This glossary helps you find your way around Ariadne ISMS quickly: for each term you see what it means and how it appears in the interface. This way you can interpret assessments, statuses and hints correctly, even if you only work in the ISMS module occasionally.
Good to know: The Interface column shows the exact label you see in the ISMS module. Scales and BIA scenarios are configured for your organization and may be labelled in your organization's language.
Objects you work with Objects
| Term | Interface | Meaning |
|---|---|---|
| Primary assets | Primary assets | Your information and business processes. They are the starting point of every assessment. |
| Secondary assets | Secondary assets | Everything that supports primary assets: software, hardware, IT services, networks, staff, locations and suppliers. In the product they are simply called assets. |
| Business process | Business processes · BP-0001 | A process in the ISMS. It can reference one or more pages in Ariadne. |
| Information | Information · IN-0001 | An information object, for example customer data or costing data. |
| Asset | Assets · AS-0001 | A secondary asset. It always has a category, which also determines where it appears in the navigation. |
| Risk | Risks · RI-0001 | A specific scenario that affects exactly one asset. |
| Measure | Measures · MS-0001 | A specific activity or control that treats exactly one risk. |
| Catalog | Risk and measure catalogs · RT- / MT- | Templates for common risks (risk catalog) and measures (measure catalog). You adopt entries when creating records instead of writing everything from scratch. |
Assessing and deriving required protection Assessment
| Term | Interface | Meaning |
|---|---|---|
| Protection goals | Confidentiality, Integrity, Availability | Confidentiality, integrity and availability. |
| Security classification | Security classification | Assessment of confidentiality and integrity for an information item, with one shared rationale. |
| Privacy classification | Privacy classification | Separate from the security classification: personal data, special categories under Art. 9 GDPR and criminal data under Art. 10 GDPR. |
| Impact scale | Impact | The levels you use to assess confidentiality, integrity, the BIA and the impact of a risk. By default five levels, from negligible to catastrophic. |
| BIA (business impact analysis) | Business impact (BIA) | Assessment of a business process: how severe is the impact of an outage per scenario and time period? |
| MTPD | MTPD | Maximum tolerable period of disruption. The system calculates it from the BIA based on the intolerance level. |
| Intolerance level | BIA intolerance level | The impact level from which an outage is considered intolerable. By default the second-highest level (severe). |
| Availability curve | Availability | Derived from the BIA: the highest impact per time period. It never decreases over time and is passed on to assets. |
| Dependency | Dependencies | A directed link from process to asset or from asset to asset, together with the information processed through this connection. |
| Dependency mode | Dependency mode: Required, Workaround possible, Optional | Determines whether and how strongly the availability requirement is passed on through a dependency. |
| Derived required protection | Required protection | The protection level the system calculates from information, processes and dependencies. You cannot change it manually. |
| Maximum principle | – | When values are derived, the highest value always wins. |
Managing risks Risk
| Term | Interface | Meaning |
|---|---|---|
| Risk score | Risk score | Impact multiplied by likelihood. By default it ranges from 1 to 25. |
| Criticality (score ranges) | Low, Medium, High, Critical | Classification of the score as low, medium, high or critical. Your admin defines the boundaries. |
| Auto-accept threshold | Auto-accept threshold | Risks below this score can be accepted automatically. By default 0, meaning off. |
| Treatment | Accept, Reduce, Avoid, Share | How you handle the risk: accept, reduce, avoid or share it. |
| Residual risk | – | The result of the reassessment after the treatment is completed. It is not a separate object but the current assessment of the risk. |
| Reassessment | Reassessment | When the next assessment is due. For risks it depends on the score, for information on the protection level. |
| Next steps | Next steps | Area on a risk or measure that shows you the action that makes sense right now. |
Collaborating and tidying up Administration
| Term | Interface | Meaning |
|---|---|---|
| Owner | Owner | May edit and manage the record, for example change its status, assessments and stakeholders. |
| Stakeholder | Stakeholder | May edit the record but not manage it. If you create a record without being its owner, you automatically become a stakeholder. |
| Confidential | Confidential · Mark as confidential | Access protection for a single record. Only key users, admins, owners and stakeholders can see it. |
| Archive | Archive | Hides a record and makes it read-only. This is independent of business statuses such as Discarded or Out of use. |
| Pending action | Action required · Pending action | A record that requires someone to act, for example a missing assessment or a due reassessment. |
Important: Don't confuse the Confidential flag with the confidentiality of an information item. The flag only controls who may see a record. How much protection an information item needs is assessed separately in the Security classification.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article