Where to start

Overview → How Modules Connect

Each destination has its own account/module/stage requirements.

Before you begin

Identify the source record and the decision you need to support.

Step-by-step

1. Start with an identifiable resource

   An Asset is an inventory record. A Supplier profile is a dependency record. A software list and its installed locations are VA scope. Keep their IDs and dates; similar names alone do not prove a saved relationship.

2. Use the explicit stored relationship

   Link a Supplier through the Asset’s offered control, or select an existing Asset for a CIA evaluation. Verify the saved relationship. Do not infer that organisational ISO/C5/EU/NIS2 assessments are automatically joined to every Asset.

   Supplier and CIA links on an Asset

3. Reuse evidence deliberately

   Cite a particular document version, policy section, Supplier assurance result or learning record in the assessment’s offered Evidence/Notes. This is manual evidence reuse unless the procedure names a stored association.

4. Separate technical observations and decisions

   Scanning records observations. VA evaluates software/CVE/location relevance and verification. A Risk represents business exposure with separate Treatment and Acceptance work. None is universally created or closed by the others.

   VA evidence and verification

5. Treat provider arrows as actions

   Create Jira Ticket can write external work; Confluence linking can stamp a page and publication can update its body. Querying, navigating or citing a key is not the same as those actions.

6. Reopen after the handoff

   Confirm local owner, linked identity, status and time. Revisit the affected assessment/decision explicitly after later changes; scores, approvals and closure do not propagate universally.

Check the result

A trace whose stored links and human decisions can be distinguished.

Current limits and common mistakes

The map is orientation, not one automatic workflow or evidence graph. Reports reflect their own current or captured populations.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Overview → Find a module or task

Visible modules depend on roles and enabled deployment features.

Before you begin

Decide whether you need a business record, reference, query, output or administrative change.

Step-by-step

1. Choose inventory or exposure work

   Use Assets for resource facts, Suppliers for dependencies/approval/assurance, VA for software/CVE/location work, and Security Scanning for authorised technical checks. These are distinct evidence types.

2. Choose the decision workflow

   Use CIA for an existing Asset’s protection impact; organisational assessments for their stated scope; Risk for business exposure, Treatment and formal Acceptance. Use the individual guide rather than a generic Create/Edit/Delete assumption.

   Choose the assessment

3. Choose document and people evidence

   Document Dialog saves authored document versions. Information Security Policy is a reference library. Training records learning and course certificates. Reading or generating content does not perform control implementation.

4. Use supporting surfaces intentionally

   Ask retrieves supported facts or drafts analysis. Integrations provide scoped reads and explicit provider actions. Admin controls access/configuration. Reports explain selected recorded evidence; none is a universal approval console.

5. Agree operating boundaries separately

   For deployment, support, permitted providers, recovery and commercial terms, use the responsible implementation team and agreed operating plan. A module count is not an implementation, coverage or price guarantee.

   Deployment responsibilities

Check the result

The appropriate task guide and a correctly bounded expected result.

Current limits and common mistakes

Commercial diagrams are optional planning context, not a fixed savings or delivery promise.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Overview → Data Flow; then the originating record

Use the owning procedure’s permissions for any write.

Before you begin

Keep source ID, selected version/run, scope and time at each stage.

Step-by-step

1. Capture the fact in its own record

   Create or update the intended Asset, Supplier, installation or assessment response. Reopen it and keep the saved ID; a form that has only been prefilled has not created that evidence.

2. Identify the evidence precisely

   For a scan retain Scan ID and coverage; for a document retain Document ID/version; for a provider result retain its issue key/Page ID and observation time. A name or undated screenshot is not the same identity.

   Record versions, filters and time

3. Make the owning decision

   Use the actual CIA review, assessment response, VA relevance/reviewer, Risk Treatment validation or Acceptance action. The source observation supports the decision but does not make it automatically.

4. Check the result of a handoff

   Verify a saved Supplier association or external reference separately from a typed citation. A resolved Jira issue is a provider status, not universal Risk closure or VA verification.

   Verify the provider/local chain

5. Review changes and stale evidence

   Reassess the relevant owning response after a policy revision, changed software or expired exception. Current reports can change; an old VA ReportRun or selected DocumentVersion stays captured evidence.

Check the result

A factual record → identified evidence → explicit decision → owned follow-up chain.

Current limits and common mistakes

Illustration: Asset A has CIA evaluation C; assessment I cites document D/version 2; Risk R cites an observed gap. The latter citation is not a claim of a universal stored Asset-to-framework or document-to-Risk foreign key.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Overview → Architecture; Admin → System Settings for the offered inventory

Deployment operators own runtime/configuration; ordinary users follow approved access and provider policies.

Before you begin

Identify the environment and processing route you actually use.

Step-by-step

1. Locate the record and storage boundary

   The web application uses configured record and document services. Confirm persistence, database and document-body storage with the operator; a diagram does not verify their backup or availability.

2. Separate authentication paths

   Local Email/Password, local TOTP/recovery, Microsoft sign-in and a configured access certificate are separate mechanisms. Do not read the three-factor illustration as a universal login sequence.

3. Identify the Ask path

   The serial Compliance Gate → Smart Router → Privacy Shield illustration describes Ask amara Pro. Base, grounded data and policy retrieval paths differ; follow their route/provider instructions before submitting sensitive material.

   Base versus Pro routing

4. Identify deliberate external traffic

   Enabled Jira, Confluence, cloud queries, public intelligence, scanner and model services have their own scopes. A configured connector does not establish that every request is permitted or successful.

5. Confirm operating responsibility

   Agree updates, monitoring, retained audit evidence, recovery and provider data handling with the implementation team. Inspect masked configuration presence without copying secrets.

   Recovery evidence

Check the result

A deployment-specific understanding of records, identity and supporting services.

Current limits and common mistakes

An architecture view is not security, residency, resilience or legal certification. Resource sizing and actual enabled components remain environment-specific.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Overview → Deployment; responsible implementation team

This is a planning reference, not an in-application deployment selector.

Before you begin

Prepare users, permitted data/processing boundary, support expectations and recovery needs.

Step-by-step

1. Choose an agreed operating model

   Managed, customer-operated and appliance-style describe who operates the environment. An isolated/air-gapped design is a separately agreed boundary, not a switch in this Help page.

2. Name the owners

   Record responsibility for accounts, data, database/configuration, persisted document bodies, updates, monitoring, support and incidents. Do not leave recovery to an assumed generic provider.

3. List permitted connections

   Identify model routes, Jira/Confluence, cloud evidence, scanners and public-intelligence refresh. An isolated design cannot depend on live external services without changing its approved boundary.

   Processing boundaries

4. Define evidence and recovery

   Agree capture scope, frequency/retention, integrity checks, recovery objectives and an isolated restore test. Include document storage, corpus and provider-state exclusions explicitly.

   Recovery planning

5. Verify before broader use

   Use the selected environment’s approved access, storage, output and recovery checks. Retain unresolved gaps and named acceptance responsibilities rather than a fixed implementation timetable.

Check the result

An operating plan with accountable owners and checkable verification criteria.

Current limits and common mistakes

Profile names establish no price, certification, legal approval or guaranteed rollout duration. This draft performs no deployment or configuration change.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Application → Asset Management, Assessments and the relevant follow-up module

Use your own approved account and the separate permissions for each chosen action.

Before you begin

Choose one legitimate resource and its responsible owner; do not run a trial against an unauthorised target.

Step-by-step

1. Register the resource

   Follow Registering an Asset with its real name/category/status and useful ownership/context. Save, reopen the same Asset and retain its ID before continuing.

   Register and reopen an Asset

2. Classify its business impact

   Select that existing Asset for CIA. Record rationale and complete the applicable review stages. Creating the inventory record does not create or approve CIA automatically.

   CIA procedure

3. Record the actual dependency

   Review or create the intended Supplier and use the Asset’s Link Supplier action where needed. Verify the relationship type and both identities; Supplier approval and assurance are separate.

   Supplier relationship

4. Collect only the required evidence

   If software/exposure evidence is needed, use reviewed intake or an authorised scan through its detailed guide. A CVE mention or scanner observation is not yet a confirmed affected installation.

5. Own the follow-up

   Create the separate Risk/Treatment or VA work when justified. Use the offered responsibility/date fields and preserve verification. Formal Acceptance is a deliberate exception, not remediation.

   Create an explicit Risk

6. Review the chain

   Reopen each saved identity and record missing evidence or decisions. Retain the exact version/run/time in an evidence index rather than claiming the whole application is ready from one journey.

Check the result

One understandable chain with saved records, explicit decisions and visible gaps.

Current limits and common mistakes

This is a suggested sequence, not a timed wizard or automatic chain. Optional providers/scans are not prerequisites for every onboarding case.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Application login; account menu for Profile / Logout

Use the account and login method supplied by your administrator. No active self-registration is offered.

Before you begin

Have your own Email/Password or approved Microsoft identity and, when required, your private second factor.

Step-by-step

1. Use the local form correctly

   Enter the required valid Email and Password, then Login. This is Email, not Username; there is no offered remember-me control. Correct format/required errors. For unknown/inactive/expired accounts, wrong credentials or authentication failure, use the administrator’s recovery process rather than another identity.

2. Use Microsoft only when configured

   Hybrid mode can show Sign in with Microsoft; Entra-only mode hides the local form. Missing service/configuration or an identity not registered/allowed requires administrator help. Normal Logout does not necessarily end Microsoft SSO.

3. Complete the factor branch

   An enrolled local account can be sent to Verify; a required-unenrolled account must finish setup. Pending-login verification or required-enrolment challenges can expire after five minutes. This is not a universal timeout for MFA setup when you are already signed in. The shared required-setup hook can still apply after Microsoft sign-in; do not assume a blanket exemption.

   Private MFA enrolment and recovery

4. Orient without changing records

   Use module navigation and the account menu. EN/DE changes session language; theme and compact-sidebar choices are browser preferences. Sidebar tooltips help identify collapsed controls; presentation changes do not approve work.

5. Choose ordinary account or synthetic demo deliberately

   Where configured, read the demo notice and select its checkbox to enable Accept & Enter Demo. A short press enters the synthetic demo; use no customer or sensitive data. To reach ordinary Login, press and hold that same entry control for five seconds, then use your authorised account. This grants no Admin permission. The separate five-step tour offers Back/Next/Skip/Finish/Escape and records browser-local orientation, not account/module completion.

6. Open existing work first

   Confirm account/module/stage and use the owning list before creating records. Missing controls can reflect roles, read-only status or configuration.

   Resolve access

7. Leave through account menu → Logout

   This ends local app login and clears current-tab Ask memory. It does not erase business records, provider conversation/history or necessarily Microsoft SSO. Use the approved separate process for those layers.

   Memory and retention boundaries

Check the result

An authenticated session in the intended scope, or a specific recoverable error rather than assumed success.

Current limits and common mistakes

Authentication audit is best-effort, not proof of complete immutable logging. Demo’s long-press ordinary-login entry grants no Admin rights. Self-registration redirects to Login.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Selected assessment context or Document Dialog creation/editor

Account Admin owns user access; deployment operators own configuration.

Before you begin

Prepare the real entity name, sector/industry, size, scope and boundaries required by the selected form.

Step-by-step

1. Identify the owning form

   Use the assessment’s organisation/context fields or the chosen document template’s actual inputs. System Settings is not a universal organisation wizard.

   Template-specific organisation fields

2. Confirm the identity and scope

   Before changing an existing assessment/document, record its ID and current context. Similar organisation names across modules do not make their records one shared profile.

3. Save through that workflow

   Use its actual Start/Complete/Save/version control and correct validation. Refer to the selected assessment’s guide for its distinct lifecycle rather than a generic save assumption.

   Owning assessment procedures

4. Inspect dependent outputs deliberately

   Review a newly requested report or saved document version. Existing exported files and historical versions retain their prior content; no global automatic rewrite is established.

5. Manage access separately

   Use User Management for approved roles/activation and the implementation team for unsupported deployment changes. Do not place credentials in organisation fields or support evidence.

Check the result

Consistent context in the intended records with other affected copies identified.

Current limits and common mistakes

Changing a name in one form is not an automatic update to all assessments, documents, courses or external pages.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Account menu → Profile; Admin → User Management for other accounts

Role badges are not self-service editors. Read Only disables rendered submit buttons; this is not a claim of exhaustive endpoint enforcement.

Before you begin

Know whether the intended change is your profile, local password, MFA or an administrator-owned account action.

Step-by-step

1. Open your own Profile

   Confirm the account before editing. Use Username (required, 2–20 characters), valid Email and required First/Last Name. Changed username/email must be unique. Names allow Unicode letters/attached marks and spaces, hyphens, apostrophes or periods.

2. Submit the intended profile change

   Use Update Profile; Cancel leaves the editing path without saving. Correct field errors rather than assuming a redirect means success. Do not change role badges as if they were editable controls.

3. Reopen and verify the actual outcome

   Check the same profile again. Current source has a transient-user persistence concern: a success flash alone does not establish that the profile was stored. Report a discrepancy with account/time, not secret values; no fix or runtime success is asserted here.

4. Change the local credential separately

   In Change Password supply correct Current Password, New Password of at least 12 characters, and matching Confirm New Password; use Change Password. Correct validation/storage errors and follow the next-login instruction. This changes the local credential, not Microsoft’s password.

5. Use the right recovery owner

   If the old password/factor is unavailable, ask the authorised Admin for Reset Password or Reset MFA as appropriate. Copy/print/recovery outputs are private; no automatic email or reset-link delivery is implied.

   Administrator recovery controls

6. Keep permissions and curriculum separate

   Administrators use the detailed Accounts guide for roles, activation/expiry, assignments and deletion. Read Only must stand alone in the current account form; it is not combined with additive module permissions.

   Role and assignment rules

Check the result

The intended account is identified and its actual saved outcome is checked; unresolved profile persistence remains explicit.

Current limits and common mistakes

Authentication audit writes can fail independently of the session action. Never use a login/profile flash as proof of exhaustive audit coverage or a completed business approval.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Getting Started → owning module guides

Name the account owner, record owner, reviewer and operator for each planned result.

Before you begin

Agree scope, available evidence and what remains outside the first iteration.

Step-by-step

1. Establish access and ownership

   Deliver an approved account/role list and a bounded set of saved Assets/Suppliers. Check real IDs, ownership and missing fields rather than a screenshot of a menu.

