Creating and configuring plans

A plan is the schedule that generates your recurring compliance tasks. Setting one up takes four things: a frequency, a scope of controls or assets, a task description, and activation. It generates nothing until all four are in place.

Adding new plans

Creating a plan sets its name and frequency. Scope, workflow, and activation all come afterwards.

Creating a plan

Creating a new plan starts with basic configuration that determines automatic task generation.

Plan creation steps:

1. Click "Add plan" button in the top right of Plans overview
2. Plan creation dialog opens with basic configuration fields
3. Fill in plan information according to your compliance needs
4. Click "Create" to create the plan

Filling in basic plan information

Only a name and frequency are required to create a plan.

Required fields:

Name:

• Clear description of compliance cycle
• Tip: Add PDCA phase and frequency for structure
• Examples: "Plan phase (annually)", "Check phase (quarterly)", "Monthly access reviews"

Frequency:

• Daily - For operational monitoring
• Weekly - Regular operational controls
• Monthly - Standard compliance reviews
• Quarterly - Strategic assessments
• Semiannually - Strategic assessments
• Annually - Management reviews and planning

Valid From:

• Start date for automatic task generation
• Default: "Today's date" to activate the new plan immediately
• Use: Set to future date when implementation is phased

Valid To (optional):

• End date for plan cycle
• Default: "Not set" for continuous cycles
• Use: For project-bound compliance or temporary cycles

Configuring plan details

After your plan is created, you can adjust basic information and create the workflow to activate the plan.

Updating plan basic information

• Name - Can be changed after creation
• Custom ID - Optional unique identifier (e.g. P.01)
• Valid From/To - Only Valid To can be changed
• Frequency - Not changeable after creation
• Description - Description of plan purpose

Configuring Plan Workflow

After plan details are filled in, configure automatic task generation via "Build workflow".

Setting up workflow

Task configuration steps:

Selecting task type:

• Ask users to dropdown - Choose what users should do. If you choose 'Assess the control' the Plan will create an Assessment task. In all other cases the Plan will create an Execution task.
• Execute the control - Default option for control implementation
• Other options available for different task types

Timing configuration:

• Create tasks on - When tasks are created (e.g. 1-9-2025)
• Their due date is on - Deadline for completion (e.g. 28-2-2026)
• Time between creation and deadline determines how much time teams get

Writing task instructions:

Each Plan automatically adds the Control and/or Asset description to generated tasks.

Additionally, via the 'Task instructions' it's possible to add one additional instruction to all tasks created by the Plan.

• Write tab - Use (markdown) editor for detailed instructions
• Preview tab - Check how instructions look
• Markdown support - Use headings, lists and links for clarity
• Write specific instructions - Describe exactly what needs to happen

Task instructions template:

### What needs to be done

[Describe concrete steps]

### Required information

[What data is needed]

### Expected result

[What is the desired outcome]

### Evidence

[Which documents to upload]

Completing workflow:

1. Click "Add task" to add a new task to the workflow
2. Repeat process for different task types if needed
3. Preview section shows when tasks are automatically sent
4. Check timing - Start date, due date and execution time

Defining plan scope

The scope decides which items the plan generates tasks for. You pick either controls or assets, not both.

Scope configuration options

After basic configuration, define which items are automatically controlled by this plan.

Two scope methods:

• Plan by Controls - Focus on control implementations
• Plan by Assets - Focus on business assets

Plan by Controls

Scope by controls when you're checking effectiveness against a framework or a policy, not a specific system.

When to use controls scope:

• Assess control effectiveness
• Framework compliance (ISO 27001, SOC 2)
• Check policy compliance
• Conduct process evaluations

Selecting controls:

1. Go to Scope tab in plan details
2. Select "Plan by Controls" tab
3. Select controls that belong in this cycle
4. Check for inactive Controls - tasks are only created for Controls that are themselves also active

Controls scope example:

Annual ISMS planning:
✓ A.01 Context of the organisation documented
✓ A.02 Legal and contractual requirements identified  
✓ A.03 Scope of the ISMS determined
✓ A.05 Roles and responsibilities defined

Plan by Assets

Scope by assets when the review is really about a specific system, vendor, or business unit.

