Security & Risk Management Suite: operations manual

Suite structure and permissions

The Suite combines Asset Management and Cyber. Its dashboard summarizes assets, plans, open and overdue occurrences, upcoming deadlines, and completed checks. Working areas are Assets, Plans, Schedule, Supplier Classification, Cyber, and Settings.

Assign read and write permissions before use and define owners, operational custodians, execution teams, and reviewers. Cyber functions also require the Wazuh infrastructure managed for the platform.

Calendar Activity setup

Under SRM Settings, select the default Activity type used when a plan creates calendar work. Only types that do not require a CRM customer are eligible, because controls are linked to assets and teams.

Create a recognizable type in Activities first, save it in SRM, and verify that a new test plan produces the expected calendar entry. Changing the setting does not retroactively repair existing activities.

Create an asset

Enter name, category, criticality, description, owner, operational custodian, state, location, supplier, model, and serial where applicable. Category-specific fields can cover department, continuity planning, configuration backup, code testing, encryption, version, warranty, condition, service supplier, or continuous training.

Use Not applicable only after assessment. The owner governs risk and decisions; the custodian performs daily work. Verify classification and responsibility before creating control plans.

Edit and delete assets

Update state, criticality, ownership, custodian, location, supplier, and category-specific evidence when operational reality changes. Review the effect on open plans, occurrences, deadlines, and reports before saving.

Deletion is logical and must preserve required history. Inspect linked plans and completed evidence, document the reason, and never delete an asset merely to clear overdue work. The XLSX export groups current assets by category and must be handled as a controlled copy.

Supplier classification and ACN export

Select the CRM supplier and record service category, CPV code, criticality, access level, operational impact, replaceability, compliance outcome, review dates, and notes. ICT, cloud, connectivity, security, software, hardware, datacenter, professional services, and outsourcing have distinct meanings.

Privileged access, critical impact, or a single point of failure require priority treatment. Include only eligible, reviewed classifications in the ACN export and inspect the generated file before any external transmission.

Create a control plan

Select the asset, title, assignee, Activity team, one-time, monthly, quarterly, semiannual, annual, or custom-day frequency, start date, next due date, and initial state. Add an ordered checklist, mark mandatory items, and describe measurable objectives plus expected evidence.

Saving creates the first occurrence and its calendar Activity. Confirm assignee, deadline, checklist, and generated activity before relying on the schedule.

Pause, edit, or cancel a plan

Changing frequency, dates, assignee, team, or checklist affects future execution and may interact with occurrences and calendar activities already created. Reconcile those records before and after editing.

Pausing or closing changes future scheduling; deletion archives open occurrences rather than silently erasing history. Do not cancel a plan to hide incomplete controls. Record the reason, preserve evidence, and decide how outstanding work will be handled.

Schedule, ownership, and deadlines

The Schedule filters To do, In progress, Not completed, Overdue, and Completed occurrences. Open the report and verify asset, plan, assignee, due date, and history. Take in charge attributes execution and starts operational work.

Overdue items remain visible. Do not backdate completion to hide a delay; document cause, impact, and corrective action and escalate according to the organization’s policy.

Checklist, attachments, and completion

For every checklist item record execution, date, and note. Mandatory items must be satisfied before completion. Attach only permitted, necessary images, PDFs, or spreadsheets, respecting confidentiality and retention.

Final notes should explain work, findings, and corrections. Complete only after reviewing checks and evidence. An active recurring plan then calculates and generates its next cycle.

Wazuh connection and synchronization settings

Cyber uses centrally managed Wazuh Manager and, when configured, Indexer connectivity. Configure enablement, the ISP tenant group, alert fetch limit, synchronization interval, alert-level threshold, default assignee, notification accounts, and notification email addresses.

The group is a tenant boundary and must not be changed casually. Test the connection, run one controlled synchronization, and compare its result, counters, and latest-run status with Wazuh. A blank dashboard may mean wrong group, offline agents, a high threshold, credentials/connectivity failure, or genuinely no events.

Agents and installation scripts

Agents display Wazuh ID, name, operating system, IP, group, last contact, state, and calculated risk. The Suite can generate Windows, Linux, or macOS installation commands using the configured manager, group, and endpoint name.

Review every generated script before privileged execution and run it only on the authorized endpoint. Then verify service state, appearance in the correct group, last contact, and absence of duplicates. Deleting a local record does not necessarily uninstall the endpoint agent.

Alerts, vulnerabilities, compliance, and logs

Alert states are Open, Acknowledged, In progress, Closed, and False positive. Each transition needs an operational reason. Agent detail correlates alerts, open vulnerabilities, compliance controls, authentication events, file-integrity information, and MITRE references when available.

Use live refresh deliberately and distinguish provider data from the last stored synchronization. Export authentication logs only for an authorized purpose and protect usernames, addresses, event details, and downloaded files.

Checklist

• Use a customer-free Activity type
• Assign owner, custodian, team, and reviewer
• Complete category-specific asset fields
• Review suppliers and ACN eligibility
• Create measurable mandatory checks
• Reconcile plan, occurrence, and calendar
• Take work in charge before execution
• Preserve only necessary protected evidence
• Protect Wazuh credentials and tenant group
• Review installation scripts
• Justify alert and false-positive states
• Audit every synchronization run