# CISAPP documentation

> Functional guides for CISAPP users and organization administrators.

English documentation based on verified functionality. Access requirements and unavailable features are described in the articles.

## Getting started

- [CISAPP documentation](https://docs.cisapp.eu/en/index.md): CISAPP guides to assess vendors, manage third-party risk, track compliance and answer security questionnaires.
- [Welcome to CISAPP](https://docs.cisapp.eu/en/getting-started/welcome.md): Understand the main workspaces and choose your first guide.
- [Sign in and activate your account](https://docs.cisapp.eu/en/getting-started/sign-in.md): Activate an invitation, use a password or SSO and resolve sign-in issues.
- [Navigate and search](https://docs.cisapp.eu/en/getting-started/navigation.md): Use menus, the command palette and list filters.

## Registers & vendors

- [The vendor register](https://docs.cisapp.eu/en/registers/vendors.md): Search, filter and export your organization’s vendors.
- [Create and qualify a vendor](https://docs.cisapp.eu/en/registers/create-vendor.md): Identify a company, set its criticality and add contacts.
- [Use the vendor record](https://docs.cisapp.eu/en/registers/vendor-record.md): Find a vendor’s information, contacts, notes, assessments and access.
- [Describe business activities](https://docs.cisapp.eu/en/registers/activities.md): Create an activity, qualify its criticality and link its vendors.
- [Applications](https://docs.cisapp.eu/en/registers/applications.md): List the organization's applications, built in-house or supplied by a vendor, and track their repositories, relations, personal data and assessments.
- [Read vendor maps](https://docs.cisapp.eu/en/registers/maps.md): Explore vendor criticality and the data vendors process.
- [Projects and launch decision](https://docs.cisapp.eu/en/registers/projects.md): Create a project, appoint the security reviewer and decision maker, review deliverables and record the security opinion, then the launch decision.

## Assessments & questionnaires

- [Choose an assessment type](https://docs.cisapp.eu/en/assessments/types.md): Distinguish vendor, application, project, criticality, audit and tender assessments.
- [Assess a vendor](https://docs.cisapp.eu/en/assessments/vendor.md): Select a vendor, questionnaires and finalize access.
- [Audits, applications, projects and activity criticality](https://docs.cisapp.eu/en/assessments/audits-projects.md): Match the scope and questionnaire to the assessed subject.
- [Compare vendors](https://docs.cisapp.eu/en/assessments/comparison.md): Prepare a tender with multiple vendors and a shared assessment basis.
- [Manage questionnaires](https://docs.cisapp.eu/en/assessments/questionnaires.md): Choose a template, create a questionnaire and organize questions.
- [Complete and submit responses](https://docs.cisapp.eu/en/assessments/responses.md): Open the right questionnaire, complete sections and check before submission.
- [Read assessment results](https://docs.cisapp.eu/en/assessments/results.md): Interpret progress, responses, scores and evidence.
- [Import an Excel questionnaire](https://docs.cisapp.eu/en/assessments/excel-import.md): Analyze a workbook, review its structure and publish the questionnaire.
- [Respond as a vendor](https://docs.cisapp.eu/en/assessments/vendor-workspace.md): Find client assessments and distinguish the client register from My exposure.

## Risks & incidents

- [Identify and assess a risk](https://docs.cisapp.eu/en/risks/register.md): Create a scenario, link the scope and assess the risk level.
- [Track risk treatment](https://docs.cisapp.eu/en/risks/treatment.md): Choose a strategy, track controls and review residual risk.
- [Report and track an incident](https://docs.cisapp.eu/en/risks/incidents.md): Qualify an event, track its timeline and manage communication.
- [Prepare for and manage a crisis](https://docs.cisapp.eu/en/risks/crisis.md): Find the crisis guide, emergency contacts and active cells.
- [Manage an exemption](https://docs.cisapp.eu/en/risks/exemptions.md): Define the target, justification, accepted risk and validity period.

## Compliance & trust

- [Start tracking compliance](https://docs.cisapp.eu/en/compliance/overview.md): Create a compliance workspace and read framework coverage.
- [Track requirements and controls](https://docs.cisapp.eu/en/compliance/requirements-controls.md): Organize frameworks, update controls and export the SoA.
- [Share your Trust Center](https://docs.cisapp.eu/en/compliance/trust-center.md): Prepare a compliance snapshot, choose its visibility and revoke its link.
- [Maintain GDPR registers](https://docs.cisapp.eu/en/compliance/gdpr.md): Create a register and describe processing activities, data and transfers.
- [Assess a data breach](https://docs.cisapp.eu/en/compliance/breaches.md): Describe an event and use the severity assessment wizard.
- [Manage governance documents](https://docs.cisapp.eu/en/compliance/documents.md): Use the catalogue, prepare required documents and track your documents.

## Reporting

- [Read and build dashboards](https://docs.cisapp.eu/en/reporting/dashboard.md): Read Home, create a dashboard from a template, add widgets, share it and organize the Steering menu.
- [Explore the dependency map](https://docs.cisapp.eu/en/reporting/dependencies.md): Connect activities and vendors to understand failure impacts.
- [Read dependency concentration](https://docs.cisapp.eu/en/reporting/concentration.md): Identify shared vendors and exposed activities.
- [Organize GRC monitoring](https://docs.cisapp.eu/en/reporting/news.md): Read news, filter sources and manage your organization’s RSS feeds.
- [Configure a widget](https://docs.cisapp.eu/en/reporting/widgets.md): Choose a widget's visualization, describe its data with queries and filters, combine them with formulas and set a target.
- [Widget query language](https://docs.cisapp.eu/en/reporting/query-language.md): Reference for the text syntax describing a widget's data: measures, conditions, grouping, period, sorting and functions.

