# CISAPP documentation > Functional guides for CISAPP users and organization administrators. English documentation based on verified functionality. Access requirements and unavailable features are described in the articles. --- Source: https://docs.cisapp.eu/en/ Markdown: https://docs.cisapp.eu/en/index.md Welcome to the CISAPP help centre. Explore [getting started](https://docs.cisapp.eu/en/getting-started/welcome), [practical guides](https://docs.cisapp.eu/en/guides/onboard-vendor), [troubleshooting](https://docs.cisapp.eu/en/help/troubleshooting) and [AI-readable formats](https://docs.cisapp.eu/en/help/use-with-ai). Explore [common questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/getting-started/welcome Markdown: https://docs.cisapp.eu/en/getting-started/welcome.md # Welcome to CISAPP Understand the main workspaces and choose your first guide. > **Access:** member. CISAPP connects vendors, business activities, assessments, risks and compliance evidence. Start with a vendor to understand its exposure, or with a business activity to identify dependencies. ## Before you start You need an activated account attached to your organization. Visible menus depend on your plan and permissions. A missing menu does not mean your data has disappeared. ## Your first journey 1. [Sign in](https://docs.cisapp.eu/en/getting-started/sign-in) with the email address used for your invitation. 2. Check your organization’s name in the interface. 3. Discover [navigation and search](https://docs.cisapp.eu/en/getting-started/navigation). 4. Open **Suppliers** and select a record you can access. 5. Follow [Onboard a vendor](https://docs.cisapp.eu/en/guides/onboard-vendor) to add a third party, or [Answer a questionnaire](https://docs.cisapp.eu/en/guides/respond-questionnaire) if you are a respondent. ![CISAPP home page and reporting indicators](https://docs.cisapp.eu/images/en/dashboard.webp) *Home displays the indicators available to your organization. The illustrated data is fictional. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/dashboard.webp)* ## Understand the objects | Object | Purpose | |---|---| | Business activity | Describe what your organization needs to keep doing. | | Vendor | Identify a third party and centralize its information. | | Assessment | Examine a scope using questionnaires. | | Risk | Describe a scenario and track its treatment. | | Control | Describe a mitigating action and its progress. | | Evidence | Support a response or control with a document. | ## If your workspace looks empty Check your [permissions](https://docs.cisapp.eu/en/organization/permissions), then [feature availability](https://docs.cisapp.eu/en/help/availability). An external respondent does not necessarily have the same workspaces as an administrator. --- Source: https://docs.cisapp.eu/en/getting-started/sign-in Markdown: https://docs.cisapp.eu/en/getting-started/sign-in.md # Sign in and activate your account Activate an invitation, use a password or SSO and resolve sign-in issues. > **Access:** member. ## Prerequisites Use the exact email address your organization invited. For your first visit, open the activation link received by email and complete the displayed steps: set a password, enter personal information and accept the documents presented. ## Sign in 1. Open the [CISAPP application](https://app.cisapp.eu/login). 2. Enter your email address, then select **Continue**. 3. Use a method offered for your account: password, Google, Microsoft or your organization’s identity provider. 4. Complete any additional verification before leaving the screen. 5. Check that you reach your CISAPP workspace. ![First step of CISAPP sign-in](https://docs.cisapp.eu/images/en/login.webp) *The first step identifies your account before offering the available sign-in methods. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/login.webp)* ## Pending invitation or authorization An account can be activated while authorization to join the organization is still pending. If authorization is pending, contact an organization administrator. Creating another account with a different address does not resolve it. If the invitation link has expired or been revoked, ask your administrator to resend it from **My company → Members**. ## Forgotten password Use password recovery from the sign-in screen and check your spam folder. Accounts using SSO only must follow their identity provider’s recovery process. ## Expected outcome You are signed into the correct organization. To change your language or authentication preferences, see [My profile](https://docs.cisapp.eu/en/organization/profile). --- Source: https://docs.cisapp.eu/en/getting-started/navigation Markdown: https://docs.cisapp.eu/en/getting-started/navigation.md # Navigate and search Use menus, the command palette and list filters. > **Access:** member. ## Main workspaces | Workspace | Purpose | |---|---| | Home and Reporting | Read indicators and explore dependencies. | | Registers | Find activities, vendors, projects, applications, risks, incidents and exemptions. | | Assessments | Start an assessment and manage questionnaires. | | Compliance | Track requirements, controls and trust information. | | Action plans | Organize action plans and track all actions or **My actions**. | | Files | Centralize and share documents. | | Operational security | Review exposure and monitored assets. | | My company | Manage the organization profile and access. | ## Reach an action quickly 1. Select **Search**, or press **⌘ K** on Mac and **Ctrl K** on Windows/Linux. 2. Type words describing a screen or action. 3. Navigate suggestions with the keyboard and press Enter. 4. Press Escape to close the palette without opening anything. ![Command palette and shortcuts](https://docs.cisapp.eu/images/en/command-palette.webp) *The palette offers destinations and actions permitted for your account. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/command-palette.webp)* ## Search a register List search is separate from the command palette. Combine the search field with the available filters: status, criticality, tags or owner, depending on the register. If a list is empty, clear the filters before assuming there is no data. ## Missing button or menu First check your permissions and the scope shared with you. Some modules depend on your plan or activation. See [Feature availability](https://docs.cisapp.eu/en/help/availability). The English interface uses **Reviews** for assessments and **Suppliers** for vendors. Some controls currently retain French labels. Use the screenshots and the displayed control text to locate the action. --- Source: https://docs.cisapp.eu/en/registers/vendors Markdown: https://docs.cisapp.eu/en/registers/vendors.md # The vendor register Search, filter and export your organization’s vendors. > **Access:** member, vendor creation. Subject to enabled modules and your plan. The register centralizes your organization’s third parties. A vendor record contains its identity, criticality and the information accessible to your account. ## Browse the register 1. Open **Registers → Suppliers**. 2. Search for a name and, when needed, apply **Status**, **Criticality level** and **Tags** filters. 3. Select a row to open its record. 4. Use **Export to CSV** to work with the list in another tool. Check the filters and desired columns before exporting. ![Vendor register and filters](https://docs.cisapp.eu/images/en/vendors.webp) *Find a third party in the register before opening its details. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendors.webp)* ## Understand visibility You may see that a vendor exists without being able to read all its information. Access to the record and related objects depends on permissions shared with you or your team. Indicators above the register summarize visible vendors and their assessment engagement. A vendor that has never been assessed does not necessarily have poor security: an assessment is missing. ## Add or find a vendor Use **Créer un fournisseur** and search for the company first to avoid duplicates. See [Create and qualify a vendor](https://docs.cisapp.eu/en/registers/create-vendor). ## Common difficulties - **No results**: clear the search and filters. - **Record inaccessible**: ask the owner to share access. - **Limit reached**: check the displayed quota. A vendor marked inactive remains in the register and still counts toward the created-vendor quota. - **Incomplete export**: check the visible scope and export options. ## Expected outcome You have found the correct vendor and its record matches your working scope. --- Source: https://docs.cisapp.eu/en/registers/create-vendor Markdown: https://docs.cisapp.eu/en/registers/create-vendor.md # Create and qualify a vendor Identify a company, set its criticality and add contacts. > **Access:** vendor creation. Subject to enabled modules and your plan. ## Prerequisites and permissions You need vendor-creation permission or appropriate administrative access, and an available vendor quota. Prepare the company name, website and a contact. ## Identify the company 1. Open **Suppliers → Créer un fournisseur**. 2. Search by name, domain or registration number. 3. Select the matching company. If none exists, choose **Créer manuellement**. 4. Check the required **Nom du fournisseur** (vendor name) and **Site web** (website) fields, then complete useful contact details. 5. Select **Créer** to move to qualification. This control and several field labels currently remain in French in the English interface; it does not complete the full creation workflow. ![Information for a fictional vendor](https://docs.cisapp.eu/images/en/vendor-info.webp) *Check the company’s identity before creating the vendor relationship. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendor-info.webp)* ## Qualify criticality Choose an offered qualification mode. In manual mode, select the level matching this vendor’s impact on your business. A criticality questionnaire provides guided qualification when a suitable questionnaire is available. ![Selecting vendor criticality](https://docs.cisapp.eu/images/en/vendor-criticality.webp) *Criticality describes the vendor’s business importance; it is separate from its security score. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendor-criticality.webp)* ## Add contacts and access Enter useful contacts: first name, last name, email and role. Check every address before sending invitations. If an access step is offered, assign only the necessary permissions to the relevant people and teams. ## Expected outcome The record is accessible from the register. Check its information, link it to business activities and prepare a [vendor assessment](https://docs.cisapp.eu/en/assessments/vendor). ## If creation fails Check the website format, required fields and quota. If the company already exists, return to search rather than creating a variation of its name. --- Source: https://docs.cisapp.eu/en/registers/vendor-record Markdown: https://docs.cisapp.eu/en/registers/vendor-record.md # Use the vendor record Find a vendor’s information, contacts, notes, assessments and access. > **Access:** member. Subject to enabled modules and your plan. ## Open and check the record Open the third party from **Registers → Suppliers**. Check its name and domain before making changes. Some information belongs to the vendor’s organization; editing it may depend on its status and your account permissions. ![Record for a fictional vendor](https://docs.cisapp.eu/images/en/vendor-detail.webp) *The record brings together the third party’s context and linked objects. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendor-detail.webp)* ## Maintain useful information - Check the relationship status and business criticality. - Complete contacts and their roles to identify the right respondent. - Use notes to retain context useful to your organization. - Review linked assessments and activities before deciding on a new action. - Review access when an owner or team changes. ## Exchanged documents The **Documents** tab gathers documents exchanged with the vendor: added manually, received through a questionnaire or coming from a certification (the source and the **Received** / **Sent** direction are shown). - **Add documents** (or drag and drop files onto the tab): choose a **category** for each document (Contract, DPA, NDA, Certification, Security policy, Audit report, Pentest report, Insurance, BCP / DRP, Questionnaire evidence, Financial, Other); a category may be suggested from the file name. For relevant categories (contract, DPA, NDA, certification…), fill in **Valid until**. - On the client side, **Share with the vendor** lets the vendor view the documents you add. - A banner flags documents **to classify** (**Classify now**) and expired or soon-to-expire documents. - Search and filter by category; the list is limited to the 1,000 most recent documents. - Some documents are **secure view only**: download is then unavailable. ## Personal data and subcontracting When GDPR options are enabled, dedicated fields describe personal-data processing, the third party’s roles and subcontracting information. Base these fields on the actual vendor relationship. Completing a field is not legal validation. ## Prepare a reassessment Open the previous assessment, check its scope and date, then start a new assessment if needed. See the [onboarding guide](https://docs.cisapp.eu/en/guides/onboard-vendor). ## Expected outcome Another authorized member can understand who the vendor is, why it matters and what checks have been performed. If a tab fails to load, check permissions on the related object before retrying. --- Source: https://docs.cisapp.eu/en/registers/activities Markdown: https://docs.cisapp.eu/en/registers/activities.md # Describe business activities Create an activity, qualify its criticality and link its vendors. > **Access:** activity creation. Subject to enabled modules and your plan. A business activity describes a process your organization wants to track, such as “Order processing”. It links vendors to a business need. ## Prerequisites Activity-creation permission is required to add an activity. Prepare its description, owner and supporting vendors. ## Create an activity 1. Open **Registers → Business activities** and select **Create activity**. 2. Enter the name and requested context. 3. Qualify criticality at the dedicated step. 4. Select the supporting vendors. Missing relationships will not appear on the dependency map. 5. Check the offered access settings and finish creation. ![Creating a business activity](https://docs.cisapp.eu/images/en/activity-create.webp) *The wizard starts by identifying the business process being tracked. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/activity-create.webp)* ## Keep the activity up to date Open its record from the register to review information and relationships. When a vendor changes, also update the activities it supports. An **Business Criticality** assessment can qualify a scope using a questionnaire. ## Expected outcome The activity exists in the register and its dependencies can support [reporting](https://docs.cisapp.eu/en/reporting/dependencies). ## Distinguish the concepts Business activities and GDPR processing activities serve different purposes. To describe personal-data processing, use the [GDPR register](https://docs.cisapp.eu/en/compliance/gdpr). --- Source: https://docs.cisapp.eu/en/registers/applications Markdown: https://docs.cisapp.eu/en/registers/applications.md # Applications List the organization's applications, built in-house or supplied by a vendor, and track their repositories, relations, personal data and assessments. > **Access:** member. The register depends on your plan. The list only shows records you can access; an organization administrator sees them all. The **Personal data** tab depends on the GDPR module and is in **beta**. > > **Language:** these screens are not yet translated into English. Labels below translate the French interface. An application is a technical solution of the organization (customer portal, billing API, business tool…), built in-house or supplied by a vendor. Former internal projects have been carried over as applications; old links lead straight to them. ## Create an application 1. Open **Registers → Applications**, then **New application** (or the menu **+** shortcut). 2. **Identity**: name, type (Web application, Mobile application, API / service, Business tool, Data pipeline, Automation script, System connector, Regulatory reporting, Other), sourcing (**Internal** or **Vendor**) and **Owner**. If the sourcing is **Vendor**, choose the **Publisher**. Name and owner are required. 3. **Context** (optional): **Linked projects**, lifecycle (Planned, In service, Retired), hosting (On premises, Cloud, SaaS, Hybrid, Unknown) and environments. Name each added environment, or delete it. 4. **Access** (optional): choose who can view or edit the record. You remain its administrator. 5. **Summary**, then create the record. On a vendor record, the **Applications** section lists the solutions it publishes and offers **Add an application**. ## Read the record | Tab | Content | |---|---| | Overview | Identity, owner, sourcing, lifecycle, hosting, environments, technical information. | | Code and DevSecOps | Linked GitHub or GitLab repositories, with the tools enabled on each (currently **Dependencies**, the import of dependency vulnerability alerts). | | Relations | Associated records and follow-up: vendors, projects, risks, actions, assessments… | | Personal data | GDPR declaration of the application (if the module is available). | | Access | Authorized people and teams, with Read, Edit or Administration rights. | **Edit record** updates its information, with the edit right. ## Link code repositories Repositories are linked from the GitHub or GitLab connector page, not from the record. The **Code and DevSecOps** tab offers **Open connectors** if no code connector is active. See [GitHub](https://docs.cisapp.eu/en/organization/connectors/github) and [GitLab](https://docs.cisapp.eu/en/organization/connectors/gitlab). ## Associate records and actions In **Relations**: 1. **Associate a record**: choose the type (Application, Vendor, Business activity, Assessment, Risk, Incident, Exemption, GDPR processing activity, Action, Action plan, Project), then the record. For a vendor, set its role: Associated, Host, Integrator or Other provider. 2. **Add an action**: action to carry out, owner, due date, in an existing action plan or a new one. 3. **Assess** starts an assessment of the application; **Reuse an assessment** associates an existing one. Relations grant no access rights: grant the required access explicitly in **Access**. Assessments keep their scope and date; vendor scores are not carried over to applications. ## Declare personal data The **Personal data** tab asks whether the application processes personal data (Yes, No, To be qualified), then asks for data categories, GDPR role, hosting, DPIA (Not required, Required, In progress, Completed) and retention period. Findings flag inconsistencies with the processing register: missing DPIA, undefined retention, undeclared hosting, no linked processing activity, contradictory or outdated declaration. ## Assess an application Open **Assessments → Application assessments**, or **Assess** from the record. See [Assessment types](https://docs.cisapp.eu/en/assessments/types). ## Expected outcome The application is identifiable in the register with its owner, relations and access, and its assessment can be started. ## Common issues - Record missing from the list: it is not shared with you. Ask its administrator for access rather than recreating it. - Creation blocked: enter the name and owner, and the publisher for a vendor application. - Someone linked through a relation cannot see the record: relations do not grant access. - No repository shown: link the repository from the connector page. --- Source: https://docs.cisapp.eu/en/registers/maps Markdown: https://docs.cisapp.eu/en/registers/maps.md # Read vendor maps Explore vendor criticality and the data vendors process. > **Access:** member. Subject to enabled modules and your plan. ## Prerequisites Maps use vendors you can access. Vendor mapping and processing-register generation depend on the features enabled in your plan. ## Criticality map 1. Open the map from the **Suppliers** register. 2. Filter criticality levels and status. 3. Locate vendors in the radar and review their assessment state. 4. Open the vendor record to investigate and check the date and context of its criticality. The map represents existing data; it does not perform a new assessment. ## Data map 1. Open the register’s **Data map**. 2. Filter by role and data category. 3. Review categories, countries, transfer mechanisms and data-processing agreement status. 4. If enabled, use processing-register generation and review the confirmation and result. A missing agreement or empty field needs investigation. Generation assists register preparation and requires a business review before use. ## Expected outcome and troubleshooting You identify priority vendors and missing information. For an empty map, clear filters and check access. If generation is unavailable, ask an administrator to check the plan and activation. [Dependency maps](https://docs.cisapp.eu/en/reporting/dependencies) analyze another aspect: the relationship between activities and vendors. Data mapping and register generation are **beta** features in the illustrated version. --- Source: https://docs.cisapp.eu/en/registers/projects Markdown: https://docs.cisapp.eu/en/registers/projects.md # Projects and launch decision Create a project, appoint the security reviewer and decision maker, review deliverables and record the security opinion, then the launch decision. > **Access:** member. The register depends on your plan. Review actions are reserved for the **security reviewer** and the **launch decision maker** appointed on the project, with the edit right on the record. > > **Language:** these screens are not yet translated into English. Labels below translate the French interface. A project (IT project, business change, event, acquisition…) is a file whose security is tracked up to the launch decision. Do not confuse it with an **action plan**, which groups actions to carry out: see [Action plans and actions](https://docs.cisapp.eu/en/collaboration/projects). ## Create a project 1. Open **Registers → Projects**, then **New project** (or the menu **+** shortcut). 2. **Identity**: name, type (IT project, Business change, Event, Acquisition, Other), sponsor, progress (Planned, In progress, Delivered, Cancelled), criticality, start date, target launch date and description. Dates can stay **To be defined**. 3. **Context** (optional): **Security reviewer** and **Launch decision maker**, two different people; required deliverables (Security questionnaire, Risk analysis, Architecture review, Vendor assessment, GDPR review). A dismissed deliverable needs a justification. 4. **Access** (optional): choose who can view or edit the record. You remain its administrator. 5. **Summary**, then create the record. ## Read the record | Tab | Content | |---|---| | Overview | Identity, sponsor, dates, security stage, opinion and decision. | | Security | Deliverables, prerequisites and commitments, decision history. | | Applications | Applications delivered or changed by the project. | | Risks and actions | Associated records: risks, exemptions, actions, assessments… | | Access | Authorized people and teams (Read, Edit, Administration). | ## Follow the security stages | Stage | Expected | Action | |---|---|---| | To qualify | Appoint the participants and confirm the required deliverables. | The security reviewer selects **Start review**. | | Under review | Complete the reviewed items, have deliverables reviewed, record the opinion. | The reviewer selects **Give security opinion**: Favorable, Favorable with reservations or Unfavorable. | | To decide | Examine the opinion, prerequisites and residual risks. | The decision maker selects **Decide on launch**: Launch authorized or refused, ticking the explicit acceptance of residual risks. | | Follow-up | Track remaining commitments after launch. | The decision maker or sponsor selects **Close the file**: assessment and operational follow-up owner. | | Closed | Risks and actions still open continue to be tracked. | — | At the **To decide** stage, or after a refusal, the reviewer can **Resume review**. The decision maker or sponsor can **Cancel the project** as long as it is neither closed nor cancelled; the history remains available. ## Review deliverables and prerequisites In the **Security** tab: - For each deliverable, fill in the **Reviewed items and references**, save, then **Mark as reviewed**. - **Add a prerequisite**: a measure to carry out, flagged or not as **Blocking before launch**. A blocking prerequisite must be met or covered by an approved, active exemption linked to the file. - A commitment remaining after launch must be linked to an action of the file, with an owner and due date. After an opinion or decision, editing the record opens a new revision to review. Each opinion, decision, revision, closure or cancellation is kept in the history, with the reviewed scope. ## Associate records and assess The **Applications** and **Risks and actions** tabs offer **Associate a record**, **Add an action**, **Assess** and **Reuse an assessment**, as on an [application](https://docs.cisapp.eu/en/registers/applications). Project assessments are also listed under **Assessments → Project assessments**. See [Assessment types](https://docs.cisapp.eu/en/assessments/types). ## Expected outcome The project carries a traced security opinion and launch decision, with prerequisites met or covered, then it is closed with an operational follow-up owner. ## Common issues - Review action missing: only the appointed security reviewer and decision maker, with the edit right, see the actions of their stage. - Reviewer and decision maker must be appointed before the review starts: complete **Context**, confirm at least one required deliverable and justify each dismissed one. - Same reviewer and decision maker refused: choose two different people. - Opinion refused: mark each required deliverable as reviewed. - Launch cannot be authorized: it needs a **Favorable** or **Favorable with reservations** opinion, blocking prerequisites met or covered, and remaining commitments linked to an action (see [Review deliverables and prerequisites](https://docs.cisapp.eu/en/registers/projects#review-deliverables-and-prerequisites)). - Cancellation refused: give the cancellation reason. - The file was changed while you were typing: reload it or discard your changes before continuing. --- Source: https://docs.cisapp.eu/en/assessments/types Markdown: https://docs.cisapp.eu/en/assessments/types.md # Choose an assessment type Distinguish vendor, application, project, criticality, audit and tender assessments. > **Access:** assessment creation. Subject to enabled modules and your plan. An assessment brings together a scope, one or more questionnaires and the access needed to work on them. ## Which workspace should you use? | Type | Use it to | |---|---| | Vendor assessments | Examine a vendor’s compliance or posture. | | Application assessments | Examine an application from the Applications register. | | Project assessments | Examine a project from the Projects register, for example before its launch decision. | | Activity criticality | Qualify the importance of a business activity. | | Compliance audits | Assess an internal scope and a framework. | | Tenders | Compare vendors using a common questionnaire. | ## Prepare the assessment 1. Identify the subject and the result you need. 2. Check that the subject exists in its register and is accessible to you. 3. Choose a questionnaire suited to the decision. 