Governance

BIA – Business Impact Analysis and CIA Classification

We can assess the potential adverse effects of a disruption to business processes, systems, or data assets, based on financial and non-financial evaluation criteria tailored to the company. Based on these assessments, we can classify our resources.

BIA assessment methodology:

• Business impact analysis is suitable for analyzing changes in status across all three aspects of information security: availability disruption—over any time period—confidentiality breach, and integrity breach.
• The software supports the performance of business impact analyses initiated from the perspective of data, business processes, or IT services.
• Flexible parameterization of impact types: Impact types and scales can be flexibly configured, and their textual descriptions can be tailored to the company’s operational environment.

BIA assessment:

• Based on the established methodology, the business impact analysis can be performed by designated users.

BIA Reports and Results:

• The results of the BIA assessment are inherited along Inventory dependency relationships and can be organized into lists
• Sensitivity curves, impact reports measured over time
• CIA classification of resources
• Identification of single points of failure (SPoF)
• Incident simulations showing the consequences of impact
• Impact data for risk analysis
• BCM recovery time objectives (RTO, MTPD, RPO, MBCO)

Security measures and controls

A record of the organization’s own operational security measures and controls. These may include policies, procedures, activities, software-based security, and hardware—everything that constitutes the organization’s security environment. These controls enable us to meet compliance requirements and serve as risk-mitigating controls.

Management of Inventory Resource Reviews

We support the review of corporate resource inventories (processes, systems, data assets, resources) with a dedicated workflow function.

• Compilation of review packages (resource scope, responsible parties, task assignment)
• Controlled workflow with email notifications
• Comment management
• Change management and controlled import to the live records

Incident Management

Management, evaluation, and logging of incidents, as well as management of post-incident actions. Multiple incident repositories for different purposes can be created using access control.

Managing Security Exceptions

Security exceptions are temporary conditions that deviate from the organization’s security requirements. We can track these exceptions, manage their authorization, and send warning emails when they expire.

Task and responsibility manager

The integrated task management function allows us to review and manage tasks and actions arising from all of the software’s modules and functions, as well as create new ones. We can review the one-time, ongoing, and periodic tasks of our information security management system. Email notifications can be set up for the users in charge for each task type.

Document management

The SeCube document management function can be used to order, label, and review the documents uploaded in all software functions