## Operational security

- [Understand your exposure](https://docs.cisapp.eu/en/security/exposure.md): Distinguish the security dashboard, scopes, assets and findings.
- [Configure scopes and analyses](https://docs.cisapp.eu/en/security/scopes-analyses.md): Declare a scope, verify ownership and track discovered assets.

## Projects & collaboration

- [Organize action plans and actions](https://docs.cisapp.eu/en/collaboration/projects.md): Create an action plan, assign actions and follow progress.
- [Organize and share files](https://docs.cisapp.eu/en/collaboration/files.md): Create folders, upload documents and check access and classification.
- [Prepare a signature request](https://docs.cisapp.eu/en/collaboration/signatures.md): Upload a PDF, add recipients and track the request.
- [Ask AI chat about your documents](https://docs.cisapp.eu/en/collaboration/chat.md): Choose an organization and ask about documents accessible to your account.

## Organization & administration

- [Configure your organization](https://docs.cisapp.eu/en/organization/company.md): Check the organization profile, domains and functional settings.
- [Invite members and organize teams](https://docs.cisapp.eu/en/organization/members-teams.md): Track invitations, authorize accounts and organize teams.
- [Understand permissions and sharing](https://docs.cisapp.eu/en/organization/permissions.md): Distinguish creation roles, object access and administrative permissions.
- [Set up your profile and notifications](https://docs.cisapp.eu/en/organization/profile.md): Choose your language, appearance and personal preferences.
- [Organize tags and custom fields](https://docs.cisapp.eu/en/organization/tags-fields.md): Define shared classification and extra information for your registers.
- [Administer access security](https://docs.cisapp.eu/en/organization/security.md): Find organization security settings and distinguish available screens.
- [Configure connectors](https://docs.cisapp.eu/en/organization/connectors.md): Connect an offered service, check its state and review synchronization.
- [Connect an AWS account](https://docs.cisapp.eu/en/organization/connectors/aws.md): Deploy a read-only AWS role to inventory cloud resources and import Security Hub findings.
- [Connect a Microsoft Azure tenant](https://docs.cisapp.eu/en/organization/connectors/azure.md): Create a read-only Azure service principal (Reader role) to inventory cloud resources and report posture findings and Defender for Cloud recommendations.
- [Connect a Google Cloud account](https://docs.cisapp.eu/en/organization/connectors/gcp.md): Authorize CISAPP read-only on a Google Cloud (GCP) environment through a service account that CISAPP impersonates, to inventory cloud resources and report security posture findings.
- [Connect GitHub](https://docs.cisapp.eu/en/organization/connectors/github.md): Install the CISAPP GitHub app, link repositories to applications, enable Dependabot and import its alerts.
- [Connect GitLab](https://docs.cisapp.eu/en/organization/connectors/gitlab.md): Authorize CISAPP on GitLab.com, link projects to applications and import the vulnerability report.
- [Connect an OVHcloud account](https://docs.cisapp.eu/en/organization/connectors/ovh.md): Authorize CISAPP read-only on an OVHcloud account to inventory cloud resources and report security posture findings.
- [Connect a Scaleway organization](https://docs.cisapp.eu/en/organization/connectors/scaleway.md): Create a read-only Scaleway API key to inventory cloud resources and report security posture findings.
- [Understand plans, quotas and billing](https://docs.cisapp.eu/en/organization/plans-billing.md): Read your plan’s capabilities and find billing documents.

## Practical guides

- [How do you onboard and assess a vendor?](https://docs.cisapp.eu/en/guides/onboard-vendor.md): A journey from identifying a third party to its first assessment.
- [How do you launch a vendor assessment in CISAPP?](https://docs.cisapp.eu/en/guides/launch-assessment.md): Prepare the scope, create the assessment and check respondent access.
- [How do you answer a security questionnaire?](https://docs.cisapp.eu/en/guides/respond-questionnaire.md): A journey for colleagues and external respondents invited to complete an assessment.
- [How do you create a risk treatment plan?](https://docs.cisapp.eu/en/guides/treat-risk.md): Record the scenario, decide treatment and verify implemented controls.
- [How do you prepare a vendor risk committee?](https://docs.cisapp.eu/en/guides/risk-committee.md): Gather indicators, prioritize topics and record decisions.

## Help & resources

- [Troubleshoot a problem](https://docs.cisapp.eu/en/help/troubleshooting.md): Check sign-in, permissions, filters, imports and invitations.
- [Understand feature availability](https://docs.cisapp.eu/en/help/availability.md): Distinguish plans, roles, activation, beta features and unfinished screens.
- [Glossary](https://docs.cisapp.eu/en/help/glossary.md): Terms used in registers, assessments and treatment plans.
- [Use the documentation with AI](https://docs.cisapp.eu/en/help/use-with-ai.md): Copy a Markdown article or give an assistant the documentation indexes.
- [Vendor risk and compliance: common questions](https://docs.cisapp.eu/en/help/common-questions.md): How do you assess a vendor, answer a security questionnaire, treat a risk or track compliance? Answers and practical CISAPP guides.