Contents 1. INTRODUCTION 1.1.1. ABOUT THIS MANUAL 1.1.2. CONTACT AND FEEDBACK 2. GETTING STARTED 2.1.1. REQUIREMENTS 2.1.2. SHORTCUTS 2.1.3. EXPIRATION 2.1.4. LICENSING 3. NAVIGATION 3.1.1. SAVE FUNCTION 3.1.2. CLEAR USER CACHE 3.1.3. SECURITY 3.1.4. ROLES 3.1.5. TASKS 3.1.6. USERS 3.1.7. PROPERTIES 3.1.8. DATABASE 3.1.9. ADD A DATABASE SERVER 3.1.10. UPGRADE DATABASE 3.1.11. CREATE NEW DATABASE 3.1.12. Deploy Database 3.1.13. Standard Data 3.1.14. Deploy Standard 3.1.15. DEFAULT DATA 3.1.16. REPORTING 3.1.17. AUTHORIZATION STORE 3.1.18. LANGUAGES 3.1.19. REGISTRATION 3.1.20. HELP 3.1.21. ABOUT 3.1.22. APPLICATION STYLE 3.1.23. Exit from RM Studio 4. NAVIGATING RM STUDIO 4.1.1. NAVIGATION TREE 4.1.2. TABS 5. FEATURE USAGE 5.1.1. THE GRID 5.1.2. GROUPING BY COLUMN 5.1.3. GROUPING BY SUBCATEGORIES 5.1.4. POWERFUL SEARCH 5.1.5. EXPORT FACILITIES 6. INTRDUCING RM STUDIO MODULES 6.1.1. COMMON ENTITIES 6.1.1.1. BUSINESS ENTITIES 6.1.1.2. CONTACTS 6.1.1.3. TEAMS 6.1.1.4. CATEGORIES 6.1.1.5. ASSETS 6.1.1.6. THREATS 6.1.1.7. THREAT TYPES 6.1.1.8. STANDARDS/CONTROLS 6.2. ASSESSMENT AND TREATMENT 6.2.1.1. Assessment and Treatment 6.2.1.2. RISK ASSESSMENT 6.2.1.3. GAP ANALYSIS 6.2.1.4. RISK TREATMENT 6.2.1.5. WORKING WITH THE STEPS 6.2.2. REPORTING 6.2.2.1. Reports 6.2.3. TEMPLATES 6.2.3.1. Evaluation Templates 6.3. BUSINESS CONTINUITY MANAGEMENT - NEW MODULE 6.3.1. ORGANIZATION 6.3.2. INCIDENT RESPONSE/RECOVERY 6.3.3. MAINTENANCE 6.3.4. REPORTS/BCM 6.3.4.1. Reports BCM 6.3.5. TEMPLATES BCM 6.3.5.1. REQUIREMENT TEMPLATES 7. USING RM STUDIO 7.1. BUSINESS ENTITIES 7.1.1. CREATING A NEW BUSINESS ENTITY 7.2. CONTACTS 7.3. TEAMS (Currently only for those using the BCM module) 7.3.1.1. Team Roles 7.4.  7.5. CATEGORIES 7.5.1.1. Create New Category List 7.6. ASSETS 7.6.1. WHAT ARE ASSETS 7.6.2. DEFINING ASSETS 7.6.2.1. CREATING A NEW ASSET 7.6.2.2. DESCRIPTION 7.6.2.3. CATEGORIES 7.7. THREATS 7.7.1. CREATING A NEW THREAT 7.7.1.1. CATEGORIES 7.7.1.2. THREATENED ASSETS 7.7.1.3. MITIGATING CONTROLS 7.7.2. Threat Types 7.7.2.1. Working with Types 7.8. STANDARDS/CONTROLS 7.8.1. AVAILABLE STANDARDS 7.8.2. HOW TO INSTALL A STANDARD 7.8.2.1. RESET STANDARD DATA 7.8.2.2. STANDARD CONTROLS 7.8.2.3. WORKING WITH THE CONTROLS 7.8.2.4. CREATING NEW STADARDS AND CONTROLS 8. ASSESSMENT AND TREATMENT 8.1. RISK ASSESSMENTS 8.1.1. WORKING WITH ASSESSMENTS 8.1.2. CREATING AN ASSESSMENT 8.1.2.1. COPY RISK ASSESSMENT 8.1.3. SCOPE AND BASIC CRITERIA 8.1.3.1. EXAMPLE OF BASIC CRITERIA 8.1.4. WORKING WITH ASSETS 8.1.4.1. ASSETS RETRIEVED 8.1.4.2. Owner 8.1.4.3. OPERATOR 8.1.5. EVALUATION VALUES 8.1.5.1. CONFIDENTIALITY 8.1.5.2. INTEGRITY 8.1.5.3. AVAILABILITY 8.1.5.4. VALUE 8.1.6. DEFINITIONS OF VALUE AND PROPERTIES 8.1.6.1. RISKS 8.1.6.2. ADDING RISKS 8.1.6.3. AGGREGATED VIEW OF RISKS 8.1.7. RELATIONSHIP BETWEEN ASSETS AND THREATS 8.1.8. EVALUATION VALUES 8.1.8.1.1. IMPACT OF THREAT 8.1.8.1.2. PROBABILITY OF THREAT 8.1.8.1.3. VULNERABILITY OF ASSET 8.1.8.2. HISTORY 8.1.8.3. ITEM HISTORY 8.1.8.4. VIEW ITEM 8.1.8.5. CHANGESET DETAILS 8.1.8.6. VIEW RISK ASSESSMENT VERSION 8.2. GAP ANALYSIS 8.2.1. CREATING A NEW GAP ANALYSIS 8.2.1.1. GAP ANALYSIS INFORMATION 8.2.1.2. CONTROLS 8.2.1.3. IMPLEMENTATION 8.2.1.4. STATUS 8.2.1.5. JUSTIFICATION 8.3. RISK TREATMENT 8.3.1. WORKING WITH RISK TREATMENT 8.3.1.1. RISK CRITERIA 8.3.1.2. ASSET LEVEL 8.3.1.3. CONTROLS TAB 8.3.1.4. SCHEDULING A FUTURE CONTROL 8.3.1.5. FUTURE CONTROLS TAB 8.3.1.6. OVERVIEW 8.3.1.7. RELOAD ASSETS, THREATS AND CONTROLS 9. REPORTS 9.1.1. The Standard Reports: 10. TEMPLATES 10.1. Evaluation Templates 10.1.1. SHORTCOMINGS OF EVALUATION TEMPLATES 11. BUSINESS CONTINUITY MANAGEMENT MODULE 11.1. ORGANIZATION 11.1.1. New Organization 11.1.2. Stakeholders 11.1.3. Resources/Processes 11.1.3.1. Impact Analysis 11.1.3.2. Requirements· 11.2. INCIDENT RESPONSE/RECOVERY 11.2.1.1. Associated Threats 11.2.1.2. Plans 11.2.1.2.1. Steps 11.2.2. MAINTENANCE 11.2.2.1. Test Plans 11.2.2.2. Test Results 11.3. REPORTING 11.3.1. REPORTS 11.3.1.1. Incident Management Plan Report 11.3.1.2. Business Continuity Plan Report 11.4. TEMPLATES 11.4.1. REQUIREMENT TEMPLATES 11.4.1.1. Add Columns to a Template 12. DEFINITIONS 12.1. DEFINITION OF ASSET EVALUATION VALUES 13. GLOSSARY 14. CONTEXT & FLOW 14.1.1. CONTEXT 14.1.2. FLOW 15. CALCULATIONS 15.1.1. SECURITY RISK 15.1.1.1. First risk calculation 15.1.1.2. Second risk calculation 15.1.1.3. Third risk calculation 15.1.1.4. Security risk of an Asset and the Risk Assessment 15.1.2. RESIDUAL RISK

