norms:
Review questions mapped to chapters of standards and norms are considered for the calculation of score values. These can be answered in reviews. Review questions from various reviews can populate this evaluation. Review questions can be mapped to all chapter levels.
Example: ISO 9001 chapter 6 Planning, which consists of 3 subchapters.
- Chapter 6 Planning (Score = 2.85)
- Review question 1: Score = 2
- Review question 2: Score = 2
- Score for calculation: (2 + 2) / 2 = 2
- 6.1 Measures for the handling of risks and opportunities (Score = 4)
- Review question 3: Score = 3
- Review question 4: Score = 5
- Score for 6.1: (3 + 5) / 2 = 4
- 6.2 Quality objectives and planning to their achievement (Score = 4)
- Review question 5: Score = 4
- Score for 6.2: (4) / 1 = 4
- 6.3 Planning of Changes (Score = 3)
- Review question 6: Score = 3
- Review question 7: Score = 3
- Score for 6.3: (3 + 3) / 2 = 3
To get the score for chapter 6, first the averages of the subchapters must be calculated (4 + 4 + 3) / 3 = 3.7. Then the value is calculated with the averages of the review questions of the main chapter (3.7 + 2) / 2 = 2.85.
Evaluation by reviews:
Die Auswertungen nach Überprüfungen erfolgen auf Basis enthaltenen geprüften Themen (Prüfobjekte). Der Gesamtscore einer Überprüfung ergibt sich aus dem Durchschnitt der Ergebnisse der einzelnen Prüfobjekte. Der Score der Prüfobjekte ergibt sich aus dem Durchschnitt der enthaltenen Prüffragen.
Beispiel: Überprüfung nach ISO 9001 zum Kapitel 5 Führung (Score = 3.66) und Kapitel 6 Planung (Score = 3.14)
- Chapter 5 Management (Score = 3.66)
- Review question 1: Score = 3
- Review question 2: Score = 5
- Review question 3: Score = 3
- Score = (3 + 5 +3) / 3 = 3.66
- Chapter 6 Planning (Score = 3.14)
- Review question 1: Score = 2
- Review question 2: Score = 2
- Review question 3: Score = 3
- Review question 4: Score = 5
- Review question 5: Score = 4
- Review question 6: Score = 3
- Review question 7: Score = 3
- Score = (2 + 2 + 3 + 5 + 4 + 3 + 3) / 7 = 3.14
Note: For chapter 6 the same review questions were used as for the evaluation by standards and norms.
Conformity report by reviews
The purpose of this report is to graphically illustrate the fulfillment of the prerequisites based on individual reviews. The fulfillment of the prerequisite points is presented visually in the form of spider diagrams, pie charts or tachometers.
Generate conformity report by reviews
Depending on your role there are different ways of generating this report.
- Reviews: You can generate a conformity report for the selected reviews.
- Responsible (Compliance manager only): You can generate a compliance report for one responsible person or team, where all reviews assigned to this responsible person or team are listed with their respective evaluation.
- Organizational units (Compliance manager only): You can generate a compliance report for an organizational unit, where all reviews assigned in this organizational unit are listed with their respective evaluation.