2. Complete selected evaluations

   Use CIA where Asset impact is needed and choose framework scope deliberately. Deliver saved identities, state, evidence and unanswered/unknown items, not one interchangeable compliance score.

   Choose a scoped evaluation

3. Prepare maintained documents

   Deliver reviewed Document IDs/versions/dates and explicit outstanding approval/adoption work. An Approvals paragraph or exported draft is not the organisational decision.

4. Assign and inspect learning

   Account Admin saves curriculum assignments; learners complete actual cards/quizzes. Deliver learner/course/progress/certificate context and retain evidence before renewal.

5. Exercise legitimate follow-up

   For a justified gap, use Risk/Treatment or VA’s owning procedure with responsibility and verification. Do not run scans or create provider work simply to make the plan look complete.

   Verification requirements

6. Review the evidence and remaining gaps

   Build a small index with source IDs, version/run, scope/time and unresolved owners/dates. Agree the next iteration from actual results; do not infer production readiness from elapsed days.

   Build the evidence index

Check the result

An inspectable onboarding plan with responsibilities, artifacts and open work.

Current limits and common mistakes

No fixed number of days guarantees readiness. Deployment, privacy, provider, approval and technical verification remain independent gates.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Assessments → CIA Classification → New Evaluation, or an asset’s CIA action

Admin, General Assessments or CIA access; final Risk Owner approval additionally requires Risk Assessment or Admin. Ordinary Read Only mutation limits apply. CIA has no ISO/NIS2 demo write carve-out.

Before you begin

Know the business consequences of disclosure, manipulation and downtime for the selected asset.

Fields and choices

Step-by-step

1. Start with a registered asset

   If the asset does not exist, register it in Asset Management first. New Evaluation currently offers an existing Asset picker, not a visible Create New Asset control. From the asset’s CIA action, verify the preselected identity. If an evaluation already exists for the asset, use that evaluation’s Edit action; creation blocks a second evaluation.

2. Choose Service Model

   Select Not Applicable, IaaS, PaaS, SaaS or On-Premise for the actual deployment. This controls the applicable measure/responsibility context; choosing a cloud model does not configure a cloud connector or complete a C5 assessment.

3. Assess confidentiality

   Choose Public, Internal Use, Confidential or Restricted and complete Confidentiality Justification with the information held, who could receive it and the business consequences of disclosure.

4. Check the test-environment choice

   Use Yes only for a genuinely isolated test/development environment. A deliberate Yes selection hides the integrity questions, presets their ratings to Low and may insert a no-production-impact justification when that field is empty. Review that premise; the preset is not an isolation test. Stored impact ratings—not the environment flag alone—drive the calculated integrity.

5. Assess each integrity impact

   For production, rate personal safety, society/environment and operational readiness separately as Low, Medium, High or Critical. Write Integrity Justification with manipulation consequences and existing protections. The integrity result uses the highest of the three impact ratings, not their average.

6. Assess tolerated downtime

   Choose Availability Rating: Low (>24h), Medium (4–24h), High (1–4h) or Critical (<1h). Complete Availability Justification with the actual service interruption tolerance and dependencies; do not substitute a scanner severity.

7. Save Draft or Submit

   Use Save Draft while collecting facts; use Submit for ready inputs. The non-draft path checks the selected asset, confidentiality, personal-safety impact and availability. Fill all relevant impact/rationale fields rather than treating those minimum checks as complete review. Open the saved evaluation; Submit alone has not completed the four phases.

8. Complete Phase 1: Data Entry

   Open the current phase. Review the three confirmations: CIA ratings complete/accurate, asset information verified, and justifications documented. Add phase notes if needed and choose Complete Data Entry & Submit for Review. This advances to Asset Owner Review and generates security measures; it is still not final approval.

9. Complete Phase 2: Asset Owner Review

   Confirm the owner review, choose Approve, Send Back or Reject and record comments/reason. Approval advances to Cyber Security Review. Send Back and Reject return to Phase 1 for revision. Inspect the stored decision/history and the review notes before the next stage.

10. Complete Phase 3: Cyber Security Review

    Read the ratings, owner comments and applicable measures. Confirm the security review, choose the decision and record review notes. Approval advances to Risk Owner Approval; Send Back or Reject returns to Phase 2. Where the measure panel is available, review its specific implementation/evidence rather than assuming generation implemented anything.

11. Complete Phase 4: Risk Owner Approval

    The reviewer needs Risk Assessment or Admin access in addition to CIA access. Confirm the complete review, choose the final decision and record notes. Approval completes the evaluation; Send Back or Reject returns to Phase 3. Check the final state and the latest CIA-derived asset criticality, which uses the highest confidentiality/integrity/availability rating.

12. Read the measures, heatmap and selected report

    After Phase 2 approval, the generated Security Measures panel can offer Show Details for mandatory/recommended measures and their source context. Open Report on this evaluation for its printable executive report, including ratings and approval history. View Heatmap on the CIA hub is a summary, not a rating-edit control. Inspect the asset/service context and current phase before sharing any output.

13. Edit, reset or delete deliberately

    Edit on an evaluation with approvals shows a warning; saving the changed facts resets all approval stages to Phase 1. Revert Assessment instead selects the current or an earlier phase and requires a reason, clearing approvals from that phase onward. It cannot jump forward. The retained edit-template new-asset branch is not a working nested asset-creation path: register an Asset first and retain a valid existing identity. Delete Evaluation removes the selected evaluation; preserve required evidence first.

14. Continue the right downstream task

    Return to the asset for supplier links, scans or VA software. Use a permitted measure-specific Jira action for reviewed follow-up. CIA business-impact context can inform a separately assessed Risk, but neither a generated measure nor an approved evaluation creates a universal remediation or vulnerability all-clear.

Exact behaviour and worked examples

The four-phase diagram remains your route through the assessment. Expand the sections below for save rules, calculations and what the output actually records.

Calculate CIA impact and interpret generated measures

Worked example: highest impact, not an average

This example uses assumed inputs, not a customer record. Public/Low = 1; Internal/Medium = 2; Confidential/High = 3; Restricted/Critical = 4. Integrity is the highest of personal safety, society/environment and operational readiness. Overall is the highest of Confidentiality, Integrity and Availability.

Assumed values demonstrate the maximum rule; they are not live assessment results.

Internal 2; integrity inputs Low 1 / High 3 / Medium 2; Availability Critical 4 → Integrity High 3 → Overall Critical 4. There is no 2.4 average result or likelihood × impact risk score. Unknown values map to zero internally; no recognized rating gives no aggregate label. Tolerated downtime is Low >24h, Medium 4–24h, High 1–4h, Critical <1h.

Recommendations are not installed controls

Phase 1 generation replaces existing generated measures using a 37-definition catalogue. General measures use max(C,I,A); confidentiality/integrity measures use max(C,I); availability/portability measures use A, with a missing level defaulting Low. Service Model filters measures and responsibility; Not Applicable bypasses that filter and leaves responsibility blank. Level 4 selects the very-high recommendation text. “Not required” entries are omitted; must/mandatory/shall text becomes Mandatory / High priority, otherwise Recommended / Medium.

The generator also reads some retained legacy integrity fields which the current impact calculator ignores. Low current impacts plus legacy Critical can therefore produce stronger measures than the displayed integrity. Do not force a claim that every old record’s measures and current rating agree. The inline measure panel needs generated measures and Phase 2 approval; Show/Hide Details and optional Jira are reading/follow-up controls, not a universal per-measure Accept/Edit/Verify workflow.

Which view are you reading?

The Asset uses its latest evaluation by updated time, then highest ID, and requires an eligible completed/approved/final-approved state. An unfinished latest evaluation does not fall back to an older approved one. The CIA hub confidentiality mapping differs from the current calculator: Confidential with Low I/A can appear Medium on its donut but High in the current rating. Heatmap plots Availability against Confidentiality, with bubble size from Integrity; missing values can plot Low. A low point is not proof of complete rating evidence. Old nonempty stored aggregate labels are not universally recalculated on read.

Search CIA lists using their actual controls

“My Finished Assets” is module-wide completed-only data, not a current-user ownership filter. “My Assets In Progress” covers Draft, In Progress, In Review, Pending Approval, Security Review and Risk Review, ordered newest evaluation ID first. Use Asset Name search. Finished sorts are Newest (default), Oldest, Name A–Z and Name Z–A; name ties use newest evaluation ID. A load failure in either “My” view returns 503, not a clean empty inventory.

All Evaluations control	Offered choices
Asset Name	Enter the name to search; it is not a saved owner filter.
Asset Category	All Categories / Hardware / Software / Data / Service / Facility.
Status	All Statuses / Draft / In Progress / Completed; uses displayed phase/approval state, not simply the stored status.
Approval Phase	All Phases / 1 Data Entry / 2 Asset Owner Approval / 3 Cyber Security Review / 4 Risk Owner Approval.
Overall Rating	All Ratings / 1 Low / 2 Medium / 3 High / 4 Critical / 5 Maximum. Maximum is a retained no-op, not a fifth CIA rating.
Search	Apply the chosen filters; results are newest evaluation ID first.

All Evaluations can return an empty fallback after a load error, unlike the explicit 503 “My” views. An empty list or inactive Maximum filter does not prove no exposure or complete assessment coverage.

Check the result

An asset-linked CIA evaluation with recorded ratings, rationale and the current approval state.

Current limits and common mistakes

Draft/in-progress CIA is not an approved criticality: the current asset view does not fall back to an older completed evaluation when the latest evaluation is unfinished. Minimum form validation, a review checkbox, generated measures and technical implementation are different facts. Editing approved inputs invalidates the prior approvals; inspect the warning and stored phase.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Assessments or separate NIS2 Compliance navigation

Use the framework’s actual access; NIS2 is not granted simply by General Assessments.

Before you begin

Define the entity/system/service scope and the question being evaluated.

Step-by-step

1. Choose the applicable workflow

   CIA concerns an existing Asset’s impact; Rapid is scoped posture; ISO/C5/EU AI have their own control/system context. NIS2 separates relevance and comprehensive assessment. Do not choose a framework merely because its score looks favourable.

   Choose the module

2. Identify the evidence owners

   Keep Asset/CIA facts, Supplier approval/assurance, exact document version, policy source, learning completion and technical work distinct. A source existing elsewhere does not answer the selected control.

3. Record the answer and evidence

   Use the selected module’s offered response/evidence fields and save lifecycle. Reuse evidence explicitly while keeping requirements, applicability and conclusions independent.

   Evidence handoff

4. Track real follow-up

   Use the module’s actual remediation fields. Where no Assignee exists, record responsibility in supported notes or the governed external task; do not invent a universal owner/date control. Create a separate Risk only when its governance is needed.

5. Read the exact result definitions

   Use the individual guides for their accepted algorithms, denominators, N/A/unanswered behaviour and report limits. Similar percentages are not interchangeable compliance measures.

6. Retain open work

   Show unassessed items, missing evidence and unresolved decisions beside the report. Scope selection, output generation and a green badge are not certification or legal approval.

   Keep open work visible

Check the result

An explicit chain between chosen requirements, reviewed evidence and separately owned follow-up.

Current limits and common mistakes

Shared records do not automatically satisfy another framework or confer legal compliance. Loaded catalogue limits remain stated in individual guides.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Application sidebar → Assessments; NIS2-only accounts use separate NIS2 Compliance

Hub requires sign-in and Admin, General Assessments, CIA, Rapid, ISO, C5 or EU AI permission. NIS2-only does not itself grant this Hub.

Before you begin

Know whether the task is Asset impact, organisational posture, framework controls or AI/cloud/NIS2 scope.

Step-by-step

1. Open the permitted chooser

   Use Assessments under your own account. Missing access/card is a permission/configuration question, not evidence no assessment data exists or a reason to borrow credentials.

2. Choose the appropriate card

   CIA/Rapid/ISO/C5/EU AI cards require their own role or General/Admin. NIS2’s card separately needs the dedicated NIS2 role; Admin/General alone does not make that card visible. Use Open Module or its heading shortcut where shown.

3. Keep the module context clear

   CIA starts with an existing Asset. Rapid, ISO, C5 and EU AI have separate scope/context and records. SoA belongs to a selected ISO assessment, not a seventh Hub card or independent creation wizard.

   SoA belongs to the selected ISO record

4. Use the intended NIS2 entry

   The Hub NIS2 card opens Comprehensive Assessment directly. Separate NIS2 Compliance provides relevance, saved lists and remediation; keep entity/assessment identity when moving between them.

   Separate relevance and Comprehensive flow

5. Find existing work before creating

   In the owning module confirm the saved ID/state and use its documented New/Continue/View/Reassess action. The Hub has no Save, Submit, delete, filter, report generation or completion/approval action.

6. Read usage as record counts

   The chart includes all stored states of CIA evaluations, Rapid, ISO, C5, EU AI and NIS2 Comprehensive records. NIS2 relevance/legacy populations are excluded. All six queried populations feed it even where a card is hidden; this is not a per-owner/tenant-filter guarantee.

7. Read the successful zero or failure correctly

   If their sum is zero, No assessments have been created yet is the zero-record branch. A query/page error is not clean zero. Retain the visible error and use the responsible operator.

8. Open output in the owning module

   Choose the intended saved record and its actual report prerequisite. Hub totals neither generate reports nor make a record eligible for them. Use the family-specific guide for accepted calculations and lifecycle exceptions.

   Read actual report scope

Check the result

The correct owning module and identifiable saved scope, without an assumed Hub mutation.

Current limits and common mistakes

Record share is not implementation, control/question coverage, legal compliance or catalogue completeness. Card marketing text is not source acceptance.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Assessments → Rapid Assessment → New Assessment

Use Rapid Assessment, General Assessments or Admin access. This does not automatically grant NIS2 access. Ordinary Read Only is subject to write guards; Rapid has no ISO/NIS2 demo write carve-out.

Before you begin

Have the organisation name, industry, size, date, assessor and intended assessment scope ready.

Fields and choices

Step-by-step

1. Create the organisation context

   Complete required Organization Name, Industry, Organization Size, Assessment Date and Assessor Name. Email, Phone and Reference ID are optional; if you enter a reference, it must not duplicate an existing Rapid assessment. Keep the organisation and reference consistent with the evidence you will review.

