Thank you for choosing ControlCase GRC, a powerful and versatile system that will revolutionize the way you manage your IT-GRC processes.

This manual contains conceptual, and "how to" information on basic and advanced tasks using the Graphical User Interface.

For more information, you can refer to the ControlCase GRC Getting Started Guide for description of the documentation set, a summary of the ways to work with ControlCase GRC, and instructions for accessing the Online Help.

This user manual is for version 6.0 of ControlCase GRC or later. This edition supersedes earlier editions of this manual.

The following typographical conventions are used in the online manuals and online help. These typographical conventions are used to differentiate the terms used in the documentation; they are not meant to contradict or change any standard use of typographical conventions in the various product components or the host operating system.

Italics

Introduces all actionable buttons, which a user can click
and perform a function or action.

Bold

Emphasizes important information and field names.

UPPERCASE

Indicates keys or key combinations that you can use, for example, press the ENTER key.

This chapter introduces the ControlCase GRC terminology, concepts, roles and tasks that the user needs to be familiar with, in order to use the software efficiently.

ControlCase GRC is a consolidated framework that quickly and cost-effectively enables IT governance, risk management and compliance (GRC) with one or several government or industry regulations simultaneously. It allows IT organizations to proactively address issues related to GRC and implement a foundation that is consistent and repeatable.

With ControlCase GRC organizations are able to:

§  Improve IT Governance

§  Accelerate time to compliance

§  Reduce and manage risk

§  Enable sustained compliance more effectively

§  Improve collaboration and consistency

§  Bridge information silos

§  Align regulatory needs to business requirements

§  Lower the cost of becoming and remaining compliant

§  Prove compliance

Using a consolidated framework simplifies and automates several key compliance needs that include:

§  Workflow automation

§  Mapping of standards and controls

§  User self-assessment

§  Analyzing and testing controls

§  Measuring impact to the organization

§  Measuring and clarifying risk

§  Implementing corrective actions

§  Reporting on compliance and risk

Some of the main uses of ControlCase GRC are to:

·         Assess:

Assess risk, privacy, vendors, security, etc. via surveys or questionnaires. Send to mass populations, specific groups, and individual users as necessary to collect desired information.

·         Review:

Review the results of respondents, populate standard with controls and control tests, review results of tests, determine gaps and assign for remediation.

·         Remediate:

Gap identified via the Review process (or other means such as anonymous submission for privacy or security violations) can be assigned to owners, tracked, re-assigned, or waived. Track those Gaps via graphical representations.

·         Report:

Data can be presented in any number of reports, exported for further manipulation or enhanced graphical representation. Even the report queries can be stored for future use.

·         Scan:

Network shares, websites, and databases can be scanned for cardholder data. Once found, controlsheet is automatically filled with the found evidences.

·         Manage Vendors and Merchants:

ControlCase GRC enables organizations to manage the risk and compliance of their vendors or merchants.

As you explore this latest release of ControlCase GRC, you will notice that the GUI contains several new features and concepts. Although the terms are new, they have much in common with industry terms you might already understand.

Standard

This is the defined standard that will be used for accessing the accounts for the organization.

Assessment

This is to assess risk, privacy, vendors, security, etc. via surveys or questionnaires.

Gap

A Gap is considered as an activity which appears to have the potential to impact the organization negatively (e.g., denial of service, malicious code, unauthorized access, inappropriate usage). This may be reported by anyone within the organization via email or through the online questionnaire.

Activity

An activity is a gap which has been determined to pose a real threat to the organization by the activity manager and which requires further investigation.

Evidence

Evidence includes all information or physical property that is associated with the investigation of an activity. This may include log files, hardware, hard copy documents or any other information that has been collected. All evidence is assigned a tracking number and is time-stamped upon entry into the activity file.

Evidence chain

of custody

ControlCase GRC time and date-stamps all evidence and allows you to add notes to the activity file when evidence is passed from one individual or group to another.  This maintains an evidence chain of custody that helps to keep track of all evidence and is required for legal purposes.

List Panel

List panel in ControlCase GRC provides the option of using the SORT and SEARCH functionalities. The user can sort through one column at a time either in an ascending or descending manner.

Form Panel

Form panel in ControlCase GRC allows configuring the form input fields which shall be used to accept user data into the ControlCase GRC database. Using the form panel, Administrators can configure the type of forms to use, different fields to be added, field types, etc.

Public Key

A public key is a value provided by some designated authority as a key that, combined with a private key derived from the public key, can be used to effectively encrypt and decrypt messages. ControlCase GRC uses GnuPG software to send encrypted emails to external agencies (using their respective Public Keys), to notify them about activities. Once the activity is received through encrypted email, the agency can decrypt it using its private key.

Public Key ID

Public Key ID is a string that uniquely matches a key in the GnuPG key ring, which itself is a collection of keys uploaded into GnuPG. Key ID is prefixed with 0x, for example 0xDD934139. ControlCase GRC requires this Public Key ID while adding an external agency.

The following concepts will help you understand how the different modules of the ControlCase GRC interact with each other.

Framework

ControlCase GRC is built on a very flexible Framework, where any number of organizational accounts and processes can be defined to the nth level and mapped to any customized standard defined by you. The standard can be designed for an audit, risk assessment, vendor assessment, candidate assessment, compliance or internal controls.

e.g.: For PCI Audit, organizational accounts like ‘Email servers’ or audit processes like ‘Self-Assessment Questionnaire’ can be mapped to industry standard PCI-DSS or self-defined internal control standards.

Standards

Based on the flexible Framework, ControlCase GRC can have any defined standard brought in or have a customized standard created for audit /risk assessment purposes.

e.g.: For PCI Audit, ControlCase GRC already has a built-in standard defined such as ‘IT Enterprise’. This standard can either be used for the PCI Audit or for modified / customized based on the organization’s requirements.

Organization

Definition

Based on the flexible Framework, ControlCase GRC can classify any hierarchy of organizational accounts defined, which need to undergo audit /risk assessments.

e.g.: For PCI Audit, ControlCase GRC can have a hierarchy of organizational accounts or business processes such as:

Create Controlsheet

A controlsheet is a mapping between organizational accounts and processes, and the defined standard. Once mapped, the controlsheet will create a complete set of control objectives based on the standard.

NOTE: This term is used interchangeably with ‘Review’.

e.g.: For PCI Audit, a controlsheet can be created for organizational accounts such as ‘Email Servers’ and mapped to standard PCI-DSS. The resulting controlsheet could be named ‘Email Servers – PCI - DSS’

NOTE: A controlsheet can also be created through a mapping between accounts and processes and an assessment. This is to be used for transferring responses of an assessment to a particular controlsheet.

Assessment

Administration

An administrator can create, deploy and manage Assessments.

Controlsheet Access

Administrators can give users and groups access rights i.e. read /write, to specific controlsheets. This helps to define a variety of users, such as documenters, reviewers, etc.

Module Access

Administrators can give users and groups access rights to specific modules. Based on these rights, the end users can access the specific functionalities like ‘Reports’, ‘Remediation’, etc.

Reviews

Once a controlsheet is created as described earlier, the Review function will give the end user access to all of their audit entitlements. They will use this functionality to document all of the details for the specific controlsheets they are working on. The user can have read and/or write access as per the access rights set for them by the administrator.

Reporting

Reporting functionality is of utmost importance to track the audit /risk assessment / compliance process. There are several built-in reports available within ControlCase GRC which could be useful for compliance process.

The report designing functionality lets the end user define and create their own specific reports based on the selection criteria provided. This feature also provides the ability to save these custom reports as templates for future use.

Dashboard

An executive view of panels containing a list of short-cut links to various tasks or activities presented to highlight those which need the most attention.

