ISMS: Plan, implement and document measures

Measures in Ariadne ISMS turn a risk decision into concrete work: you define who does what, track progress through clear statuses and attach the evidence directly. That way you can show at any time in an audit what you did about a risk and whether it has been checked.

Prerequisites

• The risk the measure belongs to has been created. A measure always belongs to exactly one risk.
• Ideally the risk has a defined treatment, usually Reduce. Its target date is the deadline for your measures.
• Any role can create measures. You manage the status and the effectiveness check as the measure's Owner or as a Key User or Admin.

Create a measure

There are two entry points:

• On the risk: Open the risk and click + next to Measures. The risk is already preselected.
• From the measure list: Click Measures > + Create and pick the matching risk via Search for a risk….

Enter the title in the Enter measure title or search in catalog… field. You have these options:

From the measure catalog

Reuse a proven template

Fastest route

Click a matching catalog entry. The measure is copied with its content, including attached documents. You save writing time and keep descriptions consistent.

When do I use this?

• For standard measures, for example controls from ISO 27001 Annex A.
• When you need the same measure on many risks.

Your own measure

Tailored to your risk

Custom

If the search finds nothing suitable, create the measure with your own title and describe it yourself.

When do I use this?

• For measures implemented in a way specific to your organization.
• When a catalog entry would be too generic.

Copy together with the risk

For similar risks on other assets

Several risks

When you copy a risk via … > Copy risk, you can copy its measures along with it. You do not have to create them again.

Tip: A measure cannot be assigned to several risks. If the same measure applies to several risks, create it once per risk or copy it along.

Define responsibility and content

On the measure's detail page you maintain everything that matters for implementation:

• People: Owner and Stakeholder. This makes it clear who drives the implementation.
• Description: What exactly should happen? The more specific, the easier the later check.
• Protection goals: Which protection goals the measure supports.
• Tags and Category: for filtering and reporting.
• Linked risk: The risk the measure belongs to.

The deadline comes from the risk

A measure has no due date of its own. Its deadline is the Target date you set when defining the risk's treatment. If the target date is within the next 30 days, the measure appears on the dashboard under Upcoming deadlines. If it has passed and the measure is still open, it appears under Action required.

Track progress with the status

Every measure follows a clear life cycle. You change the status via Next steps, for example with Start, or via the … menu with Mark as in progress or Mark as canceled.

Store evidence directly on the measure

Attach evidence where it belongs: click + next to Documents and choose Upload document. This can be configuration evidence, screenshots, training records or audit logs, for example. In an audit you find the evidence for every measure right away.

After implementation: back to the risk

Once all measures are implemented and verified, complete the treatment on the risk and reassess it. Only this reassessment shows you the residual risk.

Keep your measures auditable

• Create measures as separate objects as soon as work needs to be planned or checked.
• Phrase them so they can be checked: “Enable MFA for all CRM accounts” instead of “Secure access”.
• Update the status promptly so the dashboard and deadlines are accurate.
• Attach the evidence before you verify.
• Use your own task management for the day-to-day implementation. Ariadne ISMS records status, deadline and evidence.

Related articles

• ISMS: Capture, assess and treat risks
• ISMS: Dashboards: keep track of pending actions and the risk landscape
• ISMS: Roles and permissions