2. Select at least one domain

   Choose Next: Select Domains, select the relevant active domains and choose Next: Start Assessment. A new question set currently allocates 16 distinct questions across the selected domains. Saved sets retain their recorded question identities. If the catalogue cannot provide sufficient distinct coverage, correct the scope with the administrator; do not treat the failure as a saved assessment.

3. Read the guidance and answer options

   Expand each domain, read each question’s Guidance and choose the offered answer that matches actual implementation. Options are attached to the question; do not infer that every question uses a universal answer list. Use Comments to cite the policy/version, asset, supplier decision or other evidence and explain uncertainty.

4. Flag work on the question

   When follow-up is needed, select Needs Remediation. Enter Remediation Plan and a valid Remediation Deadline in the fields it reveals. This records question-level follow-up, not a formal Risk Treatment or an automatically created Jira issue.

5. Continue the same saved draft

   Use Save as Draft before leaving incomplete work. Open All Assessments and use Continue on that record. Its recorded questions/answers are reused. For a completed record, use View or the deliberate Reassess action rather than starting a duplicate.

6. Submit without confusing status and coverage

   Use Submit Assessment when ready. The current handler requires at least one valid answer, not every question to be answered. Inspect the answered/unanswered and applicable populations after submission; Completed does not mean all 16 questions were answered or every control implemented.

7. Read Gap Analysis for this assessment

   Select the same assessment in Gap Analysis and inspect the affected domains, question responses and recommendations. Keep excluded/Not Applicable answers and unassessed questions distinct. Use the source evidence to decide which gaps need a deeper framework review or separately governed Risk.

8. Maintain the Remediation Plan

   Open Remediation, select the assessment and choose View Remediation Plan. For each tracked question, edit its plan/deadline and use the completion checkbox only after reviewing the work. Save with Save Remediation Plan and reopen. This screen does not offer a universal remediation-owner field; record responsibility in the plan or supported external work.

9. Understand the score side effect

   Saving remediation recalculates the Rapid score. A tracked item marked completed receives full implementation credit in that calculation; it is an operator-recorded outcome, not independent effectiveness testing. Not Applicable answers are excluded from the score denominator. No applicable assessed answers must remain distinct from a zero score.

10. Review and retain a scoped report

    Open Reports, select this assessment and the offered Comprehensive Report, Executive Summary, Technical Details, Gap Analysis, Remediation Plan or Evidence Package. Check assessment identity, domain scope, answer coverage, excluded items and remediation status. Preserve the reviewed report externally if you need a historical baseline before reopening the assessment.

11. Reassess or remove deliberately

    Reassess on a completed record reopens that same record as In Progress and clears its completion date; it does not create a new version or immutable copy. Review existing responses and remediation before resubmitting. Delete Assessment removes the selected assessment and its associated responses/domain links; it is not archive or remediation completion.

Exact behaviour and worked examples

Use the main steps for the normal journey. The detail below separates answer coverage, implementation credit and tracked work.

Check the result

A scoped rapid assessment and separately recorded gap/remediation work.

Current limits and common mistakes

A Rapid score is a scoped answer/remediation calculation, not a maturity certification, complete organisation inventory or technical test. Reassess mutates the existing assessment’s lifecycle; retain the old result first if comparison is needed. Completing a remediation checkbox can improve the score without an independent verification step.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Assessments → ISO 27001 → New Assessment

Use ISO 27001 Assessment, General Assessments or Admin access. This does not automatically grant NIS2 access. Read-only and scoped demo rules apply.

Before you begin

Prepare the organisation, assessor, date and concrete scope, plus implementation evidence for the controls you will select.

Fields and choices

Step-by-step

1. Record the ISMS context

   Complete required Organization Name, Industry, Organization Size, Assessment Date and Assessor Name. Record ISMS Scope, Existing ISMS, Current Certifications, Certification Body and Target Certification Date where applicable. Email, Phone and Reference ID are optional. Describe systems, teams/sites and exclusions; entering a certification name is not verification that it is valid.

2. Select the control categories

   Choose Next: Select Control Categories. Select at least one of A.5 Organizational, A.6 People, A.7 Physical or A.8 Technological Controls, then Next: Start Assessment. The offered catalogue determines the control population; selecting all categories is not a guarantee that the application contains every standard control.

3. Open a control and record Implementation Status

   Choose Implemented, Partially Implemented, Planned, Not Implemented or Not Applicable for each relevant control. A blank status remains unassessed, not Not Implemented or an exclusion. Evaluate the control’s wording against the stated ISMS scope.

4. Separate evidence, gaps and notes

   In Evidence, cite the actual document/version, record or technical result. In Identified Gaps, state what is missing. In Notes, explain scope and assumptions. A policy draft, supplier approval or training certificate can support an answer only to the extent it demonstrates this control.

5. Record maturity only when assessed

   Use Maturity Level (0–5), with the offered 0.5 step, when you have assessed maturity. Leave it blank when unknown rather than entering zero. A maturity rating and Implementation Status answer different questions.

6. Define the control’s remediation

   Use Remediation Plan, Remediation Owner, Remediation Deadline and Remediation Status (Not Started, In Progress or Completed) for follow-up. An owner/date is not proof the gap is fixed. Record why completion is supported before marking it.

7. Save as Draft or Submit Assessment

   Save as Draft keeps the assessment In Progress. Submit Assessment requires at least one evaluated control; it does not require every selected control to have a response. Reopen the detail and check evaluated, unassessed, applicable and Not Applicable populations before interpreting the result.

8. Continue or adjust the existing scope carefully

   Use Continue for the existing draft. A completed record must be reopened with Reassess before revising responses. Where returning to category selection, removing a category deletes its associated saved responses from this assessment. Preserve required evidence before narrowing the scope; do not assume removed answers are merely hidden.

9. Review Gap Analysis and owned implementation work

   Select the same assessment in Gap Analysis. For an eligible gap with Jira enabled, review and deliberately submit Create Jira Ticket, then inspect the reference. Controls Implementation is an all-completed-assessment grid, not an assessment picker: identify each row’s assessment/control and update Status, Owner and Deadline with Update. This does not automatically rewrite a control’s original response or complete a separate Risk Treatment.

10. Prepare the Statement of Applicability separately

    Open this assessment’s SoA. Save each applicability decision and its justification, then review it against scope and implementation. Not Applicable in an assessment response and an explicit SoA applicability decision are separate stored facts.

11. Generate and review the intended report

    Open Reports, select the assessment and use its executive, technical, gap, comprehensive or SoA output. Inspect identity, scope, current catalogue, missing statuses/maturity and remediation. Report generation selects completed assessments. Audit Evidence is currently disabled as Coming Soon / Not Available; do not treat it as a working sixth export. The output is evidence for review, not certification or automatic approval.

12. Reassess or delete with the right expectation

    Reassess reopens the same completed assessment as In Progress and clears its completion date; it does not create an immutable prior version. Retain the prior report before changing it if you need comparison. Delete Assessment removes that assessment and related response/applicability records; it is not an archive command.

Exact behaviour and worked examples

Keep implementation, applicability, response coverage and maturity separate. Expand the detail relevant to the task you are doing.

Check the result

A ISO 27001 assessment and evidence-led view of its selected controls.

Current limits and common mistakes

The current application catalogue is not guaranteed to cover the complete ISO 27001 standard. Selected scope, response coverage, applicability, maturity and remediation are distinct. Reassess updates the existing record, while deselecting ISO categories prunes their responses. A generated SoA/report has no separate formal approval merely because it was saved.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Assessments → EU AI Act → New Assessment

Use EU AI Act Assessment, General Assessments or Admin access. This does not automatically grant NIS2 access. Ordinary Read Only is subject to write guards; EU AI Act has no ISO/NIS2 demo write carve-out.

Before you begin

Prepare the organisation, assessor, date and concrete scope, plus implementation evidence for the controls you will select.

Fields and choices

Step-by-step

1. Identify the organisation and assessor

   Complete Organization Name, Industry, Organization Size, Assessment Date and Assessor Name. Optional Email, Phone and Reference ID identify the record. The AI form has its own employee-size choices, including Enterprise; choose the offered value for this entity.

2. Set the required AI role and region

   Choose Organization’s AI Role: Provider, Deployer, Both Provider and Deployer, Importer or Distributor. Choose AI Deployment Region: EU Only, EU and International, or International (serving EU market). These are assessment context, not a legal determination or an inferred role from an integration.

3. Describe the systems, risk categories and use sectors

   Select relevant AI System Risk Categories (High-Risk, Limited-Risk, Minimal-Risk, GPAI and/or checking prohibited practices), the actual AI Use Sectors and Assessment Scope. Name the systems and operations covered. Do not omit a difficult system merely to improve the assessment result.

4. Choose the assessment domains

   Use Next: Select Assessment Domains and select at least one domain, then Next: Start Assessment. The catalogue includes governance/strategy, risk classification/prohibited practices, risk management, data governance, documentation/logging, transparency/human oversight, accuracy/robustness/cybersecurity and conformity/compliance/monitoring. Role/risk context can filter the question population.

5. Distinguish filtering from an answer

   Role and selected system types drive the application’s relevance filter. Context-excluded questions are omitted from the active answer form and stored as N/A only after successful saving; keep the reason for exclusion distinct from an operator-selected N/A or an unanswered in-scope question. Read the selected scope and displayed population before answering and before sharing a report.

6. Record implementation evidence for each in-scope question

   Choose Implemented, Partially Implemented, Planned, Not Implemented or Not Applicable. Add Evidence, Identified Gaps and Notes that describe the actual system, policy/version, oversight arrangement or technical result. A generated AI answer is not source evidence by itself.

7. Record maturity and remediation

   Use Maturity Level (0–5, offered 0.5 steps) only when assessed. Add Remediation Plan, Owner, Deadline and Status for a gap. Human-oversight or AI-literacy evidence can cite an actual training record; a course certificate does not automatically complete this question.

8. Save as Draft or Submit Assessment

   Save as Draft keeps In Progress. Submit Assessment requires at least one evaluated question, not complete coverage. Reopen the saved record and inspect unanswered in-scope questions, exclusions and maturity availability. Unknown maturity must not be reported as zero.

9. Continue or change the domain scope on the same record

   Continue opens an existing draft; a completed record needs Reassess first. Back to Domain Selection revises the In Progress record’s selected domains, not a separate assessment. Older domain responses can remain stored; recheck saved AI context and the new active population; do not infer that a removed domain was approved.

10. Own gaps and reviewed external follow-up

    Use the same assessment in Gap Analysis and Controls Implementation. Maintain plan, owner, deadline and status. Where enabled and eligible, review Create Jira Ticket and submit once, then check its reference. A ticket’s resolution is not an automatic legal compliance approval or a rewrite of every assessment response.

11. Generate the correct AI-system report

    Use Reports and select this assessment’s executive, technical, gap or comprehensive output. Review role, region, system/sector scope, filtered versus Not Applicable versus unassessed population, evidence, gaps and maturity coverage before using it.

12. Reassess or delete deliberately

    Reassess reopens this same completed assessment and clears its completion date; it does not freeze a prior version. Preserve the report before revising if comparison is needed. Delete Assessment removes the assessment and related responses/domain links. Keep required governance evidence outside a record you intend to delete.

Exact behaviour and worked examples

Context filtering, N/A, implementation and maturity remain different facts. Expand the detail for the current task.

Applicable denominator and the four-question worked example

Current detail/list/reports use questions in the selected domains. Unknown statuses normalize to Not Assessed. Applicable = selected total minus N/A; compliance = Implemented / applicable ×100; gaps = applicable−Implemented. Partial, Planned, No, blank and missing remain gaps with no partial compliance credit. Status-distribution bars instead use all selected questions, including N/A.

N/A is excluded from compliance, while a retained entered N/A maturity can still affect the mean.

Assume Implemented 4, N/A 2, Partial 1 and unanswered. Applicable =3, compliance =1/3=33.3%, gaps =2. Maturity =(4+2+1)/3=2.3/5 (Managed), including the retained N/A rating; there is no 50% gate. All four N/A gives Not applicable, not 100% compliance; old ratings can still give a maturity mean. Completed can describe a partially answered submission.

Maturity bands: ≥4 Optimizing, ≥3 Defined, ≥2 Managed, ≥1 Initial, below 1 Not Implemented. No entered ratings gives no mean. Stored overall maturity can include old out-of-scope responses, while canonical display filters selected domains: current 4 and 2 plus old out-of-scope 0 can mean stored 2.0 versus displayed 3.0.

Read the EU AI Act hub and history

History includes all stored assessments newest creation date first, without a generic server filter/pagination. Its displayed average is the simple mean of available current-state maturity means on completed records, including numeric zero and excluding unavailable means. It is not a response-weighted overall mean or a legal compliance score.

The hub cards count Completed and In Progress records. Its radar averages non-null raw ratings on completed response rows by catalogue domain, rounded to one decimal, with unavailable empty domains and fixed target 4.0. Its pie also uses completed records, counting only recognized stored Implemented / Partially Implemented / Planned / Not Implemented / Not Applicable statuses. Blank/unknown rows are omitted. These aggregate populations are not the selected-record six-status bars, applicability calculation or legal relevance result.

Check the result

A EU AI Act assessment and evidence-led view of its selected controls.

Current limits and common mistakes

This module evaluates recorded AI-system context and answers; it does not decide the organisation’s legal duties or certify compliance. Filtering, Not Applicable and unanswered questions are different populations. Its AI-role form does not represent every possible legal-role combination. VA is separate software/CVE assurance, not this AI-governance questionnaire.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

NIS2 Compliance → Relevance Check, Comprehensive Assessment or the saved assessment’s Remediation Planning

Ordinary access requires the dedicated NIS2 role; Admin/General Assessments alone is not a bypass. Only the fail-closed shared demo identity has the explicitly scoped exceptions detailed below; ordinary Read Only does not gain those writes.

Before you begin

Gather accurate organisation/sector/service/size context and implementation evidence. Review legal applicability with your responsible specialist.

Fields and choices

Step-by-step

1. Choose the correct NIS2 workflow

   Relevance Check records whether the organisation may be in scope. Comprehensive Assessment records answers about implementation. They are separate saved records and use different forms; a relevance classification does not answer the comprehensive questions.