User Admin

- Password Policy

An Administrator can set a password policy, which all users must adhere to.

- User Management

The ControlCase GRC administrator maintains the rights to create, edit, and delete users to access the application.

- Group Management

The ControlCase GRC administrator maintains the rights to create, edit, and delete groups and assign users to group that will have access to the application.

- SMTP Settings

An administrator can set an E-mail account so that mails can be sent from ControlCase GRC software using these settings.

Workflow Activity

Template

When a controlsheet is generated from an assessment, its questions are displayed as column headers and the collected responses (so far) form the content (rows) of the controlsheet. The responses of assessments received after creating the controlsheet are triggered into the review through the activity template.

Compliance Scanner

It is an independent module that is used to scan entire network, hard disks, databases etc. to search for credit card data. The results are populated in the controlsheet and can be seen from the Review tab.

Assets

The list of IP addresses ports, machine names, and databases etc. that are scanned from Compliance Scanner and contains valid credit card information.

The process of Logging-in, Changing Password, accessing the online Help and Logging-out are explained briefly in this section.

Log-in

Once the ControlCase GRC is installed and launched, the following log-in screen appears. Enter your Username and Password and click Login.

Once you have logged into the software, you are directed to the following screen where you can see the various modules in the form of header tabs.

NOTE: To access the various features of ControlCase GRC, you need to click on the relevant tabs. By default, the Dashboard Module is available for every user. Other modules are available only to the users that have been assigned access to them by the Admin user, via the Module Access module.

NOTE: The arrows shown in the above figure help navigate through the modules. The first arrow on the right side takes the user to the first module; the second arrow to the previous module of the module displayed next to the arrow. The last arrow on the left side takes the user to the last module; the second last arrow to the next module of the module displayed next to the arrow. The small arrows at both sides provide list of modules that are currently not displayed on the top.

Change Password

This is where you can change your password. This is found on the top right corner of the Dashboard. It is recommended that you change your password at least once in every 45 days or whenever you feel it may have been compromised.

To change your password, you must enter your current password, the new password you wish to use, and then the new password again to confirm it. The password must adhere to the password policy as stated by the administrator.

Help

The Help functionality gives the ControlCase GRC user access to the most commonly used ControlCase GRC features. This is found on the top right corner of the Dashboard.

Logout

You have to ‘Logout’ whenever you wish to end the session. This is found on the top right corner of the Dashboard.

There are two types of ControlCase GRC users:

1.      Administrators: Responsible for setting up and configuring ControlCase GRC within their organization so that users can effectively and efficiently use ControlCase GRC to manage and control audit documentation.

2.      Users: Use ControlCase GRC on a daily basis for managing their documentation. Users can be classified into two categories:

Regular Users:

Users whose responsibilities include documenting, reviewing the controlsheets created with minimal set of reports available for review etc.

Executive Users:

Users whose responsibilities include reviewing others work - can be granted admin access and the complete set of reports available for review.

The way you use ControlCase GRC within your organization will vary depending on the size of, and the different assets and business processes within your organization.

Categorizing User vs. Administrator Tasks

ControlCase GRC process tasks are organized into two main categories: User and Administrator tasks. These tasks and the details to perform the task within ControlCase GRC are mentioned in the table below.

Dashboard is the first header tab of ControlCase GRC. It is a control panel that provides access to basic features of the application. It is a customizable home page, customized per user and acts as a ‘My starting page’ for each user.

It provides access to following features:

• Change starting tab.

• Add/Remove panel.

• News Updates.

• Resources panel & other links.

• Search all modules of ControlCase GRC.

Dashboard provides an executive view of panels containing a list of short-cut links to various tasks or activities, and highlights those which need the most attention. Furthermore, it allows you to search for any reviews, reports, etc. that are present or being used in the software.

Although by default the Dashboard module is the starting page for all users, you can change the starting tab as per your liking.

To change starting tab:

Step 1

Click on the Dashboard header tab. The following screen appears.

Step 2

From the Change Starting Tab drop-down list, select any other accessible module as the starting page.

Step 3

Click Change.

The Dashboard is designed to provide quick access to the pre-configured roles such as Auditor, Subsidiary/Vendor, etc. which are displayed in separate panels. Each Panel in the Dashboard can be added or removed as desired, based on your role in the organization. This is done using the Add/Remove Panel on the right hand side of the Dashboard screen. The Add/Remove Panel consists of the Panel headers that can be displayed on the Dashboard.

To add or remove a panel:

Step 1

Click on the Dashboard header tab. The following screen appears.

Step 2

From Add/Remove panel, select check-box of the required panel header to put it on display.

Step 3

To remove a particular panel from display, de-select the checkbox of the particular panel header.

Tip: The ‘x’ (cross) on the top right of each displayed panel can also be used to remove the panel from the Dashboard.

Each Panel on Dashboard is populated with task/activity links corresponding to the role of the users i.e. the links would only appear if the user has access to that particular module. These links take the user directly into the application, to that specific activity or task, thus acting as a starting point for application.

To open a particular link:

Step 1

Click on the Dashboard header tab. The following screen appears.

NOTE: If the user does not have access to other modules, the task/activity links from those modules will not be displayed.

Step 2

Click on any of the provided link, for example, ‘Creating a new assessment’ link. This directly takes the user to the page where the task or on activity has to be performed.

The Latest News panel consists of relevant corporate news and any software updates to provide the user with the latest updates.

NOTE: This panel is displayed to all the users, and is mandatory i.e. no choice to add or remove this panel.

To open a particular link:

Step 1

Click on the Dashboard header tab. The following screen appears.

Step 2

Click on any of the provided link, to open it.

Although all the panels besides Add/Remove Panel and My Updates are displayed as per the requirements and accessibility of users and consist of links to other sections of the application, the Resources panel contains general web information links (as shown below). These links provide access to related information.

NOTE: This particular panel is accessible by all users.

To open a particular link:

Step 1

Click on the Dashboard header tab. The following screen appears.

Step 2

Click on any of the provided link, to open it.

The Search ControlCase GRC panel on the Dashboard provides the user with facility to look for any reviews, reports, assessments, etc. that are present or being used in the application.

To execute the search functionality:

Step 1

Click on the Dashboard header tab. The following screen appears.

Step 2

Select the required option for searching.

Available search options:

·         Assessment: Assessment headers such as titles, filenames, and additional information; it is similar to the ‘Search Assessment’ feature in the Assessment Admin header tab.

·         Remediation: Gaps and activities reported by the users; it is similar to the ‘Search’ feature in the Remediation header tab.

·         Reporting: Report titles created by the users.

·         Review: Reviews and data within the reviews; it is similar to the ‘For review’ and ‘In Reviews’ searches available in the Review header tab.

NOTE: The Search All of ControlCase GRC feature gives a combined result of all the individual searches.

Step 3

In the box, enter the keyword you want to search for.

NOTE: The search functionality supports ‘sub-word searching’. For example, to look for the word ‘Preview’, even if the user enters ‘Pre’, ‘re’, ‘view’, etc. in the search box, all the files, names, etc. with the word ‘Preview’ would be brought up as well.

Step 4

Click Search.

Through this module, user can review the results of respondents, populate standard with controls and control tests, review results of tests, determine gaps and assign for remediation.

A regular ControlCase GRC user will have the responsibility to document the details for all the reviews. The common user tasks include entering data into the ControlCase GRC application and viewing the reports in different formats.

By default, the right hand side panel is configured for Documents and Review sub-panes. To Configure any panel click on particular node and then Configure Panel link

The page shows three types of panels, namely, Review, Document, and Graph. There are only one instances of Review and Document panel each but there can be any number of Graph panels.

