The settings let you adapt Ariadne ISMS to the rules of your organization: from which score a risk counts as critical, how often things are reassessed and which outage scenarios you consider in the business impact analysis (BIA). With the data import, you bring existing inventories into the system via Excel instead of creating them one by one.
Prerequisites
- Most settings and the data import require the Admin role.
- Key Users can also maintain tags, categories and catalogs.
- All other members can read the settings but not change them.
Open the settings
Open the user menu at the bottom left and click Settings. The settings open as a window with these sections:
- Risk treatment: score ranges, automatic acceptance, risk reassessment
- BIA configuration: scenarios, time periods and intolerance level of the BIA
- Information classification: reassessment of information
- Tags and Categories
- Members: members and roles
- Data import: import via Excel
Know who can change what
Master data
Tags, categories, risk and measure catalogs
Use these to organize records and provide templates for common risks and measures. You reach the catalogs via the user menu under Risk and measure catalogs.
Rules and access
Risk treatment, BIA configuration, Information classification, Members, Data import
Use these to define how assessments and reassessments work, who has which role and which data is imported.
Assessment scheme and Ariadne integration
Impact and likelihood scales, connection to Ariadne
These settings affect all assessments in the system. Contact our support team if you need changes.
Understand the assessment scales
You use the impact scale to classify the confidentiality and integrity of information, for the BIA and for the impact of risks. By default it has five levels:
| Value | Impact | Description | Likelihood |
|---|---|---|---|
| 1 | Negligible | No significant damage | Rare |
| 2 | Low | Minor damage, manageable in normal operations | Unlikely |
| 3 | Medium | Noticeable damage, manageable with management effort | Possible |
| 4 | Severe | Serious damage with considerable consequences | Likely |
| 5 | Catastrophic | Catastrophic damage, continued existence at risk | Almost certain |
The scales can be adapted to your organization (3 to 6 levels). Before a change, you get a preview. Afterwards the system automatically recalculates existing information classifications and BIAs. Required protection and BIA use the levels, while the risk assessment can use finer values of the same scale.
Define risk assessment and reassessment
Under Settings > Risk treatment you define how the risk score (impact × likelihood) is classified and when risks come up for review again.
| Setting | Purpose | Default |
|---|---|---|
| Score ranges | From which score a risk is Low, Medium, High or Critical | Low from 1, Medium from 5, High from 10, Critical from 17 (max. score 25) |
| Auto-accept threshold | Risks below this score are accepted automatically | 0 = off |
| Reassessment intervals | After how many days a risk is reassessed, per score range | Critical 90, High 180, Medium 365, Low 730 days |
| Default measure deadline | Default deadline for new measures | 90 days |
Adapt the BIA to your organization
Under Settings > BIA configuration you define which scenarios and time periods process owners assess in the BIA. By default, three scenarios are configured:
| Scenario | Guiding question |
|---|---|
| Task fulfilment and service capability | How severely does an outage affect core tasks, services, deadlines or operational control? |
| Duties of care and compliance | What are the consequences for legal, contractual or regulatory obligations, data protection or personal safety? |
| Economic and external impact | What financial damage, follow-up costs, contractual penalties or loss of trust and reputation arise? |
- BIA scenarios: add a scenario with name and description via Add. At least one scenario is required.
- BIA time periods: add a period with value and unit via Add. The defaults are 8 hours, 24 hours, 72 hours and 14 days. Periods must be in ascending order.
- BIA intolerance level: the impact level from which an outage is considered intolerable. The default is Severe. The system uses it to calculate the maximum tolerable period of disruption (MTPD).
Control the reassessment of information
Under Settings > Information classification you define when information is due for reassessment. The higher value of confidentiality and integrity determines the interval.
| Case | Default |
|---|---|
| First classification of new information | due after 90 days |
| Catastrophic | 90 days |
| Severe | 180 days |
| Medium | 365 days |
| Low and Negligible | 730 days |
Maintain tags, categories and members
- Categories: you maintain categories separately per object type. Assets always require a category. Each asset category appears as its own entry in the navigation under Secondary assets.
- Tags: use tags to group records across object types and filter lists by them.
- Members: assign the roles Employee, Key User or Admin here. Each member has exactly one role; new members start as Employee.
Import inventories via Excel
Do you already have assets, risks or catalogs in a spreadsheet? Then import them under Settings > Data import with an Excel file instead of creating them one by one. Only Admins can run the import.
Build the import file
| Sheet | ID prefix | Columns |
|---|---|---|
| Risk catalog | RT- | id, title, category, tags, linked_measures, content |
| Measure catalog | MT- | id, title, category, tags, linked_risks, content |
| Assets | AS- | id, title, category, tags, owner, content |
| Informations | IN- | id, title, category, tags, owner, content |
| Risks | RI- | id, title, category, tags, owner, linked_risk_catalog, asset, content |
| Measures | MS- | id, title, category, tags, owner, linked_risks, content |
Business processes (BP-) can also be imported, with title, description, owner and any number of Ariadne page IDs. If a process includes a BIA, at least one cell must be assessed.
How the system handles IDs
- New ID: the record is created.
- ID already exists: the record is updated. If it is archived, it is restored instead of being created twice.
- ID belongs to another object type: the row is rejected.
Check the preview
Before the import, a preview shows you what will be imported:
| Situation | Result |
|---|---|
| Title missing | Error |
| Unknown category | Warning imported without category |
| Unknown tag | Warning tag is skipped |
Connect Ariadne to the ISMS
To take over business processes from Ariadne and reference Ariadne pages, the ISMS must be connected to your Ariadne. Ariadne Support sets up this connection. It is not active by default.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article