2. Enter the relevance inputs in their actual units

   In Relevance Check, enter Organization Name, Sector, Entity Size Category, Annual Turnover (in million EUR), prior KRITIS/NIS1 classification, EU operations/services and Assessment Date. Enter turnover as millions, not whole EUR. Entity size is a range (Micro <10, Small 10–49, Medium 50–249, Large ≥250), not an exact employee-number field.

3. Complete the relevant conditional context

   Review the digital-services selections and any sector-specific capacity, electricity, inpatient, population or regulator questions shown. Use actual facts and distinguish Yes, No and Not sure. The calculation uses internal size-category assumptions; those assumptions are not facts you entered.

4. Save and review relevance

   Choose Check NIS2 Relevance. Inspect saved inputs, classification, reasons and confidence. Saved relevance inputs are shown read-only; this is not a generic Edit-and-resubmit form. Obtain the responsible scope/legal review rather than treating the indicator or confidence percentage as a legal ruling.

5. Carry the intended relevance context into the questionnaire

   Use the relevant result’s offered comprehensive action and verify its organisation/relevance context. Starting the questionnaire elsewhere can use different fallback context. A correct organisation name matters, but matching text alone is not proof that all assessment evidence is linked.

6. Work through the comprehensive question population

   Enter required Organization Name. The actual questionnaire presents 40 questions across 10 domains; it has no ISO-style domain-selection wizard. The domains cover risk/policies, incidents, continuity/crisis, supply chain, acquisition/development, effectiveness review, cyber hygiene/training, cryptography/data protection, access/personnel, and identity/authentication including MFA.

7. Record Yes, Partial, No or N/A

   Read each question and choose the answer supported by implementation evidence. This form does not use the five-state Implementation Status or 0–5 maturity entry from ISO/C5/EU AI. Unanswered and N/A are different. Cite or retain the supporting policy, supplier decision, training or technical evidence through its owning records.

8. Review Track for each gap

   The current saved generator does not consume the displayed Track flags. Stored Partial/No answers can generate items even when Track is off; unanswered/null values can interrupt generation after an assessment save. Inspect the saved record and item population before retrying. These are NIS2 items, not automatically formal Risk Treatments.

9. Use Complete Assessment deliberately

   The current comprehensive screen offers Complete Assessment, not Save Draft or a Continue wizard. If the incomplete-assessment warning appears, Cancel to finish the answers or knowingly use Submit Anyway. Inspect the saved answered/unanswered population afterward; a completed record can still contain unanswered questions.

10. Read the saved results and remediation

    Open the selected record in NIS2 Assessments, then its result/report and Remediation Planning. Confirm identity, relevance context, domain answers, gaps and generated work before interpreting the percentage or maturity description. Those result descriptions are not a separate maturity questionnaire.

11. Add a manual remediation item

    Choose Add Remediation Item. Enter required Title and, as needed, Description, Category, Priority and Target Completion Date. Save and reopen the item. The actual form has no Assignee field; record responsibility in the description/notes or supported external task rather than expecting an unoffered owner control.

12. Maintain status, progress and implementation notes

    Use the selected item’s Edit action. Review Title, Description, Category, Priority, Status (Open, In Progress, Pending or Completed), Target Completion Date, Progress Percentage 0–100 and Implementation Notes. Choose Update Remediation Item and reopen to confirm persistence. Completion/progress reflects recorded operator state, not an effectiveness test.

13. Protect open work before editing or regenerating

    Edit Assessment on a saved comprehensive record reopens its questionnaire and updates that same record when completed again. This is not the separate legacy draft-only Edit form and not a new immutable version. Editing/reassessment or regeneration can remove existing non-completed remediation, including manual open items, before regenerating gaps; completed evidence is preserved. Retain required open plans and inspect the replacement list.

14. Export the intended population

    Use Export Report for the selected assessment or Export Assessments for the combined view. Review questionnaire/context/remediation scope and timestamps. Browser print/save is separate from a native PDF-download route; do not assume every comprehensive record or relevance result has the same export controls.

15. Delete the precise record only when intended

    A relevance record, a comprehensive assessment and a remediation item have separate Delete actions. Deleting relevance is not deleting its comprehensive counterpart. Comprehensive deletion targets same-ID assessment/companion/remediation records; a fallback companion with a different ID is not guaranteed covered; it is not archive, approval or work completion.

16. Continue in the owning evidence/work module

    Where rendered and permitted, deliberately create a reviewed Jira task or link a Confluence reference. Maintain supplier assurance, policy versions, course completion, assets/CIA/VA and formal Risk decisions in their own modules. Enter and justify the specific NIS2 answer; no supporting module automatically certifies or completes it.

Exact behaviour and worked examples

Relevance, the 40-question comprehensive record, remediation items and older 15-question records are separate workflows. Expand the section for the record you actually have.

Check the result

Stored relevance/assessment evidence and visible remediation work.

Current limits and common mistakes

Ordinary NIS2 access requires its dedicated role; General Assessments or Admin alone is not a blanket bypass. The scoped demo exception does not grant ordinary write authority. Relevance is based on recorded ranges/assumptions, not verified legal applicability. Comprehensive has no Save Draft and submission can be incomplete. Editing/regenerating can remove open manual remediation; preserve needed plans before that action. User ownership and save/export behavior differ by path.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Assessments → BSI C5 → New Assessment

Use BSI C5 Assessment, General Assessments or Admin access. This does not automatically grant NIS2 access. Ordinary Read Only is subject to write guards; C5 has no ISO/NIS2 demo write carve-out.

Before you begin

Prepare the organisation, assessor, date and concrete scope, plus implementation evidence for the controls you will select.

Fields and choices

Step-by-step

1. Define the cloud service being assessed

   Complete Organization Name, Industry, Organization Size, Assessment Date, Assessor Name and required Cloud Service Type. Choose IaaS, PaaS, SaaS or the offered combination. Add Assessment Scope, Primary Data Location, Cloud Provider(s), Email, Phone and Reference ID where applicable. Identify the specific service boundary and your/provider responsibilities.

2. Select at least one control domain

   Choose Next: Select Control Domains, review the named domains and select the scope, then Next: Start Assessment. The selected cloud-service context is descriptive; it does not query Azure/AWS or import assets. Current routes use the default 2020 catalogue; 2025 static definitions are not an offered edition selector. Read the actual criterion labels; Additional-tier coverage is not established merely because helpers exist.

3. Review each cloud criterion

   Expand the domain/control and read its criterion and guidance. Choose Implementation Status: Implemented, Partially Implemented, Planned, Not Implemented or Not Applicable. Document the actual service’s implementation, not a general provider marketing statement.

4. Supply service-specific evidence

   Use Evidence for configuration/report/document references, Identified Gaps for missing implementation, and Notes for shared-responsibility assumptions and exclusions. Supplier certificate evidence may support a claim, but supplier internal approval alone does not prove the C5 criterion.

5. Assess maturity and follow-up separately

   Enter Maturity Level (0–5, offered 0.5 steps) only when assessed. Add Remediation Plan, Owner, Deadline and Status for needed work. Blank maturity is not zero; a remediation Completed label is not an independent cloud-control test.

6. Save as Draft or Submit Assessment

   Use Save as Draft while evidence is incomplete. Submit Assessment requires at least one criterion with an implementation status, not every selected criterion. Reopen the result and inspect unassessed and Not Applicable populations as well as the score.

7. Continue an existing draft

   Use Continue from the saved assessment list. Back to Domain Selection can revise the existing In Progress scope; verify the resulting selected domains and reported population before returning to the controls. Older out-of-scope response rows can remain stored; this differs from ISO category deselection, which prunes them. Do not begin a duplicate record merely to continue work.

8. Review Gap Analysis and implementation tracking

   Select the intended assessment in Gap Analysis and Controls Implementation. Review the specific criterion, plan, owner, deadline and current status. A permitted Create Jira Ticket on an eligible gap is a separate reviewed external action; check the resulting issue reference.

9. Produce a scoped cloud report

   Use Reports for this assessment and select executive, technical, gap or comprehensive output. Check service type, scope, catalogue, excluded/unassessed criteria, evidence and maturity coverage. An HTML/report output is not an independent C5 assurance opinion.

10. Reassess or remove deliberately

    Reassess reopens the same completed assessment as In Progress and clears its completion date, retaining the current response context rather than making a historical copy. Preserve the preceding report if needed. Delete Assessment removes the selected assessment and its responses/domain links; do not use it to disguise unfinished work.

11. Carry evidence across modules explicitly

    Maintain cloud assets in Asset Management, cloud retrieval/import in Azure/AWS, supplier assurance in Supplier Management and formal risk decisions in Risk Management. Cite those identities/versions in the C5 evidence. Their statuses are not automatically synchronised with this assessment.

Exact behaviour and worked examples

The retained domain chart describes the available C5 scope. Expand the calculation and save detail before interpreting a result.

N/A credit, maturity and the four-control worked example

Implementation and compliance are not the same

Current detail/list/reports walk every control in the selected catalogue. Implementation = Implemented / all selected controls ×100. Compliance = (Implemented + N/A) / all selected controls ×100. Missing/blank, Partial, Planned and Not Implemented are status gaps. Unlike ISO and EU AI Act, N/A stays in the denominator and receives compliance credit.

C5 report compliance credits N/A; the Gap Analysis screen additionally tests low maturity.

Assume Implemented 4, N/A 2, Partial 1 and unanswered. Report compliance =2/4=50%; implementation =1/4=25%; status gaps =2. Maturity averages the entered 4,2,1 =2.33, displayed 2.3/5 (Managed). Retained N/A maturity is included, with no 50% coverage gate. One rating of 5 among 100 selected controls can yield 5.0—state the number rated rather than implying complete coverage.

The Gap Analysis screen also treats maturity <3 as a gap, including retained N/A ratings. This example’s N/A 2 adds a screen gap, yielding 25% screen compliance versus 50% report compliance. An Implemented 2 can be a screen gap but not a report status gap. This is a current view-specific difference, not a reason to conceal a low rating. All N/A can yield 100% compliance and 0% implementation, not implemented cloud controls.

Maturity bands: ≥4 Optimizing, ≥3 Defined, ≥2 Managed, ≥1 Initial, below 1 Not Implemented; no ratings gives Not calculated/N/A.

Read the C5 hub and assessment list

The list includes all stored assessments newest creation date first, without a generic server filter/pagination. Each record uses current selected-state maturity; the list average is the simple mean of available completed per-assessment means, including numeric zero and excluding unavailable means. It is not a response-weighted organisation compliance score or immutable version history.

The hub cards count Completed and In Progress records; Not Started is a zero placeholder. Its radar uses non-null raw response ratings from completed records by catalogue domain, rounded to one decimal; absent ratings remain unavailable and target 4.0 is fixed. Its pie counts five recognized stored response statuses on completed records only: Implemented, Partially Implemented, Planned, Not Implemented, Not Applicable. Blank/unknown rows are not included. This is not the six-status selected-record bar or a denominator limited to each assessment’s current selected domains.

Check the result

A BSI C5 assessment and evidence-led view of its selected controls.

Current limits and common mistakes

The cloud scope/provider/location fields do not configure cloud access or verify residency. Current catalogue and criterion coverage must be checked in the loaded module; do not promise additional-criterion or different-edition coverage from a generic diagram. Submission may be partial and Reassess reopens the same record. Reports are not a C5 attestation.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

ISO 27001 → Statement of Applicability → selected assessment

Use ISO 27001 Assessment, General Assessments or Admin access. This does not automatically grant NIS2 access. Read-only and scoped demo rules apply.

Before you begin

Prepare the scope, control decisions and their supporting rationale.

Fields and choices

Step-by-step

1. Open the intended ISO assessment’s SoA

   Start from the selected ISO 27001 assessment or explicitly choose its identity in Statement of Applicability. The unqualified page may default to the most recent completed assessment; verify organisation, assessment ID/date and scope before changing anything.

2. Review the loaded control population

   The SoA uses the selected assessment’s catalogue/categories. Compare the displayed controls with your real ISMS scope and required control population; the application does not guarantee a complete standard catalogue.

3. Set the applicability decision

   For each control, choose Yes (applicable) or No (not applicable); Undefined means no saved choice. An unset decision must remain distinct from a justified exclusion. Implementation Status elsewhere does not automatically establish the SoA decision.

4. Write the justification

   Explain why a control is included or excluded for this ISMS, including relevant obligations, risk/context and other treatment. The current handler can store a blank justification; successful saving therefore does not prove a defensible exclusion. Review the rationale yourself.

5. Save the SoA and reopen the same assessment

   Use Save Changes, then reopen the selected assessment’s SoA. Confirm the saved choices and justification text. Select All as Applicable changes inputs and still requires saving. Filter by Category changes the view, not the decision. Saving is not a separate formal approval workflow.

6. Compare implementation and gaps

   A control can be applicable but not implemented. Review its assessment response, supporting policy/version and remediation separately. Correct those through their owning assessment/document/control workflow rather than changing applicability to conceal a gap.

7. Use the guidance and output controls for this assessment

   SoA Guidance explains the view. Report / Generate SoA Report uses the selected assessment and its saved decisions; report generation requires a completed parent assessment. The grid does not offer Implementation Method or Responsible Party fields merely because a similarly named form class declares them.

8. Review and retain the SoA report

   Use the selected assessment’s SoA report and check identity, scope, omitted/unset decisions, justifications and implementation evidence. Record your organisation’s review/approval through its approved governance process; generation does not perform that approval.

9. Maintain it when context changes

   When ISMS scope, risk treatment or obligations change, update the selected assessment’s applicability decisions deliberately and retain the earlier reviewed output if history is needed. Reassessing or deleting the parent ISO assessment is not a universal SoA version-history facility.

Exact behaviour and worked examples

The SoA is the ISO assessment’s applicability grid, not another implementation or maturity questionnaire.

Four-control example and independent implementation answers

Saving an applicability decision does not rewrite the control’s implementation answer.

Assume four selected controls: saved Yes, Yes, No and no entry. Applicable =2, Not Applicable =1, Undefined =1. Undefined =selected total−Yes−No. An Implemented answer on the No control does not change those counts. Change only its SoA decision to Yes and Save: counts become 3/0/1 without changing implementation.

Implementation N/A and SoA No are independent facts. A control can be applicable but unimplemented, or have implementation evidence yet be excluded for a justified scope. A count is not a defensible exclusion, a compliance score or a signature.

Check the result

A scope-specific applicability reference for review.

