Some entries in your ISMS should only be visible to a few people, such as a known, still open vulnerability or a risk relating to a sensitive project. With the "Confidential" flag you restrict access to a single record without changing anyone's role. Everyone else keeps working as usual and never sees the entry.
Prerequisites
- You are the record's Owner or you have the
Key UserorAdminrole. Setting the Confidential flag is part of the right to manage a record. - The flag is available on business processes, information, assets, risks and measures.
Confidential, confidentiality or archive: which one do you need?
These three sound similar but solve very different problems. Here is how to pick the right one.
Confidential flag
Menu … > Mark as confidential
You decide who is allowed to see the record. Its content and assessment stay the same.
When do I use it?
- For open vulnerabilities that should not become widely known
- For risks and measures on sensitive topics, such as HR or ongoing negotiations
Confidentiality (protection goal)
Security classification on the information
You assess how much damage would occur if a piece of information fell into the wrong hands. The ISMS derives the required protection of processes and assets from this. It does not change who can see the record.
When do I use it?
- For every piece of information, so the required protection is correct
Archive
Menu … > Archive
You hide a record you no longer need and protect it against changes. Only Key Users and Admins can archive.
When do I use it?
- For outdated or duplicate entries, since records cannot be deleted
Make a record confidential
- Open the record, for example a risk or a business process.
- Click the … menu.
- Select Mark as confidential.
- Check under People that everyone who still needs access is listed. Add them as Owner or Stakeholder if necessary.
Employee role, you only see a confidential record while you are its Owner or a Stakeholder. If you remove yourself under People, you lose access.Who can see confidential records?
| Person | Can see the record | Can edit it |
|---|---|---|
Key User, Admin | ✓ | ✓ |
Employee as Owner | ✓ | ✓ edit and manage |
Employee as Stakeholder | ✓ | ✓ edit, not manage |
All other Employee users | – | – |
What everyone else sees
For people without access, a confidential record is invisible. It does not appear anywhere:
- not in lists or search
- not in the activity history or on dashboards
- not under Next steps or in AI suggestions
- not in documents or dependencies
If someone without permission opens a direct link to the record, the system reports that it was not found. Not even the link reveals that the entry exists.
Employee only counts the records they are allowed to see.Find confidential records again
As a Key User or Admin you keep track with the Confidential filter, available in every list via Filter. The filter then appears as a filter chip, and you can share the filtered view as a link.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article