Once you have all of the questions and question lists you need in Isora GRC, you can start to create assessments. An assessment can be thought of as a bunch of questions along with a list of organizational entities that the assessment is targeting.
| Jira Legacy | ||||||||
|---|---|---|---|---|---|---|---|---|
|
...
The following flowchart illustrates many of the aspects of assessments and how they come together to produce surveys for the users. In the chart, an "org unit" type (previously referred to as " classification" type ) of assessment is shown.
PLEASE NOTE: The flowchart illustrates answer choices and answer response groups, which are a new and upcoming feature. Not all instances of Isora GRC support these features yet.
...
Figure 8-2 Assessment Object Relationships
Assessment Types
Assessment types are used to track the same assessment when you run it multiple times in a series. The types are driven by the needs of your organization, and often tied to governmental regulatory requirements. Each time you are going to start a new series of related assessments, you should start by creating a new assessment type.
Click “manage assessment types” to see a list of existing types, edit or remove them, or add a new one. You can also upload a simple CSV where each line has the name of an assessment type.
...
Assessment types have different target types, depending on what they assess. For example, if you're assessing the security of an application, the target would be "app". If you're assessing an individual person or host, you would choose "person" or "host" as the target. The "classificationThe "org unit" target refers to an assessment which includes OU-level questions and classification of all hosts within on sheets that belong to the OU. (Note: Legacy assessments (which contain unit-level questions and selected host classifications) also have the "classification" target, for compatibility.) You can rename an existing assessment type, but you can't change its target type.PLEASE NOTE: Not all instances of
| Info |
|---|
Expect future updates to allow Isora GRC to support |
...
additional target types |
...
. |
...
Creating or Editing Assessments
To work with assessments, click the “manage assessments” link. In the table, you can see a list of existing assessments. A value of published=”yes” means that the assessment has been published to Isora GRC, and surveys are available to users. It does not indicate whether any individual surveys of the assessment have been launched.
...
To create a new one, click the + button. This starts a 2-step process. In the first step, you assign a name, due date and assessment type. Depending on the type you choose, the following drop-down will be populated with question lists that are appropriate for the target type of the assessment. If this is a draft and you don't want anyone to actually start the assessment yet, leave the "publish on create" box unchecked.
...
Click next “next” to process proceed to the second step of the process. Depending on what type of assessment you are creating, the next step will offer different options. For example, if the target of the assessment type is "app," you type the name of the app you want to assess into the search box.
...
Continue clicking the checkboxes next to the OU names and filling out the forms for each OU, until all of the OUs that you want have been included. If you omit something, until it’s check the checkbox to “skip org units without sheets,” then any OUs that do not have any sheets of hosts will not be included in the assessment, even if you selected them. Until it has been published, you can edit the assessment later to add itor remove OUs, or even change the assessment type or question list. Once published, you won’t be able to edit the assessment.
...
If you save an assessment without publishing it (by setting published to “yes”), you will see a published value of “no” in the assessments table. You can edit the assessment to make whatever changes you still need, then check the “published” checkbox to publish it later.
...
Once an assessment has been published, the assessment managers and other Isora GRC users can view and work with it on the assessment module when they log in.
...
| Iframe | ||||||||
|---|---|---|---|---|---|---|---|---|
|
Next: 8.3 Working with notifications
| Page Properties | ||
|---|---|---|
| ||
|
...