4. Identify who needs to complete or read responses. 5. Open the relevant type from **Reviews**. ![Vendor-assessment list](https://docs.cisapp.eu/images/en/evaluations.webp) *Each type has its own list and creation wizard. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/evaluations.webp)* ## Permissions and availability Creating assessments requires the corresponding permission. Tenders depend on vendor-comparison activation. **Campaigns** is currently under construction; it does not replace type-specific lists or response links received by email. ## Expected outcome The scope and questionnaire match the selected type. See [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor), [Audits and projects](https://docs.cisapp.eu/en/assessments/audits-projects) or [Compare vendors](https://docs.cisapp.eu/en/assessments/comparison). --- Source: https://docs.cisapp.eu/en/assessments/vendor Markdown: https://docs.cisapp.eu/en/assessments/vendor.md # Assess a vendor Select a vendor, questionnaires and finalize access. > **Access:** assessment creation. Subject to enabled modules and your plan. ## Prerequisites The vendor must be accessible in your register. You need assessment-creation permission and access to the selected questionnaire. ## Create the assessment 1. Open **Reviews → Supplier Evaluations**, then start creation. 2. At **Suppliers**, select the third party. Starting from its record may preselect it. 3. At **Questionnaires**, choose questionnaires relevant to the scope. 4. At **Finalization**, check the summary, name and description. 5. Expand access options if collaborators need to participate. Check each person’s permission before inviting them. 6. Confirm creation. ![Selecting an assessment questionnaire](https://docs.cisapp.eu/images/en/evaluation-questionnaires.webp) *Choose a questionnaire matching what you need to check about the vendor. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/evaluation-questionnaires.webp)* ![Finalizing a vendor assessment](https://docs.cisapp.eu/images/en/evaluation-finalize.webp) *The summary lets you check the scope and access before creation. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/evaluation-finalize.webp)* ## Recurrence A monitoring cadence may be offered when a vendor assessment is attached to an activity. This option does not appear in every workflow. ## After creation Open the assessment to find its questionnaires and responses. Share the right access with the respondent. Attaching a questionnaire and inviting a respondent are separate things to check. ## If you are blocked - Missing vendor: check permissions and selector filters. - Missing questionnaire: check its destination and your access. - Confirmation unavailable: complete required fields and earlier steps. - Invitation not received: check the address and invitation status before resending. ## Expected outcome The assessment appears in the list and its record shows the selected vendor and questionnaires. Sending it to a respondent remains a separate action to check. --- Source: https://docs.cisapp.eu/en/assessments/audits-projects Markdown: https://docs.cisapp.eu/en/assessments/audits-projects.md # Audits, applications, projects and activity criticality Match the scope and questionnaire to the assessed subject. > **Access:** assessment creation. Subject to enabled modules and your plan. ## Choose the scope These workflows are available from their lists under **Reviews**. You need assessment-creation permission and access to the relevant subjects and questionnaires. ### Application or project assessment 1. Open **Application assessments** or **Project assessments**, then start creation. From an application or project record, **Assess** opens the same wizard with the subject already chosen. 2. Select the application or project to examine (step hidden if the subject is already chosen). 3. **Information**, then **Questionnaires**. 4. **Reviewers** (optional): appoint the people or teams who will validate completed questionnaires. Entity administrators can also review them; with no appointed reviewer, only they can. 5. **Collaborators**: check access before finishing. The subject must exist under **Registers → Applications** or **Registers → Projects**. The assessment details show the **Assessed item** with a **View record** link. See [Applications](https://docs.cisapp.eu/en/registers/applications) and [Projects and launch decision](https://docs.cisapp.eu/en/registers/projects). These screens may still show French or untranslated labels in the English interface. ### Activity criticality Open **Business Criticality** and choose the business activity. Use a questionnaire designed for criticality, then check information and access. This assessment qualifies an activity; it does not replace a vendor security assessment. ### Compliance audit Open **Compliance Audits**. Define the context, choose the offered framework and useful questionnaires, then assign access before confirming. Prepare the evidence needed to support responses. ## Review results Open the created assessment from its list. Check that questionnaires, subject and authorized people match the agreed scope. See [Read results](https://docs.cisapp.eu/en/assessments/results). ## Common difficulties A missing subject needs to be created or shared in its register. A questionnaire intended for another purpose may not be offered. If you cannot create an assessment, check creation permission with your administrator. --- Source: https://docs.cisapp.eu/en/assessments/comparison Markdown: https://docs.cisapp.eu/en/assessments/comparison.md # Compare vendors Prepare a tender with multiple vendors and a shared assessment basis. > **Access:** assessment creation. Subject to enabled modules and your plan. ## Goal and prerequisites Use **Vendor Comparisons** to examine vendors within a common assessment basis. Comparison must be enabled for your organization. You need access to the vendors and assessment-creation permission. ## Prepare a comparison 1. Define the business need and decision criteria before contacting vendors. 2. Open **Reviews → Vendor Comparisons** and start creation. 3. Select the vendors to compare. 4. Choose common questionnaires and complete the requested details. 5. Check permissions and confirm. ## Use the comparison Open the tender details to review its assessments. Compare responses using equivalent scopes. A missing response and a negative response need different interpretations. Consider the score alongside business criticality, evidence and assessment date. Document open points before making a decision. ## Expected outcome You have a shared basis for reviewing each vendor’s responses. If a vendor is missing, check your access and its existence in the register. If the workspace is hidden, see [Feature availability](https://docs.cisapp.eu/en/help/availability). --- Source: https://docs.cisapp.eu/en/assessments/questionnaires Markdown: https://docs.cisapp.eu/en/assessments/questionnaires.md # Manage questionnaires Choose a template, create a questionnaire and organize questions. > **Access:** member, questionnaire creation. Subject to enabled modules and your plan. A questionnaire is a reusable question structure. Responses completed in an assessment belong to a response questionnaire, distinct from the template. ## Find a questionnaire Open **Reviews → Questionnaires**. Search for a title and open its details to check content, purpose and sections before use. ![Questionnaire library](https://docs.cisapp.eu/images/en/questionnaires.webp) *Check the questionnaire’s purpose before attaching it to an assessment. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/questionnaires.webp)* ## Create a questionnaire 1. Select the creation action. Questionnaire-creation permission is required. 2. Enter general information and the offered destination. 3. Create the questionnaire and open its editor. 4. Organize sections and add questions using suitable response types. 5. Review wording, answer choices and required fields before use. Details and the editor serve different purposes: use details to read and the editor to change the structure. ## Edit the structure In the editor, the center column shows the tree of sections and questions, and the right column shows the properties of the selected item. - **Add**: hover the gap between two questions and click **+** to insert a question there, or use **Add a question** at the bottom of a section. The new question is selected and its wording is ready to type. - **Delete**: deletion is immediate, with no confirmation. A message appears for a few seconds with an **Undo** action to bring the item back (with its subsections and questions for a section). After that delay the deletion is final. - **Reorder**: drag and drop a question or section in the tree. Changes are saved automatically. ## Add a maturity scale The **Maturity scale (%)** question type asks the respondent to place their level on a scale you define. The percentage of the chosen level becomes the answer score. > **Language:** this editor is not yet translated into English. Labels below translate the French interface. 1. Add a question of type **Maturity scale (%)**. It is created with the **0 – 100 % preset**: Non-compliant (0 %), Initial (25 %), Defined (50 %), Managed (75 %), Optimized (100 %). 2. For each level, enter the **Level (%)**, the **Label** and, if needed, a **Description** of what the level means in practice. 3. **Add a level** or **Remove the level** to match your grid; **0 – 100 % preset** restores the default levels. 4. Tick or untick **Justification required** (ticked by default): the respondent must then explain the chosen level. 5. Check the rendering in the **Respondent preview**. A scale has 2 to 11 levels. Each level is an integer between 0 and 100, used only once, with a label. ## Editor keyboard shortcuts Shortcuts work when no input field is active. Press **?** (or click the keyboard icon at the top of the page) to show the cheat sheet in the editor. | Shortcut | Action | | --- | --- | | **J** or **↓** | Next item | | **K** or **↑** | Previous item | | **Enter** or **E** | Edit the selected item’s properties | | **Esc** | Leave the current field, then clear the selection | | **C** | New question after the selected item (or at the end of the section) | | **S** | New section | | **Shift + S** | New subsection of the selected section | | **Delete** or **⌫** | Delete the selected item | | **⌘ Z** / **Ctrl Z** | Undo the last deletion while the message is still shown | | **?** | Show the shortcuts | ## Good practices Ask one thing per question. Explain the evidence expected in the wording. Use the same questionnaire version across vendors when comparing them. ## Common difficulties - Creation unavailable: check questionnaire-creation permission. - Missing questionnaire in an assessment: check purpose and access. - Unclear question: improve the template for future use and clarify the context with affected respondents. ## Expected outcome The questionnaire contains the intended sections and questions and can be found in pickers matching its purpose. --- Source: https://docs.cisapp.eu/en/assessments/responses Markdown: https://docs.cisapp.eu/en/assessments/responses.md # Complete and submit responses Open the right questionnaire, complete sections and check before submission. > **Access:** respondent, member. Subject to enabled modules and your plan. ## Access responses Open the assessment or questionnaire link shared with you. Sign in with the account matching the invitation. Access to a library template does not by itself grant access to an assessment’s responses. ## Answer 1. Check the title, vendor or subject and assessment scope. 2. Use the section outline to move through the questionnaire. 3. Enter answers and useful comments. 4. Add evidence when a question supports or requests it. 5. Check the displayed save state before leaving the page. 6. Review required questions, then use submission when offered. ![Response questionnaire within an assessment](https://docs.cisapp.eu/images/en/assessment.webp) *Sections and progress help locate questions that still need attention. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/assessment.webp)* ## Answer "Not applicable" When the question allows it, tick **Not applicable** next to the answer and, if needed, fill in the **Justification** (optional). On the client side, a "not applicable" answer is **approved** (**Approve not applicable**) or **challenged** (**Challenge not applicable**); the respondent then sees the notice "The client challenges the not-applicable status of this question" and can correct it. ## Answer a maturity scale For a **Maturity scale** question, choose a level under "Select your current level". If the scale requires it, fill in the **Justification**: "A justification is required for this level." is shown until it is provided. **Not applicable** remains possible if the question allows it. On the client side, the reviewer can **Adjust the score**: they choose another level or enter a **Free value (%)**. The gap stays visible as "Declared X % → validated Y %". > **Language:** these labels are not yet translated into English; they translate the French interface. ## Distribute questions among colleagues An authorized assessment owner can assign sections or questions: 1. In a section or question header, open assignment (**Assign this section** / **Assign this question**). 2. Pick an **Owner** and **Contributors**, and optionally add a message. Typing an email address **invites** someone not yet registered (unless the vendor manages its own users: only its members can then be assigned). 3. A question inherits its section's assignment; changing it creates an assignment specific to that question. 4. The **Distribution** button opens the overview: progress per person ("x / y answered"), questions without an owner, answers to fix, **Remind** (one reminder per person per day) and assignment/reminder **History**. 5. Filter questions with **All**, **My questions** or **Unassigned**. Assignees see a "You have N questions to address" banner and find their questions under **To be addressed**. On submission, a warning lists assigned questions still unanswered. Assignments can no longer be changed once the assessment is closed. ## After submission Status and available actions can change. Check the displayed state before considering the questionnaire delivered. To correct a locked response, contact the assessment owner. ## Common difficulties - Inaccessible questionnaire: check your account email and invitation. - Missing required answer: review all sections, including those not yet opened. - Missing evidence: check that the reviewers can access the document. - Cannot assign: you need the assign right on this assessment; too many recent email invitations also block sending. - Missing button: your access may be read-only or the current status may prevent edits. For a guided journey, see [Answer a received questionnaire](https://docs.cisapp.eu/en/guides/respond-questionnaire). ## Expected outcome Responses are saved in the correct questionnaire. The displayed status indicates whether additional finalization is necessary. ## Answer on behalf of the vendor When managing an assessment on the client side, input fields may be disabled. If you need to enter an answer for the vendor, select **Answering for the supplier** when offered. Distinguish these answers from information confirmed directly by the vendor. --- Source: https://docs.cisapp.eu/en/assessments/results Markdown: https://docs.cisapp.eu/en/assessments/results.md # Read assessment results Interpret progress, responses, scores and evidence. > **Access:** member. Subject to enabled modules and your plan. ## Open results Open the assessment from its type-specific list. Review associated questionnaires, their progress and status. Open a questionnaire to examine responses and evidence. ## Review effectively 1. Check the scope, subject and assessment date. 2. Check whether expected responses are complete. 3. Review comments and supporting documents. 4. Compare scores with detailed responses: a summary score does not replace reviewing critical points. 5. Identify items requiring action and use the appropriate follow-up: risk, control or action plan. ## Export or print When printing is available on the response questionnaire, open the dedicated view and use browser printing to create a PDF. Check content and scope before sharing it. ## Gap analysis The **Variance Analysis** workspace lets you explore assessments and gaps exposed by the interface. Check the framework and items available for the assessment concerned. Incomplete results should not be treated as established compliance. ## Expected outcome You know which items are adequately supported and which require action. Continue with [Treat a risk](https://docs.cisapp.eu/en/guides/treat-risk) or [Action plans and actions](https://docs.cisapp.eu/en/collaboration/projects). --- Source: https://docs.cisapp.eu/en/assessments/excel-import Markdown: https://docs.cisapp.eu/en/assessments/excel-import.md # Import an Excel questionnaire Analyze a workbook, review its structure and publish the questionnaire. > **Access:** member. Subject to enabled modules and your plan. ## Prerequisites Excel questionnaire import must be enabled for your plan. Prepare a workbook with identifiable questions and answers, and retain the original file. ## Import and review 1. Open **Reviews → Excel questionnaires** and start an import. 2. Select the workbook and complete the requested information. 3. Wait for analysis to finish. Processing can continue while you visit another page. 4. Open the import to review sheets, sections and recognized elements. 5. Correct cell roles and proposed mappings where needed. Review analysis findings before publication. 6. Use publication to open the questionnaire in the response editor. ![Excel questionnaire import list](https://docs.cisapp.eu/images/en/excel-imports.webp) *Import status distinguishes workbook analysis from opening the questionnaire. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/excel-imports.webp)* ## Human review Assisted analysis does not remove the need to check imported questions, choices and responses. Merged cells, multiple sheets and ambiguous headers need particular attention. ## Failure or empty structure If import fails, read the displayed message and use **Retry** when offered. If no usable structure is found, check the source workbook before trying again. Avoid creating identical imports while processing is still running. ## Expected outcome The published questionnaire matches the reviewed workbook and can be completed in CISAPP. Then check its responses like any other [response questionnaire](https://docs.cisapp.eu/en/assessments/responses). --- Source: https://docs.cisapp.eu/en/assessments/vendor-workspace Markdown: https://docs.cisapp.eu/en/assessments/vendor-workspace.md # Respond as a vendor Find client assessments and distinguish the client register from My exposure. > **Access:** member. Subject to enabled modules and your plan. ## Prerequisites Your organization must be known as a vendor to at least one CISAPP client. You need access to the assessment or questionnaire shared by that client. ## Find client requests 1. Open **Customer Reviews** when this entry is offered in your menu. 2. Select the relevant assessment, then the questionnaire to complete. 3. Review the requested scope before answering. 4. Follow [Respond to a questionnaire](https://docs.cisapp.eu/en/guides/respond-questionnaire) for saving and finalizing. The **Clients** register, when accessible, lists known client organizations and supports opening a record and exporting the list as CSV. The register does not create a commercial relationship on its own. ## Respondent-only account A user invited only to respond sees a reduced menu: **Assessments → To be addressed**, My exposure and Profile. The **To be addressed** page lists their assessments (questionnaires, progress, Not started / In progress / Completed status, **Respond** button) and, at the top, **My questions to address** when questions are assigned to them. The former portal addresses (`/portal`) are no longer used; use the menu or the link received by email. ## Expected outcome Your response is associated with the correct client request. Check each client’s permissions before attaching supporting documents. ## Common difficulties - Missing menu: the organization may not be identified as a vendor, or you may lack access. - Missing request: use the received link and ask the sender to check sharing. - Distinguish the Clients register from **My Exhibition → My clients**, which is currently under construction. --- Source: https://docs.cisapp.eu/en/risks/register Markdown: https://docs.cisapp.eu/en/risks/register.md # Identify and assess a risk Create a scenario, link the scope and assess the risk level. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Prerequisites The register must be enabled for your organization. Prepare the scenario, affected entities and the methodology selected in organization settings. ## Create a risk 1. Open **Registers → Risks**, then **New risk**. 2. At **Context**, enter a title, description and category. 3. At **Scope**, link the offered entities: vendor, activity, asset or team. 4. Describe the scenario, threat and vulnerability in the offered fields. 5. Assess likelihood and impact using your organization’s methodology. 6. Add an owner and treatment deadline if known, then finish. ![Context for a new risk](https://docs.cisapp.eu/images/en/risk-create.webp) *Describe a concrete scenario before assigning a level. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/risk-create.webp)* ## Read the register Search for a title and combine **Status**, **Criticality** and **Entity** filters. The **Risk matrix** represents levels by likelihood and impact. Inherent risk describes risk before treatment; residual risk describes what remains after treatment. ![Risk register and indicators](https://docs.cisapp.eu/images/en/risks.webp) *Filters help prepare a review of priority risks. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/risks.webp)* ## Expected outcome The risk appears in the register with an understandable scenario. Check its status: if creation succeeded but assessment failed, open the existing risk to complete its assessment rather than creating a duplicate. Continue with [Track treatment](https://docs.cisapp.eu/en/risks/treatment). --- Source: https://docs.cisapp.eu/en/risks/treatment Markdown: https://docs.cisapp.eu/en/risks/treatment.md # Track risk treatment Choose a strategy, track controls and review residual risk. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Open the risk Open the risk from **Registers → Risks**. Check its scenario, scope, owner and assessment before deciding treatment. ## Organize treatment 1. Choose an offered strategy: reduce, accept, transfer or avoid the risk. 2. Record the decision and treatment deadline. 3. Add the necessary controls. A control can link to a compliance requirement or be described specifically for the risk. 4. Assign an owner and deadline where offered. 5. Update control status as work progresses: planned, in progress, implemented, verified or not applicable. 6. Reassess residual risk based on controls actually implemented. ## Understand statuses A risk can be draft, identified, assessed, treated, accepted, closed or needing review. Use available record actions to move through its lifecycle. A control marked implemented is not necessarily verified yet. ## Expected outcome An authorized person can find the decision, planned actions and information supporting the residual level. Status should reflect the actual situation. ## Points to watch Do not lower residual risk solely because an action is planned. Check implementation evidence. If an action is unavailable, check permissions and the current risk status. See also [The treatment journey](https://docs.cisapp.eu/en/guides/treat-risk) and [Exemptions](https://docs.cisapp.eu/en/risks/exemptions). --- Source: https://docs.cisapp.eu/en/risks/incidents Markdown: https://docs.cisapp.eu/en/risks/incidents.md # Report and track an incident Qualify an event, track its timeline and manage communication. > **Access:** organization administrator. **Beta** feature, subject to enabled modules and your plan. ## Prerequisites and access Incident management depends on module activation and account permissions. Governance operations on incidents are restricted to organization administrators. ## Report an incident 1. Open **Registers → Incidents**, then **Report an incident**. 2. Complete **Qualification**, **Context** and **Communication**. 