# Tidal Control - Complete Documentation > Tidal Control is an EU-based GRC platform that automates compliance for 30+ frameworks including ISO 27001, SOC 2, NIS2, GDPR, and DORA. Source: https://tidalcontrol.com --- --- # Getting started ## Getting Started URL: https://tidalcontrol.com/docs/getting-started How to start using Tidal Control, from activating your account and inviting your team to implementing your first compliance framework from a template. Guidance on how to start using Tidal Control. ### Advanced setup and customisation URL: https://tidalcontrol.com/docs/getting-started/advanced-setup For setups that go beyond the standard templates. Write your own controls and risks, map them to each other and to frameworks, and create one-off manual tasks. This article is for setups that go beyond the standard templates: writing your own controls and risks, mapping them to each other and to frameworks, and creating one-off tasks that no plan generates. If the templates cover you, you do not need any of it. ## When to use advanced setup This article is for users who need to customise their Tidal Control environment beyond the basic templates. Use these instructions when: - **Starting without a template** and need to build your compliance framework from scratch - **Modifying existing templates** to fit specific organisational requirements - **Adding custom controls** not covered in standard frameworks - **Creating manual tasks** for one-off compliance activities ## Creating and managing controls Custom controls cover the requirements your frameworks do not, and they behave like any other control once linked. ### Adding new controls **Create controls that aren't included in standard frameworks:** 1. **Go to Compliance → Controls** 2. **Click "Add control"** in top right ![Add control interface](/images/help/controls_add_control.png) 3. **Fill in control details:** - **Name** - Clear, descriptive name - **Description** - What the control achieves + specific test steps for your organisation ### Linking controls to frameworks Mapping a custom control to a framework requirement is what makes it count towards that framework's progress. **Connect custom controls to compliance frameworks:** 1. **Go to Frameworks section** 2. **Select target framework** (ISO 27001, SOC 2, etc.) 3. **Click "Link control"** for relevant framework section ![Link control to framework](/images/help/frameworks_link_control.png) 4. **Map control to framework requirements** - Select applicable clauses or requirements For detailed framework management, see [Frameworks getting started](../frameworks/getting-started). ### Control implementation tasks Use [Plans](../plans) to automatically create tasks for new controls. You can also add manual tasks: 1. **Open control details page** 2. **Click "Add task"** in tasks section ![Add task to control](/images/help/controls_add_task.png) 3. **Configure task parameters:** - **Task type** - Implementation, review, or testing - **Assignee** - Team member responsible - **Due date** - Implementation deadline - **Priority** - High, medium, or low For comprehensive task management, see [Creating and managing tasks](../tasks/creating-and-managing-tasks). ## Risk management and control mapping Custom risks work the same way, and linking them to controls is what records how each risk is being treated. ### Creating custom risks A custom risk is created the same way as any other, from the Risks page. **Add risks specific to your organisation:** 1. **Go to Organisation → Risks** 2. **Click "Add risk"** in top right ![Add new risk](/images/help/risks_add_risk.png) 3. **Define risk parameters:** - **Name** - Choose a clear, descriptive name for the risk - **Custom ID** - Your own reference number (e.g., "R.IT.01", "R.HR.03") - **Assign owner** - Select the responsible person from the dropdown - **Description** - Explain what this risk entails and why it's relevant ### Linking controls to risks Link a risk to the controls that mitigate it from the control's own Risks tab. **Connect risks to mitigation controls:** 1. **Open control details page** 2. **Click on "Risks"** 3. **Search or select** relevant risks For comprehensive risk management, see [Creating and editing risks](../risks/creating-and-editing-risks). ## Creating tasks and automating with plans **Beyond standard control implementation, you often need specific one-off tasks.** Think of audits, external assessments, or organisational changes that don't fit into regular compliance cycles. Tidal offers flexible options for both manual task creation and automated batch creation via plans. ### Creating a task 1. **Go to the Tasks page** via the main menu 2. **Click "Add task"** in the top right of the overview 3. **The creation form opens** where you can fill in task information ![Create new task](/images/help/tasks_add_task.png) ### Filling in task information Only the name and type are required; everything else can be filled in later. **Required fields:** - **Name** - Choose a clear, descriptive name for the work - For example: "Conduct management review" or "Test backup procedure" - **Task Type** - Select Execution or Assessment **Optional but recommended fields:** - **Assign owner** - Assign responsible person - **Description** - Extended context and instructions ### Automatically creating tasks 1. **Go to Organisation → Plans** 2. **Click "Add plan"** to create new plan ![Create new plan](/images/help/plans_add_plan.png) 3. **Configure plan settings:** - **Plan name** - Descriptive identifier - **Scope** - Select specific assets or controls - **Execution schedule** - Set to next hour for immediate execution 4. **Set execution date:** - **Creation date** - Set to next hour or another future date - **Due date** - Leave empty or set to a date after the creation date **Tidal automatically creates tasks** when the execution time arrives. Monitor progress in the Tasks section. You can also use the Plans functionality to create a one-off Plan that creates tasks in one go for a selection of controls and/or assets. In this case, set the Creation date to next hour, and set the 'Valid to' date of the Plan to tomorrow. The Plan will then run once and deactivate itself afterwards. For comprehensive plan management, see [Creating and configuring plans](../plans/creating-and-configuring-plans). ## Asset and policy integration Your custom controls and risks still need to be attached to the assets and policies they apply to. ### Connecting custom elements **Link your custom controls and risks to existing assets:** 1. **Go to control or risk details** 2. **Navigate to "Assets" tab** 3. **Select relevant organisational assets** - Systems, processes, or data that the control protects **For policy connections:** - **Controls link to policies** via tests and evidence requirements - **Use policy management** to create supporting documentation For detailed policy management, see [Creating and editing policies](../policies/creating-and-editing-policies). ## Testing and validation Before relying on a custom setup, confirm each part of it does what you expect. **Ensure your custom setup works effectively:** 1. **Test control implementations** - Verify controls achieve intended outcomes 2. **Validate risk assessments** - Confirm risk levels reflect actual organisational exposure 3. **Monitor task completion** - Track progress on manual and generated tasks 4. **Review framework compliance** - Check that custom controls meet framework requirements For comprehensive testing approaches, see [Executing and monitoring tests](../tests/executing-and-monitoring-tests). ### Setting up Tidal Control URL: https://tidalcontrol.com/docs/getting-started/initial-setup Setting up Tidal Control takes three things. Activate your own account, create and invite the rest of your team with roles, and decide whether you need SSO. Setting up Tidal Control takes three things: activating your own account, creating and inviting the rest of your team, and deciding whether you need SSO or integrations. Data import is available if you already track compliance elsewhere. ## Account activation and first login Your invitation email carries the activation link. After activating, take a moment to get oriented in the main navigation. ### Account activation You have received an invitation email with instructions for account activation. This email contains: - **Account activation link** - Direct access to Tidal Control - **Organisation URL** - Your specific Tidal environment - **Password setup** - Via Keycloak authentication system **Activation steps:** 1. **Click activation link** in invitation email 2. **Set password** via web interface 3. **Log in** to your organisation Tidal environment 4. **Explore dashboard** for initial orientation > **tip:** Haven't received the email? Check spam folder or contact support@tidalcontrol.com ### Interface orientation The main menu splits into three areas: your own dashboard, day-to-day compliance work, and organisation-wide setup. **Understanding main navigation:** - **Dashboard** - Personal dashboard with assigned tasks - **Compliance section** - Frameworks, Controls, Tasks, Tests - **Organisation section** - Plans, Risks, Vendors, Assets, Policies - **Settings** - Integrations, organisation profile, system configuration ## Giving your team access (for Super Users) If you are a Super User, set your team up before starting compliance work. Everyone who works at your organisation belongs in **Personnel**, and a login is a field on their record rather than a separate list. ### Adding team members 1. **Go to Personnel** from the main menu and open the **People** tab. 2. **Click "Add person"** at the top right. 3. **Fill in** their first name, last name and email address. 4. **Set "Portal access"** to the role they need, or leave it on **No login**. 5. **Click "Add"**. Picking a role creates the account and emails an invitation. Leaving the field on No login registers the person without one, which is all most staff need until you assign them policies. ### Choosing a role - **Basic User** - Reads and accepts the policies assigned to them - **Read Only User** - View access only, no execution rights - **Regular User** - Standard compliance staff - **Super User** - Administrators with full access You can change someone's role later from the same field. See [Portal access](/docs/personnel/portal-access) for invitations, password resets, and how to revoke a login. ### Strict Mode considerations Organisations in Strict Mode have **granular access control** per compliance object: - **Regular Users** only see assigned objects - **Object-level roles** required (Viewer, Contributor, Owner) - **Explicit assignment** needed for controls, assets, risks For complete Strict Mode configuration, see [Strict Mode and granular access control](/docs/personnel/strict-mode-and-granular-access-control). ## Data import support If you already track compliance elsewhere, Tidal Support can import it rather than you retyping it. **Existing compliance data:** Tidal Support can import: - **Existing controls** and policies - **Risk registers** and risk assessments - **Asset inventories** - **User accounts** and their assignments **Import request:** Email support@tidalcontrol.com with: - **Current compliance data** (spreadsheets, documents) - **User list** with roles - **Required frameworks** ## Optional configuration Two things are worth setting up early but are not required to start: single sign-on and your first integrations. ### Single Sign-On (SSO) For organisations with centralised identity management: - Centralised authentication via existing identity providers (Azure AD, Google, Okta) - Automatic user deactivation upon employee departure - Multi-factor authentication via organisational policies SSO setup requires IT administrator access to your identity provider. Configuration can be done in parallel with compliance work. For complete SSO configuration instructions, see [Configuring Single Sign-On (SSO)](/docs/getting-started/sso-setup). ### Integration preparation **External system connections** for automated compliance: - **Cloud platforms** (AWS, Azure, GCP) - **Development tools** (GitHub, GitLab) - **Business applications** (Google Workspace, Jira) **Integration planning:** - **Inventory available systems** - Which tools do you use? - **Prioritise critical systems** - Which have highest compliance impact? - **Plan configuration timing** - After basic compliance setup For complete integrations overview, see [Getting started with Integrations](/docs/integrations/getting-started). ## Setup validation checklist Run through this before moving on to framework implementation. **Before proceeding:** - ☐ **Account activated** and password set - ☐ **Team users created** and invited - ☐ **Roles assigned** according to organisation structure And, where relevant: - ☐ **Strict Mode** configured - ☐ **Data import** prepared and executed - ☐ **Single Sign-On** configured - ☐ **Integrations** configured ## Next steps With basic setup complete you can begin framework implementation: - **Document organisational context** - **Perform risk analysis** and select controls - **Create asset inventory** and perform business impact analysis - **Start control implementation** - **Collaborate in teams** on tasks ### Configuring Single Sign-On (SSO) URL: https://tidalcontrol.com/docs/getting-started/sso-setup Single Sign-On lets people reach Tidal Control with your organisation's existing login over OIDC. Setup for Microsoft Entra ID and other identity providers. Single Sign-On lets people reach Tidal Control with your organisation's existing login, over OIDC. You configure an application in your identity provider, hand the credentials to Tidal, and we complete the connection at our end. This article covers all five supported providers. ## Supported identity providers Tidal Control supports SSO via the OIDC (OpenID Connect) protocol with: - **Microsoft Azure/Entra ID** - For Microsoft 365 organisations - **Google Workspace** - For Google-based organisations - **Okta** - Enterprise identity management platform - **Auth0** - Flexible authentication service - **OneLogin** - Cloud-based identity provider - **Other OIDC providers** - Any system supporting OIDC ## Preparation Before touching your identity provider, collect the redirect details from Tidal and check you have the admin rights to register an application. ### Required information Some of this comes from Tidal, some from your identity provider once you've configured it there. **Needed from Tidal Control:** - **Tenant name** - Found in your login URL: `https://portal.tidalcontrol.com/{TENANT_NAME}/` - **Redirect URI** - Automatically becomes: `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` **Needed from your identity provider (after configuration):** - **Client ID** - Unique identifier for Tidal application - **Client Secret** - Secret key for authentication - **Tenant/Domain ID** - Your organisation identifier (name varies per provider) ### Required permissions You need administrator rights in your identity provider to: - Create new application registrations - Generate client secrets - Assign user groups ## Microsoft Azure/Entra ID In Entra ID you register an application and come away with three values: the tenant ID, the client ID, and a client secret. ### Finding Tenant ID The fastest way is through the Azure Portal itself; the OpenID endpoint works too if you don't have portal access. **Via Azure Portal:** 1. **Log in** to [Azure Portal](https://portal.azure.com) 2. **Navigate** to "Microsoft Entra ID" (formerly Azure Active Directory) 3. **Copy Tenant ID** from overview page **Via OpenID endpoint:** 1. **Open browser** to: `https://login.microsoftonline.com/{YOUR_DOMAIN}/v2.0/.well-known/openid-configuration` 2. **Find "issuer" field** in JSON response - this contains your Tenant ID ### Creating app registration 1. **Go to "App registrations"** in Entra ID menu 2. **Click "New registration"** at top 3. **Configure basic information:** - **Name:** `Tidal Control - SSO` - **Supported account types:** "Accounts in this organizational directory only (Single tenant)" - **Redirect URI:** - Platform: `Web` - URI: `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` 4. **Click "Register"** to create app ### Generating client secret 1. **Open your new app registration** 2. **Copy these values** from overview page: - Application (client) ID - Directory (tenant) ID 3. **Go to "Certificates & secrets"** in left menu 4. **Click "New client secret"** 5. **Configure secret:** - **Description:** `Tidal Control SSO` - **Expires:** Choose expiry date (e.g. 24 months) 6. **Click "Add"** 7. **Copy secret value** immediately (shown only once!) > **warning:** **Important:** Store the client secret securely. You can't retrieve this value later. You'll need to create a new one if you lose it. ### Configuring API permissions (optional) No extra permissions needed for basic SSO. For advanced integration: 1. **Go to "API permissions"** 2. **Click "Add a permission"** 3. **Select "Microsoft Graph"** 4. **Choose "Delegated permissions"** 5. **Select minimum:** - `openid` - For authentication - `profile` - For user data - `email` - For email address ## Google Workspace Google requires a consent screen configured before you can create the OAuth client itself. ### Creating OAuth 2.0 Client 1. **Go to** [Google Cloud Console](https://console.cloud.google.com) 2. **Select project** or create new one 3. **Navigate** to "APIs & Services" → "Credentials" ### Configuring OAuth consent screen 1. **Click "Configure consent screen"** if not done yet 2. **Choose "Internal"** for organisation users only 3. **Fill in app information:** - **App name:** `Tidal Control` - **User support email:** Your support email - **Authorised domains:** `tidalcontrol.com` 4. **Add scopes:** - `openid` - `email` - `profile` 5. **Save and continue** ### Creating Client ID 1. **Click "Create credentials"** → "OAuth client ID" 2. **Configure client:** - **Application type:** `Web application` - **Name:** `Tidal Control SSO` - **Authorised redirect URIs:** `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` 3. **Click "Create"** 4. **Copy credentials:** - Client ID - Client secret ## Okta Okta gives you three values to copy, not two: client ID, client secret, and your Okta domain. ### Adding new application 1. **Log in** to your Okta Admin Console 2. **Go to** "Applications" → "Applications" 3. **Click "Create App Integration"** ### Configuring OIDC 1. **Select integration type:** - **Sign-in method:** `OIDC - OpenID Connect` - **Application type:** `Web Application` 2. **Click "Next"** 3. **Configure application settings:** - **App name:** `Tidal Control` - **Sign-in redirect URIs:** `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` - **Sign-out redirect URIs:** `https://portal.tidalcontrol.com/{TENANT_NAME}/` 4. **Configure assignments:** - **Controlled access:** Choose which groups get access - Or select "Allow everyone in your organisation to access" 5. **Click "Save"** ### Retrieving credentials 1. **Open your new application** 2. **Go to "General" tab** 3. **Copy from "Client Credentials" section:** - Client ID - Client secret 4. **Copy Okta domain** from your account URL (e.g.: `dev-12345.okta.com`) ## Auth0 Auth0 also gives you a domain value, and lets you manage who gets access from the same dashboard. ### Creating application 1. **Log in** to [Auth0 Dashboard](https://manage.auth0.com) 2. **Go to** "Applications" → "Applications" 3. **Click "Create Application"** ### Configuring application 1. **Configure basic settings:** - **Name:** `Tidal Control` - **Application type:** `Regular Web Applications` 2. **Click "Create"** 3. **Go to "Settings" tab** 4. **Configure URLs:** - **Allowed Callback URLs:** `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` - **Allowed