A System is a data processing or data storing entity that the business accesses directly. A system may be a physical storing unit, a business application, or a file share either on premise or in the cloud. However, a system is typically not a database or a network component as these are not accessed directly by the business.
Fill out or approve the master data for the system
Main menu > Systems. This is a part of the cores module of the complyon system
Title
Write the name of the system e.g. “Microsoft Outlook”
Description
Describe what the system does. The purpose is to let relevant people in the organization know, what this system is used for. This is necessary in order to identify main risks and to make better priorities related to information security.
As an example, the system “Microsoft Outlook” could be described as follows:
The system “Microsoft Outlook” is used for internal and external e-mail communication. All employees have their own e-mail account. Users cannot access each others e-mails.
Responsibles
Assign the users responsible for documenting the system. It is possible to add several users as responsible if necessary. One user can be marked as the overall accountable, by marking this person with the star-icon.
Data structure
Record whether the system processes data in structured, unstructured or physical form. e.g. data will be considered unstructured in file drives and structured in a database.
Tags
Here it is possible to create tags that allow the system to be searched using an alternative keyword – e.g. if IT has an alternative name to the system than the business uses.
Policies and procedures
Add or create a technicall security measure to the system on the sheet, Technical measures
Technical security measure
Add and fill out risk scenarios under the sheet, Risk Management
Risk scenarios
See assessments under the sheet, Assessments
Here you can see a list of impact assessment reports where the system has been included in the assessment scope.
See related Data, Activities and Third parties under the sheet, Relations
Data Categories are either mapped directly on the system under this sheet or added from Activities under the sheet, Data mapping.
Activities
These are mapped under the sheet Data mapping.
Third parties are mapped from Activities under the sheet, Data mapping.