3. Describe observed facts and choose the appropriate category and severity. 4. Link the vendor or affected assets when offered. 5. Check recipients and visibility before finishing. ![Reporting an incident](https://docs.cisapp.eu/images/en/incident-create.webp) *Qualification comes before context and communication choices. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/incident-create.webp)* ## Track the incident The register separates **My incidents** and **Incidents reported**. Open the record to update status and review the **Event log**. Distinguish the internal description from the public description, shown to clients only when the incident is propagated. ## Escalation and closure When a crisis cell is active, the record offers a link to it. An incident escalated to a crisis cannot be deleted: close it and retain traceability. See [Crisis management](https://docs.cisapp.eu/en/risks/crisis). ## Expected outcome The register and event log reflect facts, decisions and communications. If another session changed the incident, review the refreshed version before continuing your edits. --- Source: https://docs.cisapp.eu/en/risks/crisis Markdown: https://docs.cisapp.eu/en/risks/crisis.md # Prepare for and manage a crisis Find the crisis guide, emergency contacts and active cells. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Access The crisis workspace is restricted to organization administrators. Use the command palette to open **Crisis management** if it is not directly visible in the menu. ## Prepare the response 1. Open **Crisis**. 2. Review **Guide** to prepare response steps. 3. Check **Emergency contacts** and keep them current. 4. Review **Active cells** to find events already being coordinated. ![Crisis guide and response workspace](https://docs.cisapp.eu/images/en/crisis.webp) *The workspace combines preparation, contacts and active cells. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/crisis.webp)* ## During an event Start from the relevant incident and open its crisis cell when active. Use the workspace to follow coordination and record the information offered. Keep incident status aligned with the situation. ## Expected outcome Authorized participants can find contacts, context and coordination information. The incident record retains its connection to the crisis. ## Common difficulties If the workspace does not open, check your administrator role. If a cell already exists, open it from the incident rather than maintaining a parallel event record. Your organization’s communication obligations still need to be determined by the responsible people. --- Source: https://docs.cisapp.eu/en/risks/exemptions Markdown: https://docs.cisapp.eu/en/risks/exemptions.md # Manage an exemption Define the target, justification, accepted risk and validity period. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Prerequisites Exemptions are available to organization administrators when the module is enabled. Prepare the target, business justification and compensating controls. ## Create an exemption 1. Open **Registers → Exemptions**, then **New exemption**. 2. Choose the target type and affected item. 3. Enter **Title**, **Business rationale** and **Countervailing measure**. 4. Set start and end dates, then the next review if needed. 5. Link an existing risk or describe the accepted risk and severity. A risk target is linked automatically. 6. Check the details and select **New exemption**. ![Exemption form](https://docs.cisapp.eu/images/en/exemptions.webp) *Justification, risk and duration make the decision reviewable. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/exemptions.webp)* ## Track deadlines Combine status, target and deadline filters in the register. Use **Expires within 30 days** to prepare reviews. Open details and review available actions to follow the decision lifecycle. ## Date errors The end must follow the start and respect the maximum duration displayed by the interface. The review date must precede the end date. Correct highlighted fields before confirming. ## Expected outcome The decision is recorded with a target, justification and deadline. An exemption does not prove that the gap has been fixed: keep tracking controls and the associated risk. --- Source: https://docs.cisapp.eu/en/compliance/overview Markdown: https://docs.cisapp.eu/en/compliance/overview.md # Start tracking compliance Create a compliance workspace and read framework coverage. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Create your workspace Open **Compliance → Overview**. If no compliance entity exists, the screen offers **Create My Compliance Portal**. Use this action with an authorized account and follow the displayed flow. ![Compliance tracking overview](https://docs.cisapp.eu/images/en/compliance.webp) *A compliance workspace is needed before tracking requirements and controls. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/compliance.webp)* ## Read the dashboard The overview presents linked frameworks, control coverage and next actions. Use **Resume my tasks** to return to pending work and **Add a repository** to extend the scope when available. 1. Check the frameworks included in your scope. 2. Identify expected controls that are not yet in place. 3. Open **Requirements & Measures** to complete the items. 4. Review next actions and distribute work. 5. Review coverage after updates. ## Interpret coverage The indicator represents the state recorded in CISAPP. It is not, on its own, certification or regulatory validation. A control may contribute to several frameworks; check offered mappings before duplicating its tracking. ## Availability of regulatory workspaces Dedicated **NIS2**, **DORA** and **AI Act** pages are currently under construction. Available requirements and controls tracking in the shared workspace is separate from those dedicated pages. Continue with [Requirements and controls](https://docs.cisapp.eu/en/compliance/requirements-controls). ## Expected outcome The overview reflects the selected frameworks and scope. Missing data and follow-up actions are identified. --- Source: https://docs.cisapp.eu/en/compliance/requirements-controls Markdown: https://docs.cisapp.eu/en/compliance/requirements-controls.md # Track requirements and controls Organize frameworks, update controls and export the SoA. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Prerequisites A compliance workspace must exist and be accessible to your account. Editing actions depend on your permissions. ## Work in the shared workspace 1. Open **Compliance → Requirements & Measures**. 2. Select the framework and scope offered by the interface. 3. Use filters to find requirements or controls needing work. 4. Open an item and check applicability, status and expected information. 5. Complete tracking information and the offered evidence, then save. 6. Return to the overview to review coverage. ![Requirements and controls workspace](https://docs.cisapp.eu/images/en/requirements.webp) *The shared workspace brings together requirements and controls tracking. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/requirements.webp)* ## Requirement, control and evidence A requirement describes what is expected. A control describes what is implemented. Evidence supports the recorded state. Keep these levels consistent: adding a document does not automatically mean a control is implemented. ## Export the SoA Use **Export the SoA** when available. Check the framework, scope and export contents before sharing. An export represents a point in time. ## Common difficulties - No workspace: return to the [overview](https://docs.cisapp.eu/en/compliance/overview) to create one. - Missing item: check filters and the selected framework. - Editing unavailable: request the necessary scope permissions. - Inaccessible evidence: check file permissions separately from access to the requirement. ## Expected outcome The requirement and related controls have up-to-date tracking, with evidence accessible to authorized reviewers. --- Source: https://docs.cisapp.eu/en/compliance/trust-center Markdown: https://docs.cisapp.eu/en/compliance/trust-center.md # Share your Trust Center Prepare a compliance snapshot, choose its visibility and revoke its link. > **Access:** member. Subject to enabled modules and your plan. The Trust Center presents a snapshot of your compliance approach, downloadable or publishable through a public link. ## Prepare sharing 1. Open **Compliance → Trust Center** with the required access. 2. Review **Preview**, the date and included frameworks. 3. Choose **Included frameworks**, **Hide evidence details** and **Validity** options. 4. Use **Download the PDF** to obtain a copy for review. 5. To allow public access, enable **Post publicly**, then use **Copy the link**. ![Preparing the Trust Center](https://docs.cisapp.eu/images/en/trust-center.webp) *Publication options determine what your reader can see. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/trust-center.webp)* ## Check and revoke Open the link in a private window to check what is accessible without signing in. Disable publication to remove public access. If limited validity was selected, check the displayed expiration. ## What your recipient reads They read a snapshot, not necessarily the current state of every control. Check the date and refresh sharing when the content needs updating. ## Common difficulties If no compliance workspace exists, create it from the [overview](https://docs.cisapp.eu/en/compliance/overview). If a link no longer works, check publication and validity. Before sharing, verify the actual content shown in the preview. ## Expected outcome The portal displays only the information and documents you chose to make accessible. Its public link has been reviewed outside your signed-in session. --- Source: https://docs.cisapp.eu/en/compliance/gdpr Markdown: https://docs.cisapp.eu/en/compliance/gdpr.md # Maintain GDPR registers Create a register and describe processing activities, data and transfers. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Create the register 1. Open **Compliance → GDPR**. 2. Start register creation and choose **Type** and **Mode**. 3. Enter the offered contacts, including the DPO and controller contact where relevant. 4. Select **Create register**. If a register of that type already exists, CISAPP may open it instead of creating a duplicate. ![GDPR processing registers](https://docs.cisapp.eu/images/en/gdpr.webp) *The register groups the processing activities described by your organization. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/gdpr.webp)* ## Add a processing activity Create an activity from the register. Complete general information, client information when requested, processed data, recipients and transfers. Review the created record and supporting information or documents. A GDPR processing activity is distinct from a business activity used to track vendor dependencies. ## Keep it up to date Return to an activity when data, purposes, recipients or transfers change. Use register editing actions to maintain contacts and context. ## Expected outcome An authorized reader can understand the processing described and its main participants. The register supports tracking; the people responsible for your GDPR work remain responsible for validating its information. For an event affecting personal data, see [Data breaches](https://docs.cisapp.eu/en/compliance/breaches). --- Source: https://docs.cisapp.eu/en/compliance/breaches Markdown: https://docs.cisapp.eu/en/compliance/breaches.md # Assess a data breach Describe an event and use the severity assessment wizard. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Purpose The breach workspace records events affecting personal data and provides a severity assessment wizard. ## Use the wizard 1. Open breaches from GDPR or from the linked incident record. 2. Start the severity assessment. 3. Complete **Incident details**: context, entity and known facts. 4. At **Data impact**, describe the relevant data and consequences. 5. Complete **Risk factors** using available information. 6. Review **Assessment results** and save the offered tracking information. ## Review and complete Reopen the record when new facts become known. If you edit the assessment, check the updated results. Distinguish confirmed facts from assumptions in descriptions. ## Wizard limitations The result supports analysis; it does not make decisions for your organization’s responsible people. Notification decisions and related actions belong in your event-management process. Do not assume that recording a breach in CISAPP sends an external notification. ## Expected outcome The record retains reviewable context and assessment information consistent with the associated [incident](https://docs.cisapp.eu/en/risks/incidents). --- Source: https://docs.cisapp.eu/en/compliance/documents Markdown: https://docs.cisapp.eu/en/compliance/documents.md # Manage governance documents Use the catalogue, prepare required documents and track your documents. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Browse documents Open **Compliance → Documents**. The workspace separates your documents, documents to produce, the template catalogue and settings available to your account. ![Governance documents and catalogue](https://docs.cisapp.eu/images/en/governance.webp) *The catalogue helps you start a document suited to an identified need. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/governance.webp)* ## Create or import 1. Review required documents or the catalogue to find a suitable template. 2. Start creation and complete the offered information. 3. Open the created document to adapt its content to your organization. 4. Use import if you already have a document to bring into the workspace. 5. Review and save information before sharing. ## Configure the scope Governance settings determine what is proposed to your organization. Changing them requires appropriate administrative access. Check the effects before applying a change. ## Expected outcome Your organization’s documents reflect its context rather than an unadapted template. A governance document and assessment evidence may be related in your process, but their permissions and tracking still need separate checks. ## Common difficulties If a template is missing, check filters, language and scope. If editing is unavailable, check access. To share files, see [Files and classification](https://docs.cisapp.eu/en/collaboration/files). --- Source: https://docs.cisapp.eu/en/reporting/dashboard Markdown: https://docs.cisapp.eu/en/reporting/dashboard.md # Read and build dashboards Read Home, create a dashboard from a template, add widgets, share it and organize the Steering menu. > **Access:** member to view; organization administrator (or client entity administrator) to organize the menu and choose Home. The dashboards module depends on your plan. > > **Language:** the dashboard screens are not yet translated into English. Labels below translate the French interface. ## Open Home Select **Home**. The organization chooses which dashboard appears here for all its members. If no Home is set, the **Overview** template (critical vendors, open risks, expiring exemptions, assessment coverage) is shown. If no dashboard is available, the page offers to create your own or, for an administrator, to choose the organization's Home. ![Overview dashboard](https://docs.cisapp.eu/images/en/dashboard.webp) *Read figures alongside their scope and the data actually recorded. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/dashboard.webp)* On a dashboard, the **period and refresh** controls let you set the chart period, refresh all widgets or enable automatic refresh. Each widget also offers, depending on its type, **Full screen**, **View as table**, **Export as CSV** or **as image (PNG)**, and a **View details** link to the relevant register. ## Find your dashboards The **Steering** menu lists the dashboards pinned by the organization and your favorites. **All dashboards** opens the full list, with four tabs: | Tab | Content | |---|---| | My dashboards | The ones you created. | | Shared with me | Those a colleague gave you access to. | | Organization | Organization dashboards, visible to all members. | | Templates | Ready-made CISAPP dashboards, read-only. | Use search to filter and the star to add or remove a favorite (favorites are sorted first). ## Create a dashboard 1. In the list, select **New dashboard**. 2. **Starting point**: choose a blank dashboard or a template (Overview, Vendors, Risks, Compliance, Assessments, Action plan tracking (all plans), Action plan tracking (one plan), SecOps, GDPR, Third-party risk committee). 3. **Information**: name, description and icon. 4. **Access and sharing**: you are the owner; add colleagues or teams with read or edit rights, as for other items. 5. **Summary**, then create. A warning appears if some shares failed: retry from **Share**. An interrupted creation draft can be restored when you reopen the wizard. ## Add and arrange widgets On a dashboard you can edit, select **Customize** (or **Add a widget** if it is empty). The gallery has two tabs: - **Ready to use**: preconfigured indicators grouped by category (vendors, risks, compliance, incidents, etc.). Use the indicator search or **Expand all** / **Collapse all**. An indicator missing from your plan shows a lock ("Not included in your plan"). - **Create from scratch**: choose a visualization type (key figure, ratio, line, bars, donut, list, matrix, text, section, news, network graph, cartography), then configure its data. Drag a widget onto the dashboard, or click it to add it. A dashboard holds at most 40 widgets. - **Configure** opens the widget editor: visualization, queries, formulas, filters, target and thresholds. See [Configure a widget](https://docs.cisapp.eu/en/reporting/widgets). - Move and resize widgets with the mouse, or the keyboard (arrows; Shift + arrows to resize). Layout can only be edited on screens at least 1024 px wide. - **Duplicate** and **Delete** are available on each widget in customization mode. - **Undo/Redo**, then **Save**. If someone else saved the dashboard while you were editing, choose **Reload** or **Overwrite**. Unsaved changes can be restored when you return. - **Missing an indicator?** **Request a widget** sends your need (title, need, desired visualization) to the CISAPP team, who reply by email. Requests are limited per hour. ## Share, duplicate, publish In a dashboard's actions menu: - **Share**: gives members or teams access (read/edit rights). - **Duplicate**: creates a personal copy. A template or read-only dashboard is customized this way (**Duplicate to customize**). - **Propose to the organization**: creates a draft copy for the organization. - **Publish** / **Back to draft** (administrator): an organization draft is hidden from members, the Steering menu and Home. - **Set as organization Home** (administrator): members land on this dashboard. - **Delete**: permanent; owner only. ## Organize the Steering menu (administrator) Two entry points lead to the same settings: - In the list, **Organize menu**: drag dashboards into **Pinned** (maximum 20) and reorder them; choose the **Home**. - **My company → Dashboards**: the **Home** section chooses the **Home dashboard**; the **Steering menu** section lists pinned dashboards in order, with **Manage menu**. Only published organization dashboards can be used as Home; when none is chosen, members see **Overview (CISAPP template)**. The Home dashboard is always pinned; unpinning it removes it as Home. An organization draft cannot be pinned: publish it first. Pinning a personal dashboard **transfers it to the organization** (visible to all, editable by administrators, personal shares removed) after confirmation. ## Prepare a review 1. Check the update time and period. 2. Open priority items from lists and **View details** links. 3. Examine their details before deciding an action. 4. Complete missing data in the relevant registers. ## Current limitations Widgets reflect data from enabled modules. An empty value or dash may indicate unavailable data rather than zero. Evolution over time of a key figure or ratio is only available after enabling **Track history**, with no backfill (see [Set a target and thresholds](https://docs.cisapp.eu/en/reporting/widgets#set-a-target-and-thresholds)). See also [Configure a widget](https://docs.cisapp.eu/en/reporting/widgets), [Query language](https://docs.cisapp.eu/en/reporting/query-language) and [Prepare a risk committee](https://docs.cisapp.eu/en/guides/risk-committee). ## Expected outcome You open Home, find or create the suitable dashboard, and review indicators with their scope before opening the corresponding registers. --- Source: https://docs.cisapp.eu/en/reporting/dependencies Markdown: https://docs.cisapp.eu/en/reporting/dependencies.md # Explore the dependency map Connect activities and vendors to understand failure impacts. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Prepare the data The map uses activities and their vendor relationships. Create business activities and link supporting vendors first. Without relationships, the map can be empty even when vendors exist in the register. ## Explore the map 1. Open **Steering → Map of outbuildings**. 2. Find activities and the subjects they depend on. 3. Use the offered filters and presentation options. 4. Open accessible details to examine important relationships. 5. Consider this alongside criticality and identified risks. ![Dependency map connecting activities and vendors](https://docs.cisapp.eu/images/en/dependencies.webp) *A relationship missing from the registers cannot be inferred by the map. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/dependencies.webp)* ## Expected outcome You can identify activities affected by vendor unavailability and prepare questions for review. ## Empty or incomplete map Check relationships in activity records, filters and permissions. An isolated vendor may indicate a missing link; it is not proof that the vendor has no business impact. To find shared dependencies, see [Concentration](https://docs.cisapp.eu/en/reporting/concentration). --- Source: https://docs.cisapp.eu/en/reporting/concentration Markdown: https://docs.cisapp.eu/en/reporting/concentration.md # Read dependency concentration Identify shared vendors and exposed activities. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Purpose Concentration helps examine dependencies shared by multiple activities. It complements the map without replacing review of source data. ## Perform the review 1. Open **Steering → Concentration view**. 2. Check the offered scope and filters. 3. Find vendors and subjects used by multiple activities. 4. Open linked items to understand criticality and documented fallback options. 5. Identify dependencies to discuss with business owners. ![Dependency concentration view](https://docs.cisapp.eu/images/en/concentration.webp) *The view depends on relationships recorded in activities. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/concentration.webp)* ## Interpret results High concentration is a signal to investigate, not an automatic decision. Check actual alternatives, replacement constraints and risks already tracked. An activity without recorded links should not be treated as dependency-free. ## Expected outcome You have a list of dependencies and affected activities to examine in committee. Record decisions in [risks](https://docs.cisapp.eu/en/risks/register) or [projects](https://docs.cisapp.eu/en/collaboration/projects). If the view seems inconsistent, start by checking the [dependency map](https://docs.cisapp.eu/en/reporting/dependencies) and activity records. --- Source: https://docs.cisapp.eu/en/reporting/news Markdown: https://docs.cisapp.eu/en/reporting/news.md # Organize GRC monitoring Monitoring brings together news from sources enabled for your organization. > **Access:** members with module access; **beta** functionality subject to the plan and enabled features. ## Read news 1. From **Dashboard**, open the news section’s link to the full list. 2. Filter by category or source to focus on useful topics. 3. Open an article to read its original publication in a new tab. 4. Use pagination when the feed contains more than one page. ![GRC news list](https://docs.cisapp.eu/images/en/news.webp) *Filters focus the feed on relevant sources and categories. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/news.webp)* ## Manage sources Open **Manage My Sources**. The catalog groups sources by category; switches determine which sources your organization uses. Changes may therefore affect other members’ monitoring feeds. To add a feed, use the custom-feed action, enter a name and a public HTTPS RSS URL, then confirm. Private addresses are not accepted; respect the feed limit shown by the interface. Check the necessary permissions before modifying or deleting a source. ## Expected outcome News comes from the intended sources and can be filtered by topic. A news article provides context; it does not automatically update your requirements or risk register. ## Common difficulties For an empty list, clear filters and check enabled sources. If a feed is rejected, verify that it is public, uses HTTPS and provides the expected RSS format. A lack of recent articles may also originate from the source itself. --- Source: https://docs.cisapp.eu/en/reporting/widgets Markdown: https://docs.cisapp.eu/en/reporting/widgets.md # Configure a widget Choose a widget's visualization, describe its data with queries and filters, combine them with formulas and set a target. > **Access:** edit right on the dashboard. A template or read-only dashboard is edited after **Duplicate to customize**. The dashboards module and some indicators depend on your plan. > > **Language:** the widget editor is not yet translated into English. Labels below translate the French interface; formulas and query code are identical in both languages. ## Open the editor 1. On the dashboard, select **Customize**. 2. Add a widget from the gallery, or open an existing widget's menu and choose **Configure**. 