Index

#

72-hour clock1.4 7.7.1 7.7.2

A

A third party's files13.4.2
Acknowledgement1.7 2.14.1 5.10 5.11 5.11.1 5.11.4 5.11.6 15.9
Acknowledging a policy5.11.2
Adding a single account12.4.1
Adding evidence13.2
Adding items to a program12.4
Adding or editing a finding8.5.1
After the decision11.9.5
AI assistants2.13
An evidence record13.3
Analysis statuses4.8
Anatomy of a report15.2
Annual checks11.15.7
Answering (the Data Liaison's view)11.15.5
API token2.1 2.4 2.8 2.9 2.13 2.16 2.17 16.4
API Tokens2.16
Approval workflow2.9 2.12 5.5 5.5.1 5.5.2 5.5.3 5.5.4 11.9.4
Approving or rejecting5.5.2 11.9.4
Archive1.4 3.2 3.5.1 5.1 5.9 10.3 11.12 12.7
Archive and reactivate5.9
Archiving, reactivating and deleting12.7
Article 30 completeness11.5
Article 30 register2.1 2.12 4.13 11 11.1 11.5 11.8 11.17
Asking for acknowledgement5.11.4
Assessing an incident as a breach7.7.1
Asset1.8.2 1.8.4 3.3 3.11 7.4 7.5 11.7 16.3
Assets3.11
Attachment1.8.5 3.9 5.10 6.3.3 7.9 8.7 10.9 11.13
Attachments1.8.5
Audit finding2.1 4.9.3 8.5 8.5.1 8.5.2 8.5.4 8.6 9.4.2
Audit Log2.15
Audit log1.8.8 2 2.1 2.4 2.13 2.15 2.15.1 2.17
Authentication16.1
Automatic reminders10.7.2
Awareness Completion15.7
Awareness permissions10.11

B

Backup2 2.1 2.17
Backups2.17
Branding2.10
Building a questionnaire11.15.3
Bulk updates4.7.2
Business unit3 3.3 3.5 3.11 3.12 16.3
Business Units3.12

C

Changing status9.4.1
Classification1.4 3.1 3.2 3.13 7.2 7.3 15.3 15.8
Closing and reopening an incident7.6
Comment1.8.6 3.9 5.10 7.9 8.7 10.9 11.13 12.6
Comments1.8.6
Comments, attachments and history3.9 7.9 8.7 9.4.4 12.6
Comments, Attachments and History6.3.3
Comments, Attachments, History and Custom Fields5.10
Comments, attachments, history and custom fields10.9 11.13
Common controls and inheritance4.4
Completion and evidence5.11.7
Compliance requirements remediated9.4.3
Compliance Status15.4
Contacts tab6.3.1
Content tab: the training material10.5
Control3.10 3.10.1 3.10.2 3.10.3 4.4 4.9.2 4.9.3 8.5.4
Control testing1.5 2.14.1 3.10 3.10.1 3.10.2 3.10.3 3.13
Control testing settings3.10.3
Controls3.10
Conventions16.2
Creating a policy5.2
Creating a program10.2 12.2
Creating a project9.3
Creating a record11.2
Creating a remediation project8.5.3
Creating a request14.3.1
Creating a risk3.3
Creating a schedule15.10.2
Creating a template14.2.1
Creating a third party6.2
Creating an audit plan8.3
Creating an incident7.4
Crosswalks between frameworks4.6
CSV import1.8.2 1.8.7 2.14.2 4.2 4.6 4.7 4.11 12.4.2
Custom field1.8.2 2.1 2.4 2.6 5.10 7.9 10.9 11.13
Custom Fields2.6

D

Dashboard1.2 1.4 1.4.1 1.4.2 1.5 2.4 5.5.5 12.1
Data Liaison1.4 2.4 11.15.1 11.15.2 11.15.4 11.15.5 11.15.7 11.17
Data map1.4 2.4 11 11.1 11.15 11.16 11.17
Data mapping questionnaires11.15
Data privacy permissions11.17
Data processing agreement6.4.1 2.14.1 6.1
Data protection6.4
Data tables1.8.1
Deciding items in bulk12.5.2
Deciding one item12.5.1
Deleting a plan8.4.2
Deleting a policy5.12
Deleting a program10.10
Deleting a project9.4.5
Deleting a record1.8.9 11.14
Deleting a schedule15.10.5
Deleting a template14.2.3
Deleting a third party6.5
Deleting packages and items4.14
Delivery history15.10.4
Delivery log2.14.4
Documenting the record11.4
DPIA2.12 11.9 11.9.1 11.9.2 11.9.3 11.9.4 11.9.5 11.17
DPIAs11.9
DPO advice11.9.3