1. INTRODUCTION

Can we change this to: RM Studio is dynamic risk management software, used by organizations of all types on a global scale to to implement risk management processes and policies.·The program is based on the methodology of the ISO/IEC 27001:2005 and ISO/IEC 27002:2005 security Standards. RM Studio is a Microsoft-compatible software that is developed in Microsoft Visual Studio. Software development is done in accordance with procedures from Microsoft Solution Framework and certified by the British Standards Institution in accordance with ISO 9001 and ISO/IEC 27001.

1.1.1. ABOUT THIS MANUAL

This is the User Manual for the RM Studio application, Version 4.0

1.1.2. CONTACT AND FEEDBACK

Please send any suggestions or comments regarding this manual or the software to Stiki by sending an email to support@stiki.eu, or by calling +354 5 700 600. Any input will be recorded, viewed and used in future revisions of the software.

 

2. GETTING STARTED

2.1.1. REQUIREMENTS

For more information on SQL Server see also:

http://www.microsoft.com/sqlserver/en/us/editions/express.aspx

2.1.2. SHORTCUTS

During the installation of RM Studio, shortcuts are created on the desktop and in the Start menu under the path Start > All programs > Stiki > RM Studio.

2.1.3. EXPIRATION

Image 1.1 - Expiration Notice

By default there is only one account in RM Studio, the Administrator account. The Administrator account uses the username: “Administrator” and the password “Administrator”. The first thing you should do after you log in is to connect to / create a database and change the password for the Administrator account. To change a Users password navigate to the Users tab in the Security dialog (image 1.2).

Image 1.2 - RM Studio Security Dialog

There select the appropriate User and click on the Change Password button. The window in image 1.3 should pop up. You can only change the password for RM Studio Users not Windows Users.

Image 1.3 - Change Password Dialog

Remember that the usernames and passwords are case sensitive. Users can either be Active Directory Users (Windows Users) or defined in RM Studio, as local RM Studio users which are defined and used only within the application. When logging in you will see a drop down box which gives you the choice between the two (image 1.4). When logging in as a Windows User you can choose to use the Current Domain by checking the “Use Current Domain” box (image 1.4).

Image 1.4 - RM Studio Login Window

2.1.4. LICENSING

To add a new license to RM Studio users must click on the Registration button (image 1.5) on the RM Studio menu (Red button in the top left corner). We will go into details about licensing in chapter 2.For license information, contact Stiki ehf. by e-mailing support@stiki.eu or phoning +354 5 700 600

Image 1.5- RM Studio Menu Bar

When the Registration button is pressed the licensing window will appear (image 1.6).

Image 1.6 - Licensing window

3. NAVIGATION

RM Studio's Menu (image 2.1) has been moved in the RM Studio button in the top left corner to make RM Studio's workspace bigger. In this menu you can save, access the Security, Properties, change Languages, Register new license, access the help/manual and change the look and feel of RM Studio with the Application Styles.

Image 2.1 - RM Menu

3.1.1. SAVE FUNCTION

There are two save functions in RM Studio. One is the Single Save Button (image 2.2), this button saves only the current tab you are working on. The other is the Cascading Save Button (image 2.2) or Save All button, this button saves all the information on all tabs that you are working on.

Image 2.2 - Single Save Button and Cascading Save Button

You will also find the save functions under the RM Studio button (image 2.3).

Image 2.3 - RM Studio Menu

If you right-click on tabs when working in modules you will get a context menu with similar functionality where you can choose to save, save and close the tab, or simply close the tab (image 2.4).

Image 2.4 - Tab Commands

3.1.2. CLEAR USER CACHE

Clear User Cache button (image 2.3) will revert all adjustments and customizations that you have made for your user regarding the user grid, this reloads layout of tables, filters, etc. This function will not reset any data that has been entered or edited in the grid. This is very helpful if you may have filtered lists with·search and you forget to clear the filter and data is not appearing in your lists. All you need to do is to clear the user cache and your data will reappear in your lists.

3.1.3. SECURITY

The fourth item in the menu (image 2.5) is the security features in RM Studio. Here you can define exactly the roles of different user groups.

The basic element used to construct a Role are the Operations. RM Studio has different operations that together define everything that can be done in RM Studio. These operations can be further grouped into Tasks. Roles can then be defined to include certain Operations or Tasks.

Image 2.5 - Security Dialog

3.1.4. ROLES

RM Studio comes with a predefined set of six Roles. If you need to add a new Role click on the Add Role button (image 2.6) and the dialog box in image 2.7 will appear. When you have filled out the necessary information click OK.

Image 2.6 - Add Role Button

After you have created a Role you can then define it under the Definition tab (image 2.5). By clicking the "Add" button you can add Operations, Tasks, or sub Roles to the new Role as appropriate.

The third tab is the "Members" tab. Here you can assign different users to the Role. Likewise, under the "Users" tab you can assign Roles to individual users.

Image 2.7 - Add Role

3.1.5. TASKS

Tasks define what a particular role can do in RM Studio. Adding a new Task is similar to adding a new Role; you need to navigate to the Tasks Panel and click the "Add Task" button. One Task is made up from many Operations. Adding Operations to a Task is just like adding Tasks, Operations and sub Roles to a Role. You can even add other sub Tasks to a Task just like you could with Roles.