Logout URLs:** `https://portal.tidalcontrol.com/{TENANT_NAME}/` - **Allowed Web Origins:** `https://portal.tidalcontrol.com` 5. **Copy credentials:** - Domain (e.g.: `your-tenant.auth0.com`) - Client ID - Client Secret 6. **Click "Save Changes"** ### Assigning users 1. **Go to** "User Management" → "Users" 2. **Add users** who need access 3. **Or configure** "Connections" for automatic user provisioning ## OneLogin OneLogin's setup starts from a pre-built catalogue entry rather than a blank application. ### Adding app from catalogue 1. **Log in** to OneLogin Admin Portal 2. **Go to** "Applications" → "Applications" 3. **Click "Add App"** 4. **Search** "OpenID Connect" in catalogue 5. **Select** "OpenId Connect (OIDC)" app ### Configuring OIDC app 1. **Configure display name:** - **Display Name:** `Tidal Control` - **Click "Save"** 2. **Go to "Configuration" tab** 3. **Fill in redirect URI:** - **Redirect URI:** `https://auth.tidalcontrol.com/realms/{TENANT_NAME}/broker/oidc/endpoint` - **Click "Save"** 4. **Go to "SSO" tab** 5. **Copy credentials:** - Client ID - Client Secret - Issuer URL (use as Domain/Tenant ID) ### Giving users access 1. **Go to "Users" tab** in the app 2. **Click "Add users"** 3. **Select users** or groups 4. **Click "Save"** ## Sending configuration to Tidal Tidal completes the connection at our end, so the last step is handing over the credentials securely and waiting for activation. ### Securely sharing credentials After configuration in your identity provider, send the following information **securely** to Tidal Control: **Collect this information:** ``` Identity Provider: [Azure/Google/Okta/Auth0/OneLogin] Tenant/Domain: [Your organisation domain/tenant ID] Client ID: [Application/Client ID] Client Secret: [Secret key] ``` **Secure sending methods:** - **Encrypted ZIP file** with password (send password separately) - **Password manager** with secure sharing function (1Password, Bitwarden) - **Secure messaging service** (Signal, encrypted email) - **Temporary secret sharing** service (e.g. PrivateBin with expiry) > **danger:** **Never do:** - Send client secrets via ordinary email - Place credentials in chat applications - Take screenshots of secrets - Store secrets in tickets or documentation ### Contact Tidal Support **Email to:** support@tidalcontrol.com **Subject:** SSO Configuration for [TENANT_NAME] **Email content:** ``` Dear Tidal Support, We would like to activate SSO for our Tidal environment. Tenant name: [TENANT_NAME] Identity Provider: [PROVIDER_NAME] I'll send the configuration details via [METHOD]. Kind regards, [Name] ``` ### Activation timeline Tidal configures the connection within one working day, then you test it before it goes live for everyone. **After receiving credentials:** 1. **Tidal configures** SSO connection (within 1 working day) 2. **Test account** is created for verification 3. **You test the connection** with test user 4. **After successful test** SSO is activated for all users 5. **Existing users** can log in with SSO ## Using SSO after activation Once SSO is live, users sign in through your identity provider instead of with a Tidal password. ### First time logging in A new user's account is created automatically the first time they sign in through SSO. **For new users:** 1. **Go to** `https://portal.tidalcontrol.com/{TENANT_NAME}/` 2. **Click "Sign in with SSO"** button 3. **Log in** with your organisation account 4. **Account is automatically created** in Tidal **For existing users:** 1. **Use same email** as in Tidal account 2. **SSO automatically links** to existing account 3. **Access rights remain preserved** ## Multi-factor authentication (MFA) With SSO in place, configure MFA in your identity provider rather than in Tidal, so one policy covers every application. ### MFA via identity provider **Best practice:** Configure MFA in your identity provider, not in Tidal: - **Central MFA policy** for all applications - **Conditional access** based on location/device - **Compliance reporting** from one system **MFA configuration per provider:** - **Azure:** Conditional Access Policies - **Google:** 2-Step Verification enforcement - **Okta:** Authentication Policies - **Auth0:** Multi-factor Authentication rules - **OneLogin:** Authentication Factors policies ## User synchronisation (optional) SSO handles authentication but not account creation. SCIM provisioning is what keeps the user list in step automatically. ### Automatic provisioning For large organisations, automatic user synchronisation via SCIM: - **Automatically create** new users - **Role assignment** based on groups - **Deactivation** when employee leaves **SCIM support** varies per provider: - Azure/Entra ID ✅ - Okta ✅ - OneLogin ✅ - Google Workspace ⚠️ (via third-party) - Auth0 ⚠️ (custom implementation) Contact support@tidalcontrol.com for SCIM configuration. ## Why use SSO? Single Sign-On offers important advantages for compliance organisations: - **Central access control** - Manage all user access from one system - **Automatic deactivation** - When employees leave, access is revoked everywhere - **User convenience** - Teams don't need to remember separate password for Tidal - **Enforce security policies** - Multi-factor authentication (MFA) and password policy via your identity provider ## Troubleshooting Three failures account for nearly every SSO problem: a redirect loop, an access-denied after a successful login, and an expired client secret. ### Login redirect loop **Symptoms:** Browser keeps redirecting between Tidal and identity provider **Solutions:** 1. **Check redirect URI** - Must match exactly 2. **Clear browser cookies** for both domains 3. **Test incognito/private** browsing mode 4. **Verify tenant name** in URI configuration ### "Access Denied" after successful authentication This almost always means the user or their group isn't actually assigned to the application in your identity provider. **Possible causes:** - User not assigned to application in identity provider - Group membership not correctly configured - Email address doesn't match Tidal account **Verification steps:** 1. **Check user assignment** in identity provider 2. **Compare email addresses** between systems 3. **Test with new test user** ### Client secret expired **Symptoms:** SSO suddenly stops working for all users **Solution:** 1. **Generate new secret** in identity provider 2. **Send to Tidal Support** via secure method 3. **Temporary workaround:** Users can request password reset For further support, email support@tidalcontrol.com with: - Tenant name - Identity provider type - Exact error message - Browser console errors (F12) ### Implementing a framework with a template URL: https://tidalcontrol.com/docs/getting-started/starting-with-a-template Your environment arrives with a complete framework template already set up, so implementing it means working through the four PDCA phases, not building one. Your environment arrives with a complete framework template already set up, so implementing it is a matter of working through the four PDCA phases rather than building anything from scratch. This article walks through all four in order. ## Starting with a template This article describes the implementation of a compliance framework when you **start with a prepared template**. Your Tidal Control environment has already been set up with all required elements for the chosen framework. Did you start without a template or want to add a new framework? See the article [Initialising framework without template](../getting-started/advanced-setup). ## Framework ready for use Your environment already contains a complete framework template, so the first step is reviewing what is there rather than building it. ### Prepared framework template **Your Tidal Control environment is set up with a complete framework template:** - **Controls** are prepared and linked to the chosen framework - **Risks** are identified and already linked to relevant controls - **Implementation tasks** are automatically generated per control - **Policy templates** are available and linked to controls via tests - **Framework connections** between all elements are already established **All building blocks are present and connected - you can start implementation immediately.** ### Getting started 1. **Go to Frameworks section** 2. **Select desired framework** (e.g. ISO 27001) 3. **Framework shows implementation status** and controls to implement 4. **Begin with first implementation steps:** ![Framework overview with implementation status](/images/help/frameworks_overview.png) For more information about frameworks, see [Frameworks getting started](../frameworks/getting-started). ## PDCA implementation cycle PDCA (Plan-Do-Check-Act) is a proven methodology for systematic compliance implementation. This cyclical approach ensures structural improvement and sustainable compliance: - Plan - Strategic planning, risk analysis and scope determination - Do - Execution of controls and policy implementation - Check - Monitoring, testing and validation of effectiveness - Act - Improvement actions and optimisation for next cycle By executing this cycle you create a working information security management system (ISMS). The cycle then repeats annually for continuous improvement of your compliance posture. > **tip:** The Controls overview page contains a 'Phase' filter where you can filter on the Plan-Do-Check-Act phase. ![Controls overview](/images/help/controls_overview.png) Begin your implementation with the Controls in the Plan phase. For more information about controls, see [Controls getting started](../controls/getting-started). ## Plan phase In the Plan phase you lay the foundations for your Information Security Management System (ISMS). Because you're starting with a prepared template, most risks and controls are already identified and linked. In this phase you'll personalise this setup to your own organisation. **Your focus is on:** - **Contextualising** predefined elements to your organisation - **Validating** whether template risks and controls are relevant for your situation - **Adjusting** scope and priorities where needed - **Preparing** the implementation team and resources The following steps help you move from a generic template to an organisation-specific implementation plan. ### Step 1: Fill in business profile and conduct context analysis This step answers the following questions: - **Organisation description** - What does your business do, which products and services? - **Business environment** - Which people, technologies, locations and processes are needed for this? - **Stakeholder mapping** - Who are important parties (customers, suppliers, regulators) and what do they expect from you regarding information security? - **Threat identification** - Which information security risks threaten these interests? How to execute: 1. **Go to Policies section** 2. **Find and select 'Context of the organisation'** from the policies list. ![Policy overview](/images/help/policy_overview.png) 3. **Select 'Edit' top right of the screen** to fill in the form 4. **Complete the document** according to instructions in the yellow box 5. **Select 'Update'** to save the form (interim) 6. **Select 'Approve'** to approve the form and complete this task. ### Step 2: Inventory external requirements This step answers the following questions: - **Laws and regulations** - Which legal obligations apply to your organisation? - **Standards** - Which industry-specific standards are applicable? - **Contractual obligations** - Which information security requirements do customers place on your organisation? How to execute: 1. **Go to Policies section** 2. **Find and select 'Register of legal, statutory, regulatory, and contractual requirements'** from the policies list 3. **Select 'Edit' top right of the screen** to fill in the form 4. **Review the first block** - Review the predefined list of laws and regulations and mark what applies to your organisation 5. **Complete the second block** - Add industry-specific standards relevant to your sector 6. **Document the third block** - Inventory information security requirements from customer contracts and agreements 7. **Select 'Update'** to save the form (interim) 8. **Select 'Approve'** to approve the document and complete this task ### Step 3: Create asset inventory and classify assets This step answers the following questions: - **Asset identification** - Which systems, data and processes are critical for your organisation? - **Asset ownership** - Who is responsible for each asset? - **Classification levels** - What is the security value per asset? - **Business impact** - What happens with loss of availability, integrity or confidentiality? How to execute: 1. **Go to Assets section** 2. **Click "Add asset"** to add new assets ![Add asset](/images/help/assets_add_asset.png) 3. **For each asset you fill in:** - **Asset name** and description - **Asset type** (e.g. System, Data, Process) - **Owner** - Assign a responsible person - **Classification** - Determine security level (Low, Medium, High) 4. **Repeat this process** for all critical assets 5. **Review the complete list** - Are all essential assets included? For more information about asset management, see [Assets getting started](../assets/getting-started). ### Step 4: Conduct risk analysis This step answers the following questions: - **Relevant risks** - What are the risks to information security? - **Risk levels** - What is the likelihood that risks materialise, and how high is the impact for the organisation if they lead to damage? - **Risk treatment strategy** - Do we accept these risks, or will we do something about them (reduce, transfer, or avoid)? How to execute: 1. **Go to Risks section** 2. **Open predefined risks** from framework 3. **Assess each risk** against your business context: ![Risk assessment](/images/help/risks_assessment.png) For more information about risk management, see [Risks](../risks). - **Likelihood** - How likely is the risk to occur? - **Impact** - What is business impact when occurring? - **Risk level** is automatically calculated - **Risk treatment** Select a treatment option - If 'reduce': Review relevant controls to reduce this risk - **Residual risk level** determine residual risk after implementing treatment option 4. **Add organisation-specific risks** if needed 5. **(optional) Link risks to specific Assets** if desired ### Step 5: Finalise and document scope This step answers the following questions: - **Scope of assets:** processes, locations, and business units - **Scope of controls** - Which controls are or aren't relevant for identified risks? - **Justification** document this for audit purposes How to execute: **First we'll finalise the Controls scope:** 1. **Go to Controls section** 2. **Click 'More filters'** at top of screen 3. **Click 'Risks'** filter 4. **Select 'No risk assigned'** in dropdown ![Controls overview](/images/help/controls_overview.png) 5. **Review the Controls in this list:** - **Link risks** to Controls you deem necessary for information security - **Consider archiving** all controls where after evaluation still no risk is linked ISO 27001 requires that all controls (in scope and out of scope) contain justification. Tidal uses the following strategy: - **In Scope:** Justification follows from linking with one or more risks. - **Out of Scope:** Justification follows from absence of risk linking, but must also be specifically documented in 'Statement of applicability', found in the Policies section. **Now we'll finalise the Statement of applicability:** 1. **Go to Policies section** 2. **Find and select 'Statement of applicability'** from the policies list 3. **Select 'Edit' top right of screen** 4. **Review the document** - It's already largely completed based on your template 5. **Mark out-of-scope controls:** - **Identify controls** not applicable to your organisation - **Add justification** - Document why each control isn't relevant - **Mark as 'Not Applicable'** in document 6. **Verification step** - Check if out-of-scope list matches archived controls in Tidal: - Open second tab with **Controls section** - Filter on **Archived** controls - Compare both lists for consistency 7. **Select 'Update'** to save changes 8. **Select 'Approve'** to approve document **Finally we'll finalise formal scope documentation:** 1. **Go to Policies section** 2. **Find and select 'Scope of the ISMS'** from the policies list 3. **Select 'Edit' top right of screen** to fill in the form 4. **Document the following elements:** - **Processes** - Which business processes fall within scope? - **Locations** - Which sites and offices are included? - **Assets** - Which systems and assets are part of the ISMS? - **Organisation units** - Which departments and business units fall within scope? 5. **Select 'Update'** to save form 6. **Select 'Approve'** to approve document ### Step 6: Approve Information security policy This step answers the following question: - **Organisation commitment** - How does the organisation show its commitment to information security and the ISMS? The Information security policy forms the basis of your ISMS and shows management commitment to information security. This policy must be approved by senior management. How to execute: 1. **Go to Policies section** 2. **Find and select 'Information security policy'** from the policies list 3. **Select 'Edit' top right of screen** to fill in the form 4. **Review and adapt policy template:** - **Check organisation details** - Name, sector, and business activities - **Validate scope reference** - Does reference to your ISMS scope match? - **Review commitment statements** - Do these fit your organisation culture? - **Adapt where needed** - Make policy organisation-specific 5. **Select 'Update'** to save form 6. **Select 'Approve'** to approve policy and complete this step The Information security policy must be formally approved by senior management (CEO, directors). Ensure the right person approves the document in Tidal. ### Step 7: Assign roles and finalise objectives This step answers the following questions: - **Who is responsible for what** - Which people fulfil key ISMS roles? - **What do we want to achieve** - Which concrete objectives does the organisation have for this PDCA cycle? - **How do we measure success** - By which criteria can we measure progress? **Fill in Roles and responsibilities:** 1. **Go to Policies section** 2. **Find and select 'Roles and responsibilities'** from the policies list 3. **Select 'Edit' top right of screen** 4. **Fill in ISMS roles table:** - **CISO/ISO** - Assign Information Security Officer - **DPO** - Appoint Data Protection Officer (if applicable) - **Other roles** - Fill in additional functions according to your organisation 5. **Select 'Update'** to save form 6. **Select 'Approve'** to approve document **Review Information Security Objectives:** 1. **Go to Policies section** 2. **Find and select 'Information security objectives'** from the policies list 3. **Select 'Edit' top right of screen** 4. **For first PDCA cycle:** - **Review predefined objectives** - These are already filled in for the first cycle - **Adapt where needed** - Make goals specific for your organisation context - **Expertise gaps** - If additional training is needed for team members, add those as objectives here too - **Validate objectives are SMART** - Check success criteria, responsible persons, and timelines are concrete and realistic 5. **Select 'Update'** to save form 6. **Select 'Approve'** to approve document For second and subsequent PDCA cycles you start with an empty template. Objectives are then determined based on: - Action points from previous cycle - Findings from management reviews - Lessons learned from Check and Act phases **Assign tasks to team:** 1. **Go to Tasks section** ![Tasks