Example conformity report: Reviews
Example conformity report: Responsible
| Berichtsoptionen | |
|---|---|
| Selection of the analysis period | This option determines which analysis period the report elements come from. |
| Selection of the target score | For reports including review questions, this option determines when they are counted as a gap. If the answer is below the set vgalue, it is a gap. |
| Target score on the cover page | Steuert, ob der gewählte Target Score am Deckblatt des Berichts angedruckt wird. |
| Table of contents | This option determines whether a table of contents is included in the report. |
| Review objects/questions in table of contents | This option determines whether the table of contents also contains individual review objects/questions. |
| Review | Header data: if activated, all available information on the review is printed in the header data. If not, the report only shows the reviewed organizational units, beginning an dend of the review, as well as the participants, if filled in. The remining options determine whether review remarks are printed, and whether and which graphics are included in the report (bar chart, donut diagram, compliance spider charts). The "unnecessary" option in this position affects all donut diagrams of the report. |
| Review object | Header data: if activated, all available information on the review object is printed in the header data. If not, the report only shows name of the review object. The remining options determine whether and which graphics are included in the report (donut charts AND/OR scoreline). |
| Tabular evaluation of review questions | Prints an overview of the review questions and results with their answers in the form of a table. The cells containing the answers are colored as per the target score. Unnecessary review questions/results are grey. Not answered review questions/results are colorless and marked with "-". Anwered information gatherings are marked with "answ.". All OR Only positive OR Only negative: Determines for the table whether all evaluations, only positives as per the target score, or only negatives as per the target score are included. Information gatherings AND/OR Unnecessary AND/OR Not answered: Determines the inclusion of information gatherings and those review questions/results marked as unnecessary or unanswered in the table. |
| Detailed evaluation of review questions | Prints a detailed overview of the review questions and results with various additional information in the report. All OR Only positive OR Only negative: Determines for the detailed evaluation whether all evaluations, only positives as per the target score, or only negatives as per the target score are included. Information gatherings AND/OR Unnecessary AND/OR Not answered: Determines the inclusion of information gatherings and those review questions/results marked as unnecessary or unanswered in the detailed evaluation. Answer AND/OR Justification AND/OR Description AND/OR Protection targets AND/OR Measures & controls: Determines the inclusion of these elements in the detailed overview of the review questions/results. Move to appendix: If this option is selected, the detailed evaluation of the review questions and results is moved from the main body of the report into the appendix. |
| List attachments/evidences | Prints the file names of attachments/evidences in the report.. |
| Embed image attachments | Image files (.jpg or .png) attached to review questions and/or review results are also embedded in the report as images. The file names of the respective images are printed below them. If available, the timestamp of the capture is also printed. Consequently, the file size of the report is larger and generation can take a little longer. |
| Attachments/evidences as zip-file | The report is downloaded in a zip-folder along with any attachments/evidences. Links are listed in a .txt file. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Conformity report by standards and norms
The purpose of this report is to graphically illustrate the fulfillment of the prerequisites in each requirement area of the standard. The fulfillment of the prerequisite items will be visually represented in the form of spider diagrams, pie charts, or tachometers. After selecting a standard, a list of applicable knowledge bases and their various versions will appear. From this, choose all knowledge bases and versions thereof which are to be part of the report's data basis.
For display purposes, questions answered Yes, No, or Partially are converted to scores. "No" corresponds to score 1, "Partial" corresponds to score 3, and "Yes" corresponds to score 5.
Generate conformity report by standards and norms
First, the desired norm or standard must sbe selected for which a conformity report is to be generated. If the option "Include mapped standard chapters" is selected, the mapped standard/the mapped norm can be selected from a second list. Then, the knowledge bases to be considered in the report must be selected.
The selected knowledge bases form the basis for the evaluations in the report. Only knowledge bases that have a mapping to the selected standard and at least one review object (of a gap analysis) are displayed. If a review object exists in several versions, only the one with the highest version is considered. If a restriction is also made to an OrgUnit, the highest version of the review object that is linked to the OrgUnit is used. In addition, note that reviews may not be in the state "Draft" or the respective knowledge bases will also not be listed.
| Berichtsoptionen | |
|---|---|
| Selection of the target score | For reports including review questions, this option determines when they are counted as a gap. If the answer is below the set vgalue, it is a gap. |
| Selection of a time period from-to | This option determines from which time period between a beginning and an end date the report elements are taken. |
| Selection of the OU | This option determines which organizational units are considered for the report. |
| Target score on the cover page | Steuert, ob der gewählte Target Score am Deckblatt des Berichts angedruckt wird. |
| Table of contents | This option determines whether a table of contents is included in the report. |
| Review objects/questions in table of contents | This option determines whether the table of contents also contains individual review objects/questions. |
| Only closed reviews | With this option, only reviews in the state "Closed" are included in the report. |
| Report format | Determines in which format the evaluation is displayed in the report: - Tabular evaluation - Tabular evaluation + graphical evaluation of the main chapters - Graphical evaluation of the main chapters - Graphical evaluation of the main chapters & subchapters incl. question |
| Detailed evaluation of review questions | Prints a detailed overview of the review questions and results with various additional information in the report. All OR Only positive OR Only negative: Determines for the detailed evaluation whether all evaluations, only positives as per the target score, or only negatives as per the target score are included. Information gatherings AND/OR Unnecessary AND/OR Not answered: Determines the inclusion of information gatherings and those review questions/results marked as unnecessary or unanswered in the detailed evaluation. Answer AND/OR Justification AND/OR Description AND/OR Protection targets AND/OR Measures & controls: Determines the inclusion of these elements in the detailed overview of the review questions/results. Move to appendix: If this option is selected, the detailed evaluation of the review questions and results is moved from the main body of the report into the appendix. |
| Include mapped standard chapters | If the selected standard/norm refers to other standards/norms via mappings, the review questions and results linked with those chapters can be included in the report with this option. |
| Include not applicable chapters in the statistics | Determines whether chapters marked as not applicable in the management system are considered in the report. |
| Include review results | If selected, manually created review results are also considered (meaning those not coming from a knowledge base). |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Standards and Norms
Reports about standards and norms can be generated here.
