What is a system?

A System is a data processing or data storing entity that the business accesses directly. A system may be a physical storing unit, a business application, or a file share either on premise or in the cloud. However, a system is typically not a database or a network component as these are not accessed directly by the business.

Fill out or approve the master data for the system

Main menu > Systems. This is a part of the cores module of the complyon system


Write the name of the system e.g. “Microsoft Outlook”


Describe what the system does. The purpose is to let relevant people in the organization know, what this system is used for. This is necessary in order to identify main risks and to make better priorities related to information security.

As an example, the system “Microsoft Outlook” could be described as follows:

The system “Microsoft Outlook” is used for internal and external e-mail communication. All employees have their own e-mail account. Users cannot access each others e-mails.


Assign the users responsible for documenting the system. It is possible to add several users as responsible if necessary. One user can be marked as the overall accountable, by marking this person with the star-icon.

Data structure

Record whether the system processes data in structured, unstructured or physical form. e.g. data will be considered unstructured in file drives and structured in a database.


Here it is possible to create tags that allow the system to be searched using an alternative keyword – e.g. if IT has an alternative name to the system than the business uses.

Policies and procedures

Add or create a technicall security measure to the system on the sheet, Technical measures

Technical security measure

Add and fill out risk scenarios under the sheet, Risk Management

Risk scenarios

See assessments under the sheet, Assessments

Here you can see a list of impact assessment reports where the system has been included in the assessment scope.

See related Data, Activities and Third parties under the sheet, Relations

Data categories

Data Categories are either mapped directly on the system under this sheet or added from Activities under the sheet, Data mapping.


These are mapped under the sheet Data mapping.

Third parties

Third parties are mapped from Activities under the sheet, Data mapping.

Was this article helpful?

Related Articles

Need Support?

Can't find the answer you're looking for?
Contact Support

Want to hear more?

Let's talk about how our experience and software can help your company.