To configure the panel:

Step 1

Click on the Review header tab.

Step 2

Click on the node in the left panel for which you would like to configure the panel.

Step 3

Select the panels that are to be shown and then click the Save button.

The panels appear as shown below.

NOTE: To reconfigure the panel, click the Configure Panel link in the top right corner. The Configure Panel link is available only for users in the admin group.

This panel displays a list of all the controlsheets in the selected organization or sub-unit of the organization.

To view the list of controlsheets:

Step 1

Sample controlsheets contained in the ‘Controls’ part of the organization are shown in the Review panel below.

Step 2

To display the list of controlsheets in the PDF format, click on the PDF view option.

Reviews can be read or further modified by users. For this purpose, they are available in either View or Edit mode, depending upon the rights the user has been granted by the administrator.

To access a review:

Step 1

Click on the Review header tab. The organizational tree appears.

Step 2

To access specific controlsheets of a department, for example ‘Controls’, click on it. The reviews appear as shown below.

Step 3

To access a review, click View next to it.

NOTE: If you have write permission, you can edit the controlsheet by clicking Edit.

This screenshot is an example of a worksheet of a review in the View access mode.

To export the review in CSV format:

Step 1

Click on the Export button.

You will then be prompted to save or open the ‘report.csv’ file.

If you are allowed access to edit the review, an Edit button also appears on the screen as shown below. Or else, you would only be able to export the review to excel.

Editing Mode allows the user to enter into the selected review and begin documenting directly into the cells.

To edit a review:

Step 1

Click on the Review header tab. The organizational tree appears.

Step 2

To access specific controlsheets of a department, for example ‘Controls’, click on it.

Step 3

To edit a review, click Edit next to it.

NOTE: If you are in the View mode, you can enter the editing mode by clicking on the Edit button as shown below.

Step 4

You can now document directly into the cells.

NOTE: You can also use the editing tools provided at the top of the sheet. Data and changes made are saved automatically.

Editing Tools

The editing tools provided within the reviews are circled in the picture below. These tools, basically used to ease the job of editing, are explained below.

The ‘Add Filter’ functionality allows the user to search through all the review columns and displays only the rows containing or leaving out a certain phrase or word you are looking for or wanting to exclude, respectively.

Step 1

Click on the Add Filter button.

Step 2

From the Column drop-down menu, select the column name to which the filter is to be applied.

Step 3

Select the condition for applying filter.

Filter options:

is equal to: To search for table cells in a selected column for the exact word or phrase.

is not equal to: To search for table cells in a selected column which do not contain the word or phrase mentioned.

is like: This is similar to the is equal to feature, but enhanced with the ability to search even by entering a part of the word or phrase that you are looking for. For example, entering ‘pre’ in the filter box, would search for words such as ‘preview’, ‘preface’, etc.

is not like: This is similar to the is not equal to feature, but
enhanced with the ability to filter your search even by entering a part of the word or phrase that you are looking to exclude.

Step 4

Enter the required or appropriate words into the text box.

Step 5

Click Add. The filter is added and applied to the controlsheet which now shows the data based on the filter.

NOTE: Three more buttons are added next to the Add Filter button; Remove Filter, Save Filter, and Delete Filter.

Step 6

To remove an added filter, click on the Remove Filter button.

Step 7

From the Filter drop-down menu, select the filter that is to be removed.

Step 8

Click Remove.

NOTE: To remove all applied filters, click on the Remove All button.

Step 9

To save an added filter, click on the Save Filter button.

Step 10

In the Filter field, enter the name for the filter and click Save.

Step 11

To delete an added filter, click on the Delete Filter button.

Step 12

From the Delete Filter drop-down menu, select the filter that is to be deleted and click Delete Filter.

Step 13

To apply an already added filter, click on the Add Filter button.

Step 14

From the Add Filter drop-down menu, select the filter that is to be applied and click Apply Filter.

The Add Row functionality allows you to add an additional row at the end of the review in case you want to edit or insert any data.

Step 1

Click on the Add Row button.

It displays a popup with list of 4 options:

·         Add Above Selected Row – Add row above the selected row.

·         Add Below Selected Row - Add row below the selected row

·         Add Row At Bottom – Add row at the end of the review.

·         Exit – Close the popup.

Select any option to insert a row in the review.

Step 2

Enter data and click Save at the top of the screen to save any changes made to the review.

The Delete Row functionality allows you to delete rows from the review in case you feel any data is unwanted.

Step 1

Select the checkbox of the row that is to be deleted and then click on the Delete Row button.

TIP: A row can also be deleted using the Delete link next to the row.

NOTE: Click the Test link next to the row to upload test data.

The Export to PDF’ functionality exports the controlsheet to PDF format.

Step 1

Click on the Export to PDF button.

The PDF file appears as shown below.

The Export to Excel functionality allows you to export the review in CSV format in the local system.

Step 1

Click on the CSV button. User will then be prompted to save or open the ‘report.csv’ file.

Step 2

Select the required option.

The Import form Excel functionality allows the user to import the worksheet from excel CSV worksheet format.

Step 1

Click on the Import button. The following screen appears.

Step 2

Enter the name of the file to be imported.

TIP: Alternatively, click on the Browse button to browse for the required file.

Step 3

In the Number of Rows to import field, enter the number of rows to import.

NOTE: To import all rows, leave this field blank.

Step 4

Select the ‘First row in the file is field names’ check box, if you want to synchronize all the column names in the CSV file to the field names of the controlsheet.

NOTE: make sure that the column names in the CSV file to be imported matches exactly with the field names of the controlsheet created.

Step 5

Click Continue.

ControlCase GRC allows the user to create test plans for the internal control and to attach documents collected during the testing phase of the audit to the worksheet. A test plan helps in maintaining information about the test that is carried on. For instance, it can contain the test date, test result, the tester who carried out the test, and any other documents that can be helpful in backing-up the test plan.

To create a test plan:

Step 1

Click on the Review header tab. The organizational tree appears.

Step 2

To access specific controlsheets of a department, for example ‘Controls’, click on it. The reviews appear as shown below.

Step 3

To access a review, click Edit next to it.

Step 4

Click the Attachment link for the control against which you want to create a test plan.

Step 5

To add a new test plan, click the New button.

This will bring up a screen where you can enter detailed information about the test plan and attach the test documents.

Step 6

In the Test Plan box, enter the name for the test plan.

Step 7

From the Test Status drop-down list, select the appropriate status in which the test plan is in.

Step 8

In the Tested By field, enter the name of the tester.

Step 9

To attach a test document, click the Browse button and select the document from your directory.

Step 10

In the Description box, enter a brief description for the uploaded document.

Step 11

In the Test Date box, enter the data on which the test was performed by clicking the button next to it.

Step 12

Click the Save button.

Additional test files can be attached to an existing test plan as and when needed.

To attach an additional test file:

Step 1

Click the Attach and View Files link.

Step 2

Click the New button.

Step 3

Click the Browse button and locate the new file that is to be attached.

Step 4

In the Description box, enter description for the attached file.

Step 5

Click the Save button.

Once saved, the new file appears in the list of uploaded documents.

Test files can be downloaded for examination by an auditor.

To download a test file:

Step 1

Click the Attach and View Files link.

Step 2

Click the filename that you want to download.

Step 3

On the File Download screen, select the required option.

Test file can be deleted if it is not required anymore or if it is placed under a wrong test plan.

To delete a test file:

Step 1

Click the Attach and View Files link.

Step 2

Click the Delete link next to the file you want to delete.

Step 3

A confirmation box appears. Click OK.