3.1.6. USERS

The Users of RM Studio can be either Integrated Windows users (Active Directory) or locally defined RM Studio Users.

To add a user, navigate to the User Tab and click on the "Add User" button. The window in image 2.8 should appear. If you select Integrated Windows user you will have to fill in the "Windows login" and "Password". In RM Studio you can also use Domain authentication.

Image 2.8 - Add User

If you choose RM Studio User you will have to make a new password and confirm it (image 2.9).

Image 2.9 - Adding RM Studio User

3.1.7. PROPERTIES

The fifth item on the Menu Bar is Properties (image 2.10). The Properties window is divided into three areas, Database, Reporting and Authorization Store.

3.1.8. DATABASE

Under the Database node you can configure which Server RM Studio uses. By default the application will have no Servers defined (image 2.11).

Image 2.10 - Properties Window

3.1.9. ADD A DATABASE SERVER

To add a your current Database Server click on the "Add" button below the list of Servers. A "New Database Server" window will appear (image 2.11). In this window you will have to fill in the Name, Server, Database Name, and Integrated Security fields. The Name field is a name that you gave the Database instance, Server is the name of the server where the Database resides on your network, Database Name is the name of the RM Studio database on your server and Integrated Security dictates whether or not IWA (Integrated Windows Authentication) is used on the Server.

When you have entered the necessary information and clicked OK you can test the connection by clicking on the "Test Connection" button. If the icon turns green then a connection with the server was established. If the icon turns red the connection failed.

Image 2.11 - New Database Server

3.1.10. UPGRADE DATABASE

If you have a previously installed RM Studio database and would like to continue using it, you can upgrade it to the latest version. Before continuing we strongly suggest you back up your Database.

Start up RM Studio and open the Properties dialog. Make sure that you have a connection string to the database you wish to upgrade. If it is not there, enter it and remember to mark it as default. Click Test Connection if you wish to verify that it is correct. If the string was already correct and marked as default you can continue directly with the upgrade. If not, you must mark the database you would like to upgraded as default and restart RM Studio. Then repeat this step to upgrade.

Image 2.12 - Upgrade Database

Click on the Check Version button (image 2.12), it should tell you the version number and if your database is·out of date. If your Database is out of date the upgrade button should become enabled.

Note that there are several large, atomic actions taken, so the progress bar may seem to stand still for a while. Please wait patiently and allow the upgrade to complete. If for any reason the upgrade fails, restore your database and restart the upgrade.

Note: ·To be able to upgrade your database, you must be signed in as DOMAIN ADMINISTRATOR, LOCAL ADMINISTRATOR privledges may not enable you to upgrade the Database.

Once it completes, the properties window should tell you that your database version is upgraded and RM Studio is now ready for use. Restart RM Studio.

3.1.11. CREATE NEW DATABASE

The Create New Database button (image 2.13) allows you to create a New RM Studio database on the Database Server's that you can connect to from within RM Studio.

Note ! To be able to create a new database, you must be signed in as DOMAIN ADMINISTRATOR, LOCAL ADMINISTRATOR privledges may not enable you to create the new Database.

To create a new RM Studio database make sure that you name the connection in a descriptive manner, that you have the name of the server, a name for the Database and the type of security settings that apply to your network. Click "OK" (image 2.11). Creating a new database will take a few moments. Afterwards you will need to mark that database as default and restart RM Studio. After restarting RM Studio navigate to the Properties window again and press the "Test Connection" button (image 2.13). If you get green check mark you have created and made the new database as your new default Database.

Image 2.13 - Create New Database

3.1.12. Deploy Database

When a Database has been imported (new database created on the server and not from within RM Studio), you need to Deploy the Database. That is done by selecting the newly created Database you have added ( see above Add New Database Server) and then you press Deploy Database (image 2.13). You will be asked to confirm your request (image 2.14). When you Deploy you are actually adding the schema to the Database. This process is only needed when you add an older Database to RM Studio or a database you created directly on the SQL server itself. When you create new Databases (see above) they get Deployed automatically.

Image 2.14 - Deploy Database

3.1.13. Standard Data

Under Database > Standard Data you can see all the Standards you can deploy into your RM Studio. You can also reset the Standards to their original state if you have made changes to the Standards in the Standards Module in the Common node.

Image 2.15 - Standard Data

3.1.14. Deploy Standard

To deploy a Standard into RM Studio, you will have to have bought the Standard and have the right key registered in the registration window (image 1.6). If all these steps have been completed the Standard Data window should show the Standards available to you. The key you have registered will open up the standards you can deploy and the standards you cannot deploy are greyed out (locked). Further detail on installation of Standards will be covered in the chapter "STANDARDS" .

3.1.15. DEFAULT DATA

Here Administrators can reset all predefined data to their original state. This action will only reset the data that came with the software and will not affect Threats, Categories, Evaluation Templates or Threat Categories created by the user after installation of RM Studio.

The options are, All Default Data, Threats only, Categories only, Evaluation Templates or Threat Categories (image 2.16).

Image 2.16 - Reset to Default Data

When you have selected the option you would like to reset press the Reset Default Data button. When pressed all changes made to the selected data will be reverted to its original state. This will not affect data entered into the Risk Management and Risk Treatments.

3.1.16. REPORTING

There are two options under Reporting "Servers" and "Logos".

Under Servers (image 2.17) you can configure wheather you like to use the Local Reporting Module or the Microsoft Reporting Services. Local Reports are selected by default in RM Studio. If your company wants to use the MS Reporting Services you need to configure the Server version, the Reporting Path, the Reporting Service Path and the Report Path. You will have to ask for the server reports from our Customer Service department, they are not shipped with the software by default.

IT IS RECOMMENDED TO USE LOCAL REPORTS FOR FASTER REPORT GENERATION

When using the Local Reports Module the Reporting Server is incorporated into RM Studio and there is no network configuration needed to run the reporting services and reports can be generated with ease without any configuration.

In the case of shared customized reports we recommend using Server Reports. We have an installation manual for those who prefer to set up Reporting services. Please send an e-mail to our This e-mail address is being protected from spambots. You need JavaScript enabled to view it asking for a copy of the Microsoft Reporting Services Installation Guide.

Image 2.17 - Reporting Servers

Under Logos (image 2.18) you will find a list of the logos you can use when generating Reports from RM Studio. This list is empty by default. You can upload your own logos.