3. The editor opens in a side panel. **Expand editor** gives it the full screen width. The panel holds the **Title**, a **Preview**, then the **Visualization**, **Data** and **Display** sections. **Apply** carries the settings over to the dashboard; then **Save** the dashboard. The preview updates as you type. While the configuration is incomplete, it says the preview will appear once the configuration is complete, or shows the last valid configuration. **Pin preview** keeps it visible while you scroll through the settings. ## Choose the visualization | Visualization | Use | Expected data | |---|---|---| | Key figure | One highlighted value. | A single value. | | Ratio | A percentage with a progress bar or ring. | A part and a total. | | Line | Change over time. | A grouping by date; up to 12 series. | | Bars | Comparison between categories or periods. | A grouping; up to 12 series. | | Donut | A breakdown. | A grouping by category. | | List | Items with a link to their details. | Columns (maximum 8). | | Matrix | A grid crossing two dimensions, colored by volume. | A grouping and a **Split by** field. | | Network graph | Links between vendors, assets or risks. | A network-type source. | | Text | Instructions, context, links. | None: Markdown content (headings, lists, links, bold). | | Section | A heading that splits the dashboard into parts. | None: title and optional **Subtitle**. | | News | Latest cyber news. | None: **Sources**, **Categories** and **Number of articles**. | | Cartography | A mini-map of your vendors and their dependencies. | None. | Changing the visualization adapts the existing queries when possible. If the data does not fit the new type, a message at the bottom of the panel explains why, for example that this widget type needs a grouping and a **Split by** field. ## Describe the data with queries The **Data** section contains one or more queries. Each query has a name (**a**, **b**…) that the displayed value and formulas reuse. 1. In **Source**, choose a ready-to-use indicator (**Indicators** group) or a data family (**Data** group: vendors, risks, treatment measures, incidents, controls, evidence, exemptions, assessments, assets, vulnerabilities, applications, activities, GDPR processing activities, connectors, action plans, tasks). 2. Add filters (see below). 3. For a line, bars or donut, choose **Group by**. For a date, choose the period: day, week, month, quarter or year. 4. For a list, choose the **Columns** (maximum 8). 5. Open **Advanced options** if needed: **Calculate** (Count, Distinct values, Sum, Average, Median, Minimum, Maximum, Share), **On field**, **Split by**, **Period** and **Date used**, **Sort by** and **Maximum number of rows** (maximum 200). 6. The **Label** field renames the series in the legend. The **Action plans** selector limits the data to the chosen action plans, for sources attached to them. On each query row, you can **Hide** or **Show** the query (it is still computed and usable by formulas), **Duplicate** it, **Delete** it or collapse it. The **Form / Code** toggle lets you write the query as text; see [Query language](https://docs.cisapp.eu/en/reporting/query-language). The **Query** button adds a query, copied from the last data query: changing one filter is often enough. A widget holds at most 6 queries. ## Filter the data 1. Select **Add a filter**, then choose a field, a condition and a value. 2. To combine conditions, select **Add a group** and choose its mode: **All**, **At least one** or **None**. Conditions available depending on the field: equals, differs from, greater than, greater than or equal, less than, less than or equal, contains, is one of, is not one of, contains all, is between, is empty, is filled in. Dynamic values: - **Me (signed-in user)** and **My teams**: each reader sees their own figures. - Relative dates: Today, 7, 30 or 90 days ago, One year ago, In 7 or 30 days, Start of the week, month, quarter or year, or **Exact date**. An incomplete filter is not applied; it is flagged as not yet taken into account in the preview: complete or delete it. A query holds at most 20 conditions and 4 levels of groups. ## Choose the displayed value At the top of the **Data** section, a block states what the widget displays. It depends on the visualization. **Key figure, donut, matrix, network graph: Displayed value.** Enter an expression: `a` by default, the first query. Click query chips to insert them, for example `a - b`. The block summarizes what is displayed. **Ratio: Part and total.** The widget displays part / total as a percentage. - **Part**: the counted query, with its **Part filters**. - **Total**: by default, the same source without the part filters. You can also choose another query, a formula or **New source…**. Example: share of critical vendors whose assessment is up to date, out of all critical vendors. **Line, bars, list: Displayed series.** Each visible query is a series. **Combine series** replaces the series with a **Combined expression** (`pct(a, b)` by default). **Show series separately** returns to the series. A line or bar chart shows at most 12 series. ## Combine with formulas The **Formula** button adds a named intermediate value, for example `d = max(a, b)`. The displayed value and later formulas can reuse it. - Operators: `+`, `-`, `*`, `/` and parentheses. - The **?** button lists the available functions. While typing, browse suggestions with ↑ ↓; **Enter** or **Tab** inserts, **Esc** closes. - A formula only reads queries and formulas declared before it. - A widget holds at most 4 formulas, each up to 200 characters and 8 levels of nesting. | Function | Result | |---|---| | `abs(x)` | Absolute value. | | `round(x, digits)` | Rounded to `digits` decimals (0 by default). | | `floor(x)`, `ceil(x)` | Rounded down or up to an integer. | | `sqrt(x)` | Square root (empty if negative). | | `pow(x, n)` | x to the power n. | | `min(…)`, `max(…)` | Smallest or largest value. | | `sum(…)`, `avg(…)` | Sum or average, empty values ignored. | | `clamp(x, low, high)` | Keeps x between low and high. | | `coalesce(…)` | First non-empty value (fallback value). | | `pct(part, whole)` | Percentage: part / whole × 100. | Examples: - `pct(a, b)`: share of **a** in **b**, as a percentage. - `a - b`: gap between two queries, for example open risks minus treated risks. - `coalesce(a, 0)`: shows 0 instead of an empty value. Series are aligned by period and breakdowns by category. A division by zero or a missing value gives an empty value, except for `coalesce`, `min`, `max`, `sum` and `avg`, which ignore empty values. Deleting a query used by a formula shows a warning: fix the formula concerned. ## Set a target and thresholds For a key figure or ratio, the **Display** section offers **Target and thresholds**: - **Target** (or **Target (%)**): shown next to the value; once reached, the value turns green. - **Threshold reached** and **Warning threshold**: green above the reached threshold, orange above the warning threshold, red otherwise. If the reached threshold is lower than the warning threshold, a low value is better. - **Track history**: records the value every day. The line starts when tracking is enabled: nothing is backfilled. For a ratio, **Display** also lets you choose **Bar** or **Ring**. Once history is enabled, **Show evolution** in the widget menu adds a line of the recorded value. Only its title can be edited; the query is changed on the original widget. ## Expected outcome The widget shows the intended value, percentage or series, the preview matches the result, and the dashboard is saved. ## Common issues - **Apply** stays greyed out: read the messages at the bottom of the panel, for example add a query or make one visible, or 6 queries maximum. - Outputs do not have the same shape: combined queries must use the same grouping. - A query is split by a second field: remove **Split by** from that query to use it in a formula. - A query returns a list or graph: a list or graph cannot be used in a formula. - No query or formula is called **d**: declare formula **d** before the one using it, or fix the name. - **Track history** missing: history only applies to a single data query, with no formula, and without the **Me** or **My teams** values. - Value differs from another widget: the dashboard period may override the widget's own period. A failing query is flagged in the widget frame. See also [Read and build dashboards](https://docs.cisapp.eu/en/reporting/dashboard) and [Query language](https://docs.cisapp.eu/en/reporting/query-language). --- Source: https://docs.cisapp.eu/en/reporting/query-language Markdown: https://docs.cisapp.eu/en/reporting/query-language.md # Widget query language Reference for the text syntax describing a widget's data: measures, conditions, grouping, period, sorting and functions. > **Access:** edit right on the dashboard. See [Configure a widget](https://docs.cisapp.eu/en/reporting/widgets) for the editor. The editor labels are not yet translated into English; the query syntax is the same in every language. ## Write a query as text 1. In the widget editor, find the query row (**a**, **b**…). 2. Switch from **Form** to **Code**. 3. Type the query. The editor offers **Suggestions** (measures, data, clauses, fields, values) and flags errors with their position. The text describes the whole query and is equivalent to the form: you can switch between them without losing anything. The query is applied as soon as it is valid. The **Action plans** selector is only set in the form. ``` count(ticket) where status IN (TODO, BLOCKED) by priority split assignee ``` ## Structure A query starts with `measure(data)`, followed by clauses, in any order and each at most once. | Clause | Meaning | Example | |---|---|---| | `where …` | Conditions on the counted items. | `where status != DONE` | | `of …` | With `percent`: share of items matching the condition. | `percent(riskMeasure) of status = VERIFIED` | | `by field` | Group. For a date: `by field:day`, `week`, `month`, `quarter` or `year`. | `by createdAt:month` | | `split field` | Split by a second field. | `split assignee` | | `columns a, b` | With `list`: list columns (maximum 8). | `columns title, owner` | | `during …` | Period: `last7d`, `last30d`, `last90d`, `last12m`, `ytd`, `all`, or `"2026-01-01" to "2026-03-31"`. | `during last12m` | | `on field` | Date field the period applies to. | `on dueDate` | | `sort …` | Sorting: `value` or `key` for a grouping, a field for a list, then `asc` or `desc`. | `sort value desc` | | `limit n` | Maximum number of rows or groups (maximum 200). | `limit 10` | ## Measures | Measure | Meaning | |---|---| | `count(ticket)` | Number of items. | | `sum`, `avg`, `min`, `max`, `median` | Calculation on a numeric field: `avg(vendor.criticality)`. | | `distinctCount(ticket.assignee)` | Number of distinct values. | | `percent(ticket)` | Percentage, with the `of` clause. | | `list(ticket)` | List of items, with the `columns` clause. | ## Data | Code | Data | |---|---| | `vendor` | Vendors | | `risk`, `riskMeasure` | Risks, treatment measures | | `incident` | Incidents | | `control`, `evidence` | Controls, evidence | | `exemption` | Exemptions | | `evaluation` | Assessments | | `asset`, `finding` | Assets, vulnerabilities | | `application` | Applications | | `scope` | Activities | | `processingActivity` | GDPR processing activities | | `connector` | Connectors | | `project`, `ticket` | Action plans, tasks | Available data depends on the modules in your plan. ## Conditions The `where` and `of` clauses contain conditions, combined with `AND`, `OR`, `NOT` and parentheses. `AND` takes precedence over `OR`. ``` criticality >= 3 AND status = ACTIVE AND (cf."SSO" = false OR cf."SSO" IS EMPTY) ``` | Operator | Meaning | Example | |---|---|---| | `=` `!=` | Equal, different. | `status = ACTIVE` | | `>` `>=` `<` `<=` | Comparison of numbers or dates. | `criticality >= 3` | | `~` | Contains (text). | `name ~ "bank"` | | `IN (…)` `NOT IN (…)` | One of, not one of. | `status IN (ACTIVE, ONBOARDING)` | | `ALL (…)` | Contains all values (multi-value fields). | `tags ALL ("critical", "EU")` | | `BETWEEN … AND …` | Between two values. | `dueDate BETWEEN 2026-01-01 AND 2026-03-31` | | `IS EMPTY` `IS NOT EMPTY` | Empty, filled in. | `assignee IS EMPTY` | Available operators depend on the field type. A query holds at most 20 conditions and 4 levels of parentheses. ## Fields and values - **Fields**: use the technical name offered by suggestions (`status`, `criticality`, `assignee`, `dueDate`…). A custom field is written `cf."Field name"`. - **Text** in quotes: `"SSO rollout"`. - **Numbers**: `3`, `0.5`. **Booleans**: `true`, `false`. **Dates**: `2026-03-31`. - **Fixed values** (status, type…): the code or the label; suggestions show the label. - **References** (user, team, action plan, vendor): the name in quotes, for example `project = "SSO rollout"`. CISAPP stores the identifier: the widget keeps working if the item is renamed. ## Functions | Function | Value | |---|---| | `me()` | The user viewing the dashboard. | | `myTeams()` | Their teams. | | `now()` | Now; `now(-30d)` 30 days ago (`d` days, `w` weeks, `m` months, `y` years). | | `startOf(month)` | Start of the period: `day`, `week`, `month`, `quarter`, `year`. | With `me()` or `myTeams()`, each reader sees their own figures. Such a widget cannot track history. ## Examples ``` count(ticket) where assignee = me() AND status != DONE by priority percent(riskMeasure) where status != PLANNED of dueDate < now() avg(vendor.criticality) by createdAt:month during last12m list(risk) columns title, owner, residualCriticality where open = true sort residualScore desc limit 10 count(ticket) where createdAt >= startOf(month) ``` ## Expected outcome The query is accepted with no error message, the widget preview shows the expected data, and switching to **Form** shows the same settings. ## Common issues | Error | Cause | |---|---| | Unknown field | Typo, or deleted custom field. | | Unclosed quote | A quoted text is not terminated. | | Unknown value | The value does not exist for this field. | | Incomplete query | The query stops in the middle of a clause or condition. | | Unknown measure | The query must start with a measure: `count(…)`, `avg(…)`… | | Unknown data | The name in parentheses is not one of the data codes above. | | Measure needs a field | `sum`, `avg`, `min`, `max`, `median` and `distinctCount` apply to a field: `avg(vendor.criticality)`. | | Field not usable in `by` | This field cannot be used to group, split, sort or display as a column. | | Clause not available | `of` goes with `percent`, `columns` with `list`; a list has no `by` or `split`. | | Clause appears twice | Each clause is written only once. | | Operator not available for the field | Choose an operator suited to the field type. | | Too many conditions / nested parentheses | At most 20 conditions and 4 levels. | --- Source: https://docs.cisapp.eu/en/security/exposure Markdown: https://docs.cisapp.eu/en/security/exposure.md # Understand your exposure Distinguish the security dashboard, scopes, assets and findings. > **Access:** member, tool creation. Subject to enabled modules and your plan. ## Available workspaces Open **Operational Safety** to view the dashboard. Advanced scopes, assets and findings require activation and tool-creation permission. ![Operational security dashboard](https://docs.cisapp.eu/images/en/asm.webp) *The dashboard distinguishes scope types and monitoring of exposed assets. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/asm.webp)* | Item | Purpose | |---|---| | Scope | Define domains, FQDNs or addresses to monitor. | | Asset | Represent an item discovered or declared in the scope. | | Analysis | Run an offered discovery or check. | | Finding | Record detected exposure or an issue. | ## Read the overview Check coverage and the dates of recent analyses. Consider a partial score or absence of findings alongside analyses actually executed. An empty page before any analysis does not mean there are no issues. ## My exposure **My Exhibition**, **Certifications**, **My clients** and **Shares** in that workspace are currently under construction. They should not be treated as an operational posture-sharing portal in this version. ## Expected outcome You understand the data feeding the overview and what remains to be checked. To configure monitoring, see [Scopes and analyses](https://docs.cisapp.eu/en/security/scopes-analyses). --- Source: https://docs.cisapp.eu/en/security/scopes-analyses Markdown: https://docs.cisapp.eu/en/security/scopes-analyses.md # Configure scopes and analyses Declare a scope, verify ownership and track discovered assets. > **Access:** tool creation. Subject to enabled modules and your plan. ## Prerequisites Advanced functionality must be included and enabled. Tool-creation permission is required. Prepare a scope your organization is authorized to monitor. ## Add a scope 1. Open **Operational Safety → Scopes**, then **New scope**. 2. Choose an offered type: domain, CIDR range or FQDN list. 3. Enter the requested information and check the scope before confirming. 4. Follow the displayed ownership verification procedure. CIDR ranges require manual verification. 5. Open scope details and launch the offered analysis once required checks are complete. ![Managing monitoring scopes](https://docs.cisapp.eu/images/en/asm-surface.webp) *Verification comes before active checks that require it. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/asm-surface.webp)* ## Review assets and findings Use **Assets** for discovered items and **Findings** for detected issues. Filter by severity, category and status. Open a result to examine the offered information and recommendations. Scope discovery and tool analyses on assets follow separate schedules. Check the relevant last-run date before interpreting a result. ## Limits and stopping When the asset limit is reached, some newly discovered assets cannot be recorded. Review the quota message. Stopping or deleting scope monitoring does not mean all historical assets and findings are erased. ## Expected outcome The declared scope matches the need, verification is tracked and results are reviewed. No scan is required to consult this documentation. --- Source: https://docs.cisapp.eu/en/collaboration/projects Markdown: https://docs.cisapp.eu/en/collaboration/projects.md # Organize action plans and actions Create an action plan, assign actions and follow progress. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. The **Projects** menu is now called **Action plans**, and tickets are now **actions**. Until the English interface is updated, some screens may still show the former names. The **projects** in the Registers menu are a different thing: see [Do not confuse](https://docs.cisapp.eu/en/collaboration/projects#do-not-confuse). ## Create an action plan 1. Open **Action plans → All plans**, then **New action plan** (or the **Create an action plan** shortcut). 2. Enter the title and description of the work to organize. 3. Choose the proposed status and check access. 4. Finish creation and open the action plan. 5. Add actions to break the work down into concrete tasks. ![Demo action plan and actions](https://docs.cisapp.eu/images/en/projects.webp) *An action plan gathers the actions to carry out. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/projects.webp)* ## Track actions Fill in the proposed information: title, description, priority, owner and due date. Move actions between **To do**, **In progress**, **Blocked** and **Done**. In the Kanban view, moving a card updates its status; check the confirmation if an error is displayed. Use **All actions** for a cross-cutting view (**Kanban** or **List** views, **Assignee** and **Priority** filters, **Add an action** button) and **My actions** for those assigned to you. Relations between actions can represent blockers when offered. An action can also be created from an application or project record with **Add an action**: it is placed in an existing or new action plan, then associated with the record. ## Collaborate Open an action to view or complete its comments, attachments and relations. Check the action plan's rights before adding information to share. ## Expected outcome Each useful action has an owner and an understandable status. The action plan status and its actions' statuses represent different levels. ## Do not confuse A **project** under **Registers → Projects** is a file whose security is tracked up to the launch decision: see [Projects and launch decision](https://docs.cisapp.eu/en/registers/projects). An **application** is an assessed technical solution: see [Applications](https://docs.cisapp.eu/en/registers/applications). --- Source: https://docs.cisapp.eu/en/collaboration/files Markdown: https://docs.cisapp.eu/en/collaboration/files.md # Organize and share files Create folders, upload documents and check access and classification. > **Access:** member. Subject to enabled modules and your plan. ## Add documents 1. Open **Files**. 2. Use **Create folder** or open an existing folder. 3. Drop files into the offered area or use the upload action. 4. Wait for transfer confirmation and check the displayed files. 5. Open a file to verify its content before reusing it as evidence. ![File explorer](https://docs.cisapp.eu/images/en/files.webp) *Card, list and tree views help you find documents. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/files.webp)* ## Organize and classify Use file or folder actions to rename items, complete descriptions and manage tags. Check **TLP** classification. When editing a folder, applying changes to contained files and subfolders extends the change to those items: review the scope before confirming. ## Share Check the offered permissions for people and teams. Access to an assessment does not automatically guarantee access to every file mentioned. Verify visibility with the intended recipient. ## Quotas and deletion Used and available storage is shown in the explorer. If an upload fails, check the quota and transfer message. Deleting one or more items requires confirmation and is irreversible. ## Expected outcome The correct document is organized, identifiable and accessible to the intended people. To ask the CISAPP chat about it, see [AI chat and documents](https://docs.cisapp.eu/en/collaboration/chat). --- Source: https://docs.cisapp.eu/en/collaboration/signatures Markdown: https://docs.cisapp.eu/en/collaboration/signatures.md # Prepare a signature request Upload a PDF, add recipients and track the request. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Prepare the document Open **Electronic signatures** from the command palette. Check that you are using the final PDF and have the required access. ## Create the request 1. Start creating a signature request. 2. Drop the PDF into the upload area. 3. Wait for transfer confirmation. 4. Enter **Document title**, then select **Créer une signature**. 5. Open the created request and review its document preview. ![Creating a signature request](https://docs.cisapp.eu/images/en/signature.webp) *The form starts with the PDF and document title. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/signature.webp)* ## Add recipients Use **Ajouter un destinataire** and enter their name and email. Check addresses before selecting **Envoyer pour signature**. Sending is separate from creating the request. ## Track the request Reopen its record to review recipients, status and creation/completion dates. A created but unsent document has not yet been submitted to recipients. ## Common difficulties If upload fails, check that the file is a PDF and meets the displayed limit. If sending is unavailable, check recipients and required fields. ## Expected outcome The request contains the correct PDF and recipients; its state reflects the progress shown by CISAPP. --- Source: https://docs.cisapp.eu/en/collaboration/chat Markdown: https://docs.cisapp.eu/en/collaboration/chat.md # Ask AI chat about your documents Choose an organization and ask about documents accessible to your account. > **Access:** member. **Beta** feature, subject to enabled modules and your plan. ## Prerequisites **AI Chat** must be included in your plan. Your account needs access to documents in the selected organization. If none are accessible, upload files or request sharing before creating a conversation. ## Start a conversation 1. Open **AI Chat**. 2. Select **New conversation**. 3. Choose the organization whose documents you want to ask about. 4. Add a description if useful and create the conversation. 5. Ask a precise question about available documents. ![AI conversation workspace](https://docs.cisapp.eu/images/en/chat.webp) *Document access determines whether a conversation can be created and used effectively. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/chat.webp)* ## Ask clearly Specify the document or topic, context and expected result. For example: “In our access policy, which steps cover reviewing external accounts?” Review cited information before reusing the answer. ## What chat reads Chat answers from the selected organization’s documents. It does not read live vendor, risk or incident register data. For current information, open the relevant registers. ## Expected outcome You receive help reading your documents. Verify important information against its source. This product chat is separate from [Markdown documentation access](https://docs.cisapp.eu/en/help/use-with-ai), which requires no CISAPP AI service. --- Source: https://docs.cisapp.eu/en/organization/company Markdown: https://docs.cisapp.eu/en/organization/company.md # Configure your organization Check the organization profile, domains and functional settings. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Open the right workspace Select **My company** and check the organization name. Available management tabs depend on your role. Use an administrator account for organization settings. ## Maintain the profile Open **Profile** to review identity information and contact details. Save changes and check the displayed result before continuing. ## Domains and settings - **Domains**: add and verify domains using the offered actions. An organization domain is not the same as an ASM monitoring scope. - **Questionnaires and risks**: choose vendor and activity criticality questionnaires. Only questionnaires with the appropriate purpose are offered. - **Risk register methodology**: choose EBIOS RM or ISO 27005. This applies to new risks; existing risks retain their creation methodology. - **Miscellaneous**: manage the public vendor register when available. ## Publish the public register Under **Miscellaneous**, enabling the public register provides a viewing link. Only vendors marked public appear. Review the result in a private window before sharing the link. This register is distinct from the Trust Center. ## Expected outcome The profile and settings match your organization. To organize access, see [Members and teams](https://docs.cisapp.eu/en/organization/members-teams). The public vendor register is a **beta** feature in the illustrated version. --- Source: https://docs.cisapp.eu/en/organization/members-teams Markdown: https://docs.cisapp.eu/en/organization/members-teams.md # Invite members and organize teams Track invitations, authorize accounts and organize teams. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Invite a member 1. Open **My company → Members** with the required invitation permission. 2. Select **Invite** and enter the person’s email. 3. Check information and offered permissions before confirming. 4. Track the member’s status in the list. ![Members and invitation tracking](https://docs.cisapp.eu/images/en/members.webp) *Status distinguishes account activation from authorization. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/members.webp)* ## Understand states A member may be not invited, awaiting activation, awaiting authorization or active. Offered actions depend on state: **Send invitation**, **Resend the invitation**, **Cancel the invitation** and **Allow**. Revoking an invitation invalidates the link already sent. Before resending, check the address and spam folder with the recipient. ## Organize teams 1. Open **Teams**, then **Add team**. 2. Define its name, members, owners and offered roles. 3. Use teams to assign collective resource access. 4. Review membership when responsibilities change. A team can grant permissions on objects shared with it; it does not automatically make every resource visible. ## Import and removal Member import is offered in the list: use the format requested by the interface and review results. Before removing a member, check access and responsibilities that need transferring. ## Expected outcome Each person has the right account status and belongs to the necessary teams. For role details, see [Permissions and sharing](https://docs.cisapp.eu/en/organization/permissions). ## Review vendor access requests Under **My company → Supplier Access Requests**, authorized reviewers can open the vendor record, read the requester and message, then **Approve** or **Decline** a pending request. Check its scope before granting access. This decision is separate from inviting a member. --- Source: https://docs.cisapp.eu/en/organization/permissions Markdown: https://docs.cisapp.eu/en/organization/permissions.md # Understand permissions and sharing Distinguish creation roles, object access and administrative permissions. > **Access:** member. Subject to enabled modules and your plan. ## Check two levels **Roles** authorize actions within the organization. **Object permissions** allow reading, editing or administering a specific resource. A creation role does not automatically grant access to every existing resource. | User role | Main capability | |---|---| | User | Read shared resources. | | Organization admin | Administer the organization and members. | | Vendor creation | Create and manage vendors according to granted access. | | Assessment creation | Create and manage assessments. | | Questionnaire creation | Create and manage questionnaires. | | Activity creation | Create and manage activities. | | Tool creation | Access corresponding tooling and security operations. | | Portal user | Answer assigned questionnaires. | ## Check permissions 1. Open **My company → Rights & Roles**. 2. Review invitation permissions and offered roles. 3. Check the person’s and their teams’ permissions. 4. Open sharing on the affected resource to check its specific access. ![Permissions and role settings](https://docs.cisapp.eu/images/en/permissions.webp) *Organization permissions and resource access work together. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/permissions.webp)* ## Share a resource In sharing or the access step, choose a person or team and the necessary level: read, write or administration depending on the object. Check an external invitation’s scope before confirming. ## If access is refused Check the organization, role, object access and module activation in that order. Billing, connectors, incidents and ASM functionality can have specific permissions. Request appropriate access rather than sharing an account. ## Expected outcome Members have the required role and resources are shared with the intended people or teams. --- Source: https://docs.cisapp.eu/en/organization/profile Markdown: https://docs.cisapp.eu/en/organization/profile.md # Set up your profile and notifications Choose your language, appearance and personal preferences. > **Access:** member. ## Access your profile Open your user menu, then **My profile**. Personal settings apply to your account; they do not replace organization settings. ## Language and appearance Under **Paramètres**, choose an offered language and light, dark or system appearance. Application language is independent of this documentation site’s language. ![Personal language and appearance settings](https://docs.cisapp.eu/images/en/profile.webp) *Personal preferences adapt your workspace. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/profile.webp)* ## Personal information Open personal information to check displayed contact details. Save changes and verify the result. ## Notifications Under **Notifications**, review available preferences and events relevant to you. In-app notifications remain accessible from their dedicated entry. An assessment notification may open an object that also requires access permissions. ## Authentication Use **Authentification** to review methods and security options offered to your account. Follow verification steps when required. For SSO-managed accounts, some operations belong to the organization’s identity provider. ## Expected outcome Your language, appearance and preferences meet your needs. If an expected message is missing, also check the account email and spam folder. --- Source: https://docs.cisapp.eu/en/organization/tags-fields Markdown: https://docs.cisapp.eu/en/organization/tags-fields.md # Organize tags and custom fields Define shared classification and extra information for your registers. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Choose the right tool A **tag** groups items under a shared label. A **custom field** adds structured information to a supported object type. Define their purpose before creating them to avoid unnecessary variations. ## Manage tags An administrator opens **My company → Tags**. Create clear labels, then apply them to objects offering this classification. Use tag filters to find the desired scope. ## Manage custom fields 1. Open **My company → Custom fields** as an administrator. 2. Choose the affected object type. 3. Create a field with a clear label and an appropriate offered type. 4. Save, then open a record of that type to check the field and enter a value. 5. Check filters or columns offering the field. ![Custom-field management](https://docs.cisapp.eu/images/en/custom-fields.webp) *Object type and field type should match the classification need. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/custom-fields.webp)* ## Edit or delete Before deleting a tag or field, identify its use in records and filters. Inform affected users and check views after changes. ## Expected outcome Members use shared terminology and comparable data. Technologies, when offered in organization settings, complement classification for the relevant objects. --- Source: https://docs.cisapp.eu/en/organization/security Markdown: https://docs.cisapp.eu/en/organization/security.md # Administer access security Find organization security settings and distinguish available screens. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Prerequisites Organization security settings are restricted to that organization’s administrators. Settings for your own authentication are under [My profile](https://docs.cisapp.eu/en/organization/profile). ## Use the right screen Open **My company → Security**. Review offered options and sign-in information. Identity-provider and network-restriction settings depend on capabilities enabled for the organization. **Administration → Security** is currently under construction. It does not replace the My company security page. ## Prepare a change 1. Check that you are administering the correct organization. 2. Review how its members authenticate. 3. Prepare the information requested for the chosen setting. 4. Apply the change with the people responsible for organization authentication. 5. Verify sign-in with an affected account before considering the setting operational. ## Expected outcome Settings reflect the policy your organization selected, and affected members can sign in. For refused access, follow your internal support process with useful non-sensitive details: time, browser and displayed message. For common sign-in issues, see [Troubleshooting](https://docs.cisapp.eu/en/help/troubleshooting). --- Source: https://docs.cisapp.eu/en/organization/connectors Markdown: https://docs.cisapp.eu/en/organization/connectors.md # Configure connectors Connect an offered service, check its state and review synchronization. > **Access:** organization administrator. **Beta** feature, subject to enabled modules and your plan. ## Prerequisites Connectors must be included and enabled. Organization administrators manage them. Prepare access to the service you want to connect. ## Add a connection 1. Open **My company → Connectors** or the corresponding **Integrations** entry. 2. Review providers actually offered in the interface catalogue. 3. Choose a service and follow its required method: provider authorization or dedicated settings and credentials. 4. Check requested permissions and finish configuration. 5. Open the created connection to review its state and available synchronization functions. ![Connector list](https://docs.cisapp.eu/images/en/integrations.webp) *The catalogue in your workspace is the reference for supported services. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/integrations.webp)* ## Connector guides - [Connect GitHub](https://docs.cisapp.eu/en/organization/connectors/github): app installation, repository links, Dependabot. - [Connect GitLab](https://docs.cisapp.eu/en/organization/connectors/gitlab): OAuth authorization, project links, vulnerability report. - [Connect an AWS account](https://docs.cisapp.eu/en/organization/connectors/aws): read-only role, cloud inventory, Security Hub. - [Connect a Scaleway organization](https://docs.cisapp.eu/en/organization/connectors/scaleway): read-only API key, cloud inventory, posture findings. - [Connect an OVHcloud account](https://docs.cisapp.eu/en/organization/connectors/ovh): read-only authorization, cloud inventory, posture findings. - [Connect a Microsoft Azure tenant](https://docs.cisapp.eu/en/organization/connectors/azure): read-only service principal, cloud inventory, posture findings, Defender for Cloud. - [Connect a Google Cloud account](https://docs.cisapp.eu/en/organization/connectors/gcp): read-only service account impersonated by CISAPP, cloud inventory, posture findings. Each connection record also offers a **Documentation** button to the matching guide. ## Track the connection Review state, last synchronization and errors offered on its record. Saving a connection does not imply that all expected data has already synchronized. ## Fix or remove If authentication expires, follow the offered reconnection action. If data is missing, check the scope and permissions granted in the remote service. Disable or remove connections no longer needed. ## Expected outcome The connection is authorized for the correct scope and its state has been checked. Services absent from the catalogue are not described as available in this documentation. --- Source: https://docs.cisapp.eu/en/organization/connectors/aws Markdown: https://docs.cisapp.eu/en/organization/connectors/aws.md # Connect an AWS account Deploy a read-only AWS role to inventory cloud resources and import Security Hub findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - Be able to create a CloudFormation stack and an IAM role in the target AWS account. - For security findings: AWS Security Hub enabled in the regions to scan. ## Deploy the role 1. Open **My company → Connectors**, then **Connect** on the AWS card. 2. **Deploy the role** step: CISAPP shows its principal and an **ExternalId** unique to this connection. 3. Click **Deploy with CloudFormation**, or copy the template and deploy it yourself with these two values. 4. The role is read-only (SecurityAudit and Security Hub read access): CISAPP never changes your account. ## Verify and connect 1. Click **I deployed the role**. 2. Paste the **Role ARN** (RoleArn output of the stack). 3. Optionally list **Regions**; leave empty for every enabled region. 4. **Verify and connect**: CISAPP tests access, activates the connection and starts the first synchronization. If you close the wizard before verification, the connection stays **Pending**: use **Resume setup** from its record. ## Track synchronization The record shows the last synchronization and, if needed, an incomplete one (for example an unreachable region). **Synchronize** starts a new scan; an automatic synchronization also runs every night. Resources appear in **View inventory** and **View map**, Security Hub findings in security findings. ## Common issues | Message | What to do | | --- | --- | | AWS connector is not configured | The connector is not available on your platform yet: contact support. | | AWS refused access | Check that the stack is deployed and that principal and ExternalId match the displayed values. | | Security Hub is not enabled in any scanned region | Enable Security Hub or adjust the regions. | ## Disconnect **Disconnect** deletes the connection and its cloud inventory, and resolves its Security Hub findings. Then delete the CloudFormation stack in your AWS account. ## Expected result The connection is active, the cloud inventory is populated and Security Hub findings appear in CISAPP. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/azure Markdown: https://docs.cisapp.eu/en/organization/connectors/azure.md # Connect a Microsoft Azure tenant Create a read-only Azure service principal (Reader role) to inventory cloud resources and report posture findings and Defender for Cloud recommendations. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - Be able to create an **app registration** in Microsoft Entra ID and assign a role on the target subscriptions (or on their management group): owner, User Access Administrator or equivalent rights. - An Azure tenant can only be connected to **one** CISAPP organization; an organization can, however, connect several tenants. - **Public** Azure cloud only: the China (21Vianet) and US Government clouds are not supported. ### Minimum permissions The **Reader** role is enough, on each subscription to analyze or on a management group. The **Security Reader** role is not needed: Reader already reads Microsoft Defender for Cloud recommendations. **Never grant** Contributor, Owner, User Access Administrator, or any data-access role (for example Key Vault Secrets User, Storage Blob Data Reader): CISAPP does not need them. No Microsoft Graph permission is required either. ## Create the access in Azure CISAPP never uses your personal account: create a dedicated, read-only **service principal** with a **client secret**. ### With the Azure CLI Replace `` with the ID of the subscription to analyze. ```bash az ad sp create-for-rbac --name cisapp-reader --role Reader --scopes /subscriptions/ --years 1 ``` Several subscriptions: separate the scopes with spaces. ```bash az ad sp create-for-rbac --name cisapp-reader --role Reader --scopes /subscriptions/ /subscriptions/ ``` A management group (covers current and future subscriptions). Use its **ID**, not its display name: ```bash az ad sp create-for-rbac --name cisapp-reader --role Reader --scopes /providers/Microsoft.Management/managementGroups/ ``` Run only **one** of these three commands (each creates the service principal). To extend the scope afterwards, use `az role assignment create`: ```bash az role assignment create --assignee --role Reader --scope /subscriptions/ ``` The creation command prints a JSON document, **only once**; the secret cannot be read again afterwards: | Field printed by Azure | CISAPP field | | --- | --- | | `tenant` | **Tenant** | | `appId` | **Client ID** | | `password` | **Client secret** (this is the secret **value**) | | `displayName` | Informational only, not requested | The secret is valid for one year (`--years 1`). To read its end date (to enter in CISAPP, see below; keep the first 10 characters, in `YYYY-MM-DD` format): ```bash az ad app credential list --id --query "[].[displayName,keyId,endDateTime]" -o tsv ``` The command also prints each secret's `keyId`, needed to delete the old one during a rotation. The date entered in CISAPP must be **in the future**. ### From the portal 1. In the Microsoft Entra admin center, **App registrations → New registration**: single tenant, no redirect URI, and do not add any API permission (Microsoft Graph). Copy the **Application (client) ID** and the **Directory (tenant) ID**. 2. **Certificates & secrets → New client secret**: choose an expiry, then immediately copy the **Value** (not the **Secret ID**). 3. In the Azure portal, open **Subscriptions** (or **Management groups**), pick the scope, then **Access control (IAM) → Add → Add role assignment**. 4. Choose the **Reader** role, then **Members → Select members**, search for the application name, select it and confirm with **Review + assign**. Repeat for each subscription. > A role assignment can take up to **10 minutes** to propagate (sometimes longer for a management group). If CISAPP does not see any subscription yet, wait and try again. ## Connect in CISAPP 1. Open **My company → Connectors**, then **Connect** on the Azure card. 2. Fill in: - **Tenant**: the directory GUID (the `tenant` field of the command), or a verified domain of the tenant (for example `contoso.onmicrosoft.com`); - **Client ID**: the application ID (`appId`); - **Client secret**: the secret **value** (not its ID); - **The secret expires on** (optional, format `YYYY-MM-DD`, must be **a future date**): lets you be alerted 30 days before the secret expires; - **Subscriptions** (optional): GUID identifiers, 100 at most. Empty: every subscription the principal can read (beyond 100 subscriptions, leave the field empty or assign the Reader role on a management group). The list can be edited later from the record. 3. **Verify the credentials**: CISAPP tests the credentials with Microsoft before saving anything. 4. At the **Confirm the Azure tenant** step, check the displayed **tenant ID**, then **Connect**. An Azure tenant can only be connected to one CISAPP organization. The first synchronization starts. If you close the panel before confirmation, the connection stays **Pending**: use **Confirm the account** from its record. Subscriptions in the **Disabled** state are not collected (see "Subscription not collected" below). Connecting a tenant that is already attached to another CISAPP organization is refused ("This Azure tenant is already connected by another CISAPP organization."). ## What CISAPP collects CISAPP queries **Azure Resource Graph** and a few targeted Azure Resource Manager reads. It only reads **configuration**, never content: - storage accounts (blob service configuration, not the objects); - network security groups, virtual networks and subnets, public IP addresses; - virtual machines and managed disks; - SQL servers (Azure SQL), PostgreSQL and MySQL flexible servers, Cosmos DB accounts; - Key Vault vaults (vault properties only), AKS clusters; - App Service and Functions apps; - subscriptions and their number of owners (Owner role assignments); - Microsoft Defender for Cloud recommendations. CISAPP changes nothing in your tenant. It never reads access keys, secrets, app settings, connection strings or `kubeconfig` files, and does not use the Key Vault data plane. The Reader role does not allow the actions that reveal these values anyway, and CISAPP never calls them. Resources appear in the **Operational Safety → Cloud inventory** menu entry and its **Map** view. ## Posture findings Findings appear in security findings with the **Azure posture** source. A rule only triggers when the information is certain: an unknown state (missing permission, absent data, resource not collected) neither creates nor resolves a finding. | ID | Rule | Severity | | --- | --- | --- | | `azure-storage-public-blob-access` | Storage account allowing public blob access | High | | `azure-storage-http-allowed` | Storage account accepting unencrypted HTTP traffic | Medium | | `azure-storage-weak-tls` | Storage account accepting TLS 1.0 or 1.1 | Medium | | `azure-storage-network-open` | Storage account open to all networks | Medium | | `azure-storage-blob-soft-delete-disabled` | Storage account without blob soft delete | Low | | `azure-nsg-remote-admin-exposed` | Network security group exposing SSH or RDP to the Internet | High | | `azure-nsg-database-ports-exposed` | Network security group exposing a database port to the Internet | High | | `azure-sql-public-network-access` | SQL server reachable from the public network | Medium | | `azure-sql-weak-tls` | SQL server accepting TLS below 1.2 | Medium | | `azure-sql-firewall-open-to-internet` | SQL server with a firewall rule open to all IP addresses | Critical | | `azure-dbflex-public-network-access` | PostgreSQL/MySQL flexible server reachable from the public network | Medium | | `azure-dbflex-tls-not-required` | PostgreSQL/MySQL flexible server not enforcing TLS | High | | `azure-keyvault-purge-protection-disabled` | Key vault without purge protection | Medium | | `azure-keyvault-public-network-open` | Key vault open to all networks | Medium | | `azure-aks-api-server-public` | AKS cluster whose Kubernetes API is exposed without IP restriction | High | | `azure-aks-rbac-disabled` | AKS cluster without Kubernetes RBAC | High | | `azure-webapp-https-only-disabled` | Web app not enforcing HTTPS | Medium | | `azure-webapp-weak-tls` | Web app accepting TLS 1.0 or 1.1 | Medium | | `azure-cosmos-public-network-open` | Cosmos DB account publicly reachable without a filter | High | | `azure-subscription-too-many-owners` | Subscription with more than 3 owners (Owner) | Medium | A SQL firewall is only flagged for the full range 0.0.0.0 to 255.255.255.255; the special "Azure services" rule (0.0.0.0 to 0.0.0.0) does not trigger a finding, and a server whose public network access is disabled is compliant. For network security groups, rules are evaluated by priority: an unreadable rule placed before the deciding rule makes the state unknown, and a deny rule only closes a port for the whole group when its destination is any (`*`, `0.0.0.0/0`, `::/0`). ### Subscription not collected If a selected subscription is not collected (**Disabled** state, configured ID that is no longer listed, or not yet visible to Azure Resource Graph), CISAPP still creates new findings but **automatically resolves no CISAPP rule finding** during that synchronization, and deletes nothing of that subscription. Defender for Cloud recommendations of the collected subscriptions still resolve normally. The cause is reported by an English note shown under the last incomplete synchronization text: `Posture findings are not auto-resolved while these subscriptions are not collected: . Remove them from subscriptionIds, or wait until Azure deletes them.` Azure deletes a **Disabled** subscription about 90 days later; it then leaves the listing. If you entered a subscription list, remove it from the list. If a **Disabled** subscription stays listed (default mode: all subscriptions), enter an explicit subscription list that does not contain it to resume automatic resolution. ### Defender for Cloud recommendations If Microsoft Defender for Cloud is enabled on a subscription, CISAPP also imports its recommendations in the **Unhealthy** state as findings, with the same **Azure posture** source. One finding is created per recommendation and per affected resource. Their titles, descriptions and severities come from Microsoft and are shown in **English**. The number of imported recommendations is capped per subscription (most severe first). When a recommendation is no longer unhealthy, its finding is resolved. If Defender for Cloud is not enabled or returns no data, nothing is imported or resolved. Nothing is resolved either when the cap is reached. ### Secret expiry The expiry date (**The secret expires on**) is handled separately from the rules: without a date, no warning is shown; less than 30 days before the declared deadline, a **Credentials expiring soon** badge appears on the record. ## Replace the secret (rotation) 1. Create a new secret **while keeping the old one**: ```bash az ad app credential reset --id --append --years 1 --display-name cisapp-AAAA ``` Never forget `--append`: without it, the command deletes all existing secrets and the connection fails immediately. 2. On the connection record, **Update credentials**: in the **Replace the Azure secret** panel, paste the new secret **value**, fill in **The secret expires on** with its new date (it must be in the future: the field is prefilled with the old date, which you must replace, especially after an expiry), then **Verify and replace**. The old secret stays in use until the new one is validated. 3. The new secret must belong to the **same Azure tenant**; otherwise it is refused and the current secret is kept. 4. Then delete the old secret: find its `keyId` with `az ad app credential list --id --query "[].