Current limits and common mistakes

Applicability, implementation and formal organisational approval are separate. The current SoA save does not enforce a substantive exclusion rationale or provide its own approval/certification. It depends on the loaded ISO catalogue and parent assessment; verify complete scope and preserve prior outputs where needed.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Document Dialog → Select Template / View Documents / Document Map

Admin or Document Dialog access applies. Read-only creation has a specific name-based Password Policy exception; it is not general document-write permission or a universal demo rule.

Before you begin

Decide whether you need a new identity, a new version, a selected export or an external handoff.

Step-by-step

1. Find existing work

   Open View Documents, ordered newest-created first. Type in Search documents... to filter immediately by case-insensitive title substring; clear the input to restore all rows. There is no server Search/Reset button or category/version/approval filter. A filtered No documents found is different from a truly empty inventory: use its Create New Document action to choose a template. Content unavailable is a storage state, not a search result.

2. Use the action menu for the exact row

   View Details reads the current body; Edit creates a new saved version; Version History reads stored revisions; Export downloads the selected current body; Delete is a separate destructive choice. Verify title and ID before choosing.

3. Choose the right template path

   Select Template opens the latest existing document where one exists, otherwise generation. To create another document for an existing template, use Document Map’s +/create entry and the duplicate-choice dialog.

   Choose existing or new

4. Save or revise deliberately

   Generate Document creates Document + version 1. Existing Document → Edit → Save New Version retains the identity. A draft in the editor is not a saved revision.

   Save and inspect the revision

5. Interpret review and lifecycle separately

   Overdue/Due Soon/Active/Not Set are date bands, not approval. The lifecycle chart counts registered templates, not individual documents; an old overdue document can keep a template in Overdue.

6. Read and retain the body

   Check exact version, dates, unresolved markers and current body. Missing body requires recovery, not empty replacement. Export or publish only after that check, following their separate procedures.

   Export and publish separately

Check the result

The correct Document identity/version and a deliberate next action.

Current limits and common mistakes

Generation is not approval, implementation or acknowledgement. Export is HTML, not a promised native PDF/DOCX or complete backup.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Document Dialog → Select Template or Document Map

Use the document access and read-only limits stated in the overview.

Before you begin

Prepare real business facts; source examples and a policy title are not verified organisational content.

Step-by-step

1. Choose an available registered template

   Read the available registered template’s category, purpose and actual form. If Select Template is empty, use its Document Map path. The map also lists unavailable source-only entries; those cannot be generated and are not a coverage guarantee.

2. Open or create intentionally

   Select Template’s View Document opens its latest record. To create another identity use Map +/create. Existing Document Found shows the latest three titles, versions and dates plus an extra count when more exist. Check them before choosing: Create New Version opens the latest editor; Create New Document or Close returns to the new unsaved form. Neither silently saves.

   Maintain an existing version

3. Read each actual field

   Check label/help, requiredness, type, limits, choices and defaults. Forms can use text, long text, dates, integers and checkboxes; do not substitute a generic Company/Owner/Version form.

   Field types and full ISMS inputs

4. Use the specialised guide where applicable

   Canonical ISMS uses the source-driven 46-input form below in Generating a Document. Password Policy’s rotation boolean changes prose, not the account system. Other templates depend on their actual registered stored schema.

5. Correct validation before generation

   Use clear real values, valid ISO dates and any displayed numeric range. Required-looking checkboxes do not universally mean checked is mandatory; do not infer a numeric validator from an asterisk alone.

6. Recover unavailable legacy links

   An old convert-template link redirects a single registered match; ambiguous matches return selection and missing matches are unavailable. It is not a self-service conversion/seeding tool.

Check the result

An available template and a deliberate new-document or existing-version path.

Current limits and common mistakes

The 88 source files/marker inventory is not a census of offered templates or fields. Non-ISMS stored schemas were not read from private data; follow the rendered form and obtain authorised schema clarification if it is unclear.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Document Dialog → selected registered template → creation form

Admin/Document Dialog access applies. The read-only Password Policy name exception is narrow, not general write permission.

Before you begin

Prepare Document Title and the selected form’s required facts. Check for an existing intended document before generation.

Step-by-step

1. Confirm template and identity

   Document Title is required and at most 200 characters. Check the template context and the Existing Document Found choice; Create New Document makes another identity, while Create New Version opens the latest editor.

2. Complete the actual schema

   Use the visible fields and help. Canonical ISMS has the 46 inputs grouped below; only Review Cycle defaults to 12. Supply actual organisation/scope/contacts/references and policy text, not unexplained sample claims.

   Template availability and schema

3. Handle field types deliberately

   Text has its actual length validator; long text/blocks can have different limits. Dates use YYYY-MM-DD. Integer fields use the stated range. Checkbox false is a valid value unless its real validator says otherwise; an asterisk alone is not proof checked is mandatory.

4. Check specialised effects

   For Password Policy, the rotation boolean changes the generated rotation sentence; it does not configure account passwords. For ISMS, entered Approvals/Version History are escaped authored content, not approval or version events.

5. Generate once

   Use Generate Document. It saves the Document, version 1 and persistent body. A missing/past effective date is clamped to today; next review uses effective date plus the calendar-month cycle. Template/generation/storage failure is not a saved draft.

6. Inspect the entire saved output

   Read headings, scope, responsibilities, dates, tables, references and remaining placeholders. Review any fixed sample communication/history claims. Effective Date is automatic at creation; unresolved approval/signature/employee/department/acknowledgement markers are not extra offered approval inputs.

7. Revise through the actual editor

   Use Edit, correct the current body and dates, add Change Notes and Save New Version. Entered block Markdown was substituted as literal escaped content; use Insert Table if a real table is required.

   Link, table and save controls

8. Reopen before sharing

   Check the same Document ID/current version and body. Export the intended stored version. Publish sends current content separately; neither action approves or implements the policy.

   Selected export versus current publication

Check the result

A readable persisted draft with correct identity, body, version and dates, or a specific failure requiring reconciliation.

Current limits and common mistakes

Handled storage/DB failure retains input and reports no save. Non-ISMS fields remain schema-driven, not a privately inspected catalogue. Do not promise a universal 500-character limit or automatic organisation-wide propagation.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Saved Document → Edit / Version History

Use the permitted account and exact Document ID. Read-only does not give a general editing exception.

Before you begin

Read the current body, version, effective/review dates and desired changes. Retain required evidence first.

Step-by-step

1. Open Edit on the existing identity

   Do not generate a duplicate merely to revise wording. Missing metadata or a missing saved body is an error/recovery case; do not replace unavailable history with an empty document.

2. Format selected text or the cursor position

   Use Bold, Italic, Underline, Bullet List, Numbered List, H1/H2/H3 or Paragraph. These affect the editor only until Save New Version; the editor does not rerun every original template field.

3. Insert a link safely

   Use Insert Link with the intended selection/cursor. Enter a safe URL and nonblank Text, then Insert. Correct inline URL/selection errors; Cancel or Escape abandons that panel. Enter submits the panel’s intended action.

4. Insert a real table

   Use Insert Table. Default is 3×3; rows are whole numbers 1–100 including the header, columns 1–20. Insert creates header/body rows at the saved cursor. Correct inline errors, or Cancel/Escape. Resolve open link/table panels before saving the document.

5. Set version metadata

   Effective Date and Next Review Date are optional ISO inputs; Change Notes is optional, at most 500 characters. Blank effective retains the current value. Blank next review recalculates today plus existing cycle; enter it explicitly when a different schedule is agreed.

   Review-date rules

6. Save the new version

   Use Save New Version. The sanitised body must remain nonempty. Correct validation errors and inspect storage feedback; Cancel is not a save. Metadata dates do not rewrite every date typed in the body.

7. Inspect Version History

   Confirm the new number, Current marker, editor/time and Change Notes. Entries are newest first; Content unavailable is not an empty valid revision. Numbered Export preserves the chosen version rather than changing current_version.

8. Compare the intended pair

   Use Compare with previous or Version 1 / Version 2 → Compare. Red means removed, green added, orange changed. This is a text-line comparison, not a complete formatting diff. Missing version is unavailable; missing body needs recovery.

9. Retain or adapt deliberately

   Export the exact numbered/current body as HTML and inspect it. There is no native Restore/Revert action; to reuse earlier content, review it and save a deliberate new revision.

   Retain the chosen output

Check the result

A new stored body/version and checkable history, or an explicit validation/storage failure.

Current limits and common mistakes

Handled storage failure can retain submitted input; invalid field redisplay does not guarantee every draft value survives. Version history is not organisational approval or a complete backup.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Information Security Policy → table of contents → section → subsection

Reference reading is public. Integration actions are separately authenticated/configured; reading is not a permission grant.

Before you begin

Know the topic and whether you need a reference passage or an organisation-specific maintained document.

Step-by-step

1. Browse the hierarchy

   Open a section, then the intended subsection. Use parent/overview navigation and the collapsible table of contents; click or Enter/Space can toggle it. A missing section/deep path returns the overview with a notice, not an editor.

2. Search locally

   Enter q through Search using useful terms at least two ASCII-alphanumeric characters long. Results rank title/body matches and are limited to 20. No matches is a local search outcome, not proof there is no applicable policy.

3. Reset and broaden carefully

   Use Clear to remove the query, browse the parent and try recognised terms. This search is not an external provider search or an Ask query. German content can use English source fallback.

4. Read the full context

   Check the selected paragraph and its parent before citing it. Reference text is not your organisation’s signed policy register or evidence that a control is implemented.

5. Retain the reference URL

   On a subsection use Show URL to reveal the link and Copy URL for the clipboard. Verify the copied destination. The Asset Management shortcut navigates to inventory; it creates no Asset.

   Inventory shortcut is navigation

6. Choose a separate follow-up

   On a full section, eligible Integrations can offer Create Jira Ticket, Link Confluence Page and Open ISC Space. Open ISC Space is external navigation to the fixed ISC Confluence space, subject to provider access; it does not create/link/publish a page or adopt policy. A subsection has the eligible Jira/link actions but no Open ISC Space option. Use Document Dialog separately for a maintained organisational version.

   External action and evidence boundaries

Check the result

The intended source topic, reference link and deliberate next action.

Current limits and common mistakes

Legacy #documents/isp links are normalised to #policy/isp by this Help copy on initial load, navigation and browser history. Use Policy Reference as the canonical destination. This compatibility is in Help only; no application bridge was edited or runtime-tested.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

View Documents → intended document → Edit / Version History

Follow your organisation’s actual reviewer/approver responsibility process.

Before you begin

Check the saved version and Next Review Date, plus changes in scope/process since the last review.

Step-by-step

1. Interpret the date band

   Past date is Overdue. Today through 30 days ahead is Due Soon, inclusive. More than 30 days ahead is Current on detail / Active on list. Blank is Not Set. None means approved or already reviewed.

2. Review the content and context

   Compare the saved body with current Assets/CIA, Supplier evidence, assessments, incidents and responsibilities. A due badge is attention guidance, not an assigned reviewer or automatic ticket.

3. Record the actual result

   Use Edit and Save New Version when recording revised content, dates or review notes. Maintain reviewer/approver evidence through the organisational process; typing an approval block is not an application approval event.

   Record a versioned review

4. Choose the next date explicitly

   Creation calculates effective date plus cycle. Edit with blank next review calculates today plus cycle, not necessarily the effective date. Use an explicit ISO Next Review Date for an agreed exception/schedule.

5. Reopen the same identity

   Confirm version, metadata, body dates and Change Notes. Metadata edits do not rewrite dates embedded in prose. Preserve any review evidence needed separately.

6. Publish or track follow-up separately

   Create a reviewed Jira task or Publish current content only through its intended action. Jira completion is not a local version save/approval, and later edits are not automatically republished.

   Check deliberate publication

Check the result

A maintained Document version and truthful next-review evidence.

Current limits and common mistakes

Example relative to today: yesterday → Overdue; today and +30 days → Due Soon; +31 days → Current/Active; blank → Not Set. No universal automatic notification or legal approval is implied.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Document Dialog → existing Document; View Documents action menu for Delete

Use eligible Document/integration access; external actions require enabled services and their own gates.

Before you begin

Confirm exact Document ID/current body and whether the intended output is a historical export or current-body publication.

Step-by-step

1. Finish and save local review

   Read the entire draft. Use Edit → Save New Version for corrections and reopen it. A preview or typed Approvals paragraph is not saved approval or adoption.

   Save the intended local revision

2. Export the chosen persisted body

   Use current Export or a numbered Version History export. Check filename/version/date and the actual sanitised HTML body. No native DOCX/PDF is promised; browser printing is separate.

3. Prepare a current-body publication

   Only after confirming readable current storage, open Publish to Confluence. Check read-only Document identity, required Page Title and the offered ISC space. A historical export selection is not what Publish sends.

4. Cancel or Publish once

   Cancel leaves that publication unsent. Publish can create or update a same-title page. If the body is missing/unavailable, recover it first rather than risk timestamp-only or incomplete external content.

5. Reconcile both sides

   Inspect the remote Page ID/body and local reference. Provider success does not guarantee local reference persistence. Do not blindly republish after an unclear outcome or assume another local version was created.

   Reconcile remote and local outcomes

6. Create review work separately

   Use Create Review Ticket if a Jira task is intended. Its completion does not approve the policy, save a version or republish future edits.

   Ticket consequences

7. Delete only after retention review

   In View Documents use the exact row’s actions → Delete. Check the named title, then Cancel or Delete. Deletion removes the Document/version database rows; failure requires inspection, not assumed removal.

8. Inspect the actual removal boundary

   Deletion is not archive, template removal, retraction of Jira/Confluence/exported copies or complete physical-file erasure. Retain required evidence before the action.

Check the result

An inspected chosen-version export, deliberate current-body publication or correctly bounded deletion outcome.

Current limits and common mistakes

No general Document Dialog approval, send-back or version-revert endpoint is established. Provider and local writes are not one atomic transaction.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Training → My Training / My Progress / Certificates / Course Catalog

Use the eligible learner account. Trainer/Admin oversight and Account Admin assignment writes are different responsibilities.

Before you begin

Check the primary/assigned role, available curriculum and any missing role guidance before starting.

Step-by-step

1. Choose the intended course

   Use My Training → View My Courses for assigned mandatory work and optional explored courses; use Course Catalog → Browse Catalog for available roles. No primary role or Coming Soon/missing content is not completed learning.