When you add a logo to the RM Studio application you will have to define them as "Large" or "Small", this categorizes the logos so that they will appear in the respective lists when you generate reports. Large logos are used for the front page and Small logos are used for the header of each page in the report. Please note in case you are using Reporting Server it must have access to the location where the logos are stored.

Image 2.18 - Reporting Logos

3.1.17. AUTHORIZATION STORE

The Authorization Store is where authorization information is kept in RM Studio. Here the data defining Users, Roles, Tasks and Operations is stored.

In order for this information to be accessible globally the Authorization Store must be stored in a global location, e.g. global server.

To do this copy the XML file from its default location ( C:\Program Files\Stiki\RMStudio\RMStudioPolicyStore.xml )and paste it into a shared folder on your SERVER. Open the Properties window in RM Studio > Authorization Store > Options and point to the file in the shared folder on your SERVER. (image 2.19).

Note! This file is not to be used by more than one computer and will not store user information added into another compuer on the same domain. When you have created user in RM Studio on computer X, that user is only defined to use that instance of RM Studio and you will not be able to log into RM Studio instance on computer Y, even if the Authorization Store is stored globally. Two RM Studio instances are not able to use the same Authorization Store.

Image 2.19 - Properties Window

3.1.18. LANGUAGES

The sixth item on the Menu Bar is Languages. RM Studio currently supports English, German and Icelandic (image 2.20). ·The BCM Module is not available in German at this time.·

Image 2.20 - Languages

RM Studio is shipped with English as the default language. If you wish to run RM Studio in German or Icelandic please contact our This e-mail address is being protected from spambots. You need JavaScript enabled to view it in order to obtain a license that will open up these options. Entering licenses will be covered in the "Registration" section.

3.1.19. REGISTRATION

In order to learn more about the price structure of the license system please contact our This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

To enter a new license click the Registration button on the Menu Bar. The Licenses window in image 2.21 will appear. Enter the Serial Number that you were provided into the text box and click on the "Apply License" button. All available features will then be displayed.

Image 2.21 - Registration

3.1.20. HELP

By pressing the "Help" button you will open up the Manual. ·For further assistance please contact our customer service department at support@stiki.eu . ·

3.1.21. ABOUT

The last item in the Menu is the About window. The About window displays information such as Version number and copyright notices.

3.1.22. APPLICATION STYLE

On the right side of the Menu Bar you will find Application Style. The Application Styles contains 8 predefined RM Studio looks. By default the RMStudioBlue is selected.

3.1.23. Exit from RM Studio

Under the RM Studio button you will also find an Exit button (Image 2.22) to close the application.

Image 2.22 - Exit RM Studio

 

4. NAVIGATING RM STUDIO

4.1.1. NAVIGATION TREE

The Navigation Tree is on the left hand side of the RM Studio window (Image 3.1). The Navigation Tree groups the various functions into Common Entities,Assessment and Treatment·and Business Continuity Management. From the Navigation tree you can access all these functions by double clicking on them.

Image 3.1 - Navigation

4.1.2. TABS

RM Studio utilizes tabs to provide the user with a clean and orderly working environment. New elements are opened up in a new tab (image 3.2) so the user can easily navigate between different items and functionalities in RM Studio.

Image 3.2 - Tabs in RM Studio

5. FEATURE USAGE

5.1.1. THE GRID

The RM Studio Grid that is used to display most of the items stored in the application is a versatile tool that deserves some attention. The user can sort by columns using the grids customizable interface. The Grid also has powerful search capabilities as well as the ability to export its data to a number of formats including Excel and PDF.

5.1.2. GROUPING BY COLUMN

The Grid allows the user to drag a column to a grouping area placed above the column titles (image 4.1) and sort the contents of the grid into groups based on the column selected. To revert to the default list you must only drag all grouped columns back out of the group-by area. This should return the Grid to its original state.

Image 4.1 - Sort By Column

To revert to the default list you must drag all grouped columns back out of the group-by area. This should return the Grid to its original state.

5.1.3. GROUPING BY SUBCATEGORIES

The user can also group by sub categories once a list has been sorted by a specific column (image 4.2).

Image 4.2 - Sort By Sub Category

This works in the same way as grouping by a single column.·To do this, simply·drag the next column the user wishes to sub categorize by into the group-by area next to the current grouped-by column (image 2.26).

5.1.4. POWERFUL SEARCH

The Grid offers the User the capability to search by a variety of criteria. Amongst those are free text search and search by parameters such as "less than" and "equal to" to name a few. To use the search you must click on the Search button found on the Toolbar (image 4.3).

Image 4.3 - Toolbar

If you click on the drop down box you can choose which criteria you wish to search by (image 4.4).

Image 4.4 - Search

5.1.5. EXPORT FACILITIES

All the lists can be exported to Excel and Portable Document Format (PDF). To do this you must use the buttons with the appropriate icons on the Toolbar (image4.5).

Image 4.5 - Toolbar

6. INTRDUCING RM STUDIO MODULES

6.1.1. COMMON ENTITIES

6.1.1.1. BUSINESS ENTITIES

6.1.1.2. CONTACTS

Contact Information are the detailed information about those connected to the entitites that are to be assessed and treated (Image 5.2)

Image 5.2 - Contact Information

6.1.1.3. TEAMS

Teams are a new module in RM Studio and the reason for Teams in RM Studio is to meet the reqirements for the BCM Module to use Teams. Teams are set up to assign roles and responsibilty in the BCM Processes (image 5.3). As for now Teams are not used in·Assessment and Treatment.

.

Image 5.3 - Teams

6.1.1.4. CATEGORIES

Users of RM Studio can define their own Categories for Assets or modify the system library. Categories can be defined as Parent or Sub Categories (image 5.4).

Image 5.4 - Categories

To add a new Parent Category click on the single + button (image 5.5) and type in the Name and Description in the appropriate fields. To add a new Sub Category first select the appropriate Parent Category from the list and then click on the "double + sign". Type in the name of the Sub Category and the description.

Image5.5 - Add/Remove Categories

6.1.1.5. ASSETS

6.1.1.6. THREATS

When creating new Threat, the new Threat must have a Name, be assigned to a Category and have assigned a Mitigating Control from the standard you are preparing to implement. To bo able to assign a Mitigating Control you must have the Standard/Controls you are going to use for the assessment already deployed into your database (see here how to).

6.1.1.7. THREAT TYPES

Threat Types are a way to categorize threats for easy identification for the users.