[displayName,keyId,endDateTime]" -o tsv`, then `az ad app credential delete --id --key-id `. Subscriptions can be changed from the record (**Edit**, **Edit the scope** panel), without re-entering the secret. Removing a subscription from the connection removes its resources from the inventory at the next sync. The expiry date (**The secret expires on**), however, is updated together with the secret, not from **Edit**. An expired secret puts the connection in **Error** (**Expired credentials**): create a new secret and rotate it from the record. ## Common issues **When connecting**, Azure does not detail the cause in the interface: every refusal shows the message "Azure refused these credentials: invalid secret (paste the secret value, not its ID) or expired, application or tenant not found, access blocked by a conditional access policy, or Reader role missing...". **At synchronization**, the AADSTS codes below appear under **Last synchronization incomplete** (connection record) when an already saved secret is refused; their meaning there sometimes differs from the connection one. | Message | What to do | | --- | --- | | The Azure connector is unavailable on this CISAPP instance (secret encryption not configured). Contact support. | The connector is not configured on your platform yet: contact support. | | Azure refused these credentials... | Check, in order: the secret **value** (not its ID), its expiry date, the **Tenant** and the **Client ID**, that no conditional access policy blocks the application, and the Reader role assignment on each listed subscription (propagation: up to 10 minutes). | | AADSTS7000215 / AADSTS70002 at synchronization (invalid client secret) | The saved secret was deleted or replaced on the Azure side (for example `az ad app credential reset` without `--append`): create a new secret and rotate it from the record. When connecting, the usual cause is the **secret ID** pasted instead of its **value** (`password` in the command output). | | AADSTS7000222 (expired secret) | The client secret has expired: create a new one and rotate it from the record. | | AADSTS700016 (application not found) | When connecting: the client ID or the tenant is wrong, check that the application belongs to this tenant. At synchronization: the application was deleted in Microsoft Entra ID; recreate it, then rotate from the record. | | AADSTS90002 (tenant not found) | The tenant ID or domain is wrong: use the directory GUID. | | This service principal belongs to another Azure tenant: the current secret is kept. | When rotating, the new secret must belong to the same tenant as the connection. | | **Insufficient permissions** status and last synchronization `no readable subscription` (English message) | The Reader role is not assigned to the application (or was removed), or the assignment has not propagated yet (up to 10 minutes): check the assignment, wait and try again. | | A subscription is reported as unreadable in the synchronization (English message, `Subscription ... not readable`) | The Reader role is missing on that subscription, or its ID is wrong in the list: the other subscriptions are analyzed normally. Fix the assignment or remove it from the list. | | Subscription missing from the inventory, or findings that no longer resolve | A selected subscription is not collected (**Disabled** state, no longer listed, not yet visible to Azure Resource Graph): the synchronization reports it (note under the last incomplete synchronization) and suspends automatic resolution of CISAPP rule findings. See "Subscription not collected". | | Recent resource missing | Azure Resource Graph is eventually consistent: a resource created just now appears at the next synchronization. | | This Azure tenant is already connected by another CISAPP organization. | An Azure tenant has a single connection: disconnect it from the other CISAPP organization first. | | Expired credentials or Credentials rejected | Create a new secret and rotate it from the record. | ## Limits - Public Azure cloud only (no China or US Government). - An Azure tenant can only be connected to one CISAPP organization; an organization can connect several tenants. - Synchronization follows the same schedule as the other cloud connectors: automatic every night, and on demand with **Synchronize** on the record. - The secret expiry date is **declarative**: CISAPP cannot read it from Azure, and it must be in the future. Without a date, expiry is only detected when Microsoft refuses the secret. - Selected subscriptions are limited to 100 (beyond that: empty field, or Reader role on a management group). - When a subscription leaves the scope (removed from the list, or deleted by Azure), its resources are removed from the inventory and its CISAPP rule findings are resolved, but its already imported Defender for Cloud recommendations stay open until the connector is disconnected. ## Disconnect **Disconnect** deletes the connection and its cloud inventory, and marks its posture findings as resolved. Then delete the secret (or the app registration and its role assignments if they are no longer used) in Microsoft Entra ID and in the Azure portal. ## Expected result The connection is active, the cloud inventory is populated and Azure posture findings, along with Defender for Cloud recommendations, appear in CISAPP. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/gcp Markdown: https://docs.cisapp.eu/en/organization/connectors/gcp.md # Connect a Google Cloud account Authorize CISAPP read-only on a Google Cloud (GCP) environment through a service account that CISAPP impersonates, to inventory cloud resources and report security posture findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## How it works No key is exchanged or stored. You create a **read-only service account** in one of your projects and you allow the **CISAPP platform service account** to **impersonate** it (the "Service Account Token Creator" role, on that service account only). At each synchronization, CISAPP obtains a short-lived access token (about one hour) from Google on behalf of your service account and reads your configuration. This token is never stored: it stays in CISAPP's memory and is reused for at most one hour (refreshed 5 minutes before it expires). Removing the authorization on the Google Cloud side prevents new tokens from being obtained: access ends at the latest when the current token expires (one hour at most), subject to Google IAM propagation. For an immediate stop on the CISAPP side, use **Disconnect**. ## Prerequisites - Be an organization administrator in CISAPP. - Have the rights in Google Cloud to create a service account, create a custom role and grant IAM roles: for example IAM Admin on the organization (or on the project), or project owner. Without a Google Cloud organization, these rights are needed on every project to analyze. - Have the `gcloud` CLI signed in with an authorized account, or Cloud Shell. - A service account can only be connected to **one** CISAPP organization. Several service accounts (so several connections) remain possible within one CISAPP organization. - The service account must be **one you created** (`name@project.iam.gserviceaccount.com`). Google-managed accounts (service agents `gcp-sa-…` and legacy Google service agents, the default Compute account `…-compute@developer.gserviceaccount.com`, the App Engine account) and legacy domain-named projects (`example.com:project`) are not supported. It must not belong to CISAPP's own project. ## Set up Google Cloud The commands below are the ones in the CISAPP setup panel. **The panel shows them already pre-filled** with your connection's verification token and the CISAPP service account address: copy them from the panel rather than using the generic values on this page (`` and ``). 1. Open **My company → Connectors**, then **Connect** on the Google Cloud card. The **Set up Google Cloud** panel shows two values to copy: - the **CISAPP service account (platform)**: the address to authorize; - the **verification token**: specific to this connection, in the form `cisapp-verify-` followed by 32 hexadecimal characters. 2. **Adapt the variables.** `PROJECT_ID` is the project that will host the service account (its "home project"), `ORG_ID` is the numeric identifier of your organization (not needed without an organization). ```bash PROJECT_ID="my-project-id" SA_NAME="cisapp-readonly" SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" ORG_ID="123456789012" ``` 3. **Create the service account**, with the verification token as its **description**: it proves that you control this account. ```bash gcloud iam service-accounts create "$SA_NAME" --project="$PROJECT_ID" \ --display-name="CISAPP read-only" \ --description="" ``` If the service account already exists, only update its description: ```bash gcloud iam service-accounts update "$SA_EMAIL" --project="$PROJECT_ID" \ --description="" ``` 4. **Allow CISAPP to impersonate the service account**, **on that service account only**. **Never** grant it on the project, a folder or the organization: CISAPP refuses the connection if this role is granted more widely. ```bash gcloud iam service-accounts add-iam-policy-binding "$SA_EMAIL" \ --project="$PROJECT_ID" \ --member="serviceAccount:" \ --role="roles/iam.serviceAccountTokenCreator" ``` 5. **Save the custom role definition** in a `role.yaml` file. It only contains metadata read permissions (see the list below): no data access. ```yaml title: CISAPP Posture Reader description: Read-only metadata access for CISAPP security posture scans. No data-plane access. stage: GA includedPermissions: - resourcemanager.projects.get - resourcemanager.projects.getIamPolicy - compute.instances.list - compute.firewalls.list - compute.networks.list - compute.subnetworks.list - compute.projects.get - storage.buckets.list - storage.buckets.getIamPolicy - cloudsql.instances.list - container.clusters.list - iam.serviceAccounts.get - iam.serviceAccounts.list - iam.serviceAccountKeys.list - cloudfunctions.functions.list - cloudfunctions.functions.getIamPolicy - run.locations.list - run.services.list - run.services.getIamPolicy - cloudkms.locations.list - cloudkms.keyRings.list - cloudkms.cryptoKeys.list - bigquery.datasets.get - bigquery.datasets.getIamPolicy - serviceusage.services.list ``` 6. **Create the role and grant it to the service account.** The role must cover **the service account's home project** (it must be able to read itself) **and** the projects to analyze. - **With a Google Cloud organization**: a single grant at the organization level covers all its projects, including the home project. ```bash gcloud iam roles create cisappPostureReader --organization="$ORG_ID" \ --file=role.yaml gcloud organizations add-iam-policy-binding "$ORG_ID" \ --member="serviceAccount:$SA_EMAIL" \ --role="organizations/$ORG_ID/roles/cisappPostureReader" ``` - **Without an organization**: project by project. Replace `project-a project-b` with your projects, **without forgetting the service account's home project**. The role is created in each one. ```bash for P in project-a project-b; do gcloud iam roles create cisappPostureReader --project="$P" \ --file=role.yaml gcloud projects add-iam-policy-binding "$P" \ --member="serviceAccount:$SA_EMAIL" \ --role="projects/$P/roles/cisappPostureReader" done ``` 7. **Enable the APIs in the service account's home project**: its calls are counted and rate-limited there. ```bash gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com serviceusage.googleapis.com \ --project="$PROJECT_ID" ``` Product APIs (Compute Engine, Cloud Storage, Cloud SQL…) do not have to be enabled for CISAPP: a product that is disabled in a project simply has nothing to inventory. ### Fallback predefined roles If your organization forbids custom roles, grant these predefined roles to the service account instead, on the organization or on each project (without forgetting the home project): - `roles/browser` - `roles/compute.networkViewer` - `roles/cloudsql.viewer` - `roles/container.clusterViewer` - `roles/iam.serviceAccountViewer` - `roles/cloudfunctions.viewer` - `roles/run.viewer` - `roles/cloudkms.viewer` - `roles/bigquery.metadataViewer` - `roles/serviceusage.serviceUsageViewer` - `roles/storage.bucketViewer` > **Limit:** these roles do not allow reading bucket access policies (IAM). The **public bucket check then stays "unknown"**: it neither creates nor resolves a finding. ## Connect in CISAPP 1. In the setup panel, click **I'm done**. 2. Enter the **service account email** (for example `cisapp-readonly@my-project.iam.gserviceaccount.com`). 3. Optionally enter the **projects** to analyze, one identifier per entry (50 at most). **Empty: every active project the service account can read**, up to a cap set by the platform (100 by default); beyond it only the first ones are analyzed and the synchronization reports it. 4. **Verify access**: CISAPP checks that the service account exists, that it can impersonate it, that the token is in its description and that the projects are readable. 5. Check the displayed **service account** (its numeric identifier), then **Connect**. The connection becomes active and the **first synchronization** starts. If you close the wizard before confirmation, the connection stays **Pending** and the setup panel is resumed from its record (the verification token stays the same). A connection left pending for more than 7 days without activity is deleted automatically. Google IAM permissions propagate with a slight delay (a few seconds to a few minutes). If verification fails right after the commands, wait and try again. Likewise, the first synchronization may report a few partial "not granted" errors: the next one fixes them. Once the connection is active, the list of **projects** can be changed from the connection record (**Edit scope**); the service account email cannot. ## What CISAPP collects CISAPP only performs **reads** (`GET` requests; reading IAM policies uses the Google API `POST` method, without changing anything) and only reads **configuration**, never content. For each analyzed project: - Google Cloud projects (identifier, state) and the **project IAM policy**, summarized as counters (no member address is kept); - Compute Engine: instances, VPC firewall rules, networks and subnets; - Cloud Storage: buckets (configuration and IAM access rules, not the objects); - Cloud SQL: instances; - Google Kubernetes Engine (GKE): clusters; - service accounts and their user-managed keys (metadata: age, state); - Cloud Functions and Cloud Run services (configuration and who may invoke them); - Cloud KMS: encryption keys (rotation metadata); - BigQuery: datasets (configuration and public access); - the list of APIs enabled in each project. Resources appear in the **Operational Safety → Cloud inventory** menu entry and its **Map** view, with their region and location. A product that the service account cannot read is reported as **not granted** in the synchronization result. ## What CISAPP never reads CISAPP changes nothing in your environment. The role includes no write permission and no data read permission. CISAPP **never** reads, and therefore never stores: - bucket content (objects), BigQuery tables, rows and queries; - service account **key material** (no key is created, downloaded or used), secrets (Secret Manager), KMS keys themselves (no encryption, decryption or signing); - environment variables and secrets of Cloud Functions and Cloud Run services, container images and arguments; - GKE cluster credentials (certificates, tokens), passwords, certificates and flag values of Cloud SQL instances; - disk encryption keys, labels, serial port output, screenshots and guest attributes; - public IP addresses themselves (only the existence of a public address is kept) and the addresses of IAM policy members. Compute instance and project metadata (for example startup scripts, SSH keys) is read for **three flags only**: `enable-oslogin`, `block-project-ssh-keys` and `serial-port-enable`. Google does not allow requesting a single key: the items are therefore requested as key/value pairs and their values pass through memory while the response is read; only these three flags are kept and nothing else is converted, stored or logged. ## Posture findings Findings appear in security findings with the **Google Cloud posture** source. A rule only triggers when the information is certain: an unknown state (product not granted, unreadable value, value missing from the response) neither creates nor resolves a finding. 20 rules are evaluated. | Finding title | Severity | | --- | --- | | Basic Owner or Editor role granted in the project | High; medium if only users hold the role | | Project IAM policy open to allUsers or allAuthenticatedUsers | Critical | | User-managed service account key older than 90 days | Medium | | Compute instance exposed with a public IP address | Medium | | Instance using the default service account with full API access | High | | OS Login disabled on the instance | Medium | | Serial console access enabled on the instance | Medium | | Firewall rule open to the Internet on an administration port | High | | Firewall rule open to the Internet on a database port | High | | Firewall rule allowing all traffic from the Internet | Critical | | Publicly accessible storage bucket | Critical; high if only read roles are public | | Uniform bucket-level access disabled | Medium | | Cloud SQL instance reachable from the Internet | Critical | | Cloud SQL instance not enforcing TLS encryption | High; medium if the instance has no public address | | Automated backups disabled on the Cloud SQL instance | Medium | | Legacy ABAC authorization enabled on the GKE cluster | High | | GKE control plane endpoint open to the Internet | High | | Publicly invocable serverless function or service | Medium; high if ingress is open to all and the default Compute account runs it | | KMS encryption key without automatic rotation | Medium | | Publicly accessible BigQuery dataset | Critical | Details: - **Firewall**: only classic VPC ingress rules that are enabled are evaluated. Administration = ports 22 and 3389; databases = 1433, 1521, 3306, 5432, 6379, 9200, 9300, 11211 and 27017. A rule that opens every port is reported once, by the "all traffic" rule. - **Serverless functions and services**: public access is often intended (public API); the finding is advisory. An ingress limited to the internal network is considered compliant. - **Buckets**: only the IAM policy is evaluated. Legacy object or bucket ACLs are not read. - **KMS**: only symmetric keys that can be rotated are concerned; a rotation period longer than 365 days is also reported. ## Limits - **Organization policies** (for example `compute.requireOsLogin`, `compute.disableSerialPortAccess`, the ban on public bucket access) and **hierarchical or network firewall policies** are **not evaluated**: a finding may be neutralized at your organization level, and a deny rule is not taken into account. Findings describe each resource's own configuration. - Audit policies inherited from a folder or the organization are not visible for a project attached to an organization. - Google IAM permissions are **eventually consistent**: a role granted or removed may take a few minutes to take effect. - Two CISAPP organizations can see the same projects through two different service accounts: the connection is exclusive per service account, not per project. - An empty scope is capped; an inaccessible project is reported and its resources are not removed from the inventory. - If the service account sees more projects than the cap (100 by default) in "all projects" mode, only the first ones are analyzed and **automatic finding resolution is paused for the whole connection**: findings are still created and updated, but none is resolved, and the synchronization reports it. List the projects to analyze explicitly to restore it. ## Revoke access - **On the Google Cloud side**: remove the "Service Account Token Creator" role granted to CISAPP on your service account. CISAPP can no longer obtain a new token; the token already issued stays usable until it expires (one hour at most), subject to Google IAM propagation. ```bash gcloud iam service-accounts remove-iam-policy-binding "$SA_EMAIL" \ --project="$PROJECT_ID" \ --member="serviceAccount:" \ --role="roles/iam.serviceAccountTokenCreator" ``` - **On the CISAPP side**, **Disconnect** deletes the connection and its cloud inventory, marks its posture findings as resolved and drops the token kept in memory: this is the immediate stop on the CISAPP side. There is nothing to revoke at Google: no credential is stored. Then remove the impersonation role, and delete the service account and the custom role if they are no longer needed. ## Common issues | Message | What to do | | --- | --- | | The Google Cloud connector is unavailable on this instance | The platform service account is not configured on your platform yet: contact support. | | Google Cloud refused access | See the detailed causes below. | | This service account is already connected by another CISAPP organization, or does not match this connection's account | A service account has a single connection: disconnect it from the other CISAPP organization first. Otherwise the account was deleted then recreated (new identifier: it is no longer the service account connected earlier): check the email you entered, disconnect the connection and reconnect it. The same message appears if the connection was changed while it was being verified: reload the page. | | Unable to confirm: this service account changed since the verification | Start the verification again. | | Too many attempts | Too many connection attempts in a short time (10 per minute at most): wait a minute. | | The email is not valid (message under the field) | Enter a service account you created (`name@project.iam.gserviceaccount.com`). Google-managed accounts, including the legacy Google service agents, are refused. This is an input error, not a refusal from Google Cloud. | When Google Cloud refuses access, verification stops at the first cause it meets, in this order: | Cause | What to do | | --- | --- | | The service account belongs to CISAPP's project | Create it in one of **your** projects. | | CISAPP cannot impersonate this service account | Check the email and that CISAPP's service account holds `roles/iam.serviceAccountTokenCreator` **on this service account**. Google does not distinguish a missing account from a missing permission. Wait for IAM propagation. | | The service account cannot read itself | Grant it the custom role on **its home project**. | | Enable an API in the home project | Enable `cloudresourcemanager`, `iam` and `serviceusage` in the home project (step 7). | | A VPC Service Controls perimeter blocks the service account | Allow the service account in the perimeter. | | The service account is not found, does not match the email, does not belong to its project or is disabled | Check the email and re-enable the service account. | | The verification token was not found in the service account description | Update the description with the **exact** value from the panel (no extra text). The token is only checked while the connection is not active. | | `roles/iam.serviceAccountTokenCreator` is granted on the project, a folder or the organization | Remove these wide grants and grant the role on the service account only. | | The service account sees no project, or a project is not readable | Grant the custom role on the projects to analyze (or on the organization) and check that each project is active. | After connecting, in synchronizations: | Symptom | Likely cause | | --- | --- | | Product "not granted" in the result | A permission of the role is missing on that project: grant it on that project or on the organization. | | `SERVICE_DISABLED` error in the result | An API of the service account's home project is disabled (step 7). | | Connection in error "credentials refused" | Impersonation is refused (role removed, account deleted or disabled): restore it, then start the verification again from the record. | | Connection in error "the service account was replaced" | The service account was recreated: disconnect, then reconnect the account. | | Project limit reached | Explicitly select the projects to analyze (while the list is empty, no finding is resolved automatically). | ## Expected result The connection is active, the cloud inventory is populated and Google Cloud posture findings appear in CISAPP. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/github Markdown: https://docs.cisapp.eu/en/organization/connectors/github.md # Connect GitHub Install the CISAPP GitHub app, link repositories to applications, enable Dependabot and import its alerts into findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - Be able to install a GitHub app on the target GitHub account or organization (organization owner, or owner of the personal account). - If GitHub shows an approval request, a GitHub organization owner must approve it. ## Install the app 1. Open **My company → Connectors**, then **Connect** on the GitHub card. A panel sums up the steps and the requested access; click **Continue to GitHub**. 2. On GitHub, choose the account or organization, then **All repositories** or a selection. 3. Authorize the app when GitHub asks: this proves your GitHub account can access the installation. 