   Course and assignment choice

2. Open the course overview

   Inspect actual loaded cards/quizzes and existing progress. Opening the course or quiz can create empty progress; it does not mark a card complete.

3. Study the card

   Read text/examples and infographic. The card position bar is your current card number divided by loaded count, not saved completion.

4. Record completion explicitly

   Use Mark Complete & Continue or final Mark Complete after study, or pass the corresponding quiz. A page visit alone is not the completion action.

5. Submit every required quiz

   Answer every question with at least one choice and Submit Quiz. Exact-set scoring, metadata thresholds and latest-score rules apply; inspect feedback and remaining work.

   Exact quiz scoring

6. Check progress and the certificate separately

   Use My Progress → View My Progress for Overall Completion, Courses Completed, In Progress, Cards Completed and Training History; the detailed procedure is linked below. Quiz submission can create the certificate only when all loaded cards/quizzes qualify; marking the final card alone does not generate it. Use Certificates → View Certificates to check identity, issue and expiry.

   Certificate trigger and renewal

   My Progress — entry, history, status and exact denominators

7. Use administration for assignments

   Training Role Assignments is reference/navigation. Account Admin → User Management → Edit User saves curriculum roles/primary role; Training Admin alone cannot save them there.

Check the result

Saved card/quiz progress and, after qualification, a specific course certificate.

Current limits and common mistakes

Dashboard progress can include optional/empty started rows; assigned-only reports have a different denominator. Training is learning evidence, not policy approval or technical/legal compliance.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Training → Course Catalog / My Training

Use actual Training/module access. Read-only learning scope is limited to the offered CISO/General Staff paths, not all courses.

Before you begin

Know the learner’s responsibility and whether the course is assigned or optional.

Step-by-step

1. Browse the active catalogue

   Roles are grouped Specialist, Executive and Functional. Start Course means content is offered; Coming Soon or missing content is not a complete curriculum. Localised display names can change without changing the English-name-derived course identity.

2. Check assignment separately

   My Training distinguishes mandatory assigned courses and optional explored courses. A catalogue visit or empty progress row does not create an Account Admin assignment.

3. Use the actual editor for assignments

   Account Admin uses User Management → Edit User → selected training roles/primary role → Save. Training Admin’s Role Assignments view is not an assignment-write form. Unassignment retains earlier learning progress/certificates.

   Save curriculum assignments

4. Read the course overview

   In the course overview inspect actual loaded cards/quizzes and results. Start Course appears when no cards are complete; Continue (Card n) uses highest completed card + 1 while incomplete; All Cards Completed! appears when its card count is complete. My Courses instead offers its Start/Continue Course/Review Course branches. Neither navigation silently resets progress.

5. Fill gaps deliberately

   Continue can choose highest completed card + 1, not the first missing card. Use individual card/quiz links to return to a gap, Previous/Back to Overview for navigation, and actual completion controls to save learning.

   Complete a card or quiz

6. Compare denominators correctly

   My Courses currently uses a fixed 24 denominator. The course/progress view uses actual loaded counts (with a fallback where needed). Do not infer every course has 24 cards or that unlike percentages are equivalent.

   My Progress — rows, certificate states and weighted totals

Check the result

The intended learner-course identity and a specific next unfinished task.

Current limits and common mistakes

Course availability is deployment/content-dependent. This guide does not create a course editor, source catalogue census or role grant.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Training → selected course → card / quiz

Use the intended learner and course identity.

Before you begin

Read the actual lesson and the displayed quiz requirements before answering.

Step-by-step

1. Study and inspect the illustration

   Read the card’s text and examples. Click an infographic to enlarge; clicking the image can zoom, and close resets it. Missing content is a content error, not completion.

2. Navigate without confusing position and progress

   Previous and Back to Overview move between views. The position bar is current card number / actual loaded count; it can be full while saved learning is incomplete.

3. Record the card

   Use Mark Complete & Continue or final Mark Complete. This idempotently stores the card number and returns next/overview. It does not itself issue a certificate.

4. Answer every quiz question

   Take Quiz, select at least one option for each question and Submit Quiz. Multi-select needs every correct option and no extras. Inline unanswered highlighting retains the page; a server fallback can redirect without an answer draft.

   Confirm the actual curriculum

5. Read exact-set scoring

   Each question is all-or-zero: if correct choices are A+C, A alone or A+C+D earns no credit. Four exact-correct questions out of five gives 4/5 × 100 = 80%.

6. Separate raw pass from displayed score

   Raw percentage is compared with quiz metadata, then saved to one decimal. A raw 79.96 can fail an 80 threshold while displaying 80.0 after rounding; later stored-score qualification can differ. Use actual feedback and criteria.

7. Review or retry the actual result

   Latest submission overwrites the score; it is not a best-attempt ledger. Failed output can offer Retry/Review/Next. Review mode at stored score ≥80 shows disabled answers and no Submit, even if metadata qualification differs.

8. Check course qualification

   A passing quiz also marks its card. At a qualifying Submit Quiz, the application checks recorded completion counts and quiz scores against the loaded-course requirements before attempting certificate creation. These count/score checks are not independent proof that every lesson was reviewed or mastered. Later failure does not necessarily clear an existing completion date/certificate; inspect saved state rather than assuming clean recomputation.

   Inspect the certificate

Check the result

A recorded card and latest quiz score, with any remaining course qualification explicit.

Current limits and common mistakes

There is no persisted answer draft or complete attempt history. Some next-card/result links retain fixed-24 assumptions; use the actual overview to resolve curriculum gaps.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Training → Certificates → exact certificate

The owner or global Admin can view; Training Admin alone is not an owner-view bypass. Renewal is owner-only.

Before you begin

Verify learner/course/issue/expiry and retain any required evidence before Renewal.

Step-by-step

1. Find the exact certificate

   Certificates lists your records newest-issued first. No certificate is an explicit state; verify course qualification rather than assuming the final card issued one.

2. Read identity and validity

   Check learner/course, issue/expiry, Valid/Expired, days left, CERT identity and 16-character hash. Validity is 365 days; the hash is not a digital signature, public verification or external qualification.

3. Open View & Print

   This opens the separate certificate view. Print Certificate invokes browser printing; inspect preview and the intended private destination. There is no dedicated native PDF download endpoint.

4. Recognise the offered renewal condition

   The menu offers Renew when expired or floored days-left is at most 30. This UI rule can differ from an exact 30-day report boundary; the owner-only handler has no separate expiry gate.

5. Retain before the one-click action

   Renew immediately posts from the menu without a separate confirmation. It clears completed cards, quiz scores and completion date, restarts the start date and deletes the old certificate; it does not reset last activity.

   Retain evidence before renewal

6. Retake and requalify

   A renewed course is not an extended old certificate. Complete the needed cards/quizzes and verify a newly qualified certificate through the actual quiz-triggered workflow.

   Requalify through actual quizzes

Check the result

An identifiable retained certificate or a deliberate reset for retraining.

Current limits and common mistakes

The reset is destructive to the old active certificate/progress state. Learning evidence does not establish policy acknowledgement, mastery or legal compliance.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Training → trainer/Admin → Role Assignments / Reports / View All Users

Admin or Training Admin reads/exports these views. Account Admin alone owns assignment writes in User Management.

Before you begin

Identify whether the question concerns active assignments, optional exploration, learner status or all certificates.

Step-by-step

1. Choose the relevant view

   Trainer landing offers Role Assignment → Manage Roles, Reports → View Reports and Course Management → Manage Courses. These open assignment reference, aggregate reporting and active-user progress, not a course editor or assignment-write grant. In Reports, View All Users, Export CSV and Print Report are separate read/output controls.

2. Read assignments as pairs

   Each active user/active assigned role is one assignment. A learner assigned two roles contributes two to the report denominator. Optional courses are excluded from assigned-only completion.

3. Calculate the example

   For two active users, the first assigned two roles with one completed and the second assigned one with none completed: coverage = 2/2 = 100%; assignment completion = 1/3 = 33.33%, not 1/2 users = 50%.

4. Check user-detail semantics

   Completed can include optional courses while assigned In Progress/status uses the assigned population. Compliant means the nonempty assigned learning set is complete; it is not regulatory compliance.

   Learner My Progress — complete history and denominator guide

5. Read certificate cards separately

   Global certificate totals, valid/expired/within-30-days and last-ten completions are not the active-assignment denominator. Role presentation bands ≥80/≥50 are visual categories, not legal thresholds.

6. Export only the offered scope

   Export CSV downloads the seven fields listed below; Print Report opens current HTML/browser output separately. No learner quiz-score ledger, all-answers export or complete backup is implied.

   Check format and sharing scope

7. Inspect and protect the output

   Check population, identities, rows and time before retention/sharing. Keep learner email/activity/certificate data limited to authorised recipients. Use the Account Admin editor for any actual assignment correction.

   Correct the assignment through Account Admin

Check the result

A correctly interpreted assigned-learning report/export with explicit population.

Current limits and common mistakes

Optional exploration can affect user totals and last activity. Compare like-for-like views instead of averaging unrelated percentages.

Continue in a related module

Application-source review: 15 October 2026. Source guidance is separate from executed deployment/customer acceptance.

Where to start

Ask amara → chat

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Use a specific question and know whether you want a record fact, policy source or analysis.

Fields and decisions

Step-by-step

1. Open the correct account and chat

   Use Ask amara under the intended authenticated session. Anonymous demo streaming is separate from the logged-in workflow. Do not submit private material there or infer a private-corpus boundary from the demo label.

2. State a concrete task

   Name the module, record or topic, intended population and date/scope. A Context setup: message gives conversational context, not durable organisation settings or new account rights.

3. Choose a supported capability where useful

   Select a domain and an offered query. Availability affects the registry; a disappeared option may mean an unavailable backing service rather than missing data. A visible internal-data choice does not prove module-role filtering.

4. Complete required arguments

   Use Complete query for the exact issue/page/board/user or registered Asset required. Compile query submits the completed request automatically; do not press Send again. A valid-looking ID does not itself establish access.

5. Read the submitted response

   Inspect route/source/status and the returned result. Unsupported data-shaped questions must not be read as live evidence; an interrupted stream is not a finished verified answer.

6. Open and verify the source

   Compare underlying identity, date, scope and unknown values. A data answer does not create a record; a source quotation does not approve a policy.

7. Keep follow-up context bounded

   Current-tab memory retains a limited recent conversation. The server trims accepted history further. Repeat the exact record/scope when needed rather than assuming unlimited context.

8. Clear current-tab memory deliberately

   Clear chat memory removes this tab’s saved/displayed conversation and reloads. It does not reset every provider/session/audit layer or retract sent information.

9. Use owning module controls for decisions

   Open the specific Asset, CIA, Risk, Supplier, VA, Document or assessment to save, approve or verify. A conversational recommendation is not that action.

Submit a typed request or a selected capability

1. Typed message

   Enter a specific question, for example “how many risks?”, then press Send once. Read whether the result is a supported data answer, curated guidance, a quotation or generated analysis.

2. Capability selection

   Choose the domain and capability. A choice with no required arguments submits immediately. If Complete query opens, fill every required field and use Compile query; that submits the completed request. Cancel closes it without sending.

3. Consequential scan

   For an offered active scan, choose the Registered Asset, read the confirmation and confirm only an authorised target. Successful confirmation submits the request; do not press Send again. Follow the returned Scan ID to inspect the job, not just the chat text.

The result is an answer or, for a structured scan, a queued job. Use the owning record to change, approve or verify business work.

Check the result

A supported answer whose source and scope can be checked.

Current limits and common mistakes

History has no bound history collection; Settings has no form/save persistence logic. Their presence is not working account-wide chat history or preferences. Opening the chat can initialize a provider thread; even page entry is not guaranteed provider-free.

Generated explanations can be inaccurate. Ask History and Settings pages do not currently provide a complete saved-history/settings workflow. Do not promise durable chat history or unrestricted module actions.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Ask amara → query and visible source/processing information

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Separate data lookup, document retrieval, analysis and optional external information.

Fields and decisions

Step-by-step

1. Identify the evidence question

   Decide whether you want a current record fact, policy passage, provider lookup or generated interpretation. State the intended source and scope.

2. Use the supported entry

   Write a specific question or select a capability and supply its arguments. Prefix routes, data intents and ISP retrieval are considered before general intelligence.

3. Read what actually answered

   Inspect response source/route, returned references and displayed status. A planned route or capability name does not prove which provider/data service supplied the final answer.

4. Separate raw evidence from interpretation

   Keep retrieved facts/quotes and the generated summary distinct. Verify each important assertion against its source; a source badge does not validate every sentence.

5. Follow the source safely

   The module-index reader exposes its fixed cited At a Glance section, not arbitrary filesystem paths or the project’s operating history.

6. Keep context and identity current

   History accepts bounded role/content context. A login-ownership freshness mismatch can return409/reload; it is not a new authorization grant.

7. Handle missing service or unsupported intent

   Read the actual error/unavailable/clarification state. An unsupported AWS resource query or missing ISP topic must not turn into invented live records.

8. Perform changes through the owning workflow

   Provider query output is not an Asset import, saved external reference, document version or approval. Open the appropriate explicit control when a real change is intended.

Tell a live result from guidance

1. Ask for a current fact

   Use a supported explicit intent such as “how many risks?”. Check the returned population and source; a narrative about risk management is not a current count.

2. Ask for policy text

   Name the section or topic. Compare the returned passage and cited location. Curated quick facts are fixed English guidance; a citation string does not mean the referenced file was opened.

3. Check exact subsection scope

   Appendix A 1–4 and B 1–4 have specific mappings. A C/D subnumber can fall back to the whole appendix while its footer names the subnumber; verify the actual passage before attributing it to that subsection.

An Ask quotation does not create a DocumentVersion, ingest a file, or approve an ISP section. Keep those actions in their owning workflows.

Check the result

An answer with an identifiable evidence and processing context.

Current limits and common mistakes

A routing diagram describes possible configured paths, not a guarantee that every request uses one fixed provider or is free of error.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Ask amara → a specific record question

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Know the module and population the question should cover.

Fields and decisions

Step-by-step

1. Choose a supported fact question

   Ask for a count, list, lookup or status of a specified module record. Add an identifying name and any important status/scope.