E

Editing a plan and changing its status8.4.1
Editing and deleting7.8
Evidence13.1 13.2 13.3 13.4 13.5 13.6 13.8 13.9
Evidence on other records13.4
Evidence packages for auditors13.8
Exception1.8.2 2.14.2 3.7 3.8 4.12 5.1 5.8 15.5
Exceptions3.8 5.8 15.5
Exceptions on a clause4.12
Expiry and reminders13.7
Export1.8.1 1.8.2 1.8.7 2.1 2.15 2.17 4.3 4.11
Exporting a package4.3

F

Files on controls, requirements and account reviews13.4.1
Filtering by family4.7.1
Finding status workflow8.5.2
Finding the Settings screens2.1
Findings raised by failed control audits8.5.4

G

Group1.5 2.1 2.2 2.3 2.4 2.8 5.11.4 10.11
Groups2.3

H

Header, help and user menu1.3.2
History1.8.8 3.9 5.10 6.3.3 7.9 8.7 10.9 11.13
History tabs1.8.8
How a scheduled report is sent15.10.3
How scoring works3.4

I

Importing a package4.2
Importing accounts from CSV12.4.2
Importing from CSV1.8.2
Incidents15.8
Integrations2.7
Integrity2.15.1

L

Label1.8.4 2.5 3.2 3.10 3.11 5.1 5.3 8.5.1
Labels1.8.4 2.5
LDAP2.7.2 1.2 2.2 2.7 2.7.3 2.9 2.15
Linked assets, risks and controls11.7
Locked evidence and file fingerprints13.6

M

Managing requests5.11.6
Managing the classification catalog7.2
Managing the shared dashboard1.4.2
Mapping controls, policies and risks4.9.2
MCP1.8.5 2.13 2.16 14.6 16.4
My notifications1.6.2
My profile1.6
My Tasks1.5

N

NIST SP 800-531.1 4.1 4.4 4.5 4.6 4.11
Notification rule1.6 1.6.2 2 2.1 2.14 2.14.2 11.11 14.7
Notification rules2.14.2
Notifications2.14
Notifications and audit trail14.7

O

Open audit findings on mapped controls4.9.3
Open findings8.6
Organization-defined values4.5.1
Owner1.5 4.10 5.8 5.13 6.4.4 6.6 8.5.1 10.1

P

Packages4.1
Password1.2 1.6 1.6.1 2.2 2.7.1 2.7.2 2.7.3 2.15
Password change1.6.1
Permissions3.14 4.15 5.13 6.6 7.1 8.1 9.1 10.11
Personal data breach1.4 1.8.2 2.14.1 2.14.2 7.5 7.7 7.7.1 7.7.2
Personal data breaches7.7
POA&M1.1 4 4.9.3 4.10 4.11 4.15 8.5.4 8.6
Policies2.11
Policy Acknowledgements15.9
Policy portal1.4 1.7 5 5.3 5.11 5.11.1 5.11.3 5.13
Policy portal and acknowledgements5.11
Privacy2.12
Program status: draft, active, archived10.3
Provisioning (SCIM)2.8
Publishing5.5.3
Putting a policy on the portal5.11.3

Q

Questionnaire1.4 2.4 11.15 11.15.2 11.15.3 11.15.4 11.15.5 11.15.6

R

Record of processing1.5 2.6 6.4.2 7.7.2 11.1 11.2 11.8 11.9
Record status: draft, active, archived11.12
Record tabs4.9.5
Recording an approval made outside the app5.5.4
Recording the analysis4.9.1
Records of processing that name this vendor6.4.2
Reissuing the public link14.3.4
Related access paths16.4
Remediation project4.9.4 4.10 8.5.3 9 9.2 9.3 9.4 9.4.5
Remediation projects4.9.4
Reminders11.15.8
Repeating assessments14.5
Replacing earlier evidence13.5
Report schedule1.6.2 15.10 15.10.3
Requests14.3
Residual risk1.4 3.2 3.3 3.4 3.5 3.13 11.9.4 15.3
Retakes10.8.1
Retention2.15.2
Review1.4 3.7 5.7 11.10 11.11 12 13.4.1 15.6
Review notifications11.11
Reviewing answers11.15.6 14.4
Reviewing items: keep or disable12.5
Reviews3.7
Reviews Due15.6
Reviews tab5.7
Risk appetite1.4 2.14.1 3.4 3.5 3.6 3.7 3.13 15.3
Risk Register15.3
Risk score1.4 3.3 3.4 3.13
Risk Settings3.13
Risks tab6.3.2
Roles2.4