overview](/images/help/tasks_overview.png) 2. **Filter on framework** tasks to show only relevant tasks 3. **Select tasks** requiring manual execution 4. **Assign owners** via "Assign" dropdown per task 5. **Team receives notifications** and can start execution 6. **Monitor progress** via task status updates For more information about task management, see [Tasks](../tasks) ## Do phase In the Do phase you actually execute the planned controls. Because you start with a template, implementation tasks are already prepared and linked to controls. Your focus is on execution and documentation. ### Configure and monitor automatic testing Connect the systems you actually run so their compliance tests can start reporting real data. **Automate technical controls:** 1. **Identify relevant systems** - AWS, Azure, Google Cloud, GitHub, etc. 2. **Go to Integrations section** ![Integrations overview](/images/help/integrations_overview.png) 3. **Configure integrations** for automated compliance tests 4. **Test connections** - Check data is retrieved correctly 5. **Monitor test results** - Review pass/fail status for technical controls 6. **Address failures** - Resolve technical issues where tests fail For detailed integration setup, see [Integrations getting started](../integrations/getting-started). **Interpret test results:** 1. **Go to Tests section** ![Tests overview](/images/help/tests_overview.png) 2. **Review framework-related tests** 3. **Analyse Pass/Fail trends** 4. **Identify improvement points** from Failed tests 5. **Plan improvement actions** for tests that can't be resolved immediately For test management, see [Tests getting started](../tests/getting-started). ### Adopt remaining policies Work through the policies still sitting at Not started or Draft and adapt each template to your own context. **Adapt remaining policy templates:** 1. **Go to Policies section** 2. **Filter on 'Not started' and 'Draft' status** to show unfinished policies 3. **For each policy:** - **Open and review** template content - **Adapt to organisation context** - Make it specific for your situation - **Fill in placeholders** - Replace generic text with organisation details - **Submit for approval** via "Request Approval" 4. **Monitor approval workflow** - Track status and address feedback 5. **Communicate approved policies** to relevant teams For more information about policy management, see [Policies getting started](../policies/getting-started). ### Execute manual tasks Your personal task list already exists; work through it, following each task's own instructions. **Complete your own control implementation tasks:** 1. **Go to My Tasks section** - this is already filtered to your personal tasks 2. **For each task:** - **Review implementation instructions** in task description - **Execute required actions** according to guidance - **Upload evidence** - Documents, screenshots, or certificates - **Document implementation details** via task comments - **Update status to 'Completed'** when finished 3. **Validate:** no tasks remain open in My Tasks **Monitor team progress:** 1. **Go to Tasks page** - To check status of tasks assigned to others 2. **Monitor blocked tasks approaching deadline** - Help team members with obstacles 3. **Go to Dashboard page** - For total overview of outstanding work in Tidal For more information about dashboard and overviews, see [Tidal Control documentation](../). ## Check phase In the Check phase you validate effectiveness of implemented controls and prepare for formal reviews. You check all controls are executed correctly and document findings for management. ### Control status monitoring Filter the Controls overview for anything not green and resolve those first. **Get all controls to green:** 1. **Go to Controls section** ![Controls overview](/images/help/controls_overview.png) 2. **Review control status overview** - Use dashboard for total overview 3. **Filter on 'Ineffective' status** to identify problematic controls 4. **For each control not showing green:** - **Open control details** - Analyse why status isn't OK - **Check linked tasks** - Are all implementation tasks completed? - **Validate evidence** - Is documentation complete and current? - **Address issues** - Resolve missing elements 5. **Validate all controls show 'Effective' (green)** A control can only get Effective status (green) when all linked tasks are completed. ### Validate Tidal quality tests Filter the Tests overview for Tidal-integration failures and work through them one by one. **Run through quality checks:** 1. **Go to Tests section** ![Tests overview](/images/help/tests_overview.png) 2. **Filter on integration 'Tidal' and status 'Failed'** to show failed quality tests 3. **For each failed test:** - **Review test description** - Understand what's being checked - **Analyse why test fails** - What's not compliant? - **Correct underlying data** - Fix issues in risk analyses, asset assessments, etc. - **Re-run test** - Check test now passes 4. **Validate all Tidal tests have 'Passed' status** Common problems in Tidal: - **Incomplete risk assessments** - Risks without likelihood/impact scores or risk acceptance criteria not filled in - **Missing asset owners** - Assets without assigned owner - **Policy gaps** - Policies in draft status or not approved ### Conduct internal audit The Internal audit programme policy sets out the process; check its prerequisites are met before you start. **Internal audit preparation:** 1. **Go to Policies section** 2. **Find and open 'Internal audit programme'** - Review audit process description 3. **Check all prerequisites are met:** - All controls have OK status - All Tidal tests are passed - Policy documentation is complete and approved **Audit execution:** 1. **Plan internal audit** - Usually conducted by Tidal consultant 2. **Follow Internal audit programme** - According to standardised methodology 3. **Document findings** - Use Tidal reporting template 4. **Respond to audit findings** - Management fills in their initial response to report in reporting template 5. **Upload reporting and close corresponding assessment task in Tidal** to complete process For more information about internal audits, see [Tidal Control documentation](../). ### Conduct management review Bring senior management the findings, turn decisions into action plans, and close the task once minutes are uploaded. **Management review execution:** 1. **Plan management review meeting** - Invite senior management 2. **Present findings** - Use 'Management review' template as agenda 3. **Create action plans** - And document these in meeting minutes 4. **Upload minutes and close corresponding task in Tidal** to complete process For more information about management reviews, see [Tidal Control documentation](../). ## Act phase In the Act phase you convert findings from Check phase into concrete improvement actions and set up the system for continuous monitoring. You document action points as Issues and configure recurring processes via Plans. ### Create issues for findings and actions Every finding from the audit and the review becomes its own issue, so it gets tracked and assigned. **Record management action points:** 1. **Go to Issues section** 2. **Click 'Add issue'** to create new action points ![Add issues](/images/help/issues_add_issue.png) 3. **For each finding from internal audit and management review:** - **Issue title** - Short, clear description of action point - **Description** - Detailed explanation of finding and desired action - **Assign owner** - Assign owner (usually management or process owner) - **Due date** - Set realistic deadline - **Priority** - Determine urgency (High/Medium/Low) - **Link to framework** - Link to relevant framework if applicable 4. **Monitor progress** - Track status of issued action points 5. **Update status** - Mark issues as 'Resolved' when completed For more information about issue management, see [Issues](../issues). ### Validate and adjust plans Because you started from a template, the essential Plans already exist; you only need to check and adjust them. **Review preconfigured Plans:** Because you start with a template, essential Plans are already created and configured. You only need to validate settings and adjust where needed. 1. **Go to Plans section** ![Plans overview](/images/help/plans_overview.png) 2. **For each Plan:** - **Open Plan details** - Click Plan name - **Check 'Creation Date'** - Is start date for task generation correct? - **Validate 'Due Date'** - Are deadlines realistic for your organisation? - **Check linked Controls** - Are correct controls in Plan? - **Redistribute between Plans** - Move controls to correct Plan if needed 3. **Activate Plans** - Ensure all Plans have 'Active' status 4. **Review task generation** - Check next tasks are created correctly For detailed Plans configuration, see [Plans](../plans). ### Implement continuous improvement Closing the cycle means confirming issues were picked up, plans still work, and lessons are documented for the next round. **Prepare next PDCA cycle:** 1. **Review all Issues** - Ensure action points are picked up 2. **Validate Plans** - Check automation works correctly 3. **Document lessons learned** - Record experiences for next cycle 4. **Prepare next cycle** - Planning for next PDCA iteration **Success indicators:** - **All Issues have owners** and realistic deadlines - **Plans are active** and generate tasks according to schedule - **Team is trained** on new processes and tools - **Framework is operational** and delivers continuous compliance value You now have a fully operational compliance framework with automated monitoring that delivers continuous value to your organisation. --- # Assets ## Assets URL: https://tidalcontrol.com/docs/assets Register the hardware, software, data and locations you want to protect, assess their impact, and link them to the risks and controls that cover them. ### Performing asset assessments URL: https://tidalcontrol.com/docs/assets/assessing-assets Score an asset on confidentiality, integrity and availability with a business impact analysis, then set RTO and RPO. Tidal turns that into an impact rating. An asset assessment scores one asset on confidentiality, integrity, and availability, and optionally records how fast it must be back after an outage. Tidal turns those scores into the asset's impact rating, which then drives its risk assessments and the controls you apply to it. ## Opening asset assessment You fill the assessment in on the asset itself, in the **Assessment** tab. ### Navigating to the assessment 1. **Go to the Assets page** via the main menu 2. **Click on an asset** to open the details 3. **Select the "Assessment" tab** 4. **Fill in the CIA-triad** and the rating will be automatically set 5. **Optionally also fill in recovery metrics** to make these requirements known ![Performing an asset assessment](/images/help/assets_assessment.png) ### What you see in the Assessment tab The Assessment screen shows: - **Impact categories** - CIA-triad assessments (Confidentiality, Integrity, Availability) - **Overall impact assessment** - Automatically calculated based on highest individual score - **Recovery metrics** - RTO, RPO, MAO and MASL settings ## Business Impact Analysis (CIA-triad) Score the asset on each of the three criteria in turn. Tidal takes the highest of the three as the asset's overall impact. ### Assessing Confidentiality Evaluate how sensitive the information is that this asset contains or processes: **1. Public** - Information that can be freely shared - *For example: company website, public documents* **2. Internal** - Internal information without major consequences if leaked - *For example: meeting notes, general procedures* **3. Confidential** - Sensitive business information with possible competitive advantage - *For example: strategic plans, customer data* **4. Strictly confidential** - Very sensitive information with serious consequences if leaked - *For example: personal data, financial data, legal documents* ### Assessing Integrity Determine how important accuracy and completeness of the data is: **1. Negligible** - Small errors have no business impact - *For example: decorative website elements* **2. Low** - Errors cause minor inconveniences - *For example: newsletter template, internal wiki* **3. Moderate** - Errors lead to operational problems - *For example: inventory system, customer service tools* **4. High** - Errors have serious consequences for business operations - *For example: financial administration, production database* ### Assessing Availability Assess how critical it is that the asset remains available: **1. Negligible** - Outage has no direct business impact - *For example: archive system, old reports* **2. Low** - Temporary outage is acceptable - *For example: HR portal, internal tools* **3. Moderate** - Outage disrupts business processes - *For example: email system, office applications* **4. High** - Outage stops critical business activities - *For example: production systems, payment processing* > **info:** **Overall impact assessment**: Tidal automatically calculates the total impact based on the **highest individual assessment**. If Confidentiality = 2, Integrity = 4, and Availability = 3, then the overall impact = 4. ## Setting recovery metrics Four optional metrics record how fast the asset must be back and how much data loss is acceptable: RTO, RPO, MAO, and MASL. Fill these in only for assets that genuinely need high availability. ### Recovery Time Objective (RTO) **What is RTO?** RTO defines how quickly a system must be technically recovered after an incident. **Setting via dropdown:** - **30 minutes** - For critical real-time systems - **3 hours** - For important business systems - **18 hours** - For daily operational tools - **3 days** - For weekly or monthly processes - **5 days or more** - For non-critical systems > **tip:** **Setting realistic RTO**: Choose an RTO that is technically feasible with your current infrastructure and budget. Too ambitious objectives lead to wrong expectations. ### Recovery Point Objective (RPO) **What is RPO?** RPO specifies how much data loss is acceptable during an incident. **Practical choices:** - **1 hour or less** - For information that cannot be lost - **1 day** - Acceptable for most business data - **1 week** - For data that doesn't change often - **1 month** - For less critical information that changes infrequently - **2 months or more** - For archive or backup data ### Maximum Acceptable Outage (MAO) **What is MAO?** MAO indicates the maximum time that a business process can function without this asset. **Business perspective:** - **1 hour** - Business stops immediately upon outage - **5 hours** - Short period with manual workarounds - **1 day** - One workday bridgeable - **5 days** - Temporary outage doesn't lead to major problems - **1 week or more** - Longer period without major problems > **warning:** **MAO vs RTO difference**: MAO is how long the business can survive, RTO is how long technical recovery takes. MAO must always be greater than RTO to remain realistic. ### Minimum Acceptable Service Level (MASL) **What is MASL?** MASL specifies the required uptime percentage for normal business functioning. **Availability levels:** - **100.00%** - Must always be available - **99.99%** - About 1 hour outage per year - **99.90%** - About 10 hours outage per year - **99.00%** - About 8 hours outage per month - **< 98%** - More than 16 hours outage per month ## Completing the assessment Saving updates the asset's impact level immediately. Come back to the assessment whenever the asset changes materially, and at least once a year. ### Saving the assessment 1. **Fill in the CIA scores** - The rating updates directly 2. **Check your settings** - Ensure RTO < MAO and other logic is correct 3. **Click "Update"** to save your assessment 4. **Status is updated** - Asset now shows the correct impact level ### Reviewing the assessment An incident or a compliance audit is as good a reason to revisit the scores as the calendar is. **When to review:** - During major changes to the asset (functionality, users, criticality) - Annually as part of risk assessment cycle - After incidents that provide new insights - During compliance audits or reviews **Review process:** 1. **Open the Assessment tab** of the asset 2. **Check current scores** against actual business situation 3. **Adjust scores** where necessary 4. **Update recovery metrics** based on new infrastructure/processes 5. **Save changes** and document reasons for adjustments > **info:** **Recovery metrics often not applicable**: Recovery metrics only need to be filled in for business resources that require a high degree of availability. ## Best practices for asset assessments Two things make assessments hold up over time: scoring comparable assets the same way, and setting objectives you can actually meet. ### Ensuring consistency Comparing similar assets and applying the same criteria is what keeps scores meaningful across the register. **Use comparable assets as benchmark:** - Compare similar systems within your organisation - Apply consistent criteria for impact levels - Document your considerations for future reference **Involve the right stakeholders:** - **Asset owners** - Know daily usage and business impact - **IT teams** - Understand technical recovery capabilities - **Business owners** - Can assess business continuity ### Realistic objectives Not every asset needs 99.99% uptime. Match the objective to what the asset actually is, then verify it's achievable. **Balance ambition with feasibility:** - Not all assets need 99.99% uptime - Higher availability means higher costs - Focus first on the most critical assets **Test your assumptions:** - Perform disaster recovery tests to validate RTOs - Check backup procedures for RPO realization - Measure actual recovery times during incidents > **tip:** **Start simple**: Begin with rough assessments for all assets, then refine the most critical ones later. A global assessment is better than no assessment. ## Why asset assessments are important Beyond the impact rating itself, a completed assessment helps you to: - **Identify and prioritise** critical business resources - **Better assess risks** based on actual impact - **Establish recovery plans** with realistic objectives - **Demonstrate compliance** for frameworks like ISO 27001 and SOC 2 - **Support budget decisions** with objective data > **tip:** Perform assessments for all assets that are important to your business operations. Start with the assets that most people and processes depend on. ## Next steps After completing asset assessments you can: - **Perform risk assessments** based on this impact data - **Improve continuity plans** with realistic recovery time objectives - **Implement control measures** proportional to asset criticality - **Generate compliance reports** with accurate impact classifications ### Creating and managing assets URL: https://tidalcontrol.com/docs/assets/creating-and-managing-assets Add an asset, fill in its details, roles and information types, link it to the controls, plans and risks that apply, and archive it when it goes out of use. This article covers the full life of an asset record: creating it, filling in its details and roles, linking it to the controls, plans, and risks that apply, and archiving it when it goes out of use. ## Adding assets Add an asset from the Assets page. Common systems are available from a predefined list that fills in the description for you. ### Starting to add an asset 1. **Go to the Assets page** via the main menu 2. **Click "Add asset"** at the top right of the overview 3. **The add form opens** where you can fill in asset information ![Add asset](/images/help/assets_add_asset.png) ### Filling in asset information - **Asset name** - Choose a clear, recognisable name - **Custom ID** - Your own reference number (useful for linking with other systems) - **Asset owner** - Select the responsible person from the dropdown - **Description** - Explain what this asset does and why it's important > **tip:** **Choosing clear names**: Use names that everyone in your organisation understands. Instead of "SRV-01" use "Microsoft 365 Email Server" or "Customer Database Production". ### Using the predefined list For common assets, Tidal offers a predefined list: **Searching the list:** 1. **Type in the search field** of the add form 2. **Suggestions appear automatically** based on your input 3. **Select a suggestion** to automatically fill in relevant information **Benefits of predefined assets:** For these assets, the **description** field is already filled with useful information needed for assessing this vendor > **info:** Work is being done on a separate Vendors module with built-in vendor assessment. Once this is introduced, information from predefined vendors will already be filled in advance. **Commonly used predefined assets:** - **SaaS solutions** - Microsoft 365, Google Workspace, Slack, Zoom - **Cloud platforms** - AWS, Azure, Google Cloud - **Security tools** - Antivirus, firewalls, backup systems - **Business software** - CRM, ERP, HR systems > **tip:** **Not found in the list?