A test plan can be edited from time to time to reflect its current status. For instance, you may want to change the test status or the results of the test on its completion.

To edit a test plan:

Step 1

Click the test plan that you want to edit.

The test plan becomes yellow and two additional buttons, Edit and Delete appear at the bottom of the screen.

Step 2

Click the Edit button.

Step 3

Make the necessary changes; for example, change the test status to Completed, the test result to Pass, and then click the Save button.

A test plan can be deleted if it is not required anymore.

To delete a test plan:

Step 1

Click the test plan that you want to delete.

The test plan becomes yellow and two additional buttons, Edit and Delete appear at the bottom of the screen.

Step 2

Click the Delete button.

Step 3

A confirmation box appears. Click OK.

The Hierarchical View functionality displays the controlsheet in hierarchical tree mode.

The Hierarchical View is as shown below. In this mode you can add a new row, a new column, and also modify any existing data in the controlsheet.

Below, the Column headers of a selected node and its Column contents are shown. Following that, the various modifications that can be made to a node are discussed.

Each node represents certain data cells of a row. The columns which the node represents are displayed (on the left) when a particular node is selected and its content is displayed alongside as shown in the screen above.

Hence, through this functionality, you can edit content of row cells displayed.

Step 1

Click on Edit. The next screen (below) displays the fields present in the selected node with their respective contents.

Step 2

Edit the content of the fields and click Save.

This functionality adds a new attribute to the node. The attribute will represent a new column in the controlsheet.

Step 1

Click on Add an Attribute. The following screen appears.

Step 2

Fill in the details such as ‘Name’, ‘Type’ and ‘Length’ for the new field.

NOTE: This field will then be displayed as a new column for that particular node.

Step 3

Click Save.

This functionality removes any selected column from the controlsheet.

Step 1

Click on Delete an attribute. The following screen appears.

Step 2

Select the attribute to be deleted from the drop-down menu.

Step 3

Click Save. The attribute is removed from the controlsheet.

This functionality creates a child to the selected control element and depending on the number of attributes given to the child control element; the number of columns will be created in the controlsheet.

Once a child control element is created for a particular control element, any more child control elements created at the same level take up the same attribute-names as those given to the first child control element created (at that level).

NOTE: All control elements at the same level have the same attribute-names.

Step 1

Click on Add a control element. The following screen appears.

Step 2

Enter the desired label and attribute name for the new child control element and click Save. This adds another column to the controlsheet.

NOTE: Child control element creation need not appear as a new column in the controlsheet. However, if the created child had to go through the creation of new attributes, then new column(s) are added to the controlsheet.

This functionality creates a child to all the nodes at the same level.

Step 1

Click on Add a child to each control element. The following screen appears.

NOTE: The Add a child to each control element feature does not work unless the selected control element is a leaf control element.

Step 2

Enter the desired number of attributes for the new child control element and click Save.

Step 3

Fill in the details such as attribute name, type, and attribute length for the new attribute. This attribute will then be displayed as a new column in the controlsheet.

Step 4

Click Save to continue. The following screen appears.

Step 5

Enter the desired label name and attribute content for the new child control element.

Step 6

Click Save.

As seen in the screenshot above, ‘Remediation’ was entered as the label name for the new child control element. On saving the details, the following screen appears where ‘Remediation’ is seen as the child-name and its attribute names are shown on the right hand side respectively.

You can use the Search functionality to look for particular review names (i.e. the ‘For Review’ option), or even specific data within the reviews (i.e. the ‘In Reviews’ option).

To search for reviews:

Step 1

Click on the Review header tab and then click on the Search panel. The Search panel appears.

Step 2

To search for review names, select the ‘For Review’ check box. To search for specific data within the reviews, select the ‘In Reviews’ check box.

NOTE: If you select both the check boxes, search will be performed for both the options.

Step 3

Enter the particular word or phrase that you wish to search for through the reviews.

Step 4

Click binocular icon, to run the search. The search results are displayed in the panel on the right hand side as shown below.

TIP: You can also press ENTER on your keyboard.

This panel is used to associate documents with nodes of the organization. When on a particular node, user may make changes to reviews available for that node. The changes made have to be supported with some evidence as to why they are made. The Documents panel helps gain this evidence. The users can upload their evidences or other documents using this panel. The uploaded documents will then appear on this panel for that particular node, for example, the ‘User policy’ file against the Controls node as shown below.

The panel shows three columns:

·         The first column shows the format of the uploaded document.

·         The Name column shows the name of the file.

·         The Status column shows the status of the file.

NOTE: To download a file click on its name.

Step 1

Click on the Add File button.

Step 2

In the File Attachment field, enter the file path of the file to be attached.

TIP: Alternatively, you can click the Browse button to browse for the required file.

Step 3

In the File Description field, enter description for the file.

Step 4

Click Save. The file is uploaded and added at the end of the list.

Step 1

Click on the Uploaded documents button.

NOTE: You can also click on the file name.

Step 2

Under ‘Filename’ column, click on the file name to be downloaded.

Step 3

Select to open or save the file.

In the list of Uploaded Documents, the first column represents the ‘Version’ of the uploaded file. This is incremented automatically as and when a user updates and saves the file.

For example, if the default version is set to ‘1.0’, as soon as the file is updated and saved, the version of the saved file is displayed as ‘1.1’; and, the following updates on the file are shown as version ‘1.2’, ‘1.3’ and so on. To view the full list of previous versions as shown below, click on Version.

This concept allows just one user to work on a single file at a time. Once the user checks out a file, no other users can then modify or update the file unless and until it is checked in by the user. The other users will not see the Check-out option for this particular document when they log in. This ensures consistency of the documents by preventing it from modifying my multiple users at the same time. Once you finish working on the file, you need to upload the updated document.

Step 1

To check out a file, click on CheckOut next to the file.

Step 2

Under ‘Filename’ column, click on the file name to be downloaded.

Step 3

Select to open or save the file.

Step 4

Make necessary changes and save the file.

Step 5

To check in the file, click on CheckIn next to the file. The following screen appears.

Step 6

In the File Attachment field, enter the name of the changed file.

TIP: Alternatively, you can click the Browse button to browse for the required file.

Step 7

In the File Description field, enter description for the file.

Step 8

In the Summary changes field, enter description for the changes made to the file.

NOTE: If you select the ‘Major Version’ option, the version of the updated file would jump to the next integer. For example, the previous version of the file was ‘1.2’; the next version would be saved as ‘2.0’ instead of ‘1.3’.

Step 9

Click Save. The file is uploaded and added at the end of the list.

Step 1

Click on Delete next to the file you want to delete. A warning message appears.

Step 2

Click OK.

Gaps may be reported via email, through the Remediation header tab, or through the company’s intranet portal. Once the gap has been reported, it appears on the Gap panel.

Gap reports may be submitted via email by anyone within the organization. In this, gaps are reported to a particular email address that is pre-configured with ControlCase GRC. They remain in the mail box, until they are fetched by the application.

NOTE: To use this feature, configuration of email account is done using the User Admin module.

Step 1

E-mails get reported as and when refresh is clicked on, in the Gap panel as shown below.

This feature is available to any user with login access to ControlCase GRC.

NOTE: To use this feature, the New Gap form has to be configured from the Remediation Admin module.

To submit gaps via the Remediation header tab:

Step 1

Click on the Remediation header tab.

Step 2

Click Report a New Gap.

Step 3

Add details of the gap in the cells provided.

Step 4

Click Save. The reported gap is then displayed in the list of gaps under the Gap panel.

·         For information on adding new attributes in a Gap form, refer to Adding a new Attribute topic under, Remediation Administration”, “Configuring the New Gap Form.”