S

SAML1.2 2.2 2.7 2.7.3 2.8 2.15 2.15.3 11.15.1
SAML single sign-on2.7.3
Scheduled reports15.10
Scheduler2.14.3
Scheduling and recording control tests3.10.2
SCIM1.8.7 2.1 2.2 2.3 2.8 2.17 16.4
Security alerts2.15.3
Sending a questionnaire11.15.4
Sending a reminder10.7.1
Session1.2.1 1.3.2 2.1 2.2 2.7.3 2.8 2.9 2.15
Sessions2.9
Shared UI conventions1.8
Sidebar1.3.1
Sign-in security1.6.1
Signing in1.2
Signing out and session length1.2.1
SMTP2.7.1 2.7 2.15.3
Starting and screening a DPIA11.9.1
Status and actions3.5.1
Status badges and overdue highlighting1.8.3
Sub-processor6.3.3 6.4.3 11.4
Sub-processors6.4.3
Submitting for approval5.5.1

T

Taking a test10.8
Templates2.14.1
Templates and the question editor14.2
Test tab: building the question set10.6
The analysis workspace4.7
The app layout1.3
The Article 30 register11.8
The Assessments page14.1
The audit plans list8.2
The breach card7.7.2
The catalog page4.5.2
The compliance report (PDF)4.13
The control page3.10.1
The Dashboard1.4
The data map11.16
The detail page6.3
The draft → approval → publish workflow5.5
The Evidence page13.1
The full assessment11.9.2
The gap view (POA&M)4.10
The incident detail page7.5
The incidents list7.3
The landing page15.1
The linked audit finding9.4.2
The NIST SP 800-53 catalog4.5
The package page4.1.1
The plan detail page8.4
The POA&M register4.11
The policies list5.1
The policy detail page5.3
The Policy Portal1.7
The program detail page10.4
The program page12.3
The programs list10.1 12.1
The project detail page9.4
The projects list9.2
The public assessment page (for external contacts)14.6
The Questionnaires tab11.15.2
The record detail page11.3
The records list11.1
The register6.1
The request page14.3.3
The requests list14.3.2
The Reviews tab11.10
The risk detail page3.5
The risk register and its tabs3.1
The Risks list3.2
The schedules list15.10.1
The template page14.2.2
Third party1.4 4.11 6 6.1 6.2 6.4.2 6.5 13.4.2
Time zone1.6 1.8.7 2.2 2.7.2 2.7.3 2.8 15.10.2
Times and time zones1.8.7
Tracking tab: who has completed the program10.7
Transfer impact assessment2.14.1 6.1 6.4.4 11.6
Transfer impact assessments6.4.4
Transfers11.6
Treatment3 3.2 3.4 3.5 3.6 3.8 3.10 15.3
Treatments3.6
Two-step verification1.2 1.6.1 2.2 2.7.3 2.9 2.14.1 2.15 2.15.3

U

Unpublished changes5.5.6
Unsubscribing15.10.6
Uploading a reissued document5.5.5
User1.3.2 2.2 2.3 2.4 2.7.2 2.7.3 2.8 2.15
Users2.2

V

Version4.1 5.3 5.5.3 5.5.5 5.6 5.11.1 5.11.5 5.11.6
Versions tab5.6

W

What a decision records12.5.3
What is available16.3
What is recorded5.11.5
What the portal shows5.11.1
What you can manage1.1
When a page is off limits1.8.10
Who can be a Data Liaison11.15.1
Who can do what5.13 6.6 7.1 8.1 9.1 12.8 14.8
Who can do what (Compliance Management)4.15
Who can do what (Risk Management)3.14
Who can do what with evidence13.9
Who can manage schedules15.10.7
Who can see reports15.11
Working on an item4.9
Working with findings8.5
Writing content (Content tab)5.4

Y

Your own dashboard1.4.1