** No problem! You can add the asset to your list by pressing 'enter'. ### Saving the asset 1. **Check all filled information** 2. **Click "Create"** to create the asset 3. **The new asset appears** in your overview 4. **The impact rating is still empty** - see [Performing asset assessments](/docs/assets/assessing-assets) ## Editing and managing asset information Everything after creation happens in the asset's **Details** tab: its basic fields, the information types it holds, its attributes, the three roles, and archiving. ### Opening asset details 1. **Click on an asset name** in the overview 2. **Select the "Details" tab** 3. **Here you see all asset information** and editing options ![Asset details view](/images/help/assets_details_page.png) ### Editing basic information Click any field to edit it directly, then confirm with Update to save. **How to edit information:** 1. **Click on the input field** 2. **Adjust the text** in the input field 3. **An 'Update' button appears** - click this button to save changes ### Setting information types **What are information types?** Information types register what kinds of data this asset contains or processes. **Adding information types:** 1. **Find "Information types" section** in the Details tab 2. **Click on the dropdown menu** 3. **Select relevant types** such as: - **Customer Information** - For CRM and sales tools - **Financial Records** - For accounting systems - **Software Source Code** - For development environments - **Application Secrets** - For (cloud) infrastructure > **tip:** **Multiple information types**: Most assets contain different types of information. An HR system can contain both "Employee Information" and "Financial Records". ### Adding attributes **What are attributes?** Attributes are labels that help categorize and filter assets. **Adding an attribute:** 1. **Find "Attributes" section** in the Details tab 2. **Click "Add attribute"** 3. **Fill in a title** such as 'category' 4. **Fill in a description** such as: - **Critical** - For business-critical systems - **Cloud** - For cloud-based assets - **Vendor** - For externally managed systems - **Test** - For development and test environments > **info:** An attribute is more than a label because it has both a value and a title in addition to a value. This allows you to vary infinitely with attributes and group them. **Managing attributes:** - **Reuse existing attributes** for consistency - **Remove attributes** by hovering over the attribute and choosing the trash can - **Use short, clear labels** for efficient filtering ### Assigning roles #### Setting owners **What does an owner do?** Owners are responsible for the asset and decide on changes, maintenance, and usage. Owners are automatically assigned as Task Owner to new tasks for this Asset. **Assigning an owner:** 1. **Find "Owners" section** on the right side 2. **Click on the user icon** 3. **Type a person's name** and select them from the dropdown list 4. **Multiple owners possible** - useful for shared responsibilities #### Assigning executors **What does an executor do?** Executors oversee solving tasks related to the asset. Executors are automatically assigned as Contributor to new Execution tasks for this Asset. **Setting an executor:** 1. **Find "Executors" section** 2. **Select people** who perform operational tasks 3. **Often IT teams** or system administrators #### Assigning assessors **What does an assessor do?** Assessors evaluate the work of executors and report to owners. Assessors are automatically assigned as Contributor to new Assessment tasks for this Asset. **Assigning an assessor:** 1. **Find "Assessors" section** 2. **Select people** with control responsibilities 3. **Often managers** or quality assurance teams > **info:** **Authorizations**: Read more about user roles and permissions in the 'Authorizations' section. ### Archiving or deleting assets Delete an asset only when it should be gone entirely; archive it instead if you want to keep the history. **When to delete:** - Asset is no longer used - System has been phased out or replaced - Vendor stopped providing services - Hardware permanently taken out of use **When to archive:** - Asset is (temporarily) no longer in scope for compliance - Deletion is not possible or desirable because historical data needs to be preserved **Archiving / Deletion process:** 1. **Select one or more assets** with the checkboxes on the left in the overview 2. **"Archive" and "Delete" buttons appear** at the top of the table 3. **Click "Archive" or "Delete"** to archive or delete all selected Assets **What happens during archiving:** - **Asset disappears** from daily overviews - **Links are made invisible** but remain for audit trails - **Historical data preserved** for compliance - **Can be restored later** if needed **What happens during deletion:** - **Asset disappears** from the entire application > **warning:** **Archiving vs deleting**: Archiving preserves all data for reporting and audit purposes. When deleting, the Asset can only be restored via a restore request to the helpdesk. ## Creating and managing links Each asset has, in its Details tab, a section for Controls, Plans, and Risks that you set yourself, plus separate Issues and Tasks tabs that show what has accumulated against the asset. Changes save automatically. ### Linking controls **Why link controls?** By linking controls to assets, you establish which security measures apply. **Linking controls:** 1. **Open an asset** and go to the **"Controls"** section in the Details tab 2. **Select relevant controls** from the available list 3. **Updates are automatically processed** ![Controls linked to an Asset](/images/help/assets_details_controls.png) > **tip:** **Relevant linking**: Only link controls that actually apply to this specific asset. Too many links make the overview unclear. ### Assigning plans **What are plans?** Plans are predefined schedules that enable automatic task creation for testing assets. Assigning a Plan ensures that tasks are automatically created on this schedule for all controls linked to this Asset. These tasks are assigned to the Asset owners and contributors. **Linking a plan:** 1. **Go to the "Plans" section** in the Details tab of the asset 2. **Select relevant plans** from the available list 3. **Updates are automatically processed** ![Plans linked to an Asset](/images/help/assets_details_plans.png) > **warning:** Although it's possible to assign multiple plans to an Asset, this often leads to too many tasks. ### Connecting risks **What are risk links?** Risk links indicate which risks are relevant for this Asset. This again helps determine the controls that should apply to the asset. **Managing risk links:** 1. **Open the "Risks" section** in the Details tab of the asset 2. **Select relevant risks** from the available list 3. **Updates are automatically processed** ![Risks linked to an Asset](/images/help/assets_details_risks.png) ### Monitoring issues The Issues tab shows every open problem linked to this specific asset. **Issue tracking:** 1. **Go to the "Issues" tab** 2. **View open problems** related to this asset 3. **Follow up on issue status** and resolution ![Issues linked to an Asset](/images/help/assets_details_issues.png) ### Tracking tasks and progress The Tasks tab shows every task linked to this asset and where each one stands. **Viewing tasks:** 1. **Open the "Tasks" tab** of the asset 2. **See linked tasks** and their status 3. **Monitor progress** of tasks assigned for this asset ![Tasks linked to an Asset](/images/help/assets_details_tasks.png) ## Best practices for asset management An asset register stays useful when names and ownership are predictable, and when someone reviews it on a schedule rather than only when something breaks. ### Organisational structure Clear, consistent names and at least one owner per asset are what keep a large register navigable. **Consistent naming:** - Use clear, descriptive names - Apply standard prefixes for categories - Avoid technical abbreviations that not everyone understands **Owner assignment:** - Assign at least one owner per asset - Ensure backup owners for critical assets - Update ownership during organisational changes ### Maintenance workflows An asset register stays accurate only with a regular review cadence, not just when something changes. **Regular reviews:** - Plan annual asset reviews - Check link relevance - Update asset information when changes occur - Archive unused assets **Documentation consistency:** - Keep descriptions current - Document important changes - Link to external documentation where relevant > **tip:** **Start small, build out**: Begin with your most critical assets and gradually build your asset register. Completeness comes with time, accuracy is important from day one. ## Next steps Now that you can create and manage assets: - **Perform assessments** for impact and risk assessment - **Monitor compliance status** via linked controls - **Track performance** through tasks and issues - **Generate reports** for management and auditors ### Getting started with Assets URL: https://tidalcontrol.com/docs/assets/getting-started Learn what assets are in Tidal Control and how to use the Assets page. What the columns mean, how to search, filter and sort, and where archived assets live. The Assets page is where you register the business resources you want to protect, and where you see the risks, controls, and owners attached to each one. This article covers finding your way around that overview: what the columns mean, and how to search, filter, and sort it. ## Navigating the Assets page You don't need to open an asset to see its compliance status: the overview shows its links and impact rating directly. ### Opening the Assets page Go to the Assets section via the main menu. You'll arrive at an overview page showing all assets from your organisation. ![Assets overview](/images/help/assets_overview.png) ### What you see in the overview The assets overview shows: - **Name** - The title of the business resource - **Custom ID** - Your own reference number (optional) - **Controls** - Which controls are relevant for this asset - **Risks** - Which risks are relevant for this asset - **Assignee** - The person(s) responsible for this asset - **Status indicators** - How risky this asset is - **C I A rating** - Which quality criteria (Confidentiality, Integrity, and/or Availability) this asset scores high on ### Archived Assets At the top of the overview, you see two tabs: - **Open** contains the current active assets - **Archived** contains assets that are no longer in use Archive assets when they are no longer actively used. They are kept in the archive for audit trails and historical reference, and you can always restore assets from the archive later. > **tip:** Use archiving to keep your overview organized. Archived assets disappear from daily workflows but remain available for reporting and compliance. ## What counts as an asset Assets in Tidal Control are all business resources that are important to your organisation. These can include: - **IT systems** - Servers, applications, databases - **Software** - SaaS solutions, internal tools, licences - **Hardware** - Laptops, network equipment, printers - **Vendors** - External parties that provide services - **Locations** - Offices, data centers, production facilities By registering assets in Tidal, you gain insight into risks, compliance status, and responsibilities for each business resource. > **tip:** You can link Assets to risks, controls, and tasks. This allows you to split tasks across 5 different Business Units, or assign specific controls to high-risk software. Read more about this in [Creating and managing assets](/docs/assets/creating-and-managing-assets) ## Search and filtering Search matches names and custom IDs; the filters narrow the list by attribute, by linked risks and controls, and by the people assigned to an asset. ### Search functionality Nothing filters until you press Enter; there is no live-as-you-type result. **Using the search bar:** 1. **Click in the search bar** at the top of the overview 2. **Type asset names** or custom IDs 3. **Press 'Enter'** and your search results will be shown ### Filter options Use the filter dropdown menus to find specific assets: **Filter by attribute:** - Select from predefined attributes - For example: "Critical", "Cloud", "Vendor" - You can add attributes to Assets yourself. Read more about this in [Creating and managing assets](/docs/assets/creating-and-managing-assets) **Filter by risks and/or controls:** - Filter assets based on their linked risks and/or controls > **tip:** The filters contain options "No risk assigned" or "No control assigned" that allow you to quickly identify missing links in your setup. **Filter by assigned persons:** - Filter by owners, executors, or assessors - See directly which assets fall under your responsibility > **info:** **Combining multiple filters:** You can use different filters simultaneously to find very specific asset sets. For example: all critical IT assets with high risk assigned to you. ## Sorting and organising Sorting reorders the list you already have; it doesn't narrow it, so combine it with a filter rather than using it alone. ### Sort options Click the sort dropdown to order assets: **By date:** - **Oldest** - Oldest assets first - **Newest** - Most recent assets first **By identification:** - **Custom ID (A-Z)** - Alphabetical by your reference numbers - **Custom ID (Z-A)** - Reverse alphabetical - **Name (A-Z)** - Alphabetical by asset name - **Name (Z-A)** - Reverse alphabetical by name **By impact:** - **Impact (High-Low)** - Critical assets first - **Impact (Low-High)** - Least critical assets first > **tip:** **Efficient working:** Combine sorting with filters for optimal workflow. For example: filter on your assigned assets and sort by impact level to quickly see priorities. ### Interpreting results An empty result is almost always a filter or the archive, not missing data. **Empty results:** - Check if your filters aren't too restrictive - Look in the "Archived" tab - Possibly no assets have been created yet **Too many results:** - Add additional filters to refine - Use the search function for specific terms - Sort by relevance (e.g., impact level) ## Next steps Now that you know how to find and filter assets, you can: - **Add assets** for new business resources - **Perform assessments** to map risks - **Create links** with controls, plans, and risks > **note:** **No assets visible?** This may mean that no business resources have been registered in your Tidal environment yet. Start by adding your first asset via the "Add asset" button. ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/assets/troubleshooting-and-faq Most asset problems come down to a filter that hides everything, an archived asset, missing access rights, or an assessment never filled in. Fixes for each. Most asset problems come down to one of four things: a filter that hides everything, an asset sitting in the archive, missing access rights, or an assessment that was never filled in. The answers below cover each of those. ## Frequently asked questions ### Why don't I see any assets in my overview? This is almost always a filter or the Archived tab, not a real data problem. **Possible causes:** - You have filter settings that hide all assets - Assets are in the "Archived" tab - You don't have access rights for these assets - No assets have been created in the environment yet **Solution:** 1. **Check the Archived tab** - Click on "Archived" at the top of the overview 2. **Reset all filters** - Clear filters and perform an empty search 3. **Check your permissions** - Ask your administrator for access 4. **Create your first asset** - Click "Add asset" to begin > **note:** New Tidal environments start without assets. Begin by adding your most critical business resources via the "Add asset" button. ### Can't I edit an archived asset anymore? **This is normal behaviour.** Archived assets are read-only to ensure data integrity. **Solution:** 1. **Restore the asset from archive** - Go to the "Archived" tab 2. **Select the asset** with the checkbox 3. **Click "Unarchive"** 4. **The asset becomes active** and can be edited again ### How can I edit multiple assets at once? Selecting several assets at once lets you assign an owner or archive them in a single action. **Available bulk operations:** - **Assign owners** - Select assets and assign the same owner - **Archive or delete** - Process multiple assets in one action ### Why can't I assign an owner to an asset? The person usually just doesn't have a Tidal account yet, or you don't have rights on this asset. **Possible reasons:** - The person doesn't have a user account in Tidal - You have insufficient rights for this asset - The owner is assigned, but the page hasn't refreshed yet **Solution:** 1. **Check user list** - Type the name and check if suggestions appear 2. **Ask administrator** to add the person to Tidal 3. **Refresh the page** - F5 to resolve any cache problems ### Where do I find the impact rating of my asset? The CIA rating shows in the overview column and in full on the Assessment tab; it's empty until that assessment is filled in. **Impact rating locations:** - **Assets overview** - "Assessment" column shows C, I, A scores - **Assessment tab** - Complete impact analysis with details **If impact rating is empty:** 1. **Go to the asset** and open the "Assessment" tab 2. **Fill in CIA scores** (Confidentiality, Integrity, Availability) 3. **Rating is automatically calculated** based on highest score 4. **Save assessment** - Impact appears in overviews See [Performing asset assessments](/docs/assets/assessing-assets) for a complete explanation. > **tip:** Start with a rough assessment for all assets. A global impact rating is better than no rating, and you can always refine later. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Risks ## Risks URL: https://tidalcontrol.com/docs/risks Every risk in your organisation shown twice over, as an inherent level before your measures and a residual level after them, with a heatmap across both. ### Conducting Risk Assessments URL: https://tidalcontrol.com/docs/risks/assessing-risks Assessing a risk means scoring it four times over. Likelihood and impact before your measures, a treatment decision, then likelihood and impact again after. Assessing a risk in Tidal means scoring it four times over: likelihood and impact before your measures, a treatment decision, then likelihood and impact again after them. Approving the result locks it and sets the risk to Approved for a year. ## Performing risk assessment You assess a risk from its own detail panel, and the assessment stays a draft until you approve it. ### Starting an assessment 1. **Go to the Risks page** via the main menu 2. **Click on a risk name** to open the detail panel 3. **Create or continue an assessment** using one of the available options: - **Continue Assessment**: appears when a draft assessment exists. Opens the existing draft for completion. - **New Assessment**: creates a new draft pre-filled from the latest approved assessment. Useful for periodic re-assessments. - **New Blank Assessment**: creates an empty draft with no pre-filled values (available via the menu). The assessment dialog has three sections: **Inherent Risk**, **Treatment**, and **Residual Risk**. Changes are saved automatically as you fill in fields. The **Assessment** tab in the detail panel shows all past assessments. From there you can open, approve, revoke, or delete assessments. ![Risk assessment interface](/images/help/risks_assessment.png) ## Assessing inherent risk Score the risk as it would be without any of your measures in place: how likely it is, and how bad it would be. ### Estimating likelihood and impact Set likelihood and impact from their dropdowns, and Tidal multiplies the two into the risk score for you. **Setting Likelihood:** 1. **Select the Likelihood dropdown** 2. **Choose from available options:** - **1 - Remote** - Rarely or never occurring (\<1% chance per year) - **2 - Unlikely** - Improbable but possible (1-10% chance per year) - **3 - Possible** - Reasonable chance of occurring (11-50% chance per year) - **4 - Likely** - Probable within foreseeable time (51-90% chance per year) - **5 - Almost certain** - Almost certain to happen (\>90% chance per year) **Determining Impact:** 1. **Select the Impact dropdown** 2. **Assess potential damage:** - **1 - Insignificant** - Negligible consequences - **2 - Minor** - Limited impact on organisation - **3 - Moderate** - Significant but manageable consequences - **4 - Major** - Serious impact on business operations - **5 - Extreme** - Critical threat to organisation **Automatic risk score:** - Tidal automatically calculates: **Likelihood × Impact = Risk Score** - **Score 1-6**: Low (green) - **Score 7-15**: Medium (orange) - **Score 16-25**: High (red) ### Adding comments Justify your estimate in a comment; that's what makes the score defensible later, to another assessor or an auditor. **Supporting your assessment:** 1. **Use the Comments field** to justify your estimation 2. **Describe specific factors** that influence likelihood 3. **Explain what impact** is expected from this risk 4. **Reference concrete examples** or historical incidents **Using AI support:** - **Click "Ask TidalBot" or the TidalBot icon (3 stars)** for automated risk assessment - **AI analyses organisational context** and generates realistic assessment - **Review and adjust** based on specific circumstances > **tip:** **Consistent assessment**: Use the same criteria for all risks. Document your assessment methodology to ensure consistency between different assessors. ## Determining Treatment Plan With the inherent score known, decide what to do about the risk. Only the Reduce option requires you to link controls. ### Selecting treatment options After assessing inherent risk, you must determine how the risk will be treated: **Reduce - Most commonly used option:** - Implement controls to decrease likelihood or impact - Example: Install firewall against cyber attacks - Suitable for: Medium to high risks that can be influenced **Accept:** - Consciously accept the risk without additional measures - Example: Low financial risk that's more expensive to mitigate - Suitable for: Low risks or where mitigation isn't cost-effective **Transfer:** - Shift risk to another party (insurance, outsourcing) - Example: Purchase cyber insurance for data breach risks - Suitable for: Financial risks or specialized expertise **Avoid:** - Completely stop the activity causing the risk - Example: Not using certain technology - Suitable for: Very high risks where alternatives exist ### Chosen Reduce? Then also link Controls Reduce is the only treatment that requires linking controls: they're what actually reduces the risk. **Selecting controls:** 1. **Choose "Reduce" as treatment** 2. **Review relevant controls** if controls are already linked to the risk 3. **Add relevant controls** by selecting the Controls field and searching or selecting from the list 4. **Multiple controls possible** per risk **Effective control mapping:** - **Preventive controls** - Prevent risk from occurring - **Detective controls** - Detect when risk occurs - **Corrective controls** - Restore after risk incident - **Compensating controls** - Alternative protection **Notes (Comments):** - **Explain why** you chose this treatment - **Describe how controls** mitigate the risk - **Mention any limitations** of chosen approach ## Assessing Residual Risk Now score the same risk again, this time with your measures in place, and check the result against what your organisation is willing to accept. ### Estimating residual risk After treatment, you must assess the remaining risk: **New likelihood and impact:** 1. **Consider effect of linked controls** 2. **Set new Likelihood** (usually lower due to preventive controls) 3. **Determine new Impact** (possibly lower due to detective/corrective controls) 4. **Automatic recalculation** of Residual Risk score **Realistic estimation:** - **Controls aren't 100% effective** - Account for implementation gaps - **Human factor** - Procedures may not always be followed correctly - **Technical limitations** - Systems can fail or be bypassed - **New threats** - Risks evolve despite current controls ### Assessing acceptability Compare the residual score against your organisation's risk appetite; anything above it needs more than what's already in place. **Testing risk appetite:** - **Compare residual risk** with organisational risk appetite - **High residual risk** may require additional controls - **Acceptable residual risk** can be approved by management > **warning:** **Residual risk >= Inherent risk**: If residual risk is higher than inherent risk, check your risk assessment. This can happen with poor control implementation or new threats. ## Approving an assessment Click **"Approve"** to finalize your assessment, once verified. This locks the assessment and sets the risk status to **Approved**. - **Revoke Approval**: reopens an approved assessment for editing - **Delete**: removes the assessment entirely Approvals are valid for 12 months. After that, Tidal automatically changes the status to **To be reviewed**. > **info:** To maintain a clear audit trail, Tidal enforces the following rules: - Only **one draft** can exist per risk at a time. Approve or delete the current draft before creating a new one. - Only the **latest assessment** can be approved. - To revoke an approval, the assessment must be the **latest one** and there must be no draft. ## Using AI support TidalBot can draft an assessment for you from the risk description, which you then correct rather than write from scratch. ### Deploying TidalBot TidalBot drafts an assessment from your organisational context and similar risks already in the system. **Automatic assessment:** 1. **Click "Ask TidalBot"** in Comments section 2. **AI analyses:** - Organisational context and sector - Available asset information - Similar risks in database - Industry best practices **Using AI output:** - **Review generated assessment** critically - **Adjust for specific context** of your organisation - **Add organisation-specific factors** - **Use as starting point** for stakeholder discussion **AI limitations:** - May miss recent developments - Requires human validation and contextual knowledge ## Best practices for assessment Assessments are only comparable if everyone scores the same way, so agree the criteria first and have someone else check the result. ### Objective assessment Two assessors scoring the same risk should land on the same number, which only happens if everyone uses the same criteria. **Ensuring consistency:** - **Use standard criteria** for likelihood and impact scores - **Involve multiple stakeholders** for broader perspective - **Document assumptions** and starting points - **Review assessments** periodically with "fresh eyes" **Evidence-based approach:** - **Reference historical data** where available - **Analyse similar organisations** and their experiences - **Use industry statistics** for sector calibration - **Add expertise** such as expert assessments by risk specialists ### Assessment validation (optional) A second person checking the assessment, especially for high risks, catches what one assessor alone would miss. **Peer review process:** - **Second assessor** checks assessment - **Management review** for high risks - **Subject matter expert** input for technical risks - **Cross-functional feedback** for business impacts **Quality controls:** - **Logical consistency** between likelihood and impact - **Realistic treatment options** chosen - **Adequate control coverage** for treating risks with controls - **Proportional effort** relative to risk level ## Validating risk assessments Two things tell you whether your assessments are complete: a built-in Tidal test, and the status column on the Risks overview. ### Automated completeness check Tidal Control has a built-in Test available that automatically checks whether all risk assessments are completed: **"All risks have an inherent risk level, treatment option, and residual risk" test verifies:** - **Inherent risk filled** - Likelihood and Impact for all risks - **Treatment option chosen** - Reduce/Accept/Transfer/Avoid for each risk - **Residual risk determined** - Residual risk assessment after treatment - **Risk appetite configured** - Organisational risk appetite settings **Test results:** - **Pass** - All risks have complete assessment - **Fail** - One or more risks are missing assessment information - **Error** - Technical issue with the test ### Checking overview completeness **In the Risks overview page** you can directly see which risks still have incomplete assessments: - **Colored risk badges** - Show inherent and residual risk levels - **Empty badges** - Risks without complete assessment - **Assessment status column** - Indicates which risks still need attention > **tip:** **Systematic approach**: Review the "All risks have an inherent risk level, treatment option, and residual risk" test after performing a risk asssessment to ensure it is complete. This supports compliance with ISO 27001 and other risk management standards. ## What a risk assessment is A risk assessment is a systematic process to identify, evaluate and prioritise potential risks that could affect your organisation. It involves analysing threats, vulnerabilities and potential impact to effectively manage risks. The process consists of five main steps: 1. **Identify risks** - Map threats and vulnerabilities 2. **Analyse risks** - Determine likelihood and impact 3. **Determine treatment** - Accept, avoid, reduce or transfer 4. **Evaluate residual risks** - Compare with acceptance criteria 5. **Monitor and adjust** - Monitor effectiveness and adapt > **info:** **Risk assessment frequency**: Perform a complete risk assessment at least annually, or more frequently when there are significant changes in organisation, technology, or business environment. Tidal already enforces the annual minimum for you: an approval expires after 12 months and the risk status changes to **To be reviewed**. ## Next steps After conducting risk assessment, you can: - **Validate completeness** with the "All risks have an inherent risk level, treatment option, and residual risk" test - **Implement controls** to reduce risks - **Verify asset scope** for complete risk coverage - **Generate risk reporting** to keep management informed - **Plan periodic reviews** to monitor risk developments > **tip:** **Start with high-impact risks**: Begin your assessment with risks that have the greatest potential impact on your organisation. This provides the best results for your risk management. ### Creating and editing risks URL: https://tidalcontrol.com/docs/risks/creating-and-editing-risks The risk record itself rather than its scores. Creating it, classifying it, linking the assets it threatens and the controls that treat it, and its owner. This article covers the risk record itself rather than its scores: creating it, classifying it, linking the assets it threatens and the controls that treat it, assigning an owner, and archiving it when it no longer applies. For scoring, see [Conducting Risk Assessments](/docs/risks/assessing-risks). ## Adding new risks A risk needs only a name to exist; classification, links, and scores can all follow later. ### Creating a risk 1. **Go to the Risks page** via the main menu 2. **Click "Add risk"** in the top right of the overview 3. **The creation form opens** where you can fill in risk information ![Creating new risk](/images/help/risks_add_risk.png) ### Filling in risk information Only the name is required; a custom ID and owner can be added now or later. **Required fields:** - **Name** - Choose a clear, descriptive name for the risk - For example: "Malware installation on systems" or "Insufficient management involvement" **Optional fields:** - **Custom ID** - Your own reference number (e.g. "R.IT.01", "R.HR.03") - **Assign owner** - Select the responsible person from the dropdown - **Description** - Explain what this risk entails and why it's relevant > **tip:** **Clear naming**: Use names that directly indicate what the risk involves. Avoid vague terms and focus on concrete threats to your organisation. ### Saving the risk 1. **Check all entered information** 2. **Click "Create"** to create the risk 3. **The new risk appears** in your overview with initial status ## Editing risk information The detail panel holds the risk's own fields and its classification attributes. ### Opening risk details 1. **Click on a risk name** in the overview 2. **Select the "Details" tab** in the risk interface 3. **All editable fields** are displayed ![Risk details page](/images/help/risks_details_page.png) ### Adjusting basic information Once created, a risk's name, validity period, appetite, and description can all still be changed. **Editable fields in Details tab:** - **Name** - Adjust risk name - **Custom ID** - Change for better reference - **Valid from / Valid to** - Set validity period - **Risk Appetite** - Determine acceptable risk levels - **Description** - Extended risk description **How to edit information:** 1. **Click in the relevant field** 2. **Adjust the text or date** 3. **Click the Update button** on the left bottom or top right of the screen to save changes ### Risk classification Attributes let you tag a risk with the domain, category, or threat group it belongs to. **Adding attributes:** 1. **Scroll to "Attributes" section** 2. **Click "Add attribute"** 3. **Enter a title** (e.g. "DOMAIN", "RISK CATEGORY") 4. **Enter a value** (e.g. "Equipment", "Information risk") 5. **Attributes help** with filtering and reporting **Examples of useful attributes:** - **DOMAIN** - IT, HR, Finance, Operations - **THREAT GROUP** - Cyber, Physical, Personnel, External - **IMPACT TYPE** - Financial, Reputation, Operational, Compliance > **info:** **Consistent attributes**: Reuse existing titles and values from the dropdown list to prevent typos and make filters effective. ## Linking assets to risks Linking assets records what the risk actually threatens, which in turn suggests which controls belong on it. ### Why link assets? By linking business assets, you establish which systems, data or processes are threatened by this risk. ### Selecting assets 1. **Go to the "Assets" section** in the Details tab of the risk 2. **View available assets** in the list 3. **Select relevant assets** by checking checkboxes 4. **Links are automatically saved** ![Assets linked to risk](/images/help/risks_detail_assets.png) **Selection criteria:** - **Direct exposure** - Asset is directly threatened by this risk - **Critical dependency** - Asset is essential for business operations - **Data sensitivity** - Asset contains confidential information - **Compliance impact** - Asset falls under regulations > **tip:** When conducting risk assessments, linked assets should be included in impact calculations. Therefore, only link assets that are actually affected by this specific risk. ## Owners and responsibilities A risk needs an owner before its assessment can move past Not assigned. ### Assigning risk owners The owner is the person ultimately accountable for how the risk is managed. **Setting Owners:** 1. **Find "Owners" section** on the right side of Details tab 2. **Click the user icon** 3. **Type username** and select from dropdown 4. **Multiple owners possible** for shared responsibility **Assigning Executors:** - People who perform executive tasks for risk treatment - Often operational staff or specialists - (future feature) Automatically assigned to new manual tasks **Appointing Assessors:** - People who perform risk assessment tasks - Usually risk managers or compliance officers - Independent from implementation team - (future feature) Automatically assigned to new risk assessment tasks > **warning:** **Owner vs Executor**: Owners are ultimately responsible for risk management, Executors perform specific tasks. Ensure clear separation of responsibilities. ## Managing risk lifecycle A risk has to be activated before it counts, and archiving keeps its history when it stops applying. Deleting does not. ### Risk activation Inactive risks currently have no impact on application functionality. (future feature) In the future, risk assessments will only be scheduled for active risks. **A risk becomes "Active" when:** - The "Valid from" date is in the past - The "Valid to" date is in the future (or empty) - Controls are linked to the risk **Active risks:** - (future feature) Will be included in scheduled risk assessments - Visible in dashboards and reports ### Risk archiving Archive a risk once it's genuinely no longer relevant, rather than deleting it, so the history survives. **When to archive:** - Risk is no longer relevant - Business activity causing the risk has stopped - External circumstances make risk irrelevant - Risk has been merged with another risk **Archiving process:** 1. **Select one or multiple risks** with checkboxes in overview 2. **Click "Archive" button** at top of table 3. **Confirm archiving** - risks disappear from daily overview 4. **Historical data** remains available for audit **Effect of archiving:** - Risk appears in "Archived" tab - All links remain preserved but hidden - No new assessments or treatments - Reports don't account for archived risks ### Risk deletion Delete a risk only when it should never have existed: a test entry, a duplicate, or data that must not be retained. **When to delete:** - Test risk with incorrect information - Duplicate risk accidentally created - Sensitive information that must not be retained - Organisation requires permanent deletion **Deletion process:** 1. **Select risks** with checkboxes 2. **Click "Delete" button** at top of table 3. **Confirm permanent deletion** - irreversible action 4. **All linked data** is completely erased > **warning:** **Archive vs Delete**: Use archiving for risks that are no longer relevant but have historical value. Only delete for technical errors or data privacy requirements. ## Planning risk treatment Once treatment is decided, the linked controls are what carry it out, so their effectiveness is what you monitor from