From your IT to your risks: the order of work

1. IT environment: what you have, and what counts

Under IT environment you walk three steps. Integrations reads your devices and accounts from tools such as Microsoft 365. Inventory shows everything that came in, plus what you add by hand. Size asks how many devices, accounts, apps and suppliers you really have, and compares that with the inventory so you see what is still missing.

On Size you also find Outside NIS2. What you put there is not assessed anywhere. You always give a reason, and your auditor reads it. You can put three things outside:

• Whole groups, for example the phone systems you host for customers. Click Put a group outside NIS2, pick the group and give the reason. Before you confirm, you see how many items move out.
• Single items, such as one old laptop in a cupboard. An item inside a group that is outside can still be taken back in on its own.
• Rules, set by your IT partner. Only your IT partner changes those.

Take back in undoes it.

2. Security groups: which parts get their own look

A security group is a set of devices or people that need different protection, with the reason. You need one because a risk does not weigh the same everywhere. Ransomware on the office laptops stops the work. On a kiosk computer the damage is probably much smaller, so there you may simply accept the risk, while you lower it on the laptops. Without a group "Kiosk computers" that risk gets one score for both. Typical groups are servers, kiosk computers, and the machines that run a supplier's software. How to make one is on Making groups.

Each group is either assessed on its own or not:

• Tick Assess separately on a group. It moves to Assessed on their own, in this order.
• A group you do not tick stays under Candidates, fall under All the rest. Its items are assessed together with everything else.
• All the rest is always last and holds everything no group holds. It is fixed: you cannot remove it, and you cannot assess it separately, because it is assessed anyway. Neither can a group that is Outside NIS2.
• Groups with nothing in them fold away under Empty groups.

The order matters. An item belongs to the first group in the list that it fits. That group owns it. A laptop that is both an office laptop and a supplier machine counts once, for the group that comes first. Each group shows what it owns and what it matches, for example "owns 12, matches 17". Move a group with the arrows. Before anything changes, you see which items would change group.

Ticking Assess separately asks you to confirm. Every risk the group reaches gets a To do line. The lines that lose items to it move to To review: does that score still hold without this group? Untick it, and that group's assessments stop counting. You still see them.

3. Assessments: one per group

The bar at the top of Security groups tells you what is next, for example "Next step: assess All the rest", with Start assessment. Or click New assessment on the Assessments step.

1. Answer Which part of the company is this assessment about? You can pick a group you assess separately, or All the rest. A candidate group cannot get its own assessment: tick Assess separately first.
2. Pick All findings (recommended) to get every known risk to confirm or dismiss, or Blank to add them yourself.
3. Does that group already have an assessment? The newest assessment of a group is the one that counts. If the older one is still on the list, archive it when you no longer need it there.

Each assessment card has Hub to go through the risks one by one, Wiki for the page itself, and Archive.

• Archive takes an assessment off the active list. You find it again under Archived, and Restore brings it back. The text under Archived tells you whether an archived assessment still counts in your register.
• Want it gone for good? Open its wiki page and delete it there. There is no delete button on the list on purpose.
• Only members who may change the organisation see Archive and Restore. Someone who may only read sees the list without them.

4. Register: every risk, per group

The register sorts risks the way your groups are sorted. Applies to everyone holds the risks that count for the whole company. Under it, each group you assess separately has its own branch, and Everything else (All the rest) comes last.

• Open a risk to see likelihood, impact and score, and Applies to. Choose groups narrows the risk to some groups.
• Does the risk weigh differently in one group? Add a group gives that group its own likelihood, impact, owner and treatment. For ransomware you would add "Kiosk computers", give it a lower impact and set the treatment to Accept, with a reason and a review date. Does not apply to this group takes a group out, with a reason your auditor sees. More on Risks.
• Management approval is where management signs off on accepted risks and the roadmap.
• Export CSV gives you the register as a spreadsheet.

Where your register shows one line per group, each line has a state: To do (not assessed yet), Assessed, or To review (something changed, check the score). Older assessments of the same group show as Replaced, and those of a group you no longer assess separately as Lapsed. Neither counts.

5. Roadmap: the work that lowers the risks

The roadmap holds the actions that lower your confirmed risks, such as turning on MFA or testing backups. Plan them per sprint and drag them to Done when they are finished. See Risks for the columns.

When something changes later

• A new laptop joins a group by itself when it fits the group's rule. Nothing to do.
• You assess a new group separately: its risks get To do lines, and the lines that lost items go to To review.
• You assess a group again: the new assessment takes over from the old one. If the old one is still on the list, archive it when you no longer need it there.