2. Read whether the request was supported

   A route/permission failure, missing integration or unsupported query differs from an actual zero result.

3. Check returned record links

   Open the underlying record when the number or status affects a decision.

4. Follow up with the same scope

   Clarify which population or record you mean. Do not assume a broad total includes every tenant, permission scope or historical status.

5. Use the selector for exact supported intent

   Choose the offered amara data domain/capability where available. Do not infer arbitrary SQL, all filters or create/update/delete from a list of example questions.

6. Distinguish query scope from display permission

   Internal query handlers differ. A visible selector and a role-aware label do not prove uniform per-module or tenant enforcement for every query; inspect the service’s returned scope.

7. Check learner and document references

   A Training summary is not quiz submission or a certificate. A Document answer is not a selected-version export or a newly saved DocumentVersion.

8. Keep the decision outside the query

   Carry reviewed facts and their source identity into the owning assessment or business process explicitly; asking a follow-up does not approve or mutate records.

Reconcile a query with its source module

1. Keep the population fixed

   Record the selected capability, status/category and time. A list can be capped; do not use its visible row count as the total unless the output says it is complete.

2. Check the meaning of severity

   Name the exact producer: Risk Summary uses Critical ≥16, High ≥9, Medium ≥4; Complete Risk List uses Critical ≥12, High ≥8, Medium ≥4. For score 8, Summary is Medium, Complete Risk List High, and canonical 4×4 Risk Management Medium. Score 9 is High in both Ask producers. Open the Risk record for the saved decision.

3. Check stored versus derived values

   Ask Asset criticality reads the stored field, not necessarily the current approved CIA-derived rating. Training counts use assigned learner/course pairs. Document “pending approval” queries concern review-due dates, not an approval queue.

Reading through Ask does not save a relationship or inherit every module’s UI role filter. The current capability catalogue is not filtered by its supplied module-role flags; have the administrator confirm the approved Ask access model.

Find a supported question

Worked examples, not live results: rows are not totals, assignments are not people, and review dates are not approvals.

Choose a domain below. Selector entries submit automatically; typed examples require Send once. Use the input shown here rather than adding unsupported date, tenant or category filters. These queries read stored evidence; they do not approve, import, edit or delete records.

Check the result

A scoped record answer rather than an assumed global total.

Current limits and common mistakes

Supported functions use defined query services with differing access/scope checks. They do not imply uniform per-module enforcement, arbitrary database querying or write access.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Ask amara → processing/source context; administrator → processing configuration

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Use the organisation’s approved data boundary and only supply information permitted for the selected route.

Fields and decisions

Step-by-step

1. Identify the active processing route

   Read the displayed local/external context and the deployment’s approved settings.

2. Review the material you submit

   Limit personal, confidential and regulated data to the task and the approved processing policy.

3. Inspect shielding and source information

   Where privacy controls are enabled, they process the request before the configured analysis route. A shield label is not a legal assurance for every possible data type.

4. Check important output

   Review sources, scope and any privacy/failure warning. Human review remains necessary when relying on generated text.

5. Escalate configuration uncertainty

   Use the administrator/implementation team for data-residency, retention and provider terms instead of inferring them from a help-page diagram.

6. Interpret Pro’s actual shielding behavior

   The Pro path anonymizes recognized PII for external routing, can reassemble output and checks mapped raw values across prompt/system/history at egress. Recognition is not complete detection of every secret or personal fact.

7. Read failure and fallback explicitly

   A privacy failure on the external shield path forces local fallback. That behavior does not establish that every base, legacy or public path uses the same processing.

8. Do not turn stage labels into approval

   checked_no_pii does not prove the original request was non-sensitive or its external transfer authorized. An interrupted/error stream cannot be treated as verified compliance.

9. Keep sent information and local memory separate

   Clear chat memory removes current-tab context, not provider-thread data, server/audit records or the RAG corpus. Follow the approved retention/data process for those layers.

10. Distinguish audit metadata from conversation storage

    Current structured grounded/Pro audit stores prompt/query hash and length rather than raw prompt/response text, alongside user/session/route/status metadata. Browser text and provider conversation remain separate; Clear does not delete these records. This does not establish identical storage in every legacy or provider log.

Use the approved data boundary

1. Before submission

   Confirm the deployment’s provider policy before entering sensitive material. The Base Local radio, Pro label or a matching High/Critical rule is not an unconditional local-only guarantee.

2. Interpret the threshold

   Strict 0.3, Balanced 0.5 and Permissive 0.7 are minimum detector scores. Lower thresholds accept more possible matches and can produce more false positives; they are not percentages of data protection.

3. Review the evidence

   Recognizers have language, validation and dependency limits. A missing library or recognizer can reduce coverage. Do not infer that checked_no_pii means no confidential information was present or transfer was authorised.

Do not upload sensitive material to the normal knowledge-base interface or rely on the public demo as a private workspace. Clear chat memory does not remove provider content or corpus chunks.

Check the result

A deliberate use of the permitted processing route.

Current limits and common mistakes

Privacy controls do not replace a data-processing agreement or guarantee that all confidential context is removed. Air-gapped operation and external connectors are different deployment choices.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Ask amara → available processing options; Admin → Ask amara Pro / System Settings

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Check the options actually enabled for your account and deployment.

Fields and decisions

Step-by-step

1. Read the active mode

   Inspect the available UI and administrator-approved configuration rather than assuming Base or Pro always implies the same infrastructure.

2. Choose the task

   Use supported record lookup or policy retrieval where it answers the question. Analysis and drafting may use a separately governed route.

3. Inspect processing context

   Review the source/provider information displayed for the response and any fallback/failure message.

4. Review generated advice

   Open source records and validate important instructions before acting. Mode selection does not grant record-write or approval permissions.

5. Check the mode’s real controls

   Base mode can show OpenAI/Local choice when LLM is enabled. In Pro it is replaced by automatic-routing presentation/hidden input; do not document a per-query force-local switch there.

6. Use administration for approved global changes

   Provider enabling, rules, privacy confidence and tier defaults belong to Ask amara Pro administration, not the inactive learner Settings form.

7. Inspect fallback rather than assuming success

   Read actual/planned provider, source and failed dispatch where recorded. Warm-up can invoke a model; do not use it merely to browse settings or resolve every failure by activating another provider.

Choose a mode without assuming its provider

1. Inspect available controls

   Base can show OpenAI/Local radios; Pro shows automatic routing. Check the actual response provider and deployment policy, not only the selected radio.

2. Understand the deployment override

   AI_MODE configured as openai or both can choose the normal OpenAI path even with the Base Local radio. Ask the operator to establish the required processing boundary before submitting private text.

3. Change global policy in Admin

   Use the dedicated provider/rule/tier controls for approved global changes. Ordinary Ask Settings has no functioning preference-save workflow; a chat option is not a global policy save.

Local tier defaults, enabled providers and fallback behavior are separate settings. Warm-up and healthy Admin status checks can execute models.

Check the result

A response processed under the selected deployment’s available configuration.

Current limits and common mistakes

No universal cost, provider, data-residency or accuracy promise is made by the mode name alone.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Ask amara → enabled integration prefix

Use your permitted application session and enabled capabilities. The answer's scope follows its governed sources and optional connectors.

Before you begin

Have the connector, external project/page/resource and account scope clear.

Fields and decisions

Step-by-step

1. Check connector and access first

   Integration query paths require the captured Admin/Integrations guard and an enabled backing service. Scanner additionally needs Scanner/write access; feature flags are not permissions.

2. Choose the exact prefix or domain

   Use jira:, confluence:, azure: or aws: for the intended supported provider question. The current Security scan domain/capability is separate from free-text execution.

3. Complete exact identifiers

   Supply the required issue key, board ID, page ID, IAM user or search term through Complete query. A typed raw IP or URL is not a substitute for the registered-Asset picker.

4. Read supported Jira query output

   Search/read issue/project/board results under connector scope. A full-looking create-ticket sentence still returns drafting/missing-field guidance; create actual work in the owning module modal.

5. Read Confluence without confusing it with a link

   Inspect the returned page identity/content. A chat search/read does not store a Risk/Document reference or publish an external page.

6. Keep cloud intent within actual support

   Azure supports specified identity/resource/activity queries; AWS supports IAM/user/MFA/recent CloudTrail/EC2 intents. Unsupported S3, IAM-role or broad account requests are not zero-count evidence.

7. Start scanner work only through the structured action

   Select an offered scanner capability, choose a registered authorized Asset, read the action and confirm where required. The server checks write/access/target and can queue a persisted Scan job.

8. Check queue state and source

   Read the returned Scan ID/detail link. Queued is not Completed or clean. Typed status inquiry, passive capability and active scan execution are distinct operations.

9. Reconcile a failure before retrying

   Preserve permission, unavailable, provider or unsupported feedback. A missing connector answer is not proof the external record is absent.

10. Return to the owning module

    Use its explicit import/link/ticket/publish/review controls for changes. MCP is integration infrastructure, not an extra normal-user CRUD module.

Supply the exact query arguments

1. Issue or page lookup

   For Find ticket, enter a Jira issue key such as ITSEC-42. For page children, enter Page ID. For Search all spaces, enter the search term. Empty fields block Compile query; a nonempty value still needs to resolve under provider access.

2. User and board queries

   Search IAM user requires the IAM user name, not a local amara username. Show board issues requires Board ID; its current adapter has a status-argument mismatch and can fail, so do not treat that failure as an empty board.

3. Confluence space search

   Search ISC space uses the fixed ISC space and literal text “isc space”, limited to 20 results. This is a text search, not all pages in that space. Page/space inventory and owning-record linking are separate actions.

4. Scan lookup versus execution

   Passive DNS and active nmap/TLS/Nikto/NSE capabilities require the registered-Asset picker. The Ask option labelled WHOIS currently maps to a standard DNS scan, not WHOIS execution. After Compile query and any active-scan confirmation, the request submits automatically. The registered path returns a persisted Scan job/status, not a legacy Kali formatter result; use the Scan ID for actual tool/results.

Jira, Confluence, Azure and AWS reads do not create local links or imported Assets. Use the Integration guides for deliberate writes.

Atlassian query catalogue

Use the selector for the named choice; type the example only for entries labelled typed-only. The five Jira and five Confluence selector choices share these eight service contracts. Compile query submits once; Cancel does not send. None of these reads creates Jira work, saves a local link or publishes a page.

Provider payload shape matters: missing raw data can produce “No results”, malformed JSON can display plain provider text, and an unrecognized JSON shape can be shown as a 600-character excerpt. None is a complete export or proof of absence. Source labels and backend response hints do not validate omitted fields.

For every Azure/AWS selector and typed-only option, use the Azure catalogue and the AWS catalogue. They distinguish Ask reads, saved Admin Sync and deliberate Asset import. For the six scan dialogs use the exact mapping above and the persisted Scan lifecycle.

Check the result

A scoped connector response whose external reference can be inspected.

Current limits and common mistakes

Missing access or an unavailable connector is not proof that the external record does not exist.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

The owning module → Reports / Export

Use the owning module's access. Reports can have narrower populations than the full application.

Before you begin

Define the question, record, time range and audience before choosing an output.

Controls and inputs

Step-by-step

1. Define the evidence question

   Identify the record, selected domains/categories, tenant or learner population, period and authorised audience. Choose the module that owns that evidence.

2. Open the actual output entry

   Use its Reports, record Report/Export, VA Create report or Admin View Audit Snapshot. There is no universal report hub/type/date wizard.

3. Choose a supported type and assessment

   Use the offered completed-assessment selector where present. UI selection and generator guards differ; Completed does not mean every answer was supplied or control approved.

4. Read scores in their actual population

   Check evaluated, unassessed, Not Applicable and excluded counts; maturity availability; gap/plan status; and denominator. Unknown maturity is not zero.

5. Check freshness and version behavior

   VA View retains saved inputs/generator/hash/time. Document export can select a stored version. Many Risk/Supplier/Asset/framework HTML reports read current records at request time.

6. Use the offered output

   Choose Save as HTML, a native HTML/CSV attachment or Print Report as actually provided. Browser Save as PDF is separate from a server export.

7. Inspect before retaining or sharing

   Check title, record identity, date, body, rows, missing data and evidence references. Existing print/reopen/coverage qualifications are not cleared by successful generation.

8. Keep decisions beside the report

   Retain assessment approval context, risk/acceptance details, document version, change and verification evidence as appropriate. Report generation performs none of those decisions.

9. Regenerate only where needed

   Create a new VA report for current work; reopening an old snapshot is not a new run. Reassessing an assessment can change later output for the same ID.

10. Use separate recovery and distribution procedures

    Exports are selected evidence, not a universal backup/restore. No scheduled report, automatic email or whole-module evidence ZIP is established here.

Produce and retain a scoped report

1. Select the source

   Open the intended completed assessment in its Reports selector, or the exact operational record/run/version. Confirm ID and selected scope before choosing the type.

2. Read the body

   Check answers, gaps, maturity and denominator against the source. A Completed label or No gaps sentence is not evidence every selected control was answered or implemented.

3. Save and reopen

   Use the offered HTML output, then reopen the file and inspect text, links and charts. Browser-generated HTML can need external scripts/styles; preserve the original source context and review print output separately.

4. Retain the decisions

   Store the approved output with assessment identity/scope, generation time and underlying open work. Generating it does not approve the assessment or close remediation.

A VA saved run retains its input time; a fresh report of a current assessment can change after same-ID reassessment.

Check the result

A reviewed report for a defined purpose.

Current limits and common mistakes

Reports are projections of stored data; generating one does not approve records or create an immutable whole-application snapshot.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Open the owning module → Reports

Use the owning module's access. Reports can have narrower populations than the full application.

Before you begin

Choose a report type because it answers the audience’s question.

Controls and inputs

Step-by-step

1. Choose the owning evidence

   Use the module links in the catalogue below. A name such as Executive or Comprehensive is not proof of universal module coverage.

2. Use the exact framework selector

   Rapid has six HTML types; ISO has five active types with Audit Evidence disabled; C5 and EU AI have four. Select the intended completed assessment rather than a similarly named one.

3. Read CIA separately

   Open the selected evaluation’s Report for Asset/CIA ratings, approval context and measures. The report is not the CIA approval action and is not restricted by a universal completed-only guard.

4. Distinguish NIS2 outputs

   Use Export Report for the selected comprehensive/owning context or Export Assessments for the combined list. Relevance result and retained legacy PDF path are different workflows.