here on. ### Linking treatment strategies Treatment is set from the risk's own Assessment tab, and choosing Reduce is what requires you to link controls. **After risk assessment:** 1. **Go to the "Assessment" tab** of the risk 2. **Select or change treatment option** (Reduce, Accept, Transfer, Avoid) 3. **For "Reduce"** - Link relevant controls 4. **Add justification** in comments field ### Monitoring control effectiveness Treatment isn't a one-time decision. Check periodically whether the linked controls still hold up against new threats. **Ongoing evaluation:** - **Regularly check** if linked controls are effective - **Update risk assessment** when circumstances change - **Adjust treatment** for new threats - **Changes are automatically documented** in Feed tab ## Bulk operations Selecting several risks at once lets you apply the same owner, attribute, or archive action to all of them. ### Managing multiple risks simultaneously Bulk actions cover archiving and deleting, not owner or attribute changes. **Available bulk operations:** - **Archive** - Move multiple risks to archive - **Delete** - Permanently delete selected risks **Bulk workflow:** 1. **Select risks** with checkboxes on left in overview 2. **Relevant buttons appear** at top of table 3. **Choose desired action** and confirm **Not possible for bulk:** - Edit risk descriptions - Manage attributes - Adjust asset links - Report on selected risks ## Risk reporting Export the risk register when you need it outside Tidal, for management reporting or an audit. ### Using export functionality The exported file is a snapshot at that moment, not a live sync. **Generating risk report:** 1. **Click "Export report"** in top right of overview 2. **Excel file** is downloaded with: - Risk names and IDs - Inherent and residual risk scores - Treatment status and linked controls - Asset links - Control effectiveness per linked Risk **Reporting applications:** - **Management presentations** about risk profile - **Audit documentation** for compliance - **Trend analysis** over time - **Benchmark comparison** with previous periods - **Monitor impact of ineffective controls** on current residual risks ## Best practices for risk management A risk register stays usable when risks are identified from more than one source, named consistently, and reviewed on a fixed rhythm. ### Risk identification Risks surface fastest when more than one perspective looks for them, not just the person filling in the register. **Systematic approach:** - **Use templates** for standard risks - **Involve different perspectives** (IT, HR, Operations, Legal) - **Analyse historical incidents** in your organisation - **Monitor external threats** in your sector ### Risk naming A risk name is only useful if it's specific enough to act on: "Data breaches through phishing" beats "Cyber risk". **Clear conventions:** - **Specific and measurable** - "Data breaches through phishing" vs "Cyber risk" - **Organisation relevant** - Focus on actual threats - **Consistent structure** - Use fixed format per category - **Avoid jargon** - Understandable for all stakeholders ### Regular reviews A risk register stays accurate only if someone revisits it on a fixed rhythm, not just after an incident. **Maintenance rhythm:** - **Monthly check** - Identify new risks (in very dynamic environments) - **Quarterly evaluation** - Reassess existing risks - **Annual review** - Examine complete risk portfolio - **Ad-hoc updates** - After significant changes or incidents > **tip:** **Start small, build out**: Assess all risks, but limit monitoring to the most critical risks for your organisation. Gradually add more risks as your process matures. ## Next steps Now that you can create and manage risks: - **Perform systematic assessments** for all identified risks - **Link effective controls** to high risks - **Monitor treatment progress** via dashboards - **Report regularly** to management about risk profile For operational guidance on assessments, see [Conducting Risk Assessments](/docs/risks/assessing-risks). ### Getting started with Risks URL: https://tidalcontrol.com/docs/risks/getting-started What risks are in Tidal Control and how to read the Risks page. The heatmap, what risk statuses mean, and the difference between inherent and residual risk. The Risks page shows every risk in your organisation twice over: as an inherent level before any measures, and as a residual level after them. This article covers reading that overview, the two heatmaps, and the status Tidal derives for each risk. ## Navigating the Risks page Each row carries an inherent level, a treatment decision, and a residual level, and the two heatmaps above the table plot all of them at once. ### Opening the Risks page Go to the Risks section via the main menu. You'll arrive at an overview page where all risks from your organisation are displayed. ![Risks overview](/images/help/risks_overview.png) ### What you see in the overview The risks overview shows important information per risk: - **Risk ID and title** - Unique identification and descriptive name - **Inherent risk level** - Risk level before measures (orange badges: High, Medium, Low) - **Treatment** - Chosen treatment option (Reduce, Accept, Transfer, Avoid) - **Residual risk level** - Risk level after measures (green badges: Low, Medium, High) ### Understanding risk status The status column indicates where each risk is in the assessment workflow. Tidal automatically determines the status based on the following criteria: **Not assigned** - Risk has no assignee **Not started** - Risk has an assignee but the assessment has not been started yet **Draft** - Risk has an assignee and assessment is in progress but not yet approved **Approved** - Assessment approved within the last year **To be reviewed** - Assessment was approved more than a year ago > **info:** Archived risks are no longer actively managed but remain accessible via the "Archived" tab for audit purposes. ### Risk heatmap The Risks page displays two 5×5 heatmaps side by side: **Inherent Risk** (left) and **Residual Risk** (right). Each heatmap plots risks on a grid of Likelihood (1-5) versus Impact (1-5). - Each cell shows the **number of risks** at that likelihood/impact combination - Cell colors indicate the risk level based on the score (Likelihood × Impact): - **Green** (Low): score 1-6 - **Orange** (Medium): score 7-15 - **Red** (High): score 16-25 - Hover over a cell to see arrows showing how risks move from their inherent position to their residual position > **info:** The heatmap uses the **latest approved assessment** for each risk. If no approved assessment exists, the draft assessment is used as a fallback. ## Interpreting risk levels Every risk is scored twice, before and after its measures, and each score gets a colour band. The gap between the two is what tells you whether your controls are doing anything. ### Inherent risk vs Residual risk Tidal distinguishes two important risk levels: **Inherent or Gross Risk:** - The risk level without any protective measures - Shows the "raw" threat to your organisation - Assessed on likelihood × impact **Residual risk:** - The risk level after implementing measures - Shows how much risk remains after mitigation - Determines if additional measures are needed ### Risk level colors Red means act now; green means periodic monitoring is enough. **High - Red:** - Immediate attention required - Can cause significant damage - Priority for risk treatment **Medium - Orange:** - Monitoring and planning needed - Moderate impact on organisation - Treatment within reasonable timeframe **Low - Green:** - Acceptable risk level - Periodic monitoring sufficient - Low priority for additional measures > **info:** **Risk Acceptance Level**: Acceptable risk levels differ per organisation. Determine together with management which residual risk levels are acceptable for your context. Read more about risk acceptance levels and how to maintain them in Tidal in [Creating and editing risks](/docs/risks/creating-and-editing-risks) ## Searching and filtering Search matches risk names and custom IDs. The filters narrow by attribute, linked asset, linked control, and assignee, and they combine with each other. ### Search functionality Nothing filters until you press Enter; there is no live-as-you-type result. **Using the search bar:** 1. **Click in the search bar** at the top of the overview 2. **Type risk names** or custom IDs (e.g. "R.IT.01" or "malware") 3. **Press 'Enter'** and your search results are displayed ### Filter options Use the filter dropdown menus to find specific risks: **Open vs Archived:** - **Open** - Active risks being monitored - **Archived** - Risks that are no longer applicable **Filter by Attribute:** - Show risks with specific characteristics - For example domain, risk category, or vulnerability group - Useful for thematic risk analysis **Filter by Assets:** - Show risks linked to specific assets - Useful for asset-based risk assessments **Filter by Controls:** - Show risks mitigated by specific measures - Helps assess control effectiveness **Filter by Assignee:** - Show risks assigned to specific people - Useful to see your own responsibilities **Filter by Sort:** - **Oldest/Newest** - Chronological order - **Custom ID (A-Z/Z-A)** - Alphabetical by ID - **Name (A-Z/Z-A)** - Alphabetical by name > **tip:** You can also create your own filters with attributes. For example, add a "Department" attribute to filter risks per department. Read more about attributes in [Creating and editing risks](/docs/risks/creating-and-editing-risks) ### Combining multiple filters You can use different filters simultaneously for very specific results: - **Example**: Filter on "Information risk" + "High" inherent risk + your name as assignee to see your high-risk IT risks - **Reset filters**: Click away individual filters or refresh the page ## What counts as a risk Risks are identified threats and vulnerabilities that can impact your organisation. The system helps you systematically assess and manage these risks by: - **Risk identification** - Mapping threats and vulnerabilities - **Impact assessment** - Estimating likelihood and consequences - **Risk treatment** - Accept, avoid, reduce or transfer - **Control linking** - Assigning measures to mitigate risks - **Monitoring** - Tracking progress of risk treatment By registering and monitoring risks in Tidal, you gain insight into your risk profile, which measures are effective and where additional action is needed. > **tip:** Risks can be linked to assets, controls and treatment plans. This creates a complete picture of which threats apply where and how effective your protection is. Read more about this in [Conducting Risk Assessments](/docs/risks/assessing-risks) ## Next steps Now that you know how to find and interpret risks, you can: - **Conduct risk assessments** for identified threats - **Link controls** to risks for mitigation - **Manage asset-risk relationships** for complete coverage - **Create and monitor risk treatment plans** > **note:** **No risks visible?** This may mean that no risks have been identified yet in your Tidal environment. Start by adding your first risk via the "Add risk" button, or import a risk framework template. ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/risks/troubleshooting-and-faq Risk problems fall into three groups. A risk that will not become active, scores that are inconsistent or implausible, and treatment chosen but never followed. Risk problems fall into three groups: a risk that will not become active, scores that are inconsistent or implausible, and treatment that is chosen but never followed up. The answers below cover each, and end with the checks that prevent them. ## Frequently asked questions ### Why does my risk keep "Inactive" status? Inactive risks currently have no impact on application functionality. (future feature) In the future, risk assessments will only be scheduled for active risks. **A risk only becomes "Active" when all the following conditions are met:** - The "Valid from" date is in the past and "Valid to" in the future (or empty) - At least one asset is linked to the risk **Solution:** 1. **Check validity period** - Go to Details tab and set correct dates 2. **Link Controls** - Go to the Assessment tab and select relevant Controls under 'Treatment' 3. **Refresh the page** - Status update may require a browser refresh ### How do I determine the correct likelihood and impact scores? Base the estimate on history and the current threat landscape, not a gut feeling; TidalBot can give you a starting point. **Estimating Likelihood:** - **Use historical data** - How often did this risk occur in the past? - **Analyse external factors** - Threat landscape in your sector - **Consider current measures** - What protection is already in place? - **Use the 'Ask TidalBot' button** - to receive an immediate example assessment - **Consult experts** - IT specialists, security advisors **Impact assessment:** - **Financial consequences** - Direct costs and revenue loss - **Operational disruption** - Shutting down or slowing business operations - **Reputation damage** - Media attention and customer trust - **Compliance impact** - Fines and legal consequences **Consistency tips:** - Use the same criteria for all risks - Document your assessment methodology - Have multiple people assess independently - Review scores periodically with fresh eyes ### Which treatment option should I choose for my risk? Reduce fits most medium-to-high risks where a proportional control is available; the other options are for cases where that isn't true. **Reduce - Choose when:** - Risk has medium to high impact - Effective measures are available - Mitigation costs are proportional - Organisation has control over risk factors **Accept - Choose when:** - Risk has low impact and likelihood - Mitigation costs more than potential damage - Risk falls within accepted risk appetite - No effective measures available **Transfer - Choose when:** - Risk has high financial impact - Insurance or outsourcing is cost-effective - Expertise for risk treatment is lacking - Legal liability can be transferred **Avoid - Choose when:** - Risk has extreme impact - Alternatives to risky activity exist - Reputation risk is unacceptable - Legal or ethical objections exist ### Why am I not getting realistic AI assessments from TidalBot? **AI has limited context without organisational information:** - **Add Organisational context** - [read more about this in Policies](/docs/policies/managing-policies) - **Fill in asset information** completely - Systems, data, processes - **Describe specific circumstances** in risk description - **Provide feedback** on generated assessments **Improving AI results:** 1. **Add more context** - More detailed descriptions 2. **Link Assets** - AI uses asset information for assessment 3. **Fill in Attributes** - Domain, category, threat group 4. **Iterative refinement** - Use AI output as starting point, then adjust > **tip:** **AI as a tool**: Use TidalBot for inspiration and consistency, but never replace human expertise and organisational knowledge. ### How do I effectively link controls to risks? Pick controls that actually change the risk's likelihood or impact, not just any control that mentions the same topic. **Selecting controls for "Reduce" treatment:** - **Preventive controls** - Prevent risk from occurring - **Detective controls** - Early detection of risk manifestation - **Corrective controls** - Restore after risk incident - **Compensating controls** - Alternative protection **Estimating effectiveness:** - **Direct relationship** - Control addresses specific risk cause - **Proven effectiveness** - Track record in similar situations - **Implementation quality** - Is the control being executed correctly? - **Monitoring possible** - Can you measure and adjust effectiveness? **Avoiding pitfalls:** - **Not too many controls** - Focus on most effective options - **Check overlap** - Avoid redundant protection - **Consider costs** - Proportionality between risk and mitigation - **Monitor residual risk** - Assess if additional controls are needed ## Common problems ### Residual risk higher than inherent risk **Problem:** After linking controls, residual risk appears higher than the original risk. **Possible causes:** - **Wrong assessment** - Original estimate was too optimistic - **Poor implementation** - Controls don't work as intended - **New threats** - Risk has evolved since last assessment - **Control side effects** - New vulnerabilities introduced **Solutions:** 1. **Review inherent risk** - Was original assessment realistic? 2. **Check controls** - Are they being implemented correctly? 3. **Update threat landscape** - Have new threats emerged? 4. **Find better controls** - More effective alternatives available? ### Risk assessment is inconsistent between assessors **Problem:** Different people give very different scores to the same risk. **Causes:** - **Unclear criteria** - No shared understanding of likelihood/impact scales - **Different perspectives** - IT vs Business vs Compliance viewpoint - **Lack of information** - Assessors have different facts - **Personal bias** - Risk appetite and experience influence judgment **Solutions:** 1. **Standardise criteria** - Clear definitions per score level 2. **Organize group sessions** - Joint assessment and discussion 3. **Calibration exercises** - Train assessors with standard examples 4. **Multiple perspectives** - Have different experts assess ### Assets are not correctly linked to risks **Problem:** Asset linking appears random or incomplete. **Error scenarios:** - **Too broad linking** - All assets linked to every risk - **Too narrow linking** - Critical exposure missed - **Outdated links** - Assets not updated after changes - **Wrong granularity** - Too detailed or too global **Best practices:** 1. **Specific linking** - Only actually threatened assets 2. **Regular reviews** - Periodically update links 3. **Think impact** - Which assets actually affected in incident? 4. **Stakeholder input** - Involve asset owners in risk assessment ### Risk treatment is not followed up **Problem:** Chosen treatment is not implemented or monitored. **Causes:** - **Unclear responsibilities** - No one owns execution - **Lack of priority** - Other work takes precedence - **Unrealistic plans** - Treatment options are not executable - **No follow-up process** - No systematic monitoring **Solutions:** 1. **Clear owners** - Assign specific people to each treatment 2. **Set deadlines** - Concrete timelines for implementation 3. **Regular check-ins** - Quarterly reviews of treatment progress 4. **Escalation process** - Management involvement for delays ## Technical problems ### Risk status is not updated **Problem:** Changes in risk information don't reflect in the status. **Troubleshooting:** 1. **Clear browser cache** - Hard refresh (Ctrl+Shift+R) 2. **Save changes** - By using the 'Update' button regularly 3. **Don't ignore the 'Discard changes?' popup** - If you navigate away from a screen without updating, you'll get the question to discard changes or go back to the risk (cancel). Go back to the risk and save changes first with the 'Update' button. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ## Preventive tips ### Regular maintenance A risk register drifts out of date without a fixed monthly and quarterly check. **Monthly tasks:** - **Identify new risks** - Have threats been added? - **Check status updates** - Are all active risks still relevant? - **Treatment progress** - Are planned measures being executed? **Quarterly reviews:** - **Risk assessment updates** - Are likelihood/impact scores still current? - **Asset links** - New systems or changed exposure? - **Effectiveness assessment** - Do chosen treatments work as expected? **Annual review:** - **Complete portfolio review** - Go through complete risk inventory - **Framework updates** - New compliance requirements or standards? - **Stakeholder feedback** - Input from asset owners and management ### Maintaining data quality A register full of duplicates and vague descriptions is as bad as one that's incomplete. **Consistent input:** - **Use attributes** - Standard categories for filtering - **Avoid duplicates** - Check existing risks before adding - **Clear descriptions** - Understandable for all stakeholders - **Periodic cleanup** - Archive outdated or irrelevant risks > **tip:** **Proactive risk management**: Invest time in preventive measures. Regular maintenance prevents most problems and keeps your risk management current and effective. --- # Controls ## Controls URL: https://tidalcontrol.com/docs/controls Every security measure your organisation has in place, with a compliance status Tidal calculates from the tasks, tests and assessments attached to each control. ### Creating Controls and Tasks URL: https://tidalcontrol.com/docs/controls/creating-controls-and-tasks A new control starts empty and Undetermined. How to create one, fill in its information, and give it the manual tasks, tests and plans that make it report. A new control starts empty and with an Undetermined status. It only begins to report compliance once you give it activities: manual tasks you complete yourself, automated tests, or a plan that generates tasks on a schedule. ## Adding controls Only a name is required to create a control. Everything else can be filled in afterwards. ### Creating a new control 1. **Go to the Controls page** via the main menu 2. **Click "Add control"** top right in the overview 3. **The add form opens** where you can fill in control information ![Create a new control](/images/help/controls_add_control.png) ### Filling in control information A custom ID is worth setting now if you're linking this control to an external system later. **Required fields:** - **Name** - Choose a clear, descriptive name for the control measure **Optional fields:** - **Custom ID** - Your own reference number (useful for linking with external systems) - **Assign owner** - Select the responsible person from the dropdown - **Description** - Explain what this control does and why it's important > **tip:** **Clear naming**: Use names that directly indicate what the control achieves as an outcome, such as "Information security policy established". ### Saving the control 1. **Check all filled information** 2. **Click "Create"** to create the control 3. **The new control appears** in your overview with status "Undetermined" (gray) ## Adding control activities There are three ways to give a control something to report on: create a manual task, link an automated test, or attach a plan that creates tasks for you on a fixed frequency. ### Creating manual tasks 1. **Go to the Controls page** (or the Tasks page) via the main menu 2. **Click "Add task"** top right in the overview 3. **The add form opens** where you can fill in task information ![Creating a new task](/images/help/controls_add_task.png) ### Configuring tests Tests are linked from the control's own Details tab. **Opening control details:** 1. **Click on a control name** in the overview 2. **The control details tab opens** with various sections 3. **Details section contains** all basic information and settings ![Control details tab](/images/help/controls_details_tab.png) **Linking available Tests:** 1. **Go to "Tests" tab** in control details 2. **Select the text field** to see available tests 3. **Choose relevant tests** for this control, or: 4. **Search tests** by entering the test name in the text field **Available test types:** - **Policy compliance tests** - Policy approval compliance - **Other Tidal tests** - Monitoring quality of input in Tidal, with checks on Control compliance, and correct entry of Risks and assets - **Integrations with external software** - Monitoring cloud security configurations, user rights, encryption, backup etc. > **info:** **Test requirements**: Automated tests require working integrations with external systems. Check integration status before linking tests. Setup instructions can be found in [Integrations](/docs/integrations) ### Linking plans **What are plans?** Plans determine when and how often tasks are automatically created for control validation. These "Plans" are particularly suitable for setting up periodically recurring tasks and automatically assigning them to control executors. **Opening control details:** 1. **Click on a control name** in the overview 2. **The control details tab opens** with various sections ![Control details tab](/images/help/controls_details_tab.png) **Linking a plan:** 1. **Go to "Plans" tab** of the control 2. **Select relevant plan** from available schedules 3. **Automatic task creation** starts according to plan frequency and schedule **Most common Plan types:** - **Monthly Monitoring** - Monthly checks - **Quarterly Testing** - Quarterly validation - **Annual Review / Audit** - Annual control assessments > **warning:** **Plan overload**: Avoid assigning multiple plans to one control. This leads to excessive tasks and confusion about deadlines. ### Editing and managing controls URL: https://tidalcontrol.com/docs/controls/editing-and-managing-controls Everything on a control's detail page. Editing fields, mapping it to framework requirements, adding attributes and owners, and linking it to assets and risks. Once a control exists, everything else happens on its detail page: editing its fields, mapping it to framework requirements, adding attributes and owners, linking it to assets, risks, and plans, and eventually archiving it. ## Editing control information The Details tab holds the control's own fields, its framework references, its attributes, and its owners. ### Opening control details 1. **Click on a control title** in the overview 2. **The control details tab opens** with various sections 3. **Details section contains** all basic information and settings ![Control details tab](/images/help/controls_details_tab.png) ### Editing basic information Once created, a control's name, validity period, type, and description can all still be changed. **Editable fields in Details tab:** - **Name** - Adjust control name - **Custom ID** - Change for better reference - **Valid from / Valid to** - Set validity period. Plans only create tasks for valid controls. - **Control Type** - Change between Manual/Automated/IT-Dependent Manual. This is an optional control label. - **Description** - For adding or adjusting the Control description **Buttons in Details tab:** - **Archive** - For archiving controls - **Delete** - For permanently deleting controls **How to edit information:** 1. **Click in the relevant field** 2. **Adjust the text or selection** 3. **Click the Update button** bottom left or top right of the screen to save changes > **info:** **Activate Controls to automatically create Tasks**: Plans can only create automatic tasks for active controls. A Control is "Active" when: - The "Valid from" date is in the past and "Valid to" in the future or empty. - At least one Asset is linked to the Control - At least one Plan is linked to the Control ### Framework References **What are Framework References?** Framework References link your control to compliance standards like ISO27001, NIS2, or GDPR. **Benefits of framework mapping:** - **Compliance tracking** - Automatic progress for compliance standards - **Audit support** - Clear traceability to requirements - **Reporting** - Structured compliance overviews ### Creating control attributes Attributes let you tag a control with a category or label for filtering. **Adding attributes:** 1. **Scroll to "Attributes" section** 2. **Click "Add attribute"** 3. **Fill in a title** and select 'Add item' or press 'Enter' to save it. 4. **Fill in a value** and select 'Add item' or press 'Enter' to save it. 5. **Click 'Add'** to definitively add the attribute. ![Adding control attributes](/images/help/controls_attribute_add.png) **Removing attributes:** 1. **Scroll to "Attributes" section** 2. **Move mouse over attribute** a trash can icon appears 3. **Click trash can** to remove the attribute **Editing attributes:** Create a new attribute with the correct information and then delete the 'old' attribute. > **tip:** Reduce error-proneness and typos by selecting existing titles and values from the dropdown list (if used before) instead of typing yourself. ### Assigning control owners The owner is the person accountable for the control's effectiveness. **Assigning Owners:** 1. **Find "Owners" section** on the right side 2. **Click the user icon** 3. **Type username** and select from dropdown 4. **Multiple owners possible** for shared responsibility **Setting Executors:** - People who perform execution tasks - Automatically assigned to new manual tasks - Often IT teams or operational staff **Assigning Assessors:** - People who perform assessment tasks - Automatically assigned to assessment tasks - Usually auditors or compliance officers > **tip:** **Role clarity**: Owners are responsible for control effectiveness, Executors perform tasks, and Assessors evaluate whether controls work. One person can have multiple roles. ## Relationships with other objects Controls can be linked to other objects like assets, risks, and plans using the chip component interface. This provides a visual and intuitive way to manage relationships. ![Chip Component Interface](/images/help/chip_component.png) **How the chip component works:** - **Click to add** - Click on empty chip areas to add new links - **Visual indicators** - Linked objects appear as removable chips - **Quick removal** - Click the X on any chip to remove the link - **Auto-save** - Changes are saved automatically ### Linking assets **Why link assets?** By linking assets you establish which business resources this control applies to. > **tip:** When using Plans, one task per linked Asset will be created by the Plan. By adding multiple Assets you can also subdivide tasks to Asset owners. **Linking assets:** 1. **Go to "Assets" tab** in control details 2. **Select relevant assets** from the available list 3. **Links are automatically saved** **Asset selection criteria:** - **Relevance** - Asset must actually be protected by control - **Proportionality** - Critical assets require more/stricter controls - **Practical feasibility** - Control must be realistically implementable on asset ### Linking risks **Why link risks?** By linking risks you establish which risks this control helps mitigate. **Risk-control mapping:** 1. **Open "Risks" tab** of the control 2. **Select relevant risks** that this control helps mitigate 3. **Links help** with risk management and impact analysis **Mapping strategies:** - **Direct mitigation** - Control directly reduces this specific risk - **Preventive effect** - Control prevents this risk type - **Detective function** - Control detects when this risk occurs - **Corrective measure** - Control repairs damage from this risk > **info:** The controls you link to risks will reappear during risk assessment. Determine during this risk assessment whether the linked measures still sufficiently mitigate the risk, or whether additional control links are needed. ### Linking and unlinking tests **Why link tests?** A test only counts towards compliance once it is linked to a control. Linking makes the test "In scope": its result feeds the control's effectiveness and the test statistics. Unlinking makes it "Out of scope" again. **Linking tests:** 1. **Go to "Tests" tab** of the control 2. **Select the text field** to see the available tests, grouped per integration 3. **Search by test name** or pick one from the list 4. **Links are automatically saved** - the test is immediately "In scope" **Unlinking tests:** 1. **Go to "Tests" tab** of the control 2. **Click the X** on the chip of the test you want to remove 3. **The link disappears automatically** - the test becomes "Out of scope" and stops counting towards scoring > **info:** The same link can be made from the other side: open the test and use the Controls selector on the test detail page. Both routes produce the same result. Read more about this in [Executing and monitoring tests](/docs/tests/executing-and-monitoring-tests). > **warning:** Unlinking a test removes it from your compliance scoring. Historical results stay on the test itself, but the test no longer contributes to any control's effectiveness. Policy tests work the same way: unlinking a policy test puts the corresponding policy or required document out of scope. ### Linking plans **Why link plans?** Plans ensure that new Control tasks are created periodically (e.g. monthly, annually). 1. **Go to "Plans" tab** of the control 2. **Select relevant plan** from available schedules 3. **Automatic task creation** starts according to plan frequency and schedule **Most common Plan types:** - **Monthly Monitoring** - Monthly checks - **Quarterly Testing** - Quarterly validation - **Annual Review / Audit** - Annual control assessments > **warning:** **Plan overload**: Avoid assigning multiple plans to one control. This leads to excessive tasks and confusion about deadlines. ## Control lifecycle management A control becomes active only when its validity dates, a plan, and at least one asset are all in place. When it stops applying, archive it to keep the history, or delete it to remove it entirely. ### Control activation and deactivation Miss any one of the three and the control stays Inactive, whatever else you fill in. **Activating control:** - Set the "Valid from" date (today or earlier) - Set the "Valid to" date (future) - Link to a Plan - Link to at least one asset - Status automatically changes to "Active" **Deactivating control:** - Set "Valid to" date (today or earlier) - Completed tasks remain visible for audit - Planned future tasks are cancelled - Status changes to "Inactive" ### Archiving controls Archive a control once it genuinely stops applying, rather than deleting it, so the history survives. **When to archive:** - Control is permanently no longer applicable - Framework requirement has expired - Control is replaced by new version - Organisational change makes control irrelevant **Archiving process:** 1. **Select one or more controls** with checkboxes in overview 2. **Click "Archive"** button at top of table 3. **Confirm archiving** - controls disappear from daily overview 4. **Historical data** remains available for audit and reporting **Effect of archiving:** - Control appears in "Archived" tab - All links are hidden but preserved - No new tasks are created for this control anymore - Compliance calculations and statuses don't account for archived controls. There are several differences between activating and archiving: 1. Activation (and Deactivation) happens automatically when the validity period starts or expires. Archiving is always manual. 2. A control can be deactivated because necessary links with Assets and/or Plans are missing. Archiving is always manual. 3. When a control is deactivated, links with assets, risks and tasks remain visible throughout the application. With Archiving these links are hidden. ### Deleting controls Delete a control only when it should never have existed: sensitive test data, a duplicate, or an incorrect setup. **When to delete:** - Control contains sensitive information that may not be preserved - Test setup with incorrect configuration that needs to be completely redone - Duplicate controls that were accidentally created - Organisation requires permanent deletion of certain data **Deletion process:** - **Select one or more controls** with checkboxes in overview - **Click "Delete"** button at top of table - **Make choice** between automatically closing linked tasks or not - **Confirm deletion** - definitive action that cannot be undone **Effect of deletion:** - Control is permanently removed from the entire application - All linked tasks, tests and historical data are closed (if chosen) - Links with assets, risks and plans are broken - Audit trail and reporting history is lost With deletion, the control can only be restored via a restore request to the helpdesk. With archiving, restoration is possible via the 'Archived' tab, and then the 'Unarchive' option ## Control templates Start from Tidal's templates for the standard frameworks and adapt them, rather than writing each control from scratch. ### Using control templates Each template already comes pre-mapped to the framework requirements it satisfies. **Predefined controls:** Tidal offers templates for standard compliance frameworks: **ISO27001 controls:** - A.01 Context of the organization established - A.02 Legal and contractual requirements identified - A.03 Scope of the ISMS determined - [...etc. complete set available] **Template benefits:** - **Pre-filled descriptions** - Professional control descriptions - **Framework mappings** - Automatic compliance references to all applicable frameworks - **Recommended attributes** - additional information that can be used for filtering and reporting - **Auditor tested** - Proven effective control setup ## Best practices for control management Controls stay manageable when their names say what they achieve and someone reviews them on a fixed schedule rather than only when something breaks. ### Control naming - **Descriptive names** - What exactly does the control achieve? - **Consistent IDs** - Group related controls - **Avoid acronyms** - Unless universally understood ### Control monitoring Reviewing a control on a fixed rhythm, not just when something breaks, is what keeps it actually effective. **Regular reviews:** - **Quarterly reviews** - Control performance and relevance - **Annual assessments** - Thorough effectiveness evaluation - **Incident triggers** - Extra review after security incidents - **Framework updates** - Adjustments after standard changes **Monitor the following performance indicators:** - **Task completion rates** - Percentage of timely completed tasks - **Test success rates** - Percentage of successful automated tests - **Issue resolution time** - Speed of problem solving - **Stakeholder satisfaction** - Feedback from control testers ### Continuous improvement Look for controls that could be automated or better scoped before their next review. **Control optimisation:** - **Automation opportunities** - Which manual tasks can be automated? - **Frequency fine-tuning** - Is current test frequency optimal? - **Risk-based scoping** - Right asset coverage without overload? - **Regularly review available integrations** - Better tool connections possible? **Change management:** - **Impact assessment** - Assess the effect of changes in controls on compliance (control-risk links) - **Communicate to stakeholders** - Communicate changes timely - **Training updates** - New procedures adequately trained - **Rollback planning** - Use archiving and validity periods to be able to return to previous version if needed > **tip:** **Start small, build out**: Begin with core controls for your most important assets and frameworks. Gradually add controls as your team gains experience and processes mature. ## Next steps Now that you can create and manage controls: - **Implement your first controls** for critical business processes - **Set up automatic planning** for regular validation - **Monitor control effectiveness** via dashboards and reports - **Optimise configurations** based on practical experience For operational guidance on tasks and testing, see [Implementing and testing controls](/docs/controls/implementing-and-testing-controls) ### Getting started with Controls URL: https://tidalcontrol.com/docs/controls/getting-started What controls are in Tidal Control and how to use the Controls page. What the table columns and status