6.1.1.8. STANDARDS/CONTROLS

 

6.2. ASSESSMENT AND TREATMENT

6.2.1.1. Assessment and Treatment

6.2.1.2. RISK ASSESSMENT

The first step is the Risk Assessment, which contains all Assessments that have been performed.

An Assessment is an evaluation of all Assets in the organization in regards to their selected evaluation factors. ·The evaluation template factors are·Confidentiality, Integrity and Availability. An Assessment also takes into account which Threats are relevant to those Assets and the Impact & Probability of the related Threats along with the Vulnerability of the Asset in light of that Threat.

6.2.1.3. GAP ANALYSIS

The second step is Gap Analysis. Gap Analysis is an assessment tool enabling the user to compare their actual state in regards to a particular Standard with what is needed to be eligible for certification. Gap Analysis answers two questions:

Where are we?

Where do we want to be?

The Gap Analysis is typically done as a precursor to the certification process. A Gap Analysis·will reveal the extent of a·given Standard your organization currently complies to.

6.2.1.4. RISK TREATMENT

The third step is Risk Treatment. Risk Treatment is an integral part of Standard compliance and defines if, how and when you will address the issues that you have defined in earlier steps.

6.2.1.5. WORKING WITH THE STEPS

Having double clicked on one of the Steps, say Risk Assessment, from the navigation tree you are presented with a list of all assessments available in your system . The information will vary slightly between modules but the overall functionality is the same, we will go into further details about each module later in the Manual. Along with this list you are presented with a pane, found at the bottom of the screen, that provides an overview of the information available for each module, in this case Assessment (image 6.1).

Image 6.1 - Information Pane

Image 6.2 - List of Assessments

When you run the program for the first time there will be no defined process entities in the database so each list will be empty.

If the list is populated (image 6.2) you can reopen any item by choosing it in the relevant list, the information will then be presented on the information pane. As discussed before in the Navigation chapter, to work with an individual process element you must double click on the item to have it opened in a separate tab.

6.2.2. REPORTING

6.2.2.1. Reports

RM Studio offers a variety of reporting possibilities. This gives the user a clearer, more detailed overview of the·Assessment and Treatment information·(image 6.3).

Image 6.3 - Example of a Report

6.2.3. TEMPLATES

6.2.3.1. Evaluation Templates

The Evaluation Templates is the heart of the calculation matrix. Users can define their own templates for calculation or use the default calculation templates delivered with RM Studio by Stiki (image 6.4). More information on Evaluation Templates can be found in the Starting to use RM Studio chapter.

Image 6.4 - Evaluation Templates

 

6.3. BUSINESS CONTINUITY MANAGEMENT - NEW MODULE

BCM Module

This module is new in RM Studio.··The BCM Module was developed utilizing BS 25999 framework and is meant to simplify the BCM process in a centralized repository.

6.3.1. ORGANIZATION

This node is to register Organizations for business continuity management.··Here you register/identify stakeholders, resources/processes and perform impact analysis. ·With in the Organization step, users can also identify the necessary Requirements needed to obtain continuous operations.

6.3.2. INCIDENT RESPONSE/RECOVERY

Here is where you create the Business Continuity plans (BCP). You create each plan, then you create each step in the plan and assign it to a TEAM.

6.3.3. MAINTENANCE

Here you create the test plans for the plan steps in Incident Response/Recovery. You can also create new plans for testing response time and effectiveness of the BCP.

6.3.4. REPORTS/BCM

6.3.4.1. Reports BCM

There are two reports in this reporting module. Incident Management Plan and Business Continuity Plan.

The Incident Management Plan report displays everything entered for the Organization you select to generate a report for.

The Business Continuity Plan report is a subset report and shows a less detailed view than the Incident Management Plan report.

6.3.5. TEMPLATES BCM

6.3.5.1. REQUIREMENT TEMPLATES

Here you define the requirements to reach your goals/plans in the Impact Analysis under Organization.

7. USING RM STUDIO

7.1. BUSINESS ENTITIES

The first thing you need to do when using RM Studio is to define your Business Entities. ·A business entity can be the entire organization, a department, process, another company, a clients, etc.··All Assessments and GAP Analysis are made for a specific Business Entity, Risk Treatments are done for a specific Assessment so before you start you have to define the Business Entities you are going to work with.

Under Business Entities, you can view a list of all Business Entities in the system and create new ones (image 7.1).

Image 7.1 - Business Entities

7.1.1. CREATING A NEW BUSINESS ENTITY

7.2. CONTACTS

Contacts are all the members of the entity that play role in Risk Management. Contacts entered into this module will be available for editors to assign them to assets as owners or the person responsible for an asset.·Contacts are also used to identify the responsible party for the implementation of mitigating controls.

To create Contacts, open the module and press the plus button (image 7.5). Fill out the form that appears (image 7.6) and save it. Repeat this process to create another Contact.

Image 7.6 - New Contact Form

 

7.3. TEAMS (Currently only for those using the BCM module)

This module is new in RM Studio and is linked to the BCM module to create Response Teams to attack·disruptions.

Creating Teams is done by opening up the Teams module and pressing the plus button to add a new team to your list (image 7.7). After giving the Team a name, open up the Contacts Tab to select the Teams Members (image 7.8). Press the plus button and select the members from the list of available Contacts. If your Contact is not in this list, you must create the contact in the Contacts Module prior to add him/her to your Team.

Image 7.7 - New Team

Image 7.8 - Add Contacts to Teams

Image 7.9 - Select Team Members

7.3.1.1. Team Roles

After you have added Contacts to your Teams you need a Team Leader and a Team Backup Leader. That is done by clicking on the right corner of the column Leader type in front of the name of the Contact you like to assign to a Leading Role (image 7.10)

Image 7.10 - Assign Leading Role

When you have assigned the roles, you can set the protocol for the contact tree. That is done by right-clicking on the Contact you would like to set values for, in the menu navigate to "Contacted by" and select the Contact (A) that should contact Contact (B) (image 7.11).

Image 7.11 - Contacted by

7.4. 

7.5. CATEGORIES

Categories are any general or comprehensive division of assets. Here specifically it is the division of Assets according to the applicable Standard. Categories are used to categorize Assets to simplify mitigation against Threats. When new Assets are added to the library you need to assign them to a Category. The Category will then connect the Asset, Threat and the Mitigating Control from the Standards.