The chapter applicability for the reports is calculated as follows:
| Scenario | Chapter |
|---|---|
| Scenario 1: | Chapter 1 - without measures Chapter 1.1 - with a measure Chapter 1.2 - with a measure The applicability of chapter 1 is 100%, because all chapters below have assigned measures. |
| Scenario 2: | Chapter 1 - with a measure Chapter 1.1 - without measures Chapter 1.2 - without measures The applicability of chapter 1 is 100%. As the measure is assigned to the super-chapter, it also counts towards the sub-chapters. |
| Scenario 3: | Chapter 1 - without measures Chapter 1.1 - with a measure Chapter 1.2 - without measures The applicability of chapter 1 is 50%, because only half of its sub-chapters have measures assigned to them. |
Statement of Applicability (SOA)
This report shows which chapters of the standard are "applicable" or "not applicable" in the management system. It also includes the justification for each chapter's applicability and the measures and controls associated with the chapters.
- Donut charts show the number and status of assigned measures & controls. The total number of chapters in the evaluation corresponds to the number of chapters at the lowest level. If a measure or control has been assigned to a chapter, it is also assigned to all its sub-chapters. Thus, if a super-chapter has assigned a measure or control, it behaves in the same way as if all sub-chapters had assigned that measure or control.
- In the donut diagrams, the scope of the standard is taken into account. If this has been restricted, chapters marked as not applicable are not taken into account. This can be canceled by activating the option Include not applicable chapters in the statistics.
The data basis can thereby be restricted to an earlier analysis period. In this case, only measures and controls that already existed in the selected analysis period are taken into account.
With the option "Include mapped standard chapters", the database can be extended to mapped standard chapters. This means that if standard S1 has a chapter C that is mapped to standard S2 chapter C (S1.C => S2.C) and a report is generated from standard S1, the report will also include actions and controls that are mapped to standard S2 chapter C. This behavior also applies to chapters mapped from S2.C.
| Measures | Green = Completed measures Orange = Suspended measures Blue = Open measures |
|---|---|
| Measures for chapters | Red = Chapter without measures Blue = Chapter with open measures Green = Chapter with completed measures |
| Controls for chapters | Orange = Suspended controls to chapters Green = Active controls to chapters Red = Chapters without controls |
Generate Statement of Applicability (SOA)
To generate an SOA, choose a standard/norm and configure the SOA via the report options. Click on the pink download button to generate the report.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Statistic | In the statistic, the fulfilments are determined on the basis of the total number of chapters. Only the subchapters are included in the calculation. Example: A standard consists of one superordinate chapter and three subchapters. The calculation basis for the statistic is 3 (= total number of subchapters). The superordinate chapter is only used for structuring purposes. |
| Scope | Determines whether the scope recorded in the standard is included in the report. |
| Measures and controls details | Determines whether details for included measures and controls are printed in the report. |
| Linked documents | Determines whether documents from the doc management linked with the standard or norm are printed in the report. |
| Include mapped standard chapters | If the selected standard points to other standards, then the measures and controls that are related to that standard chapter will be taken into account when choosing this option. |
| Include not applicable chapters in the statistics | Determines whether chapters marked as not applicable in the management system are considered in the report. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Management Summary
This report provides a management overview of the measures and controls assigned to a standard/norm:
- Donut charts show the number and status of assigned measures & controls. The total number of chapters in the evaluation corresponds to the number of chapters at the lowest level. If a measure or control has been assigned to a chapter, it is also assigned to all its sub-chapters. Thus, if a super-chapter has assigned a measure or control, it behaves in the same way as if all sub-chapters had assigned that measure or control.