For those within the organization who are not provided with access to ControlCase GRC, a link to submit a gap will be set up on the intranet portal. Here, any user can report gaps anonymously by completing the gap description form.

To submit gaps using the online link:

Step 1

Click on the link provided on the intranet portal to bring up the questionnaire.

http://<RootURL>/modules/incident/public/index.php?action=submitEvent

Step 2

Enter gap details into the cells provided.

Step 3

Click Save.

ControlCase GRC enables Activity Manager to classify gaps into activities based on their severity and to assign the activities to investigators who will work to resolve them.

All incoming gaps can be reviewed immediately by the Activity Manager from his Remediation header tab.

To view the reported gaps:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gaps panel. Here, all reported gaps are listed including the time and date each gap was reported and the name of the person who reported it (if provided). Expand the Gap panel (if it is not already expanded). Here, you may also change the number of gaps to be displayed per page. By default, fifty Gaps are displayed per page which is the maximum limit; however, this number can be changed as per requirements.

NOTE: Through Search button (shown in the above screenshot), gaps can be filtered by,

• Method of Request: (use words like email, user or web)

• Requested By: User id (to search for gaps reported through email/web use the word ‘anonymous’; for other gaps use the ‘user id’), or

• Dates.

To get all the gaps listed, you must click on Cancel.

The details of all the reported gaps can be viewed by the users to whom they have been assigned, for example, Activity Manager. After having viewed the gaps, the user can decide whether to classify it into an activity or send it for waiver approval.

To view gap details:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gap panel. Here, all reported gaps are listed.

Step 3

Click on View Gap next to the gap to view its details.

The following screen appears that displays the details of the selected gap.

NOTE: Here, the user can also document additional details relevant to the gap.

Before classifying a gap into an activity, the Activity Manager can provide more details about the reported gap. This further makes the gap clearer.

NOTE: To use this feature, the Gap Description Attributes form has to be configured from the Remediation Admin module. For more information refer to Configuring Gap Description Attributes topic under Remediation Section.

To add gap description:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gap panel. Here, all reported gaps are listed.

Step 3

Click on View Gap next to the gap.

Step 4

Click on the Description tab present on the Specifications panel at the bottom of the page.

Step 5

Enter the Gap details in the cells provided and click Save.

Whenever a gap is reported, some preliminary investigation is done to resolve it. The Gap Handling section allows the investigator to document the results of the investigation.

To add gap record and files:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gap panel. Here, all reported gaps are listed.

Step 3

Click on View Gap next to the gap.

Step 4

Click on the Gap Handling tab present on the Specifications panel at the bottom of the page.

Step 5

Add details of the Gap in the cells provided.

Step 6

To include files with the activity details, click the Browse button to browse to the required file.

Step 7

Click Save at the bottom of the screen to save changes to the record.

NOTE: Once an investigation record has been added, it will appear at the top of the Gap Handling section.

The files included in the Gap Handling section can be viewed and downloaded using the Gap Files section for reference. In addition, details such as Gap record title, file name, hash, etc. are also displayed here.

To view the gap handling files:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gaps panel. Here, all reported gaps are listed.

Step 3

Click on View Gap next to the gap.

Step 4

Click on the Gap Files tab present on the Specifications panel at the bottom of the page.

This directs to a list of all files that are associated with the Gap.

Step 5

To download a file, click on it. A dialog box appears prompting to open or save the file. Select the required option.

All operations performed on a gap, such as, when it was reported, viewed, updated, sent for waiver approval, reassigned, classified as activity and who all did it is displayed here.

To view the gap audit log:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gaps panel. Here, all reported gaps are listed.

Step 3

Click on View Gap next to the gap.

Step 4

Click on the Gap Audit Log tab present on the Specifications panel at the bottom of the page. This displays the log associated with the Gap.

Once the Activity Manager has reviewed a gap report and decides to proceed with further investigation, it can be categorized as an activity.

To classify gap as activity:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gap panel. Here, all reported gaps are listed.

Step 3

Click on Classify as Activity for a particular Gap.

Step 4

Click OK on the confirmation box.

Step 5

Select one of the options.

·         New Assignment: Creates a new activity.

·         Append to Existing Activity: Appends the activity to an existing activity.

NOTE: If you select this option, you must provide the Activity number to which the gap is to be appended. In that case, the same investigators would handle this gap as well.

Step 6

From the Classification drop-down menu, select the type of classification.

Step 7

Select the appropriate severity level: High, Medium, or Low.

Step 8

From the Lead Investigator drop-down menu, select the Investigator lead.

Step 9

From the Investigators list, select the Group and Investigators from that Group.

Step 10

Click Save at the bottom of the page to save the changes. You are returned to the Remediation header tab where the assigned gap is no longer on the list. The details of the activity then appear on the assigned investigator’s Activity panel.

If a gap is not significant enough to be classified as an activity, the Activity Manager can waive the gap to remove it from the Remediation header tab and preserve the details.

To waive a gap:

Step 1

Click on the Remediation header tab.

Step 2

Click the Gap panel. Here, all reported gaps are listed.

Step 3

Click on Waiver Approval next to the desired gap.

Step 4

Click OK on the confirmation window to continue.

The user is directed to the Remediation header tab where the selected gap is no longer listed.

In this section, the user can view the details of an activity and its corresponding gap as it is reported. The user can further add his own notes and evidence to the activity file, and forward the activity details to external agencies such as US-CERT.

This feature is available to any user with login access to ControlCase GRC. Here, a user can directly create and assign activities without the need of creating gaps.

To submit activities via the Remediation header tab:

Step 1

Click on the Remediation header tab.

Step 2

Click Report an Activity.

Step 3

Select one of the options.

·         New Assignment: Creates a new activity.

·         Append to Existing Activity: Appends the activity to an existing activity.

NOTE: If you select this option, you must provide the Activity number to which the gap is to be appended. In that case, the same investigators would handle this gap as well.

Step 4

From the Classification drop-down menu, select the type of classification.

Step 5

Select the appropriate severity level: High, Medium, or Low.

Step 6

From the Lead Investigator drop-down menu, select the activity lead.

Step 7

From the Investigators list, select the Individuals from Groups.

Step 8

Click Save at the bottom of the page to save the changes. The details of the activity then appear on the assigned investigator’s Activity panel.

Once an activity has been created, it may be viewed from the Remediation header tab of any user with the appropriate access rights. This provides a detailed view to users who have been assigned the responsibility of investigating or tracking a particular activity. 

To view the listed  activities:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel (Expand it if it is not already expanded). Here, every activity is listed with its classification, severity level, the list of resource to whom it is assigned, the time and date on which it was reported, and the name of the person who reported it (if provided).

The screenshot above shows the list of activities that have been assigned to resource. By default, fifty activities are displayed per page which is the maximum limit; however, this number can be changed as per requirements.

NOTE: Through Search button (shown in the above screenshot), Activities can be filtered by providing Activity classification or severity or resource or dates. However, you need to click on Cancel to get all the activities listed.

When classifying a gap into an activity, additional information like activity classification type, severity, date and time it was reported, and the name of the user who reported it is associated with it. This information can be viewed anytime by the investigator allocated for that activity.

To view reported data:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

To access the data recorded about the assigned activity, click on the desired activity number.

The details of that activity are displayed as shown below.

NOTE: The corresponding gap(s) details can be seen via the View Gap link.

To save the activity details in a single PDF document, click on the Export button.

All activities performed on an activity, right form reporting a gap to closing it, are logged in a file. This log can be viewed at any time to find out as to who performed the activities and when they were performed.

To view time and date stamps:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity number.

The details of that activity are displayed as shown below.

Step 4

Click Activity Audit log.

