ISMS: Roles and permissions

With the right roles, everyone in the ISMS module works on exactly the records they are responsible for, and sensitive content stays protected. Here you learn what each user role can do, how owners and stakeholders work together on individual records and how to make individual records confidential.

Choose the right user role

Every member of your organization has exactly one role in the ISMS module. The roles build on each other. Actions you are not allowed to perform are simply hidden.

Employee

Staff and business units

Default role

You see all non-confidential records, create new ones and edit the records where you are entered as owner or stakeholder. New members get this role automatically.

When do I use this?

• For process owners who maintain their processes and information
• For IT staff who look after individual assets, risks or measures

Key User

ISMS team, information security officer

All records

You see and edit all records, including confidential ones. You can also archive and restore records and maintain tags, categories and the risk and measure catalogs.

When do I use this?

• For people responsible for the overall picture and consistent assessments
• For people who maintain master data and catalogs

Admin

People in charge of configuration

Settings

You have all the permissions of a Key User. In addition, you maintain the settings, manage members and their roles and import data from Excel.

When do I use this?

• For a few people who manage risk treatment, BIA configuration and members
• For the person who imports initial data

Owners and stakeholders on a record

Besides your user role, it matters whether you are entered on a record. You find this in the People section.

What “edit” and “manage” mean

• Edit covers title, content, tags, category, references to Ariadne pages, links, documents, dependencies and AI suggestions.
• Manage covers owners and stakeholders, the confidential flag, status, assessments and classifications, the business impact analysis (BIA), risk treatment and the effectiveness review of measures.

So you define who assesses information or processes through permissions: whoever may manage the record may assess it.

Who can do what with records

The following permissions apply equally to assets, risks, measures, information and business processes.

Make sensitive records confidential

Some risks or assets should not be visible to everyone, for example a known vulnerability that has not been fixed yet. For this, mark the individual record as confidential: open the record and select Mark as confidential in the … menu.

• Confidential records are visible only to Key Users, Admins and the owners and stakeholders entered on the record.
• For everyone else they appear nowhere: not in lists, search, activities, dashboards, next steps, AI suggestions, documents or dependencies.
• A direct link returns “not found” for unauthorized users.

Who can change settings and master data

Open the settings via the user menu at the bottom left with Settings.

Related articles

• ISMS: What is Ariadne ISMS and how do you work with it?
• ISMS: Classify information: confidentiality, integrity and data protection
• ISMS: Settings, default values and data import