7.5.1.1. Create New Category List

7.6. ASSETS

7.6.1. WHAT ARE ASSETS

Assets are anything that has value to the organization according to the Standard. Assets are therfore the building blocks around which you build an Assessment. They can be as general as “A Building” or as specific as “HP Server named XV-231”. You will define your own Assets. ·

Under Assets you will only define what the Assets are, you will not define their value to your organization until later when you begin an Assessment.

Assets are defined once in the Asset List (image 9.1) and can then be reused across multiple Assessments.

7.6.2. DEFINING ASSETS

To define your company’s Assets you must go to the Asset List by double clicking on Assets in the navigation tree on the left hand side of the RM Studio window.

Image 9.1 - Assets

7.6.2.1. CREATING A NEW ASSET

A New Asset tab will open (image 9.3). Here you will define all the relevant information for the Asset in question.

In the Categories Tab you can categorize the Asset. You can have the Asset in several different Categories.

It is very important to specify the Asset Category as it is a prerequisite for using it in an Assessment, and is the basis for identifying the Threats associated with the Asset.

Assets cannot be created unless an owner is assigned to the asset.

See further “Owner”.

Image 9.3 - New Asset

7.6.2.2. DESCRIPTION

The Description text box (image 6.3) gives you the possibility to describe in detail the Asset in question. In this field we encourage our users to give a thorough description so that later users will have an insight into the reasoning behind any given Asset.

7.6.2.3. CATEGORIES

To Categorize the Asset you must click on the Add New Category icon (image 9.4) in the Categories List Toolbar. You will be presented with a list (image 6.4) from which you can choose the appropriate Category.

The Categories are important for the calculations of the Security Risk. They are used to connect Assets with Threats in a relationship that is defined as “Risk”.

In the case when you cannot find the appropriate Category or Sub Category, you can add both to meet your specifications. Locate the Categories Node in the Common Entities and add the Categories you find lacking in our list or define your own.

When this is done the Assets can then be used in an Assessment.

 

7.7. THREATS

7.7.1. CREATING A NEW THREAT

7.7.1.1. CATEGORIES

7.7.1.2. THREATENED ASSETS

7.7.1.3. MITIGATING CONTROLS

Image 10.4 - Mitigating Controls

7.7.2. Threat Types

Threat Types is where you set the name for the Threat type in your Threats list (image 11.1). Every Threat in RM Studio is by default assigned to the Created By Stiki type (image 9.2) and now you can create your own types and categorize your Threats.

Image 11.1 - Threat types in menu

Image 11.2 - Type

The only thing to do here is to open up Threats > Threat Types (image 9.1), press add new button (image 11.3), give the new type a name and save. From there you can navigate to Threats, press the refresh button (image 11.4), create Threats and assign your type to them. You can also change the ones that are Assigned to Stiki to your new type. Furthermore you can also remove the type and leave it BLANK with now type at all.

Image 11.3 - New Threat Type

Image 11.4 - Refresh Threats

7.7.2.1. Working with Types

To assign, remove or delete types right-click the type assigned to the Threat and navigate to Type and change the settings (image 11.5). 

Image 11.5 - Assign Type to Threats

 

7.8. STANDARDS/CONTROLS

Stiki is now offering users 10·ready to be deployed·Standards with Controls.

7.8.1. AVAILABLE STANDARDS

7.8.2. HOW TO INSTALL A STANDARD

7.8.2.1. RESET STANDARD DATA

7.8.2.2. STANDARD CONTROLS

7.8.2.3. WORKING WITH THE CONTROLS

7.8.2.4. CREATING NEW STADARDS AND CONTROLS

 

8. ASSESSMENT AND TREATMENT

8.1. RISK ASSESSMENTS

8.1.1. WORKING WITH ASSESSMENTS

8.1.2. CREATING AN ASSESSMENT

8.1.2.1. COPY RISK ASSESSMENT

8.1.3. SCOPE AND BASIC CRITERIA

8.1.3.1. EXAMPLE OF BASIC CRITERIA

8.1.4. WORKING WITH ASSETS

8.1.4.1. ASSETS RETRIEVED

When you have clicked the “Add new Asset” icon on the Asset List Toolbar (image 13.5) you are presented with a list (image 13.6) of all the Assets that you have defined under the Asset Entity of RM Studio. From the list choose the Assets that are relevant to the Assessment by highlighting them and clicking on the “OK” button (image 13.6).

8.1.4.2. Owner

8.1.4.3. OPERATOR

8.1.5. EVALUATION VALUES

8.1.5.1. CONFIDENTIALITY

8.1.5.2. INTEGRITY

8.1.5.3. AVAILABILITY

8.1.5.4. VALUE

8.1.6. DEFINITIONS OF VALUE AND PROPERTIES

8.1.6.1. RISKS

8.1.6.2. ADDING RISKS

8.1.6.3. AGGREGATED VIEW OF RISKS

8.1.7. RELATIONSHIP BETWEEN ASSETS AND THREATS

RM Studio contains a database of Threats. If you want to create a new Threat at this point, then you must first save and close the current Assessment before creating a “New Threat” in the Threat module of RM Studio.

Each Threat must be examined. If you do not agree that a Threat is imminent, you can delete it by highlighting the Threat.

Enter information in the Description window to support the Assessment.

8.1.8. EVALUATION VALUES

The values registered for the properties of the Threat are used for calculating the Security Risk. In the Standard Evaluation Template the properties are: Impact, Probability and Vulnerability. The values for each of the properties can be defined as Immense, Very High, High, Medium or Low. The definitions of the terms can be found in the Definitions of Threat Properties.

The properties and their values can be adjusted as needed via the Evaluation Templates. .

Image 13.11 - Setting Property Value

8.1.8.1.1. IMPACT OF THREAT

The Impact of Threat property assesses how serious the consequences are should the Threat occur.

8.1.8.1.2. PROBABILITY OF THREAT

The Probability of Threat property dictates how likely a Threat is to occur.

8.1.8.1.3. VULNERABILITY OF ASSET

The Vulnerability of Asset property evaluates how vulnerable the Asset is to the Threat.

8.1.8.2. HISTORY

RM Studio provides powerful traceability capabilities, with a complete version history on Risk Assessments. Users can now call up a version history for any Assessment and view previous versions as a whole or dig down into the individual building blocks of the Assessment, such as Assets and Risks. The version history will be applied to other elements of RM Studio and made even more powerful in our future releases.

8.1.8.3. ITEM HISTORY

8.1.8.4. VIEW ITEM

8.1.8.5. CHANGESET DETAILS

8.1.8.6. VIEW RISK ASSESSMENT VERSION

 

8.2. GAP ANALYSIS

Gap Analysis is an assessment tool enabling the user to compare their actual state in regards to a particular Standard with what is needed to be eligible for certification.