NOTE: To save this audit log as a CSV file, click on the Export button as seen in screen above.

During investigation of a particular activity, the investigator can document more details about the activity.

NOTE: To use this feature, the Activity Description Attributes form has to be configured from the Remediation Admin module.

To add activity description:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity number.

The details of that activity are displayed as shown below.

Step 4

Click on the Description tab present on the Specifications panel at the bottom of the page.

Step 5

Enter the activity details in the cells provided.

Step 6

Click Save.

The Activity Handling section allows the investigator to keep a record of the investigation performed on a particular activity. This record can be referred to when closing an activity.

To add activity record and evidence:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity number.

The details of that activity are displayed as shown below.

Step 4

Click on the Activity Handling tab present on the Specifications panel at the bottom of the page.

Step 5

Add details of the investigation in the cells provided.

Step 6

To include evidence files with your activity details, click the Browse button to browse for the required file.

Step 7

Click Save at the bottom of the screen to save changes to the record.

NOTE: Once an investigation record has been added, it will appear at the top of the Activity Handling section.

The files included in the Activity Handling section can be viewed and downloaded using the Evidence section that contains all the details (such as Evidence Number, Evidence File, etc.) about the evidence obtained during the investigation.

To view evidence:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity number.

The details of that activity are displayed as shown below.

Step 4

Click on the Evidence tab. This directs the user to a list of all evidence files that are associated with the activity.

The Evidence tab displays other information such as evidence number, evidence file, hash, date and time the evidence was added, and also provides access to the Evidence Chain of Custody.

Step 5

To download an evidence file, click on it.

A dialog box appears prompting to open or save the file.

Step 6

Select the required option.

The importance of keeping good track of your evidence cannot be overstated.  To organize the activity management process, as well as for legal purposes, the Evidence Chain of Custody has been built into ControlCase GRC. This makes it possible to track evidence as it moves from one person to another and, by employing SHA encryption, it is ensured that the evidence file is not modified.

To add evidence to the evidence chain of custody:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity number.

The details of that activity are displayed as shown below.

Step 4

Click on the Evidence tab.

Step 5

Click on Evidence Chain of Custody.

Step 6

Add evidence handling details in the cells provided and click Save.

NOTE: The saved details then appear in a table at the top of the screen.

ControlCase GRC allows the investigator to notify external agencies such as US-CERT and CC/CERT of activities that have occurred in order to inform them about the activities or to seek help from them.

To notify an external agency of activities:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click on the desired activity to be reported.

The details of that activity are displayed.

Step 4

From the upper-right corner of this page, select the agency that is be notified of the activity.

Step 5

Enter the required details in the email form provided.

NOTE: For convenience, ControlCase GRC facilitates automatic pre-population of several data fields based on the selected activity. These data fields can be set up using the Setting Emails Fields link in the Remediation Admin module. 

Step 6

Click Send E-mail. After the successful transmission of the email, a confirmation message is displayed on the screen.

Once an activity has been fully investigated and documented by the Investigator, it will be recommended for closure.

To recommend an  activity for closure:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Activity panel. Here, all activities are listed.

Step 3

Click the activity number that is to be recommended for closure.

Step 4

Scroll down to the bottom of the screen and click For Closure to refer this activity to the Activity Closer for their review.

Step 5

Click OK when the warning appears.

Once an investigator recommends an activity for closure, the activity will appear on the Activity Closer’s Approvals panel. The Activity Closer can then review the same activity data that the investigator added. Once the Activity Closer determines that the activity has been thoroughly investigated and resolved, he can close the activity. If the Activity Closer feels that the activity has not been thoroughly investigated and resolved, he can reassign that activity. That particular activity will then be available on the Activity panel.

To close an activity:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Approvals panel. This shows a list of all activities awaiting approval.

NOTE: Through Search button (shown in the above screenshot), recommended activities can be filtered by providing activity classification, severity, resource or dates. However, you must click on Cancel to get all the recommended activities listed again.

Step 3

Select the activity number to be reviewed. The Activity Details screen will appear.

Step 4

Click Approve to close the activity.

NOTE: To reassign the activity, click Reassign.

TIP: Alternately Activity Closer can return to the Approvals panel and select Approve or Reassign for an appropriate activity number.

NOTE: List of closed activities can be accessed via the Closed Activity panel.

If at any point of time, the Activity Closer finds that a particular closed activity has not been thoroughly investigated and more investigation is possible or essential, he can reopen that activity for reinvestigation. The activity will then appear on the Activity panel of the assigned Investigator.

To reassign a closed activity:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Closed Activities panel. This shows a list of all activities that have been approved or closed.

NOTE: Through Search button (shown in the above screenshot), approved activities can be filtered by providing activity classification, severity, resource or dates. However, you must click on Cancel to get all the approved activities listed again.

Step 3

Click Reassign.

Gaps that are waived can be accessed again for reviewing or adding further details.

To view waived gaps:

Step 1

Click on the Remediation header tab.

Step 2

Click on the Waivers panel. This shows a list of all gaps that have been waived.

NOTE: Through Search button (shown in the above screenshot), waived gaps can be filtered by providing dates. However, you must click on Cancel to get all the waived gaps listed again.

Step 3

Click on the View Gap link.

NOTE: Further details can be added using the Specifications panel. Clicking on the Restore Gap link will move the gap back to the Gap panel and it will no more be available on the Waivers panel.

The Reporting module, as the name suggests, is used for reporting purpose. Reports can be created for reported gaps, activities, assessments, and reviews. In addition, the data in the reports can also be used to create graphs.

This section deals with creation of reports from the reported Gaps and Activities. Reports can be created using the search criteria such as classification, type or resource or dates, provided within the application. The created reports can be saved for later review. Furthermore, graphs can also be created from the saved reports that can then be placed on the dashboard of the desired user for viewing.

This sections deals with creating of gap reports. Reports can be created for a single user or group of users or can be based on dates. Once a report is created, it can be saved for viewing later; it can be also exported in PDF or Excel format.

To generate a gap report:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Gap Reports link. The search criterion is displayed as shown below.

It is divided into four sections:

Time Selection: Allows selection of duration to search within. The Pre-defined Dates option allows to search within last week, last month, and last quarter while the Custom dates option provides to select the duration by entering the starting and ending dates.

NOTE: While the Custom dates option is selected, if only the From field is populated, gaps reported from then till date will be displayed. If only the To field is populated, gaps reported till the specified date will be displayed. If none of the fields is populated, gaps reported for entire duration will be displayed.

Requested By: Allows selection of users from all those who reported the gaps.

Gap Fields: Allows selection of gap fields to be displayed in the report.

Gap Detail Fields: Allows selection of gap description attributes to be displayed in the report.

Step 3

Make selections as per the requirements.

NOTE: If you select ‘admin’ as the user, only those Gaps which were reported by the admin will be displayed in the report.

Step 4

Click on Generate. The Gap Report with the required results is displayed. Notice that the fields selected previously comprise the various column headings.

NOTE: To view the details on a gap, click on its corresponding Gap ID.

Step 5

To save the report, enter the report name in the Enter Report Name field and then click Save.

NOTE: The saved report can be viewed later from the Run Saved Gap Report list. If the Fixed Data Report check box is selected, the report is saved along with its displayed content. If not selected, only the criteria for report generation is saved; the content will change the next time the saved report is run based on the then existing status. In other words, the saved report can be made fixed or dynamic.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Gap Reports link. A list of saved reports appears.

NOTE: The Run Saved Gap Report list appears only if there is at least one saved report.

Step 3

Select the report to be viewed and click Run.

NOTE: Click Delete to delete the selected report.