5. Use current operational reports

   Asset, Supplier and Risk HTML show their stated current records/relationships. Supplier phase approval is not independent assurance; Risk Accepted status alone is not a complete Acceptance record.

6. Generate a VA snapshot deliberately

   Create report persists current workspace inputs, generator/version/hash and notice context. Later View/Save as HTML reuses that saved evidence; create anew for fresh work.

7. Select exact document and learning output

   Document Export downloads the chosen stored sanitized HTML version. Training Admin CSV/HTML uses active users and assigned courses; certificates have separate browser printing.

8. Choose scanner scope precisely

   Single-scan report describes one run. Asset/Executive 90-day rollups choose current per-Asset/type context; do not add repeat runs or parent/child totals as independent evidence.

9. Check audit and policy boundaries

   Activity CSV is selected/capped. Admin Audit Snapshot is current aggregate HTML. Policy Reference has no universal report-generator family; an Ask answer is not a saved report run.

10. Validate the output against the owner

    Inspect representative source records, exclusions, stale/missing bodies and open work. No report title or zero-gap wording certifies compliance or effective remediation.

Report and format catalogue

Choose a report for its actual body

1. Rapid

   Executive summarises score/bands and recommendations; Technical shows answer detail and scored-only charts; Evidence Package is an alias of Technical HTML, not a distinct evidence archive. Gap Analysis and Comprehensive use different gap cut-offs.

2. ISO and SoA

   Read numeric status/maturity even if empty gap prose says No gaps. SoA Version 1.0, Last Updated and blank sign-off rows are output boilerplate, not persisted approval or revision history.

3. C5 and EU AI Act

   C 5 Compliance includes N/A in its numerator while Implementation does not. EU compliance excludes N/A from its denominator, with possible retained N/A maturity. Truncated evidence excerpts are not complete source export or legal certification.

4. NIS2 and CIA

   NIS 2 comprehensive HTML and legacy 15-field PDF differ; the legacy PDF has retained label/body omissions. Confidence 0.95 can display 0.95%, not 95%. CIA ratings are ordinal and measure acceptance is not implemented-control effectiveness.

Use the owning assessment guide for exact calculation and saved scope. Snapshot/report chart labels can differ from canonical module metrics; review the chart guide before comparing totals.

Check the result

A report suited to the question and the evidence available.

Current limits and common mistakes

A report type name is not a complete functional certification. Empty/unavailable sections must not be read as passed controls or absence of risk.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Select the source records and their offered reports/exports

Use the owning module's access. Reports can have narrower populations than the full application.

Before you begin

Identify the audit question, scope, period and authorised audience.

Controls and inputs

Step-by-step

1. Collect the underlying decisions

   Include the relevant assessment responses, CIA/supplier phase history, risk/acceptance decisions, document versions and treatment/verification evidence.

2. Label scope and dates

   Keep the originating module, record identity, report generation date and filters with each export.

3. Include unresolved work

   Show missing answers, open gaps, unassessed maturity, unknown applicability and exceptions with their owners/review dates.

4. Review the package

   Check that supporting documents and changed controls match the dates being assessed. Do not silently mix an old policy with a current status report.

5. Share under the approved process

   Review access, confidential content and distribution approval before sharing the collected files.

6. Separate saved from recomputed evidence

   Identify VA ReportRun snapshots and DocumentVersion bodies versus current framework/Risk/Supplier/Asset/Admin projections. Preserve the chosen output under the approved retention process when a historical baseline is needed.

7. Include the lifecycle qualification

   Training scores are latest state, not every attempt; certificate renewal removes the previous certificate; NIS2 edits can remove open manual plans. A generation date does not recreate prior state.

8. Reconcile provider evidence

   Keep Jira issue/status/approval and Confluence page/version/stamp references distinct from the local decision. A chat query or cloud sync does not universally attach an approved evidence relationship.

9. Check the format and reopen limits

   Review browser printing and saved HTML separately from native downloads. Source support for a format is not proof of correct pagination, complete body coverage or acceptance in every viewer.

Build a small evidence index

1. Create the index outside the application

   For each retained output record module, source ID, selected domains/filters, version/run, generation time, saved filename and outstanding decisions. This is a manual index, not an offered app form.

2. Keep a concrete chain

   Retain the Risk report, its Treatment validation and Jira key/status/review; the selected DocumentVersion export; and a chosen VA report run with its generator/hash/time. Record which evidence is current and which was captured earlier.

3. Show unresolved work

   Include unknown applicability, missing answers, open plans and unverified external results. A report hash establishes content identity, not completeness, authenticity of every input or technical effectiveness.

A Rapid Evidence Package is Technical HTML, not this cross-module index. Sharing approval and recovery coverage remain separate.

Check the result

A manually assembled, traceable evidence package.

Current limits and common mistakes

There is no universal one-click export that certifies all modules or supplies an auditor’s conclusion.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Open the module’s dashboard/chart

Use the owning module's access. Reports can have narrower populations than the full application.

Before you begin

Read the chart’s date range, filters, units and data population.

Controls and inputs

Step-by-step

1. Identify what is counted

   Distinguish records, completed assessments, selected controls, scan observations and affected locations.

2. Check denominator and exclusions

   An unassessed value, Not Applicable response or tenant-hidden item can change the population. Unknown is not automatically zero.

3. Compare with the list/report

   Open the associated rows or report and inspect representative records.

4. Use the chart for the next question

   A high score or count tells you where to investigate; use the underlying evidence for an actual approval or remediation decision.

5. Check course and log denominators

   Training assigned-role export and exploratory detailed progress are different populations. Activity Log daily cards are separate UTC-day totals, not the selected filtered list.

6. Check report age

   A VA snapshot’s visualisation represents its saved input time, not today’s workspace. A current assessment chart may change after same-ID reassessment.

7. Keep output-specific limitations

   Not every chart has drill-down or export, and historical Scanner rollup/language/metadata qualifications remain. A graph displayed successfully is not underlying-data UAT.

Calculate before comparing

1. Risk worked example

   Likelihood 3×Impact 3=9. Canonical Risk bands put 9 in Medium; Ask summary can use High and other displays use different predicates. Do not treat a red scatter point as the canonical saved severity.

2. Assessment worked example

   For four C 5 controls Implemented, N/A, Partial and unanswered: Compliance=(1+1)/4=50%; Implementation=1/4=25%. For EU AI with the same statuses, compliance=1/(4−1)=33.3%. Compare within the named view, not as one interchangeable score.

3. Count recent versus complete populations

   Snapshot Assessment Usage counts at most five recent records per CIA/Rapid/ISO/NIS 2 family. Completion uses full populations for those four. Example:12 Rapid records can contribute only 5 to the usage pie, not 12.

4. Check unknown and missing series

   Snapshot Risk bars omit unassessed scores; Supplier criticality can default missing values to Low. ISO category trend extraction currently cannot populate ordinary A.5/A.6/A.7/A.8 series. Missing chart data is not no gaps.

Use the exact source rows and the detailed Snapshot legend below. Store date, population and exclusions alongside any chart used as evidence.

Check the result

An interpreted visual summary with known scope.

Current limits and common mistakes

Do not add scanner parent and child totals as independent work, or compare unlike CIA/risk/VA/supplier scales.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

The selected module → Export / report view

Use the owning module's access. Reports can have narrower populations than the full application.

Before you begin

Choose the intended record or population and check the offered output.

Controls and inputs

Step-by-step

1. Choose the exact source

   Confirm assessment, evaluation, document version, VA run, scanner filters, learner population or audit scope. An identical format extension does not mean identical coverage.

2. Select only the offered format

   Use the output catalogue below. Do not advertise native Word/Excel/PDF or a universal ZIP where the active UI only supplies HTML/CSV/browser print.

3. Export document versions precisely

   Select current or numbered stored DocumentVersion and Export. The native sanitized .html attachment is separate from current-body Confluence publication and local policy approval.

4. Export VA from the chosen run

   Open saved report and its HTML output. It retains the original snapshot; Create report is the separate action to save current work.

5. Check each CSV’s population

   Training CSV concerns active-user/assigned-role evidence; Scanner CSV has one row per scan, not raw findings; Activity CSV is ordered selected scope and capped at 10,000 events; Admin CSV covers Asset fields.

6. Validate filters before trusting scanner output

   History/export share scan_type/status/date-from/date-to. Invalid date text can be ignored while still visible in filters; inspect actual resulting records and coverage.

7. Inspect the file or print view

   Open the result, verify identity/time/rows/body/link/table content and missing information. A successful download does not clear retained print/reopen qualifications.

8. Retain source context safely

   Keep filters, selected record/version/run and generation time with the approved evidence. User/audit/operational data may be private; authorise its audience separately.

9. Do not use CSV as restore

   Admin Import CSV creates new Assets and ignores imported asset_id, can skip bad rows and can fail after a first commit. It is not ID-preserving round-trip, universal upsert or complete rollback.

10. Follow separate backup/distribution procedures

    Use the responsible operator’s approved recovery and sharing process. No built-in universal scheduled export, automatic mail or full backup ZIP is established.

Choose the actual output format

Check a downloaded or printed output

1. Save HTML

   In the offered report choose Save as HTML, then reopen its file. Framework/CIA/Snapshot saves serialize the browser document, not rendered canvas pixels; CDN scripts and external/site-relative styles can be required for charts/layout.

2. Print separately

   Use Print Report or Print Certificate and inspect browser preview before choosing a PDF destination. Check page breaks, tables, missing charts and confidential fields. This is browser printing, not a native server PDF.

3. Check exact attachment scope

   Document Export uses the selected stored version; VA HTML uses the chosen saved run. Asset Export Assets queries all Assets regardless of list filters. Scanner CSV is scan rows, not finding/CVE rows.

4. Do not reimport as restoration

   Admin Asset CSV omits addresses/relationships and its importer creates new identities. Retain files as scoped evidence; use the approved recovery procedure for source/database restoration.

NIS2 HTML uses a separate clone/inlining helper and captures current disclosure expansion. Reopen the actual export before assuming complete offline presentation.

Check the result

A checked export whose scope is clear.

Current limits and common mistakes

An export is not a complete application/data backup. Generated document/report bodies and print paths retain their own qualifications.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Admin → dashboard

Use administrator access for administrator actions; own-account setup/profile and integration access have their own checks.

Before you begin

Use administrator access for account and environment administration.

Controls and inputs

Step-by-step

1. Choose the action’s owner

   Use User Management for accounts; System Settings for inspection; Activity Log for recorded events; the dedicated Pro/RAG pages for AI administration. Use the business module for approvals.

2. Inspect the current state

   Confirm the target user, record, provider and environment. An available Admin menu item does not prove every optional service is configured or every handler adds a read-only guard.

3. Follow the dedicated procedure

   Open Accounts for create/edit/activation/password/MFA; Role Permissions for module access; AI Pipeline for provider and rule changes; Knowledge Sources for ingestion. Do not treat all Save buttons as equivalent.

4. Separate inspection from execution

   System Settings is a configuration display. A sync requests external evidence. RAG file selection starts ingestion immediately. Provider/rule controls can persist on the individual action.

5. Use the consequential action once

   Read the form and warning before submitting. Unchecking Require MFA may disable enrolled MFA. Delete User can remove owned records and learner evidence; deactivate for ordinary access suspension.

6. Inspect success or failure

   Reopen the same account or record and check actual stored values. A flash message, health label or redirected page is not a whole-system verification.

7. Continue in the owning module

   Check training assignments versus learner progress, VA IT Owner versus VA review roles, and CIA/Supplier/Risk decisions versus application roles. Administrative access does not supply those approvals.

8. Retain bounded evidence

   Use Activity Log, Integration Activity, source records and offered exports. Follow the operator’s separate recovery procedure; an aggregate HTML Audit Snapshot is not a full database backup.

Read referral attribution without changing accounts

1. Open Referrals where offered

   Use the Admin referral view to inspect attribution codes and their status, sign-ups, active-user counts and last referred-login time. This is a reading view, not a code creation or deletion tool.

2. Read the recent activity scope

   The recent referred-login list is limited to 50 events. A zero or short list is not the entire account history; use Activity Log for the appropriate event scope.

3. Keep attribution private

   Do not paste actual codes, users or login details into public support. Use User Management for account changes; referral totals do not grant or revoke access.

For every Admin action, separate configuration display, local database change, provider call and business approval. The dedicated guides below explain those effects.

Check the result

An intentional administrative task with its actual effect verified.

Current limits and common mistakes

Administrator status does not prove every optional provider is connected or that a recovery mechanism has been tested.

Continue in a related module

Application-source review: 14 October 2026. A documented control is separate from a verified outcome in your deployment.

Where to start

Admin → User Management → Create / Edit user

Use administrator access for administrator actions; own-account setup/profile and integration access have their own checks.

Before you begin

Determine the account’s approved responsibilities before granting access.

Controls and inputs

Step-by-step

1. Identify approved responsibilities

   Open Create/Edit User for the intended identity, and list the modules and review responsibilities actually needed.

2. Assign one or more offered access roles

   Use the current controls for Admin, Asset, Supplier, Risk, individual/general assessments, NIS2, Document Dialog, Integrations, Security Scanning, Training or Training Admin.

3. Resolve Read Only validation

   Read Only must stand alone in the current form. Do not combine it with Admin or additive module roles and expect universal safe inspection. Retained Admin-only handlers do not all add a read-only write check.

4. Choose assessment scope explicitly

   General Assessments covers CIA, Rapid, ISO, C5 and EU AI Act. NIS2 remains dedicated. Record ownership, workflow stages and other endpoint checks still apply.

5. Separate scanner access from inventory access

   Asset Management allows inventory work. Security Scanning has its own permission plus write/configured-service/authorised-target requirements. Integrations is not scanner authority.

6. Review VA responsibility

   The offered IT Owner control synchronizes that tenant VA grant/revocation. Other VA workspace roles such as Reviewer, Action Owner, Risk Owner and Auditor are managed separately.

7. Distinguish learning assignments from access

   Curriculum roles and primary role select learning content; Training and Training Admin are application permissions. Changing assignments does not erase progress or certificates.

8. Save and verify the same user

   Submit the approved choices, correct validation errors, reopen the account, and follow the authorised access-verification process. Hidden controls alone are not an RBAC audit.