Risks, policies and people

Risks

1. In Risk Management, press Add risk: title, description, category, likelihood and impact (1 to 5), the control that answers it, an owner and a date.
2. Add a treatment plan: mitigate, transfer, accept or avoid, with a due date. When it is done, say what was done and attach the evidence that shows it.

A risk counts as reduced when something has actually changed: a completed treatment, or a passing control. Editing the numbers alone does not lower it.

Policies

1. In Policies, What your frameworks ask for lists the policies your frameworks need, each with the requirements behind it. Press Start from template there, or Start from a template or New policy at the top.
2. Make it say what your company does with Edit draft, or Adapt with AI, which fits the template to your controls and leaves what they do not answer as a gap to fill. The draft comes with a list of what it promises that no control backs up.
3. Press Publish to make it the version in force. Its text is frozen, the earlier version stays on record, and you see what changed.
4. Under Who must accept, choose the people and how often; then Send for acceptance. Each gets a personal link, reads the policy to the end and presses Accept.

People and training

• In People, add people one at a time, paste a list, or connect your HR system.
• Mark as left records somebody’s last day. Offboarding then lists each system where they still have an account, until a later reading shows it gone.
• Under Training, add a course, send it, and see who completed it. Devices come from your device management connection.