When to use assets scope:

• Technology assessments
• Vendor evaluations
• Infrastructure reviews
• Business unit reviews

Selecting assets:

1. Go to Scope tab in plan details
2. Select "Plan by Assets" tab
3. Select assets that belong in this cycle
4. Check for inactive Assets - tasks are only created for Assets that are themselves also active

Assets scope example:

Quarterly cloud security review:
✓ Microsoft Azure Cloud (SYS.001)
✓ AWS (SYS.002) 
✓ Public website (SYS.003)
✓ 1Password (SYS.004)

Plan preview and validation

The preview shows the tasks the plan would generate over the coming period, which is the fastest way to catch a scope mistake before activating.

Using preview functionality

Check when tasks are automatically generated over the coming period.

Understanding preview information:

• Task - Type of task generated (Execution or Assessment)
• Period - The period for which tasks are created
• Start date - When tasks become available
• Due date - Deadline for completion
• Time to execute - Time between start and deadline
• Number of tasks - How many tasks per cycle (corresponds to number of unique control-assets combinations)

Plan status verification

Four status checks on the right tell you whether the plan is actually valid and ready to activate.

Status indicators on the right:

• Details: ✅ Plan is valid - when current date falls within validity period
• Workflow: ✅ Tasks configured - At least one workflow task configured with valid start and end date
• Scope: ✅ Controls / Assets assigned - At least one scope object linked.
• Scope: ✅ All assigned Controls / Assets are active - Each linked scope object is itself also active.

Status troubleshooting:

• ⚠️ Plan is currently not valid - Set 'Valid to' date in the future
• ⚠️ Plan has no tasks configured - Configure at least one task in the Workflow builder.
• ⚠️ Plan has no assets assigned - Select at least one control or asset
• ⚠️ Not all assigned controls are active - Activate controls or remove from scope

Practical configuration tips

Two choices decide whether a plan helps or drowns you: how often it runs, and when in the period it lands.

Frequency selection

Start by assigning law and regulation driven activities:

• ISO 27001 - Management review annually, risk assessment quarterly
• GDPR - Processing records periodic assessment, annual review of impact assessments
• SOC 2 - Control testing quarterly, management review annually

Add risk-based activities:

• High risk - Monthly or weekly
• Medium risk - Quarterly assessments
• Low risk - Annual reviews

Timing optimisation

Spread plans across the quarter rather than the first month, and avoid the December/January period entirely.

Workload distribution:

• Avoid December/January - Holidays and vacation
• Spread over quarter - Not everything in first month
• Concurrent capacity - How many plans simultaneously?
• Team availability - Who does what when?

Common configuration problems

Almost every plan complaint is one of these two: the plan will not activate, or it activates but produces nothing.

Plan remains inactive

An empty scope, a future start date, or a missing workflow are the three usual causes.

Possible causes:

• Empty scope - No controls or assets selected
• Future start date - Valid From still in the future
• Missing workflow - Tasks not configured
• Owner problems - Scope items without responsible persons

Solution steps:

1. Check scope tabs - At least one item selected?
2. Verify Valid From - Date is today or earlier?
3. Review owners - All scope items assigned?
4. Configure workflow - Tasks set up for automation?

Preview shows no or 0 tasks

Check the scope, the Valid From date, and whether the linked controls or assets are themselves active.

Diagnosis checklist:

• Scope definition - Items selected in scope?
• Date configuration - Valid From not too far in future?
• Controls and Assets active - Check in Scope tab if controls and assets are active

Plan activation workflow

A plan only starts generating tasks once every part of it is complete.

Activation checklist

For automatic task generation everything must be complete:

• ☐ Basic configuration - Name, frequency, dates filled in
• ☐ Scope defined - Controls or assets selected
• ☐ Scope activated - Controls or assets must themselves also be Active
• ☐ Workflow configured - Task automation set up
• ☐ Preview checked - Timeline matches expectations

Next steps

Now that you can create and configure plans:

• Start with one pilot plan for known compliance cycle
• Configure task workflow for automatic execution
• Monitor first task generation and team reactions
• Optimise scope and timing based on practical experience