8.2.1. CREATING A NEW GAP ANALYSIS

8.2.1.1. GAP ANALYSIS INFORMATION

8.2.1.2. CONTROLS

8.2.1.3. IMPLEMENTATION

8.2.1.4. STATUS

8.2.1.5. JUSTIFICATION

 

8.3. RISK TREATMENT

A Risk Treatment is based on an Assessment. The Risk Treatment calculates the current and future Risk of your organization based on the status of implemented controls and other information from the Assessment.

8.3.1. WORKING WITH RISK TREATMENT

You can either work with a new Risk Treatment or you can continue working with an older one. To do this you must double click on a selected Risk Treatment from the Risk Treatment list (image 15.1).

8.3.1.1. RISK CRITERIA

8.3.1.2. ASSET LEVEL

8.3.1.3. CONTROLS TAB

8.3.1.4. SCHEDULING A FUTURE CONTROL

8.3.1.5. FUTURE CONTROLS TAB

8.3.1.6. OVERVIEW

8.3.1.7. RELOAD ASSETS, THREATS AND CONTROLS

9. REPORTS

RM Studio offers a variety of reports. You can view them on screen, print or save them in a variety of formats including PDF, Excel and Word.

9.1.1. The Standard Reports:

Statement of Applicability (SOA): the Statement of Applicability report is an overview of the status of the Risk Treatment. A Statement of Applicability is a list of all Controls from the Standard used to perform the Risk Treatment which have been labelled as Implemented, Not Implemented, Future Controls or Not Applicable. The descriptions entered for each respective control are also printed out. The status of the Risk Treatment is also displayed graphically. The report is useful for the managers of business units, customers, and agencies, e.g. the Data Protection Authority, which require a declaration of the security of the Risk Treatment in question. It can also be submitted to auditors.

Risk Assessment - Detailed information: the Assessment report contains all information entered into RM Studio for the Assessment in question.

Risk Treatment - Future controls (simple report): this report provides an overview of all Future Controls that have been defined for a given Risk Treatment. They are ranked according to date, so that the Control with the earliest date of implementation is shown first.

GAP Analysis - Future controls (simple report): this report provides an overview of all Future Controls that have been defined for a given GAP Analysis. They are ranked according to date, so that the Control with the earliest date of implementation is shown first.
Assets with Threats: Like the name indicates the Assets with Threats report aggregates all the Assets from a single Assessment and their respective threats. For each Asset the report states which values the Asset Evaluation Values and Threat Evaluation Values have. The report also states the Security Risk for each Asset.
Asset with Controls: This report shows all Assets in Assessment and the Controls used to mitigate their risks. The user can see all controls from the ISO/IEC 27001 Standard as well as any user defined Controls. The status of implementation of each controls is also shown.
Executive Summary: Shows the most important Assets based on the CIA values (Confidentiality, Integrity and Availability). It also shows the most Valuable Assets. The user can choose the number of Assets to be reported.

The Executive Summary report:·A great overview of Security Risk and Ratio of Controls. All calculations are shown graphically in a color coded way and gives the management key information on a single sheet.

Risk Treatment: All risks are listed along with their base, current and future security risk. The list is grouped by the Risk Treatment. Users can sort Risks by Base Security Risk, Current Security Risk, or Future Security Risk. This report provides a total overview of the risks and the treatment for each of them.

Controls With Assets: This report will show you all the Controls in your Risk Treatment, the name of the Control, Status of the Control, and Assets associated with the Control.

Gap Analysis - Results: This report is basically the same report as the SoA which is generated from the Risk Treatment results. This report allows you to generate the same report based on Gap Analysis.

Risk With Controls: This report is only available to those using the Local Reports. This report is useful when information is needed on whether or not a control has been implemented for specific risks (image 16.1).

Image 16.1 - Risks with Controls

10. TEMPLATES

10.1. Evaluation Templates

Evaluation Templates; these are used to qualitatively evaluate Threats and Assets in RM Studio. Users can add their own Asset or Threat Evaluations or change the definition of the Standard Asset and Threat Evaluations.

Image 17.1- Evaluation Templates

To add a new Evaluation Template click the "Add Evaluation Template" button (image 17.1) and give the Evaluation Template a name. When you have a new Evaluation Template highlighted in the list on the left hand side you will be able to "Add Template Factor" by pushing the appropriate button (image 17.2). Every Evaluation Template can hold more than one Template Factor.

Image 17.2 - New Template Factor

When you have added a Template Factor you can add a Factor Value. To do so you need to highlight the Template Factor that you wish to add a Factor Value to. The "Add Template Factor" button will change to an "Add Factor Value" button (image 17.2). Click on it to add a Factor Value.

When Asset Evaluation Templates are in use they can only be partially modified, such as changing the definitions of factor values as well as the defaults for security risk calculations.

10.1.1. SHORTCOMINGS OF EVALUATION TEMPLATES

If an Evaluation Template has no Template Factor then it can not be used as either a Threat Template or as an Asset Template for a new Risk Assessment.

If an Evaluation Template has any Factor Value equal to 0 (zero) then it can not be used as either a Threat or Asset Template for a new Risk Assessment.

There may not be more than one Evaluation Template with the same name, names should be unique for each Template.

There may not be more than one Template Factor in the same Evaluation Template with the same name. Names of Template Factors should be unique within a single Evaluation Template.

There may not be more than one Factor Value in the same Template Factor with the same name. Names of Factor Values should be unique within a single Template Factor.

Every change made to the Standard Templates will affect the calculations in the Processes using the default factors.

The algorithm used for calculating security risk is most accurate when factor values start at value 1 (one) and the increment between values is 1 (one).

 

11. BUSINESS CONTINUITY MANAGEMENT MODULE

11.1. ORGANIZATION

11.1.1. New Organization

To begin working on the BCP you need to have completed registering the Common Entities. After you finish the Common Entities you continue registering the Organization you want to set up a BCP for. The first thing is to open up the module and select the Organization and press the plus-sign to add the Organization to the module (image 18.1).

Image 18 .1 - New Organization

After pressing the plus-sign you can choose the Template and the Business Entity (image 18.2).

Image 18.2 - Select

After you press OK, you will be presented with window in image 18.3. What needs to be registered here are, Name, Scope Definition, Policy, Regulatory Information, Roles and Responsibilities. When you have finished that you continue adding Stakeholder and Resources/Processes.

