ISMS: End-to-end example: the "Create quote" process

Using the "Create quote" process as an example, you walk through Ariadne ISMS from start to finish: from the business process via information, BIA and asset to a treated risk with measures and a residual risk. Afterwards you know how the steps fit together and can capture your own processes the same way.

Prerequisites

• You have access to Ariadne ISMS. For assessments, the BIA and risk treatment you need to be the Owner of the record, or have the Key User or Admin role.
• To take over pages from Ariadne, the Ariadne integration is set up for your organization.

The path at a glance

1. Create the process

Open Business processes > + Create. If the process is already described in Ariadne, choose the Take over from Ariadne tab, type "quote" into Search Ariadne pages… and select the page. Title and Content are prefilled and you can adjust both before creating. Click Create.

• Under People, set the head of sales as owner. The page owner from Ariadne is only displayed, never taken over.
• Title and description are taken over once. Later changes to the Ariadne page do not flow into the process, but you always see the current page properties under Ariadne references.

2. Link and classify information

On the process, click + next to Processing information. The AI first checks existing links, which can take 20 to 60 seconds. Link existing items under Existing information and take over suggestions marked AI suggestion under New information with +.

Then open each information item and classify it under Security classification and Privacy classification:

Under Required protection, the process now automatically shows the highest value: confidentiality and integrity Severe, plus Personal data under Information privacy.

3. Perform the BIA

Click the pencil icon next to Business impact (BIA). For each scenario, the head of sales answers: how painful is it if the process fails, and from when? In the example, for the scenario "task fulfilment and service capability":

Add a Rationale (optional) and click Finalize assessment. Because the intolerance level (default: Severe) is reached at 24 h, the process shows MTPD 24 h. The impact can only stay the same or rise over time; lower levels are greyed out in the dialog.

4. Create the CRM as an asset and connect it

1. In the navigation under Secondary assets, choose a suitable category, for example Software, and click + Create. Enter "CRM" as Title and check the Category.
2. The asset starts as Proposed. Use the … menu with Start evaluation and Approve for use to set it to In use.
3. Open the process and click + next to Used assets. Search for the CRM, choose Required as Dependency mode, tick both information items and click Add dependency.

Under Required protection, the CRM now shows confidentiality and integrity Severe, Personal data and the availability of the process as a time series across the BIA periods. You cannot change these values by hand; they follow from the business.

5. Capture and assess the risk

1. On the CRM, click + next to Risks. The asset is preselected. Type "Unauthorized access via compromised credentials". If there is no matching catalog entry, create it with Create a risk named ….
2. Take the risk into active handling with … > Manage risk. Only then can you assess it.
3. Under Affected protection goals, select Confidentiality and Integrity and click Save protection goals.
4. Under Next steps, click Assess. Choose for example Impact Severe (4) and Likelihood Likely (4) and add a short rationale. Result: Risk score 16, rated High.

6. Define the treatment

Under Next steps, click Define and choose Reduce. Enter a Rationale, check the preselected Responsible person and set a Target date. Without a target date, Save treatment stays disabled. The target date is also the deadline for all measures of this risk.

7. Implement and document measures

On the risk, click + next to Measures and create two measures, either from the measure catalog or with your own title:

Introduce MFA for the CRM

Makes it less likely that a stolen password is enough

Measure 1

Set it to In progress via Next steps > Start. When it is done, attach evidence under Documents > +, for example a configuration screenshot, and move it through Implemented to Verified.

Implement an authorization concept

Limits the damage if an account is misused after all

Measure 2

Same flow: start, implement, attach evidence, check effectiveness. Verified means the measure has been checked. How well the risk is now under control only shows in the reassessment.

8. Complete the treatment and assess the residual risk

Once both measures are documented, click Complete under Next steps and add a closing note. The risk is immediately flagged for reassessment.

Click Assess again. With MFA, access via stolen passwords is much less likely, for example Likelihood Unlikely (2) with the same impact. Result: Risk score 8, rated Medium. This is your residual risk. Next steps shows you what comes next. If the residual risk is within your acceptance criteria, you document Accept, for example.

Check the result on the dashboard

Open Overview: the process, information and risk now count as assessed, and the CRM is listed under In use. On the Risk management dashboard you see the risk in the Risk matrix and in the risk landscape. This lets you show your management which risk you carry knowingly and why.

Related articles

• ISMS: What is Ariadne ISMS and how do you work with it?
• ISMS: How required protection is derived from process to asset
• ISMS: Capture, assess and treat risks
• ISMS: Plan, implement and document measures