This sections deals with creating of activity reports. Reports can be based on users or on dates. Once a report is created, it can be saved for viewing later; it can be also exported in PDF or Excel format.

To generate an activity report:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Activity Reports link. The search criterion is displayed as shown below.

It is divided into five sections. The first four sections are similar to those described in the gap reports section. The Activity Type section allows selection of the type of activity.

Step 3

Make selections as per the requirements.

NOTE: If you select ‘admin’ as the user, only those activities reported by the admin will be displayed in the report. If you select ‘Malicious code’ as the type of Activity, only those activities of that type will be displayed in the report. However, if you select both, ‘admin’ and ‘Malicious code’, the result will be the intersection.

Step 4

Click on Generate. The Activity Report with the required results is displayed.

NOTE: To view the details of an Activity, click on its corresponding Activity Number. Investigator(s) of that activity can open the activity in write mode. However, other users can only open it in read-only mode.

Step 5

To save the report, enter the report name in the Enter Report Name field and click Save.

NOTE: The saved report can be viewed later from the Run Saved Activity Report list. If the Fixed Data Report check box is selected, the report is saved along with its displayed content. If not selected, only the criteria for report generation is saved; the content will change the next time the saved report is run based on the then existing status. In other words, the saved report can be made fixed or dynamic.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Activity Reports link. A list of saved reports appears.

NOTE: The Run Saved Activity Report list appears only if there is at least one saved report.

Step 3

Select the report to be viewed and click Run.

NOTE: Click Delete to delete the selected report.

Graphs can be created from saved reports to view gap or activity statistics. Using graphs, data can be put together for examination or comparison in more presentable manner. While creating the graph, its preview can be viewed to find out how it will look like after its creation. Once created, permission can be given to users so that the graph will appear on their dashboards.

To create a graph:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Remediation Graphs link.

Step 3

Click on New Graph. The following screen appears.

Step 4

Enter the graph name, select graph type (Line, Column, 3D Column, Pie, Bar, etc.), and regions (1, 2, 3).

Step 5

Enter labels for the X and Y axis.

Step 6

Enter labels for the regions and select colors in which they will be displayed.

Step 7

Enter the plot and select the report from the drop-down menu.

NOTE: The drop-down menu shows the list of all saved reports. To add more reports click Add.

Step 8

Click Show Only to view the preview of the graph.

Step 9

Click Save once the desired output is set. The name of the saved graph appears in bold in the list of graphs and the corresponding graph appears on the right side.

The graph above shows two regions; Gap (blue) and Activity (red) with plots Week1 and Week2. It represents the number of gaps and activities reported in week 1 and 2.

NOTE: To delete the graph, click Delete next to it.

Step 10

To assign permissions for the graph, click  Permission button next to it. The Dashboard Permission for graphs screen appears.

Step 11

Allow or deny access to particular users or groups using the arrow keys.

Step 12

Click Save. The graph name will now appear under the Graphs section in Add/Remove Panel on the Dashboard of the user who has been assigned with the permission.

NOTE: The graph can be viewed by selecting the check-box adjacent to the graph name.

This section deals with creation of assessment reports, like assessment status reports for viewing user status, risk rating reports for viewing associated risk, and assessment reports for viewing responses for assessments. Furthermore, corresponding graphs can also be created from the saved reports that can then be placed on the dashboard of the desired user for viewing.

ControlCase GRC allows checking status of open assessments. Once an assessment is published, it becomes available for public use. The users can opt to fill the assessment based on their access rights. At any given time for any given user, the active assessment can be in one of the three states:

• Not Started: User has not started the assessment.

• Started: User has started the assessment but has not yet completed.

• Completed: User has completed and submitted the assessment.

Based on the status, further actions can be taken. For instance, if the assessment is filled by every intended user, it can be closed; if it is not filled by any of the intended user, he can be reminded of it by sending an email.

The assessment status report is based on assessment, i.e. you can check the status of users for a given assessment. You can select only one assessment and then one or more users to whom the assessment is associated with. Reports can however be generated of only private assessments.

To generate an assessment status report:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Assessment Status Report link.

It is divided into four sections:

Time Selection: Allows choice of a particular time slot for assessment status.

NOTE: If only the From field is populated, assessment status from then till date will be displayed. If only the To field is populated, assessment status till the specified date will be displayed. If none of the fields is populated, assessment status for entire duration will be displayed.

Assessment: Displays the list of active private assessments. This is a single select field.

Users: Displays the list of intended users. This is a multiple select field.

Status: Displays the list of available status. This is a single select field.

Step 3

Make selections as per the requirements.

Example: To check the status of ‘security_assessment’ assessment, select it from the list, select the users whose status is to be checked, and then select the status.

Step 4

Click on Generate. The report with the required results is displayed.

Step 5

To save the report, enter a name in the Report Name field and click Save.

NOTE: The report can be viewed later from the Run Saved Assessment Status Report list. If the Fixed Data Report check box is selected, the report is saved along with its displayed content. If not selected, only the criteria for report generation is saved; the content will change the next time the saved report is run based on the then existing status. In other words, the saved report can be made fixed or dynamic.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Assessment Status Report link. A list of saved reports appears.

NOTE: The Run Saved Assessment Status Report list appears only if there is at least one saved report.

Step 3

Select the report to be viewed and click Run.

NOTE: Click Delete to delete the selected report.

Saved assessment reports can be used to create assessment status graphs. Using graphs, data can be put together for examination or comparison in more presentable manner. While creating the graph, its preview can be viewed to find out how it will look like after its creation. Once created, permission can be given to users so that the graph will appear on their dashboards.

To create an assessment status graph:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Assessment Status Graphs link and then New Graph link.

Step 3

Enter the graph name, select graph type (Line, Column, 3D Column, Pie, Bar, etc.), and regions (1, 2, 3).

Step 4

Enter labels for the X and Y axis.

Step 5

Enter labels for the regions and select colors in which they will be displayed.

Step 6

Enter the plot and select the report from the drop-down menu.

NOTE: The drop-down menu shows the list of all saved reports. To add more reports click Add.

Step 7

Click Show Only to view the preview of the graph.

Step 8

Click Save once the desired output is set. The name of the saved graph appears in bold in the list of graphs and the corresponding graph appears on the right side.

The graph above shows three regions; NotStarted (red), Started (yellow), and Completed (green) with plots for the assessment (security_ assessment). It represents the number of users who have not started, started, and completed the security_assessment assessment.

NOTE: To delete the graph, click Delete next to it.

Step 9

To assign permissions for the graph, click Permission next to it. The Dashboard Permission for graphs screen appears.

Step 10

Allow or deny access to particular users or groups using the arrow keys.

Step 11

Click Save. The graph name will now appear under the Graphs section in Add/Remove Panel on the Dashboard of the user who has been assigned with the permission.

NOTE: The graph can be viewed by clicking on the Left arrow next to the graph name.

An assessment may contain multiple choice questions, for example, the one consisting of radio buttons or check boxes. The choices to these questions can be assigned with some predefined marks or weights. For instance, if a given question has three options to select from as an answer, the first option will be assigned 5 marks; the second option will be assigned 20 marks, and the third, 15 marks. When a user selects any of these options, he is allotted the marks associated with that option. At the end of the assessment, the marks of all the questions are summed up which denote the risk associated with the user who gave the assessment. Risk rating is important while making new improvements or taking some crucial decisions. A survey can be conducted to collect responses from the masses based on which the involved risk can be estimated.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Risk Rating Reports link.

Step 3

From the Assessment list, select the assessment for which the report is to be created. The Users list displays all the intended users.

Step 4

Click on Generate. The Risk Rating Report with the required results is displayed. It displays the users along with their marks (weight).