Image 18.3

11.1.2. Stakeholders

To add Stakeholders, press the Green plus sign in the navigation tree to add an existing contact from the Contacts or press the brown plus-sign to add a New Stakeholder that does not exist in the Contacts module (Image 18.4 & Image18.5).

Image 18.4 - New Stakeholder

Image 18.5 - Select contact

When you have selected/created Stakeholder(s) you need to define their Ranking and Expectations. Ranking sets the importance of the Stakeholder to the Organization. The Expectations are mutual between us and the Stakeholders. To explain further we need an example: Our Expectations towards e.g. our insurance company

In case of a fire, within our company, we might expect suppliers to react more swiftly to our demands and needs. That way we can minimize the disruption caused by the fire. Our clients on the other hand expect us to deliver a particular service e.g. a support during business hours. In case of a fire they may show some understanding and decide they·might be able to go about without our service for three days, after that they might need to change supplier and go to a competitor of ours·(Image18.6).

Image 18.6 - New Stakholder

11.1.3. Resources/Processes

Resources and Processes are created similarly to Stakeholders, you can add a new one from Contacts and Assets by clicking on the green plus-sign or you can create new one from scratch by clicking on the brown plus-sign. · You will need to give the Resource/Process a name, assign it to a division/department. ·Additional Requirement Information includes, assessment date and review date. ·Signed of by: is the person responsible for the assessment of this Resource/Process. · You can add notes or comments to each Resource/Process (image 18.7).

Image 18.7 - Add New Resource/Process

11.1.3.1. Impact Analysis

The Impact Analysis is done for each and every Resource/Process you create. ·You need to rank the Resource. ·You need to rank and define the Areas of Impact for each Resource/Process. ·Recovery window offers you the options to set the Maximum Tolerable Period of Disruption, Recovery Time Objective and the Minimum Service Level in case of a disruption (Image 18.8).

Image 18.8 - Impact Analysis

11.1.3.2. Requirements·

Here users can identify/define the Requirements needed to fulfill/meet the rrecovery objectives set in the Impact Analysis (image 18.9). ·First select then item category, then press the plus-sign when you have selected e.g. Software/Applications. ·After pressing the plus-sign, users can edit the name, comments and notes at the bottom of the screen. ·

Image 18.9 Requirements

 

11.2. INCIDENT RESPONSE/RECOVERY

Here the user creates the BCP's (Business Continuity Plans). ·First thing the user does is to create a new Incident Response by pressing the plus-sign and selecting the Organization (image 18.10)

Image 18.10 - Incident response

After creating the·Incident Response·the user should give it a name and write a description for the Incident Response (image 18.11).·

·
Image 18.11 - New Incident Response

11.2.1.1. Associated Threats

Here the user can add Threats that are associated to the Incident Response plan that is being created (image18.12).·

Image 18.12 - Associated Threats

11.2.1.2. Plans

For each Incident Response there can be many Plans. ·The user begins by creating a Plan by clicking on the brown plus-sign and name the Plan. ·Describe the Incident Extent, Purpose and Scope (image 18.13).·

Image 18.13 - New Incident Plan

At the bottom of the page the user must select a Contact that is responsible for the maintenance of this plan (image 18.14)

 Image 18.14 - Plan Maintained by

11.2.1.2.1. Steps

Users must create the steps needed to respond to an Incident. ·First thing to do is to press the plus-sign to create a new step, name it, set the timeframe, set the responsible team and write a short description of the step. · Repeat this process until you have all the steps needed to respond to the incident at hand (image18.15).·

 Image 18.15  - Steps

11.2.2. MAINTENANCE

In the Maintenance Step the user can test and update the plans created in earlier steps. ·First thing to do here is to create a new Maintenance plan and give it a name, set the BCM Testing Coordinator and write the overview of the Maintenance Plan (image18.16).

Image 18.16 - Maintenance

11.2.2.1. Test Plans

Create a new test plan by clicking the brown plus-sign. ·Next step is to name the test scenario and if applicable, link it to a Incident Plan. ·The scenario should be reviewed regularly and the user can set the Next to be Tested date and select the Test Coordinator. ·The frequency interval is then written in the Frequency field e.g. twice a year. ·There are four tabs, Description, Goals, Preparations and Participants for the user to fill out and describe (Image 18.17). ·The user can create as many test scenarios as needed.

 Image 18.17 - New Test Plan

11.2.2.2. Test Results

For every Test Plan, one or more Test Results can be created by pressing the brown plus-sign. ·Within a Test Result users set the expected test date and the actual test date, test results and finally Items to review/encountered issues

Image 18.18 - Test Results

11.3. REPORTING

11.3.1. REPORTS

The BCM module offers two default reports. ·

Image 19.1 Reports

11.3.1.1. Incident Management Plan Report

This report displays all information that is relevant to the BCM Plan (Image 19.2).·

Image 19.2 - Incident Management Plan Report

11.3.1.2. Business Continuity Plan Report

The Business Continuity Plan Report is a subset of the Incident Management Plan Report and only displays key information regarding the BCM. (Image 19.3.)·

Image 19.3 - BCP Report 

11.4. TEMPLATES

11.4.1. REQUIREMENT TEMPLATES

Here users can modify or create their own Requirement Templates, that are used in the Organization node. ·

Image 20.1

To begin creating a new Template press the plus-sign and a new window will be presented to the user. · In that window (image 20.2) the user gives the Template a name. ·After naming the Template the user starts adding columns to the Template.·

Image 20.2 - New Template

11.4.1.1. Add Columns to a Template

Adding new columns to the Template has no upper or lower limit to it. ·The user can add as many columns to the Template as needed (Image 20.3). ·The only thing to take into consideration is that no two columns should be named with the same name.·

Image 20.3 - Columns in Template 

After creating all the columns the user needs, saving is required. ·If the Template has been used by the user for one or more Organizations, the Columns that have been used from the templates will lock and can not be deleted. Renaming the Columns on the other hands is possible (Image 20.4).

Image 20.4 - Sample Columns

 

12. DEFINITIONS

 

12.1. DEFINITION OF ASSET EVALUATION VALUES

13. GLOSSARY

 

14. CONTEXT & FLOW

14.1.1. CONTEXT

15. CALCULATIONS

 

15.1.1. SECURITY RISK

15.1.1.1. First risk calculation

15.1.1.2. Second risk calculation

15.1.1.3. Third risk calculation

15.1.1.4. Security risk of an Asset and the Risk Assessment

15.1.2. RESIDUAL RISK