- A bar chart shows the number of measures & controls by main chapters. The number is the sum of the measures or controls assigned to the main chapter and each sub-chapter below it. A measure or control assigned several times is only counted once per main chapter.
- The report takes into account the scope of the standard. If the scope is limited, chapters marked as not applicable are not taken into account. This can be canceled by activating the option "Include not applicable chapters in the statistics".The data basis can thereby be restricted to an earlier analysis period. In this case, only measures and controls that already existed in the selected analysis period are taken into account.
Example report: Management Summary
Generate Management Summary
To generate a management summary, choose a standard/norm and configure the management summary via the report options. Click on the pink download button to generate the report.
| Report options | |
|---|---|
| Selection of the target score | For reports including review questions, this option determines when they are counted as a gap. If the answer is below the set vgalue, it is a gap. |
| Statistic | In the statistic, the fulfilments are determined on the basis of the total number of chapters. Only the subchapters are included in the calculation. Example: A standard consists of one superordinate chapter and three subchapters. The calculation basis for the statistic is 3 (= total number of subchapters). The superordinate chapter is only used for structuring purposes. |
| Measures and controls details | Determines whether details for included measures and controls are printed in the report. |
| Include mapped standard chapters | If the selected standard/norm refers to other standards/norms via mappings, the review questions and results linked with those chapters can be included in the report with this option. |
| Include not applicable chapters in the statistics | Determines whether chapters marked as not applicable in the management system are considered in the report. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
Structural analysis
Reports on RTO and RPO fulfilment can be generated here. You can find more information on RTO and RPO under "Risk management → Structural analysis".
RTO-Fulfillment
This report shows whether or not the requirements derived from the various protection needs analyses (PNAs) for the resources can be met in terms of the maximum justifiable recovery time in each case.
The report can be generated without restriction to a resource. Then it is shown how well the requirements derived from all PNAs are met for all involved resources with regard to the maximum justifiable recovery time.
If the report is restricted to a resource (e.g., a specific hardware component), only resources that require this resource (e.g., specific applications and databases) to be able to work functionally are included in the evaluation. Only PNAs that define requirements for these resources are then considered. Generate RTO-Fulfillment report
To generate a RTO fulfillment report, click the pink download button.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Statistic | Determines whether a statistic with graphics on the degree of fulfillment and coverage is included. |
| Fulfilled requirements | Determines whether identified fulfilled requirements are included. |
| Not fulfilled requirements | Determines whether identified not fulfilled requirements are included. |
| Resources with defined information | Determines whether resources with defined information are included. |
| Resources with undefined/irrelevant information | Determines whether resources with undefined or irrelevant information are included. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
RPO-Fulfillment
This report shows whether the requirements derived from the various protection needs assessments (PNAs) for the resources in terms of maximum acceptable data loss can be met in each case or not.
The report can be generated without restriction to a resource. Then it is shown how well the requirements derived from all PNAs are met for all involved resources with regard to the maximum acceptable data loss.
If the report is restricted to one resource (e.g., a specific hardware component), only resources that require this resource (e.g., specific applications and databases) to be able to work functionally are included in the evaluation. Only PNAs that define requirements for these resources are then considered. Generate RPO-Fulfillment report
To generate an RPO fulfillment report, click the pink download button.
| Report options | |
|---|---|
| Table of contents | This option determines whether a table of contents is included in the report. |
| Statistic | Determines whether a statistic with graphics on the degree of fulfillment and coverage is included. |
| Fulfilled requirements | Determines whether identified fulfilled requirements are included. |
| Not fulfilled requirements | Determines whether identified not fulfilled requirements are included. |
| Resources with defined information | Determines whether resources with defined information are included. |
| Resources with undefined/irrelevant information | Determines whether resources with undefined or irrelevant information are included. |
| Appendix with explanations | Adds an apendix with different explanatory texts. |