Step 5

To save the report, enter a name in the Report Name field and click Save.

NOTE: The saved report can be viewed later from the Run Saved Risk Rating Report section. If the Fixed Data Report check box is selected, the report is saved along with its displayed content. If not selected, only the criteria for report generation is saved; the content will change the next time the saved report is run based on the then existing status. In other words, the saved report can be made fixed or dynamic.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Risk Rating Reports link. A list of saved reports appears.

NOTE: The Run Saved Risk Rating Report list appears only if there is at least one saved report.

Step 3

Select the report to be viewed and click Run.

NOTE: Click Delete to delete the selected report.

Saved risk rating reports can be used to create risk rating graphs. Using graphs, data can be put together for examination or comparison in more presentable manner. While creating the graph, its preview can be viewed to find out how it will look like after its creation. Once created, permission can be given to users so that the graph will appear on their dashboards.

To create a risk rating graph:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Risk Rating Graphs link.

Step 3

Click on New Graph. The following screen appears.

Step 4

In the Graph Name box, enter the name for the graph.

Step 5

From the Select Risk Rating Report drop-down menu, select the report.

Step 6

In the Low Threshold and High Threshold boxes, enter threshold values.

Step 7

Click Show Only to view the preview of the graph.

Step 8

Click Save once the desired output is set. The name of the saved graph appears in bold in the list of graphs and the corresponding graph appears on the right side.

The graph above shows three regions; Low, Medium, and High. It represents the percentage of assessments that fall below low threshold, above high threshold, and between the two thresholds.

NOTE: To delete the graph, click Delete next to it.

Step 9

To assign permissions for the graph, click Permission next to it. The Dashboard Permission for graphs screen appears.

Step 10

Allow or deny access to particular users or groups using the arrow keys.

Step 11

Click Save. The graph name will now appear under the Graphs section in Add/Remove Panel on the Dashboard of the user who has been assigned with the permission.

NOTE: The graph can be viewed by clicking on the Left arrow next to the graph name.

Responses to surveys conducted can be viewed by creating reports. Creation of reports proves useful to analyze the responses from all the users using a single page. Reports can be created to view all of the data for a given survey or can be customized to view only selected data. This facilitates easy examination of the required data.

To generate an assessment report:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Assessment Reports link. The following screen appears.

Step 3

From the Assessment drop-down menu, select an assessment and click Go.

Step 4

Select the questions whose responses should appear in the assessment report.

Step 5

In the Report Name field, enter the name of the report.

Step 6

To define conditions for adding filters in the response list, select the Include conditional report check box and click Next.

NOTE: If filters are not to be applied, do not select the check box.

Step 7

Click Next.

Step 8

Give appropriate filter conditions to segregate the relevant information from the entire set of responses.

Filter conditions:

            First, enter the condition element, which differs for different question type sets. For instance, it is a text string for text type or essay type questions, an option selected for radio buttons, and a set of selections for check box type questions.

            Then give the execution criteria in the drop-down at the right side of each question content which can be ‘Result Must Contain’ (‘AND’ operation), ‘Result Can Contain’ (‘OR’ operation), or ‘Result Must Not Contain’ (‘NOT’ operation). The condition can be selected as per requirements to generate a report.

·          Result Can Contain: This is the default selection if any search criterion is not chosen. It generally searches for all the responses.

·          Result Must Contain: This selection allows you to specifically search for responses containing a particular answer that you are looking for. For example, if you enter ‘IT’ as seen in ‘Question 2’ in the screenshot below, the generated report would only bring up responses which have ‘IT’ as the answer to ‘Question 2’.

·          Result Must Not Contain: This selection allows you to specifically search for reports which do not contain a particular answer (that you want to exclude). For example, if you select ‘Wired’ as seen in ‘Question 3’ in the screenshot below, the generated report would not bring up responses which do have ‘Wired’ as the answer to ‘Question 3’.

Step 9

Click on Generate Report to generate the report with specified conditions.

Step 10

The following screen appears where the questions constitute the column headings and the corresponding responses constitute the rows.

NOTE: To export the report thus obtained, into a CSV or PDF format, click on the corresponding icons placed above the report table.

Step 1

Click on the Reporting header tab.

Step 2

Click on the Assessment Reports link. A list of saved reports appears.

NOTE: The Run Saved Assessment Report list appears only if there is at least one saved report.

Step 3

Select the report to be viewed and click Run.

NOTE: Click Delete to delete the selected report.

This section deals with creation of reports from controlsheets, extended reports, and graphs.

1. Reports can be generated from controlsheets i.e. reviews. Reports can be created for a single controlsheet or set of controlsheets that belong to the same standard. Conditions can also be applied while creating reports so that only the required data is displayed which facilitates easy examination of it. The created reports can be saved for later review.

2. Extended Reports can be created as reports on reports. Extended reports can be created by generating one single report from multiple reports. 

3. Furthermore, graphs can also be created from the saved reports that can then be placed on the dashboard of the desired user for viewing.

NOTE: A couple of standard reports have been saved in this module as examples.

This section deals with creating of review reports (also referred as base reports). Reports are created on one or multiple controlsheets of same standard to get the desired output. Once a report is created, it can be saved for viewing later; it can be also exported in PDF, Excel or Word format.

For example: You have created and edited data in controlsheets on various nodes of your organizational tree. Each controlsheet consists of many columns. Now, you want to segregate the information of any particular column from all the controlsheets. So, you generate a report using all the controlsheets on this particular column to get the desired output.

To generate a review report:

Step 1

Click on the Reporting header tab.

Step 2

Click on the Review Reports link. The following screen appears.

Step 3

Select any filter condition from the Select Filter Condition dropdown list.

For e.g. Select User Name as a filter and select the Show All checkbox or the alphabet with which the user name begins who has access to the review sheet.

Select checkboxes for all users to display the list of the Controlsheets they have access to. The list of all controlsheets will be displayed.

Step 4

Select the Controlsheet(s) for which a report is to be created.

Step 4

From the Output entries where drop-down menu, select the column on which you want to apply a condition.

Step 5

From the is drop-down menu, select the condition to be applied.

Filter options:

Equal to: To search in a selected column of a controlsheet for the exact word or phrase.

Not equal to: To search in a selected column of a controlsheet which does not contain the word or phrase mentioned by you.

Contains: This is similar to the equal to feature, but enhanced with the ability to search even by entering a part of the word or phrase that you are looking for. For example, entering ‘pre’ in the filter box, would search for words such as ‘preview’, ‘preface’, etc.

Does not contain: This is similar to the is not equal to feature, but enhanced with the ability to filter your search even by entering a part of the word or phrase that you are looking to exclude.

Step 6

Enter the value to be searched for in the Enter Value box, for example, ‘Yes’.

Step 7

Click on Generate to generate the report. The report is generated as shown below.

Step 8

To save the report as a template for future use, enter a name in the Enter Report Name box and click Save.

Select the Fixed Data Report check box, if you want the report to be static. This means report is saved with the same content and every time you open this report, the same content is displayed.

If you do not select this checkbox, then only the criteria for report generation is saved; the content will change the next time the saved report is run based on the then existing status. In other words, the saved report can be made fixed or dynamic.   

The report can be viewed later from the Run Saved Review Report list. Select the report and click Run.

Consider the following sample controlsheet:

Step 1

Click on the Add Operator button.

Step 2

Enter an appropriate operator name, select the column on which operator is to be applied, select Count / sum / average Operator and click on Add button.

NOTE:

·         Multiple Operators can be applied on one column of controlsheet.

Step 3

The result of the operator is displayed at the bottom of the column on which the operator is applied.

Step 4