4. You return to the connector record in CISAPP with the repository list. The installation link expires after 30 minutes and works once: if something fails, click **Connect** again. ## Link repositories to applications In the **Repositories** tab, use **Link to an application** to attach a repository to one of your organization’s [applications](https://docs.cisapp.eu/en/registers/applications); the **Application** column shows the link. **Unlink** removes the link without changing anything on GitHub. The repository then appears in the application’s **Code and DevSecOps** tab. To add or remove repositories, use **Manage on GitHub** and change the selection: CISAPP is notified automatically. **Synchronize** forces an immediate update. ## Enable Dependabot and import alerts A repository’s **Dependabot** switch enables vulnerability alerts and automated security fixes on GitHub, **and** imports the repository’s open alerts into CISAPP findings. Turning it off stops automated fixes and the import: the repository’s findings are resolved (alerts stay enabled on GitHub). - The **Open alerts** column of the **Repositories** tab shows alert counts by severity. - The **Alerts** tab shows totals by severity, the **Imported repositories** and the last sync date; **View findings** opens the findings list filtered on GitHub Dependabot. - An alert fixed or dismissed on GitHub is resolved automatically in CISAPP. Existing installations must accept the new **Dependabot alerts** permission on GitHub (GitHub sends a request to the installation owner). ## Common issues | Message | What to do | | --- | --- | | GitHub connector is not configured | The connector is not available on your platform yet: contact support. | | GitHub installation could not be authorized | Expired link or GitHub account without access to the installation: restart with the right account. | | Installation already linked to another organization | A GitHub installation can serve a single CISAPP organization. | | No synchronized repository | Check the repository selection on GitHub, then **Synchronize**. | | Last synchronization incomplete | The message lists the failing repositories: most often the Dependabot alerts permission was not accepted on GitHub. | ## Disconnect **Disconnect** deletes the connection, synchronized repositories and their links, and resolves GitHub findings; applications are not changed. Uninstalling the app on GitHub has the same effect. Then uninstall the app from **Manage on GitHub** if you no longer use it. ## Expected result Selected repositories appear in CISAPP, are linked to the right applications, Dependabot is active where you asked for it and its alerts appear in findings. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/gitlab Markdown: https://docs.cisapp.eu/en/organization/connectors/gitlab.md # Connect GitLab Authorize CISAPP on GitLab.com, link GitLab projects to applications and import their vulnerabilities into findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - A **GitLab.com** account that is a member of the projects to monitor with the **Developer** role or higher. Self-managed GitLab is not supported. - To import vulnerabilities: projects on **GitLab Ultimate** with at least one active security scanner (Dependency Scanning, SAST, Container Scanning, Secret Detection…). ## Connect the account 1. Open **My company → Connectors**, then **Connect** on the GitLab card. A panel sums up the steps and the requested access; click **Continue to GitLab**. 2. Sign in to GitLab.com if needed, then click **Authorize**. CISAPP only requests **read** access to the API (`read_api`). 3. You return to the connector record in CISAPP with the account's project list. The authorization link expires after 30 minutes and works once: if something fails, click **Connect** again. CISAPP acts with the rights of the GitLab account that authorized the application: preferably use a dedicated account, or one that will stay in the organization. ## Link projects to applications In the **Repositories** tab, use **Link to an application** to attach a GitLab project to one of your organization’s [applications](https://docs.cisapp.eu/en/registers/applications); the **Application** column shows the link. **Unlink** removes the link without changing anything on GitLab. The project then appears in the application’s **Code and DevSecOps** tab. The list shows the non-archived projects the account is a member of (Developer role or higher). **Synchronize** forces an immediate update; otherwise synchronization runs daily. ## Import vulnerabilities A project's **GitLab vulnerabilities** switch imports its open (detected or confirmed) vulnerabilities from the GitLab vulnerability report into CISAPP findings. Turning it off stops the import: the project's findings are resolved. Nothing changes on GitLab. - The **Open alerts** column of the **Repositories** tab shows the count per severity. - The **Alerts** tab shows totals by severity, the **Imported repositories** and the last synchronization date; **View findings** opens the findings list filtered on GitLab. - A vulnerability resolved or dismissed on GitLab is resolved in CISAPP at the next synchronization. ## Common issues | Message | What to do | | --- | --- | | The GitLab connector is not configured | The connector is not available on your platform yet: contact support. | | Authorization was denied on GitLab | You clicked **Deny**: click **Connect** again and authorize the application. | | The GitLab connection could not be validated | Expired or already used link: start the connection again. | | This GitLab account is already connected to another organization | A GitLab account can serve only one CISAPP organization: use another account. | | No repository synchronized | The account is not a member of any project with the Developer role or higher. | | No vulnerability although import is on | The project is not on GitLab Ultimate, or no scanner ran on the default branch. | | Synchronization error "reconnect" | Access was revoked on GitLab: disconnect, then connect GitLab again. | ## Disconnect **Disconnect** deletes the connection, the synchronized projects and their links, resolves the GitLab findings and revokes CISAPP's access on GitLab; applications are not changed. You can also review authorized applications from **Manage access on GitLab**. ## Expected result GitLab projects appear in CISAPP, are linked to the right applications, and their vulnerabilities appear in findings. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/ovh Markdown: https://docs.cisapp.eu/en/organization/connectors/ovh.md # Connect an OVHcloud account Authorize CISAPP read-only on an OVHcloud account to inventory cloud resources and report security posture findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - Be able to sign in to the OVHcloud account to analyze with its customer identifier (nichandle, like `xx11111-ovh`) with an account allowed to create API keys: the authorization is granted with that account. - Know the account **region**: Europe, Canada or United States. An OVHcloud account belongs to one region. - An OVHcloud account can only be connected to **one** CISAPP organization. CISAPP never asks for a password or a key to copy: authentication only happens on the OVHcloud site. ## Connect in CISAPP 1. Open **My company → Connectors**, then **Connect** on the OVHcloud card. 2. Choose the **account region** (Europe, Canada or United States), then **Continue to OVHcloud**. 3. You are redirected to the OVHcloud authorization page: sign in with the account to analyze. 4. Choose the **validity period** of the authorization. Prefer a **dated validity** over "Unlimited": an authorization without an expiration date is flagged in CISAPP, and you will have to renew it before it expires. 5. Authorize the access. OVHcloud brings you back to CISAPP automatically. 6. Check the displayed **OVHcloud account** (customer identifier), then **Connect**. The first synchronization starts. If you close the wizard before confirmation, the connection stays **Pending**: use **Resume validation** from its record (renew the authorization on OVHcloud, then confirm the account). If you refused the authorization or let the page expire, start the connection again to request a new one. ## What CISAPP collects CISAPP only performs **reads** (read-only requests, on a limited list of routes) and only reads **configuration**, never content: - Public Cloud: instances, security groups, volumes, private networks, Object Storage buckets (configuration, not the objects), managed databases, managed Kubernetes clusters; - dedicated servers, virtual private servers (VPS), web hostings; - domain names and DNS zones, IP address blocks; - services and their expiration and renewal dates; - account security: two-factor authentication, IP restrictions, API keys (expiration dates, last use, allowed addresses). A product that the authorization does not cover is reported as **not granted** in the synchronization result. Resources appear in the **Operational Safety → Cloud inventory** menu entry and its **Map** view, with their region and location. ## What CISAPP never reads CISAPP changes nothing in your account and never reads: - personal profile information (contacts, contact details) or phone numbers; - domain transfer codes; - IPMI access, Object Storage (S3) credentials, `kubeconfig` files or database access credentials; - bucket content (objects), secrets and encryption keys; - rescue passwords, SSH keys and access tokens of instances, servers and hostings. A single write is requested: letting the authorization **cancel itself** when you disconnect or renew the connection. ## Posture findings Findings appear in security findings with the **OVHcloud posture** source. A rule only triggers when the information is certain: an unknown state (product not granted, unreadable value) neither creates nor resolves a finding. - **Account**: two-factor authentication not enabled; API key without an expiration date, unused for more than 90 days or usable from any IP address. - **Domains**: domain without a transfer lock, without DNSSEC although the extension supports it, or close to expiry (less than 30 days) without automatic renewal. - **Services**: service close to expiry without automatic renewal, or unpaid. - **Network**: security group reachable from the whole Internet (0.0.0.0/0 or ::/0) on remote administration (SSH 22, RDP 3389) or on a common database port (3306, 5432, 6379, 27017…). - **Managed databases**: public access without an IP restriction, no backup. - **Kubernetes**: API reachable from the whole Internet, available upgrade not applied, audit logs missing. - **Object storage**: bucket without encryption at rest or without versioning. Public bucket detection is not possible with the OVHcloud API. - **Servers and hostings**: dedicated server without the OVHcloud hardware firewall enabled, web hosting without an SSL certificate, instance created from an end-of-support image. The connection's own key is excluded from these rules and handled separately: without an expiration date it shows a warning on the record; less than 30 days before expiry, a **Credentials expiring soon** badge. ## Renew the authorization 1. On the connection record, **Update credentials** then **Renew the authorization**. 2. You are redirected to OVHcloud: sign in to the **same account**, choose a new dated validity and authorize. 3. Back in CISAPP, confirm the account. The new authorization replaces the old one, which is revoked. 4. If it belongs to **another OVHcloud account**, it is refused and the current authorization is kept. The region cannot be changed after creation: an OVHcloud account belongs to one region. ## Disconnect and revoke **Disconnect** deletes the connection and its cloud inventory, and marks its posture findings as resolved. CISAPP also automatically asks OVHcloud to cancel the authorization; if that cancellation fails, it stays valid until it expires. Then revoke it manually in your OVHcloud account, in the API keys (credentials) section, by deleting the authorization created for CISAPP. ## Common issues | Message | What to do | | --- | --- | | The OVHcloud connector is unavailable on this instance | The connector is not configured on your platform yet: contact support. | | The OVHcloud validation is not finished, or the authorization was refused or expired | Finish the validation on the OVHcloud page, or start the connection again to get a new authorization. | | OVHcloud refused this authorization | The validation was refused or expired: start the connection again. | | This OVHcloud account is already connected by another CISAPP organization | An OVHcloud account has a single connection: disconnect it from the other CISAPP organization first. | | This authorization belongs to another OVHcloud account | When renewing, sign in to the same OVHcloud account. | | Product "not granted" | The authorization does not cover this product: renew it, then check that your account has access to it. | | Expired service (error 460) in the synchronization | A service (for example a domain) has expired at OVHcloud: this is not an authorization problem, the rest of the account is analyzed. Renew or delete that service. | | Expired or refused credentials | The authorization expired or was revoked: renew it from the record. | ## Expected result The connection is active, the cloud inventory is populated and OVHcloud posture findings appear in CISAPP. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/connectors/scaleway Markdown: https://docs.cisapp.eu/en/organization/connectors/scaleway.md # Connect a Scaleway organization Create a read-only Scaleway API key to inventory cloud resources and report security posture findings. > **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform. ## Prerequisites - Be an organization administrator in CISAPP. - Be able to create an application, a policy and an API key in the **IAM** of the target Scaleway organization (owner or equivalent rights). - A Scaleway organization can only be connected to **one** CISAPP organization. ## Create the access in Scaleway CISAPP never uses your personal account: create a dedicated, read-only **IAM application**. 1. In the Scaleway console, **IAM → Applications**: create an application (for example `cisapp-readonly`). 2. **IAM → Policies**: create a policy for this application with exactly the permission sets below. 3. **IAM → API keys**: create an API key for the application, with an **expiration date** (recommended). Note the **access key** and the **secret key**. ### Permission sets to grant | Scope | Permission sets | | --- | --- | | Projects to analyze | `InstancesReadOnly`, `ObjectStorageBucketsRead`, `RelationalDatabasesReadOnly`, `LoadBalancersReadOnly`, `VPCReadOnly`, `KubernetesReadOnly`, `FunctionsReadOnly`, `ContainersReadOnly`, `ContainerRegistryReadOnly`, `BlockStorageReadOnly` | | Organization | `IAMReadOnly`, `ProjectReadOnly` | If a product is not granted, CISAPP reports it as "not granted" in the synchronization and analyzes the rest. Grant the permission sets on **every project** of the organization, or restrict the connection to the granted projects with the **Projects** field: otherwise projects without these permissions are reported as not collected at every synchronization. **Never grant** `SecretManagerSecretAccess`, any `*FullAccess` or `*Manager` set, `BillingReadOnly` or `AllProductsReadOnly`: CISAPP does not need them. > Scaleway shows the secret key only **once**. CISAPP stores it encrypted and never displays it again. The CISAPP wizard also offers a collapsible guide with a command-line example (`scw iam …`). It is an example to adapt: check the arguments with `scw iam --help` before running it. ## Connect in CISAPP 1. Open **My company → Connectors**, then **Connect** on the Scaleway card. 2. Paste the **access key** (it starts with `SCW`) and the **secret key**. 3. Optionally list the **projects** (UUID identifiers) and the **regions** to analyze. Empty: every project the key can access and every region. 4. **Verify the key**: CISAPP tests access with Scaleway before saving anything. 5. Check the displayed **Scaleway organization**, then **Connect**. The first synchronization starts. If you close the wizard before confirmation, the connection stays **Pending**: use **Confirm the account** from its record. ## What CISAPP collects CISAPP only reads **configuration**, never content: - instances and their security groups, volumes; - object storage buckets (configuration, not the objects), managed databases; - load balancers, Kapsule clusters, Functions and Containers, container registries, private networks; - IAM users and API keys (MFA status, expiration dates). CISAPP never reads secrets (Secret Manager), environment variables, instance user data or the `kubeconfig` access file, and changes nothing in your organization. Resources appear in the **Operational Safety → Cloud inventory** menu entry and its **Map** view. ## Posture findings Findings appear in security findings with the **Scaleway posture** source. A rule only triggers when the information is certain: an unknown state (missing permission, product not granted) neither creates nor resolves a finding. - **Network**: security group reachable from the whole Internet (0.0.0.0/0 or ::/0) on remote administration (SSH 22, RDP 3389) or on a common database port (3306, 5432, 6379, 27017…); inbound default policy set to "accept" on a group attached to a server; server with a public IP behind a permissive group. - **Databases**: public access whose ACL allows 0.0.0.0/0, encryption at rest disabled, automatic backups disabled or no ready backup (a new database is flagged until its first backup), no high availability. - **Object storage**: bucket whose ACL opens access to everyone (`AllUsers`) or to any authenticated user, versioning disabled or suspended. - **Load balancers**: HTTP frontend (port 80) without a certificate, TLS level "old" on a load balancer that terminates TLS. - **Kubernetes**: cluster to upgrade without automatic upgrade, open API (cluster ACL that explicitly allows 0.0.0.0/0 or ::/0; an empty ACL is not reported, and a private network does not make the API private). - **Functions, Containers and registries**: public function or container (invocable without a token), public container registry. - **IAM**: user without multi-factor authentication, API key without an expiration date or created more than 365 days ago. The connection's own key is excluded from these rules and handled separately: without an expiration date it shows a warning on the record; less than 30 days before expiry, a **Credentials expiring soon** badge. ## Replace the key (rotation) 1. Create a new API key for the same application, with an expiration date. 2. On the connection record, **Update credentials** and paste the new access key and secret key. 3. The new key must belong to the **same Scaleway organization**; otherwise it is refused and the current key is kept. 4. Then revoke the old key in the Scaleway console. Projects and regions can be changed from the record (**Edit**), without re-entering the key. Removing a project or region from the connection removes its resources from the inventory at the next sync. ## Common issues | Message | What to do | | --- | --- | | The Scaleway connector is unavailable on this instance | The connector is not configured on your platform yet: contact support. | | Scaleway refused this API key | Check that the key is neither revoked nor expired and that the policy grants at least `IAMReadOnly` and `ProjectReadOnly` on the organization, in addition to the per-product read sets. | | This Scaleway organization is already connected by another CISAPP organization | A Scaleway organization has a single connection: disconnect it from the other CISAPP organization first. | | This API key belongs to another Scaleway organization | When rotating, use a key from the same Scaleway organization. | | Expired or refused credentials | Create a new key and rotate it from the record. | | Product "not granted" | Add the matching permission set to the application's policy. | ## Disconnect **Disconnect** deletes the connection and its cloud inventory, and marks its posture findings as resolved. Then revoke the API key (and the application if it is no longer used) in **IAM** in the Scaleway console. ## Expected result The connection is active, the cloud inventory is populated and Scaleway posture findings appear in CISAPP. See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors). --- Source: https://docs.cisapp.eu/en/organization/plans-billing Markdown: https://docs.cisapp.eu/en/organization/plans-billing.md # Understand plans, quotas and billing Read your plan’s capabilities and find billing documents. > **Access:** organization administrator. Subject to enabled modules and your plan. ## Review the plan An administrator opens **Administration → Plan and Billing**. Review the current plan, displayed capabilities and change options actually offered. Accessible functionality depends on both the plan and activation. ## Read quotas Relevant screens display limits: created vendors, activities, projects, storage or monitored assets. The interface shows quantities relevant to your plan; do not assume figures in documentation screenshots apply to your organization. An inactive vendor remains recorded and still counts toward created vendors. Soft-deleting the relationship therefore does not necessarily free a place. ## Billing Open **Billing** to review information and documents offered to your account. Check the period and organization before downloading a document. **Administration → Plan and billing** may also lead to related management. ## Feature flags An administrator can review organization functionality under **Feature flags**. Activation or lifecycle adjustment does not unlock a feature excluded from the plan. Some pages remain under construction even when their menu entry is visible. ## Expected outcome You can distinguish a quota issue from a permission or availability issue. For the complete checklist, see [Feature availability](https://docs.cisapp.eu/en/help/availability). --- Source: https://docs.cisapp.eu/en/guides/onboard-vendor Markdown: https://docs.cisapp.eu/en/guides/onboard-vendor.md # Onboard a new vendor A journey from identifying a third party to its first assessment. > **Access:** member. Subject to enabled modules and your plan. ## How do you onboard and assess a vendor? In CISAPP, vendor onboarding means finding or creating the record, qualifying criticality, linking business activities and preparing a suitable assessment. Reviewing answers and evidence then supports follow-up decisions. This third-party risk management journey keeps vendor identification connected to assessment. ## Goal and preparation Obtain a reliable record, qualify business importance and prepare the first assessment. Prepare the website, vendor contact and supported activities. You need vendor-creation and assessment-creation permissions and an available quota. ## 1. Identify the third party Search for the company under **Registers → Suppliers** first. If it exists, open its record and check access. Otherwise, follow [Create a vendor](https://docs.cisapp.eu/en/registers/create-vendor). ## 2. Qualify the relationship Enter contact details, choose business criticality and add useful contacts. Identify who will answer the questionnaire and who will own the relationship in your organization. ![Qualifying the vendor](https://docs.cisapp.eu/images/en/vendor-criticality.webp) *Criticality helps match review effort to business importance. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/vendor-criticality.webp)* ## 3. Link activities Open relevant [business activities](https://docs.cisapp.eu/en/registers/activities) and link the vendor. Then check the [dependency map](https://docs.cisapp.eu/en/reporting/dependencies). ## 4. Start the first assessment Choose a questionnaire suited to the need. Follow [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor), review the scope and check respondent access. ## 5. Plan follow-up Record points to clarify and organize actions after responses arrive. Create a risk when the scenario warrants it and an action plan if several actions are needed. ## Success criteria The record is identifiable, criticality is recorded, useful dependencies are linked and the assessment is accessible to the relevant people. No duplicate was created to work around an access problem. ## Common questions ### Do you need a new vendor record for every assessment? No. Search for the vendor first and use its existing record if it represents the company being assessed. A new assessment does not justify a duplicate; check permissions if the record is inaccessible. ### What information should you prepare before onboarding? Prepare the vendor’s identity and website, the service, supported activities and useful contacts. Business criticality and questionnaire expectations should match this relationship, not just the company name. ### Does an assessment automatically determine the risk decision? The decision requires a review of answers, evidence and business context. Read the [assessment results](https://docs.cisapp.eu/en/assessments/results), then document risks and actions needing follow-up. Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/guides/launch-assessment Markdown: https://docs.cisapp.eu/en/guides/launch-assessment.md # Launch an assessment end to end Prepare the scope, create the assessment and check respondent access. > **Access:** assessment creation. Subject to enabled modules and your plan. ## How do you launch a vendor assessment in CISAPP? To launch an assessment, choose the appropriate type, subject and questionnaires, then define context and access before confirming. Next, check that the respondent can open the questionnaire. For a vendor, this avoids confusing assessment creation with the actual start of response collection. ## Before you start Define the decision the assessment should inform. Prepare the subject, questionnaire and participants. Check your assessment-creation permission. ## Journey 1. Choose the [assessment type](https://docs.cisapp.eu/en/assessments/types) matching the subject. 2. Open its list under **Reviews**, then start creation. 3. Select the requested scope or subject. 4. Choose suitable questionnaires; review content rather than only titles. 5. Complete the name, context and access at the offered steps. 6. Review the summary and confirm. 7. Open the created assessment and check its response questionnaires. 8. Check respondent access and invitation status before asking them to begin. ![Finalizing the assessment](https://docs.cisapp.eu/images/en/evaluation-finalize.webp) *The final check covers the subject, questionnaires and access. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/evaluation-finalize.webp)* ## During and after completion Track progress in the assessment. If a response is missing, clarify expectations with the respondent. Once received, [review results](https://docs.cisapp.eu/en/assessments/results) and evidence before deciding follow-up. ## Success criteria The right subject is assessed, the questionnaire is accessible to the right respondent and the owner can track progress. Creating an assessment without checking respondent access is not enough to start collection. ## If blocked A missing subject or questionnaire may relate to permissions, purpose or the plan. Resolve that before recreating the assessment. ## Expected outcome The assessment and intended questionnaires are accessible to the appropriate people. Tracking distinguishes missing responses from completed assessments. ## Common questions ### What is the difference between a questionnaire and an assessment? A questionnaire contains questions. An assessment links them to a subject, a scope and the people involved. Choose the [assessment type](https://docs.cisapp.eu/en/assessments/types) before selecting suitable questionnaires. ### Why is my questionnaire missing from the picker? Check its destination, purpose and your viewing permissions in the [library](https://docs.cisapp.eu/en/assessments/questionnaires). Being absent from the picker does not necessarily mean the questionnaire was deleted. ### How can you check that response collection has started? Open the created assessment, check respondent access and track response progress. An assessment appearing in a list does not prove that a respondent can access it or has started completing it. Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/guides/respond-questionnaire Markdown: https://docs.cisapp.eu/en/guides/respond-questionnaire.md # Answer a received questionnaire A journey for colleagues and external respondents invited to complete an assessment. > **Access:** respondent. Subject to enabled modules and your plan. ## How do you answer a security questionnaire? To answer a questionnaire received in CISAPP, use the account associated with the invitation, check the subject and complete answers with the requested evidence. Check that changes are saved and verify the status after submission when that action is available. Saving and finalizing are separate steps. ## Preparation Use the email address the invitation was sent to. Prepare responses and supporting documents. If you represent a vendor, check the organization and request scope. ## Journey 1. Open the received link and [sign in or activate your account](https://docs.cisapp.eu/en/getting-started/sign-in). 2. Check the displayed questionnaire title, subject and requesting organization. 3. Browse sections to understand the information expected. 4. Answer questions and complete offered comments and evidence. 5. Check progress and save state after changes. 6. Review required responses and attachments. 7. Submit when available, then check the displayed status. ![Navigation within the response questionnaire](https://docs.cisapp.eu/images/en/assessment.webp) *The outline helps check sections before submission. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/assessment.webp)* ## If information is missing Contact the assessment owner. Distinguish a pending response from a negative one; do not invent evidence to finish the form. ## If access fails Check the account email, activation and invitation. Find your assessments and the questions assigned to you under **Assessments → To be addressed**, or use the received link. Ask the owner to check permissions if the questionnaire does not open. ## Success criteria Expected responses are saved and status confirms submission when required. The owner can review information and supporting evidence. ## Expected outcome Your responses are saved and the request state has been checked before informing its sender of progress. ## Common questions ### Can you prepare answers before submitting? Complete answers and check that they are saved as you work. Review information and attachments before using the submission action when offered. Do not infer finalization from the progress percentage alone. ### What if you do not know an answer? Ask the relevant owner for information and tell the assessment owner what is pending. Missing information should not become a negative answer or invented evidence. ### Why has an invitation link stopped working? Check the account address, activation and invitation validity. If the link expired or was revoked, ask the owner to resend it. See [troubleshooting](https://docs.cisapp.eu/en/help/troubleshooting) before creating another account. Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/guides/treat-risk Markdown: https://docs.cisapp.eu/en/guides/treat-risk.md # Move from a risk to a treatment plan Record the scenario, decide treatment and verify implemented controls. > **Access:** member. Subject to enabled modules and your plan. ## How do you create a risk treatment plan? A treatment plan connects a risk scenario to a decision, controls, owners and deadlines. In CISAPP, document the risk and its assessment, organize actions, then verify controls before reassessing residual risk. Creating tasks is part of follow-up, not evidence of risk reduction. ## Preparation Start with a precise fact or scenario, such as a vendor outage affecting a critical activity. Prepare context, ownership and assessment information. ## Journey 1. Check whether the risk already exists under **Registers → Risks**. 2. Otherwise, [create it](https://docs.cisapp.eu/en/risks/register) with its scenario and affected entities. 3. Assess likelihood and impact using the organization’s methodology. 4. Decide a treatment strategy and record its justification. 5. Add useful controls, owners and deadlines. 6. Use an [action plan](https://docs.cisapp.eu/en/collaboration/projects) if work involves multiple actions. 7. Update controls as work progresses and verify evidence. 8. Reassess residual risk, then use the appropriate lifecycle action. ![Risk register for review](https://docs.cisapp.eu/images/en/risks.webp) *The register helps find risks before preparing decisions. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/risks.webp)* ## If a gap must be tolerated temporarily An administrator can prepare an [exemption](https://docs.cisapp.eu/en/risks/exemptions) with justification, compensating controls and a deadline. An exemption does not replace risk treatment. ## Success criteria The scenario, decision, actions and residual level are reviewable. Do not close a risk solely because an action was created: implementation and verification should support the decision. ## Expected outcome The risk has a treatment approach, owners and tracking that can be reviewed at the next checkpoint. ## Common questions ### What is the difference between a treatment plan and an action plan? Treatment explains how the risk is addressed and how its level will be reviewed. An [action plan](https://docs.cisapp.eu/en/collaboration/projects) organizes actions and their completion. Link actions to the risk to preserve the decision context. ### When should you reassess residual risk? Reassess it when you have information about control completion and effectiveness. Apply your organization’s method and retain evidence supporting the new level. A passed deadline does not demonstrate that a control works. ### Does an exemption replace the treatment plan? No. An [exemption](https://docs.cisapp.eu/en/risks/exemptions) sets conditions for a temporary deviation, including justification and a deadline. Treatment and control follow-up remain necessary; preparing an exemption requires organization-administrator access. Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/guides/risk-committee Markdown: https://docs.cisapp.eu/en/guides/risk-committee.md # Prepare a third-party risk committee Gather indicators, prioritize topics and record decisions. > **Access:** member. Subject to enabled modules and your plan. ## How do you prepare a vendor risk committee? To prepare a vendor risk committee, gather critical third parties, recent assessments, risks requiring decisions and ongoing actions. Specify the period, scope and missing information. In CISAPP, start with indicators, then open detailed records to prepare traceable decisions. ## Preparation Define the review period and vendor scope. Check that registers, criticality levels and activity relationships are current. ## Gather information 1. Open **Home** and refresh indicators. 2. Filter the vendor register for critical vendors or those needing assessment. 3. Review recent assessments and identify missing responses or evidence. 4. Filter risks by criticality and status. 5. Review exemptions expiring within 30 days. 6. Examine dependencies and concentration for important activities. 7. Prepare available exports with their dates and scopes. ![Reporting indicators for the review](https://docs.cisapp.eu/images/en/dashboard.webp) *Indicators guide the review; decisions should rely on detailed records. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/dashboard.webp)* ## During the committee For each topic, check context, the decision needed, owner and deadline. Distinguish established facts from missing data. Record actions in the relevant risks, controls or action plans. ## After the committee Update decisions and deadlines. Assign actions and check they are visible to the relevant people. Keep useful documents in Files with appropriate permissions. ## Expected outcome Each decision is linked to a subject and follow-up. The next review can establish what changed. This journey uses current views and does not require customizable dashboards. Viewing exemptions requires organization-administrator access. If you do not have it, ask an authorized person to prepare that part of the review. ## Common questions ### What information should you present to the committee? Present topics requiring a decision, their context, available evidence and proposed follow-up. Indicators guide the review; vendor records, assessments and risks explain individual situations. ### Can you prepare the committee without a customizable dashboard? Yes. This journey uses the [current dashboard](https://docs.cisapp.eu/en/reporting/dashboard), registers and dependency views. It does not rely on a widget editor or a feature under construction. ### How do you follow up decisions after the committee? Record decisions on the relevant risks, controls or action plans with an owner and deadline. Check access for people responsible for actions and retain useful documents. The next review should be able to find decisions and subsequent changes. Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions). --- Source: https://docs.cisapp.eu/en/help/troubleshooting Markdown: https://docs.cisapp.eu/en/help/troubleshooting.md # Troubleshoot a problem Check sign-in, permissions, filters, imports and invitations. > **Access:** member. ## Before you start Record the action, displayed message, time and affected module. Check the current organization and that your session is still active. ## Cannot sign in 1. Check the sign-in address and the email used for your invitation. 2. Use **Forgot your password?** when necessary; open the most recent link. 3. Check your spam folder and the link expiry date. 4. Complete any additional authentication configured for your account. See [Sign-in and account](https://docs.cisapp.eu/en/getting-started/sign-in) for activation and authorization states. ## Missing feature or resource | Symptom | Check | |---|---| | Missing menu | Plan availability, module activation and account role. | | Access denied | Organization-level permission, then access to the resource or its team. | | Empty list | Search, filters, status and current organization. | | Disabled button | Required fields and previous steps. | | Cannot create a vendor | Plan quota; inactive vendors may still count. | | “Under construction” page | Unavailable in this version; see alternatives under [Availability](https://docs.cisapp.eu/en/help/availability). | Ask an administrator to review [permissions and sharing](https://docs.cisapp.eu/en/organization/permissions). A direct URL does not grant extra access. ## Questionnaires, imports and invitations - Questionnaire missing from a picker: check its purpose, type and viewing permissions. - Response not saved: wait for confirmation; saving and finalizing are separate actions. - Import rejected: use the supplied template, check columns and values and review the import report before retrying. - Expired or revoked invitation: request a new invitation from the affected resource. - Attachment inaccessible: check sharing and the file distribution level. ## Prepare a support request Provide the module, time, reproduction steps, exact message and a screenshot with sensitive information hidden. Never share passwords, authentication codes or private invitation links. The expected outcome is either a successful action after correction or a reproducible report for your administrator or CISAPP contact. --- Source: https://docs.cisapp.eu/en/help/availability Markdown: https://docs.cisapp.eu/en/help/availability.md # Understand feature availability Distinguish plans, roles, activation, beta features and unfinished screens. > **Access:** member. ## Why your screen may differ Menus depend on your organization’s plan, enabled features, their lifecycle and your permissions. Documentation describes the product checked on the date shown above each article. Screenshots use a demonstration workspace with fictional data. Your organization may display fewer modules, different names or more data. ## Check availability 1. Check the current organization. 2. Ask an administrator to review **Plans**, quotas and enabled modules. 3. Check your role and resource sharing. 4. Read the badges shown in the application: **Beta** indicates functionality that may change. This guide does not guarantee one fixed list of options for every plan: your organization’s subscription and enabled features determine availability. ## Screens currently under construction | Area | Limitation and alternative | |---|---| | Partners & others | Use the Vendors, Activities, Applications and Projects registers. | | Pending assessments | Open the shared assessment or the link in your invitation. | | Campaigns | Use individual assessments; these screens do not currently provide an operational campaign workflow. | | NIS2, DORA, AI Act | Dedicated pages do not provide operational tracking; use frameworks actually offered in Compliance. | | My exposure, Certifications, My clients, Shares | These pages do not yet provide a working posture-sharing portal. | | Administration: users and roles, security, workflows | Use the operational My organization pages for members, permissions and security settings. | ## Dashboards Dashboards can be customized: templates, widgets, queries and formulas. Creating and editing them depends on your rights. See [Dashboards](https://docs.cisapp.eu/en/reporting/dashboard) and [Configure a widget](https://docs.cisapp.eu/en/reporting/widgets). ## Expected outcome You can explain a difference between this guide and your workspace and identify the appropriate administrator or module. A hidden feature is not necessarily broken. --- Source: https://docs.cisapp.eu/en/help/glossary Markdown: https://docs.cisapp.eu/en/help/glossary.md # Glossary Terms used in registers, assessments and treatment plans. > **Access:** member. | Term | Definition | |---|---| | Activity | Business process supported by resources and vendors. | | Criticality | Importance of a subject to the organization and potential impact of its failure. | | Vendor | Third party tracked for its services and dependencies. | | Assessment | Workflow associating a subject, scope and questionnaires. | | Questionnaire | Structured set of questions to answer or reuse in an assessment. | | Campaign | Intended grouping of assessments; dedicated screens are under construction in this version. | | Framework | Set of requirements used as a basis for compliance tracking. | | Requirement | Expected outcome that applies to an organization within a defined scope. | | Control | Action or safeguard used to meet a requirement or treat a risk. | | Evidence | Document or information demonstrating implementation or effectiveness of a control. | | Initial risk | Risk level assessed before considering planned treatment. | | Residual risk | Risk remaining after treatment measures are considered. | | Incident | Event to qualify, track and close based on its impacts. | | Crisis | Situation requiring exceptional coordination and decisions. | | Exemption | Temporary acceptance of a deviation, with conditions and an expiry date. | | Dependency | Relationship between an activity and supporting vendors or resources. | | Concentration | Significance of a common dependency across multiple activities or vendors. | | ASM | Attack surface management: scopes, exposed assets and findings. | | Trust Center | Area for presenting and sharing trust information according to configured access. | | TLP | File distribution level that complements access permissions. | | Role | Permission assigned to a member or a resource user. | | Team | Group of members with whom resources may be shared. | See [Permissions and sharing](https://docs.cisapp.eu/en/organization/permissions) and [Availability](https://docs.cisapp.eu/en/help/availability) to distinguish access, plans and activation. --- Source: https://docs.cisapp.eu/en/help/use-with-ai Markdown: https://docs.cisapp.eu/en/help/use-with-ai.md # Use the documentation with AI Copy a Markdown article or give an assistant the documentation indexes. > **Access:** member. ## Read or copy an article Every article is available as HTML and Markdown, generated from the same source. 1. Open the relevant article. 2. Select **Copy Markdown** to copy its content with absolute links and image URLs. 3. Or select **View Markdown** to open and save the text file. 4. Give that text to your assistant along with your question. Add `.md` to an article URL. For the home page, use `/index.md` or `/en/index.md`. ## Indexes and exports | Resource | Purpose | |---|---| | [General index](https://docs.cisapp.eu/llms.txt) | Choose a language and corpus. | | [French index](https://docs.cisapp.eu/fr/llms.txt) | Find French articles and their descriptions. | | [Complete French documentation](https://docs.cisapp.eu/fr/llms-full.txt) | Import the French corpus into a tool. | | [English index](https://docs.cisapp.eu/en/llms.txt) | Find English articles. | | [Complete English documentation](https://docs.cisapp.eu/en/llms-full.txt) | Import the English corpus. | | [Complete FR/EN documentation](https://docs.cisapp.eu/llms-full.txt) | Import both languages together. | An assistant with web access can use the index to select relevant articles. If your tool cannot retrieve links, download and attach the file yourself. Support for `llms.txt` depends on the tool. ## Example request > Using the attached CISAPP documentation, explain how to onboard a vendor and launch its first assessment. Cite the articles, specify the required permissions and flag unavailable features. Exports describe product behavior. They contain no data from your organization and grant no account access. Check the assistant’s suggestions in your workspace, especially permissions, quotas and beta availability. ## Troubleshooting If copying fails, open **View Markdown** and copy the text manually. If an assistant cannot read a URL, attach the file. For an imprecise answer, narrow your request to one workflow and ask for article references. --- Source: https://docs.cisapp.eu/en/help/common-questions Markdown: https://docs.cisapp.eu/en/help/common-questions.md # Common questions about vendors, risk and compliance CISAPP helps organize vendors, their assessments, risks and compliance information. Find short answers to common third-party risk management questions, then follow the procedures to put them into practice. Available modules depend on your plan and permissions. ## How do you assess a vendor’s security? Define the service and affected business activities, qualify the vendor’s importance, then choose a questionnaire suited to the information you need. Review responses and evidence before deciding follow-up actions. In CISAPP, the journey links a vendor record to an assessment; a score alone does not replace this review. Follow [Onboard a vendor](https://docs.cisapp.eu/en/guides/onboard-vendor), then [Launch an assessment](https://docs.cisapp.eu/en/guides/launch-assessment). ## What is the difference between vendor criticality and cyber risk? Criticality describes how important the vendor is to your business and the consequences of its failure. Risk concerns a scenario, its likelihood and its impact. A critical vendor deserves attention, but its criticality alone does not demonstrate a security weakness. See [Create and qualify a vendor](https://docs.cisapp.eu/en/registers/create-vendor) and the [risk register](https://docs.cisapp.eu/en/risks/register). ## Which vendors should you assess first? Start with vendors supporting important activities, creating strong dependencies or requiring an upcoming decision. Check existing assessments and missing information to avoid duplicate requests. Priority depends on your business context and risk method. Use the [dependency maps](https://docs.cisapp.eu/en/reporting/dependencies) and [Prepare a third-party risk committee](https://docs.cisapp.eu/en/guides/risk-committee). ## How do you choose a vendor assessment questionnaire? Choose a questionnaire whose purpose and questions match the subject being assessed. Review sections, expected answers and useful evidence before selecting it. In CISAPP, a questionnaire may be absent from the picker because of its purpose or your permissions. See the [questionnaire library](https://docs.cisapp.eu/en/assessments/questionnaires) and [assessment types](https://docs.cisapp.eu/en/assessments/types). ## How do you answer a security questionnaire you have received? Open the invitation with the account matching its recipient address, check the subject and complete answers with their evidence. Check that changes are saved, then check the status after submission when that action is offered. A saved response is not necessarily a finalized response. Follow [Respond to a received questionnaire](https://docs.cisapp.eu/en/guides/respond-questionnaire). ## What should you check when a respondent cannot open an assessment? Check the account address, activation, invitation validity and resource access. Organization roles and assessment permissions are separate checks. Recreating an assessment does not necessarily resolve a sharing problem. See [Permissions and sharing](https://docs.cisapp.eu/en/organization/permissions) and [troubleshooting](https://docs.cisapp.eu/en/help/troubleshooting). ## How do you turn a risk into an action plan? Describe the scenario, assess it with your method and choose a treatment. Assign controls to owners and deadlines, verify their completion and reassess residual risk. An action plan can organize actions, but creating it does not prove the risk has been treated. Follow [Move from a risk to a treatment plan](https://docs.cisapp.eu/en/guides/treat-risk). ## What is the difference between initial and residual risk? Initial risk is the level assessed before the planned treatment. Residual risk is what remains after taking controls into account. Its reassessment should rely on controls actually completed and the evidence available. See the [treatment plan](https://docs.cisapp.eu/en/risks/treatment) and [glossary](https://docs.cisapp.eu/en/help/glossary). ## Which indicators should you prepare for a vendor risk committee? Gather critical vendors, assessment progress, missing answers or evidence, risks requiring decisions and actions to follow up. Add important dependencies and, with an authorized account, exemptions nearing their deadline. Date the information and specify its scope. Follow [Prepare a third-party risk committee](https://docs.cisapp.eu/en/guides/risk-committee) and the [dashboard guide](https://docs.cisapp.eu/en/reporting/dashboard). ## How do you organize compliance evidence? Link applicable requirements to controls and the evidence demonstrating their completion. Check document access so reviewers can read them. Storing evidence alone does not establish compliance. See [Requirements, controls and evidence](https://docs.cisapp.eu/en/compliance/requirements-controls) and [file management](https://docs.cisapp.eu/en/collaboration/files). ## What is a Trust Center used for? A Trust Center presents trust information and supports sharing under configured access rules. It complements assessments and document exchanges; it does not replace reviewing the information received. Availability in CISAPP depends on module activation and your plan. See [Configure and use the Trust Center](https://docs.cisapp.eu/en/compliance/trust-center). ## What is the difference between vendor assessment and ASM? An assessment collects and reviews information about a subject using questionnaires and evidence. ASM concerns the external attack surface: scopes, exposed assets and vulnerabilities. They provide complementary information without covering all risks on their own. See [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor) and [ASM and attack surface](https://docs.cisapp.eu/en/security/scopes-analyses). ## Can you import a questionnaire from Excel? Yes, when Excel questionnaire import is enabled for your plan. CISAPP analyzes the workbook; you then review sheets, sections and recognized elements, correct mappings if necessary and publish the questionnaire. Pay particular attention to merged cells and ambiguous headers. Follow the [Excel import guide](https://docs.cisapp.eu/en/assessments/excel-import). ## Can you already use the NIS2 and DORA screens in CISAPP? Dedicated NIS2 and DORA screens are under construction in the verified version. Appearing in a menu does not mean the workflow is operational. Check available compliance features and documented limitations before organizing your work. See [NIS2, DORA and AI Act](https://docs.cisapp.eu/en/compliance/overview) and [feature availability](https://docs.cisapp.eu/en/help/availability). ## How can you use this documentation with an AI assistant? Give the assistant the relevant Markdown article or the index for your language, then ask it to cite sources and explain access conditions. If it cannot fetch URLs, attach the downloaded file. Public documentation does not grant access to your account data. See [Use the documentation with AI](https://docs.cisapp.eu/en/help/use-with-ai).