colours mean, the progress indicator, and how to filter. The Controls page lists every security measure your organisation has in place, with a compliance status per control that Tidal calculates from its tasks, tests, and assessments. This article covers reading that overview: what the columns and status dots mean, and how to search and filter it. ## Navigating the Controls page The overview opens on your active controls, with three summary counters above the table and one row per control. ### Opening the Controls page Go to the Controls section via the main menu. You'll arrive at an overview page showing all controls from your organisation. ![Controls overview](/images/help/controls_overview.png) ### What you see in the overview The controls overview shows three important status indicators at the top: - **Assigned** are Controls that are assigned to an owner - **Implemented** are controls that are implemented and actively monitored - **Audited** are controls that have been audited and have compliance status ### Understanding the Controls table The main overview shows per control: - **Status** - Gray/Green/red dots show the compliance status - **Name** - Descriptive title of the security measure - **Assets** - Number of linked business assets (e.g. "2" means 2 assets) - **Risks** - Number of linked risks - **Issues** - Outstanding problems related to this control - **Progress** - Progress of tasks (e.g. "2/2" means 2 of 2 tasks completed) - **Due Date** - Deadline for outstanding tasks - **Framework** - Compliance standard (ISO27001, NIS 2, etc.) - **Assignee** - Assigned person/team ## Understanding status indicators A control's dot and its progress fraction are both derived, not set by hand: the dot comes from its tests, task deadlines, and latest assessment, and the fraction counts completed work against total work. ### Status colors The status column indicates whether a control is compliant or not. This is calculated as follows: **Green dot** - Control is compliant - All linked tests are OK (passed), and; - All tasks are completed or have a deadline in the future, and; - The latest closed assessment is effective. **Red dot** - Control is not compliant - One or more outstanding tasks are past the deadline (overdue) - One or more tests have a problem (failed, error) - The latest closed assessment is ineffective **Gray dot** - Control has no status yet - No tasks or tests are linked to this control yet - Or the control is archived > **warning:** Tasks without deadlines are counted as compliant (green). For accurate tracking, set deadlines on tasks. ### Progress indicator **Numerical progress** (e.g. "2/3"): - **First number** = number of completed tasks and successful tests (passed) - **Second number** = total number of linked tasks and tests - **Percentage** = (completed ÷ total) × 100 **Color coding**: - **Green** = 100% completed - **Orange** = Otherwise ## Search and filtering Search matches control names and references such as "A.01". The filters cover assignee, framework, plan, function, phase, and process, with type and relationship filters behind "More filters". ### Search functionality Nothing filters until you press Enter; there is no live-as-you-type result. **Using the search bar:** 1. **Click in the search bar** at the top of the overview 2. **Type control names** or control references (e.g. "A.01" or "Information security") 3. **Press 'Enter'** and your search results will be shown ### Filter options Use the filter dropdown menus to find specific controls: **Open vs Archived:** - **Open** - Active controls that are monitored - **Archived** - Controls that are no longer applicable **Filter by Assignee:** - Show controls assigned to specific people - Useful to see your own responsibilities **Filter by Frameworks:** - **ISO27001** - International security standard controls - **CyFun Essential** - Cyber fundamentals (NIS2) - **Other frameworks** - Depending on your organisation setup **Filter by Plans:** - Show controls linked to specific plans - For example annual review cycles **Filter by Function:** - **Procurement** - controls for the procurement function - **Human Resources** - controls for the HR function - **Other functions** - controls for other functions in the organisation **Filter by Phase:** - Filters for each phase in your Plan-Do-Check-Act cycle **Filter by Process:** - Filters for each business or IT process, e.g. 'Incident response' The "More filters" option contains additional filtering possibilities: **Filter by Type:** - **Policies & Procedures** - Policy and process measures - **Process** - Process measures - **Technical** - Technical control measures **Filter by Risks, Assets, or Issues:** - **Risks** - Show controls linked to specific risks - **Assets** - Show controls linked to specific business assets - **Issues** - Show controls linked to specific problems > **tip:** You can also create or remove filters yourself with attributes. Read more about attributes in [Creating and managing Controls](/docs/controls/editing-and-managing-controls) ### Combining multiple filters You can use different filters simultaneously for very specific results: - **Example**: Filter on "ISO27001" + "Annually" + your name as assignee to see all your annual ISO controls - **Reset filters**: Click away individual filters or use "Clear filters" ## What counts as a control Controls in Tidal Control are control measures that your organisation implements to manage risks and ensure compliance. These can include: - **Organisational measures (A.xx)** - Risk assessments, internal audits, management reviews - **Personnel measures (B.xx)** - Training, contracts, background checks - **Technical measures (C.xx)** - Firewalls, encryption, access controls - **Data measures (D.xx)** - Data management procedures, Privacy policy, Records of processing activities (ROPA) - **Vendor measures (E.xx)** - Vendor policy, Vendor agreements, Vendor monitoring - **Physical measures (F.xx)** - Access cards, camera surveillance, lock and key management - **Quality measures (G.xx)** - Quality manual, customer requirements, quality monitoring - **AI measures (H.xx)** - AI policy, AI data governance procedures, AI impact assessment By registering and monitoring controls in Tidal, you gain insight into your security status, compliance level, and which actions still need to be performed. > **tip:** Controls can be linked to assets, risks, and plans. This creates a complete picture of which measures apply where and how effective they are. Read more about this in [Creating and managing Controls](/docs/controls/editing-and-managing-controls) ## Next steps Now that you know how to find controls and interpret their status, you can: - **Complete tasks** linked to controls - **Gather evidence** for compliance audits - **Assess controls** as part of an internal audit - **Add new controls** for improved risk management > **note:** **No controls visible?** This may mean that no control measures have been configured in your Tidal environment yet. Start by adding your first control via the "Add control" button, or ask your administrator to import framework templates. ### Implementing and testing controls URL: https://tidalcontrol.com/docs/controls/implementing-and-testing-controls A control proves itself through the work attached to it. How to complete manual tasks, upload evidence, read automated test results, and record assessments. A control proves itself through the work attached to it: manual tasks that people complete and document, automated tests that check a system, and assessments that record a verdict on whether the control is effective. This article covers all three. ## Understanding Tasks vs Tests Tidal distinguishes two fundamental ways to validate controls: **Manual Tasks** - Manual activities performed by people - Require human assessment and evidence - For example: creating network diagrams, verifying that incidents are resolved - Status: Open → Closed **Automated Tests** - Monitoring progress in Tidal - For example: Periodic policy reviews, completeness of risk information - Monitoring external systems - For example: Azure security settings, firewall rules, encryption status - Status: Not executed → Pass/Fail > **info:** **Test dependencies**: Automated tests require that the relevant integration is correctly configured. Without a working connection, tests remain in "Error" status. Read more about integration setup in [Integrations](/docs/integrations) ## Working on manual tasks Manual tasks open in a sidepanel on the control. You do the work there: discuss it in the Conversation tab, attach your evidence to a comment, then close the task. ### Viewing manual tasks 1. **Go to the control** with pending tasks 2. **Click on the control name** to see the tasks and tests for this control 3. **Click on a manual task** in the expanded list 4. **The task sidepanel opens** with all necessary information 5. **The Details tab** contains additional information about the task 6. **The Linked tasks tab** contains an overview of linked tasks 7. **The Feed tab** contains a complete audit trail of this task ![Working on a task](/images/help/controls_task_detail.png) ### Collaborating via conversations Comments and @mentions are how progress gets documented and the right people get pulled in. **Conversation tab functionality:** - **Add comments** - Document progress and ask questions - **Use @mentions** - Notify specific people (e.g. @john) - **Real-time notifications** - Stakeholders receive immediate messages **Example of an @mention:** ``` @jane Can you review the network diagram I uploaded? ``` ### Uploading evidence Evidence is attached through a comment, so every file arrives with the context of why it was added. **File upload:** You can upload documents directly in the Conversation tab: 1. **Scroll to the "Add your comment" section** in the task interface 2. **Click "Drop, or click to add files"** or drag files directly to the comment field 3. **A new comment automatically appears** containing a link to the just uploaded file **Evidence best practices:** - **Screenshots with timestamps** for configuration evidence - **Signed documents** for policy approvals and training records - **Log files** for incident response and monitoring activities - **Reports** for security scans and audit results ### Completing / closing tasks - **Select 'Close task'** at the top of the screen, or - **Write a comment and select 'Submit and Close'** to close the task with a final comment. Assessment tasks are a special type of task that ask the user to indicate whether the Control should be assessed as "Effective" or "Ineffective". This conclusion affects the Control Status indicator on the overview page. See [Completing assessments](/docs/controls/implementing-and-testing-controls#completing-assessments) for more information. ## Working on tests You do not complete a test yourself; you refresh it and read the result. Any result other than Passed marks the control red. ### Viewing tests 1. **Go to the control** with linked tests 2. **Click on the control name** to see the tasks and tests for this control 3. **Click on a test** in the expanded list 4. **The test sidepanel opens** with all necessary information ### Refreshing test results 1. **Click "Refresh"** top right in the overview 2. **The test now starts running** and will add a new result > **tip:** In the Tests menu you can refresh multiple tests at once. Read more about this in [Executing and monitoring tests](/docs/tests/executing-and-monitoring-tests) ### Interpreting test results **Not executed (Gray)** - The test has never been executed - Refresh the test to get a result - Control is automatically marked red **Pass (Green)** - Test executed successfully - Configuration meets required security standards - Contributes to green control compliance status **Fail (Red)** - Test detects non-compliance or security issue - Requires immediate attention and remediation - Control is automatically marked red **Error (Orange)** - Technical error in test execution - Test must be executed again - Control is automatically marked red ![Automated test results](/images/help/controls_azure_test_detail.png) ### Azure Cloud tests example Azure integration tests check: - **Data encryption at rest** - Verification that Azure Data Disks are encrypted - **Network security groups** - Firewall rules and access controls - **Identity management** - Multi-factor authentication configurations - **Resource compliance** - Tagging and naming conventions - **Backup configurations** - Automated backup schedules and retention > **info:** **Integration dependencies**: Azure tests require a working Azure connector with proper permissions. Without access to Azure subscriptions, tests remain in "Error" status. Setup instructions can be found in [Azure Integration](/docs/integrations/azure) ## Completing assessments An assessment is a manual task with one extra obligation: you have to conclude whether the control is Effective or Ineffective, and that verdict feeds the control's status. ### Assessments vs regular tasks Assessments are specialized manual tasks with additional functionality: - **Assessors** - Automatically assigned to control assessors (not owners) - **Linked tasks tab** - Overview of all related tasks - **Effectiveness conclusion** - Mandatory choice: Effective vs Ineffective - **Periodic assessment per control** - assessments typically occur periodically, with one assessment covering the entire control - **One assessment for multiple controls** - it's quite normal to assess multiple controls in one assessment. The Assessment task is then visible under each linked control in the overview ### Executing assessments Assessments are otherwise executed in the same way as regular manual tasks. ### Drawing a conclusion There is no unambiguous instruction to determine whether a control is Effective or Ineffective, or these instructions are organisation-specific. But in general terms, we recommend the following strategy: **A control is effective when:** - All linked tasks have been successfully completed (closed) - The associated evidence demonstrates adequate implementation of the relevant control - All automated tests have been successfully completed (passed) - No tasks, tests or other requirements are missing - Any Issues linked to the control have been handled timely and adequately **A control is ineffective when:** - Tasks have not been executed according to deadline - The associated evidence is insufficient - Automated tests show security issues - Tasks or tests needed for the control are missing - Any Issues linked to the control have not been handled timely or adequately ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/controls/troubleshooting-and-faq Most control problems trace back to activation conditions. Why a control stays Inactive, why a Plan generates no tasks, and what an automated test Error means. Most control problems trace back to the activation conditions: a control stays Inactive until it is complete, and a Plan only generates tasks for controls that are already active. The answers below cover that, plus editing, bulk changes, and where to read a control's compliance status. ## Frequently asked questions ### Why does my control keep "Inactive" status? **A control only becomes "Active" when all the following conditions are met:** - The "Valid from" date is in the past and "Valid to" in the future (or empty) - At least one Asset is linked to the Control - At least one Plan is linked to the Control **Solution:** 1. **Check validity period** - Go to Details tab and set correct dates 2. **Link an asset** - Go to Assets tab and select relevant business resources 3. **Link a plan** - Go to Plans tab and select an appropriate schedule 4. **Refresh the page** - Status update may require a browser refresh > **note:** Only active controls can have automatic tasks created by Plans. Inactive controls are "silent" and generate no new activities. ### Can't I edit a control after creating it? **Controls can always be edited,** regardless of their status. **Solution:** 1. **Click on control name** in the overview 2. **Details tab opens** where all fields are editable 4. **Make changes** and click "Update" to save **Possible causes of problems:** - Browser cache - try hard refresh (Ctrl+Shift+R) - Insufficient rights - ask administrator for edit permissions ### How can I manage multiple controls at once? Selecting several controls at once lets you assign an owner, archive, or delete them in a single action. **Available bulk operations:** - **Assign owners** - Select controls and assign the same owner - **Archive** - Move multiple controls to archive - **Delete** - Permanently delete selected controls **Bulk workflow:** 1. **Select controls** with checkboxes on the left in the overview 2. **Relevant buttons appear** at the top of the table (Archive, Delete, Assign) 3. **Choose desired action** and confirm **Not possible for bulk operations:** - Edit control descriptions - Adjust framework references - Manage individual attributes ### Why am I not getting automatic tasks from my Plan? **Plans only create tasks for active controls that meet all conditions.** **Check the following points:** 1. **Control status** - Must be "Active" (green) 2. **Plan linking** - Control must be linked to a Plan via Plans tab 3. **Asset linking** - At least one asset must be linked 4. **Plan timing** - Plan schedule determines when tasks are created **Plan troubleshooting:** 1. **Go to control Details** and check all tabs 2. **Verify that Plan is active** - Inactive plans don't create tasks 3. **Check Plan scheduling** - Some plans only work on specific dates 4. **Wait for next cycle** - Tasks are created according to plan frequency ### Where do I find the compliance status of my control? The status shows as a dot in the overview, as a percentage on the dashboard, and in full detail on the control itself. **Compliance status locations:** - **Controls overview** - Status column shows green/red/gray dots - **Dashboard widgets** - Assigned/Implemented/Audited percentages - **Control details** - Detailed status information and history **Status meanings:** - **Green** - All tasks completed and tests passed - **Red** - Overdue tasks or failed tests - **Gray** - No tasks or tests linked yet **If status is incorrect:** 1. **Refresh page** - F5 for updated information 2. **Check task status** - All tasks must be "Closed" for green 3. **Re-run tests** - Click "Refresh" on failed tests 4. **Check deadlines** - Tasks without deadline count as compliant See [Implementing and testing controls](/docs/controls/implementing-and-testing-controls) for detailed status explanation. ## Common problems ### Automated tests remain in "Error" status This is almost always the integration, not the test itself. Try disconnecting and reconnecting it first. **Test execution problems:** - Tests don't start after clicking "Refresh" - Permanent "Error" status despite working integration - "Not executed" status doesn't change to result **Solutions:** - **Restart integration** - Disconnect and reconnect external system - **Update credentials** - Refresh API keys and permissions - **Contact technical support** - With specific error logs For technical integration problems, see [Getting started with Integrations](/docs/integrations/getting-started) ### Tasks are not automatically assigned **Problem:** Plan creates tasks but they don't get an owner. **Possible causes:** - **Control has no owners** - Owners, Executors or Assessors missing - **Plan configuration** - Plan doesn't assign default assignees - **Asset owners missing** - Tasks per asset but assets have no owners **Solutions:** 1. **Assign control owners** - Go to Details and set Owners, Executors, Assessors 2. **Check asset owners** - Assets must have owners for asset-specific tasks 3. **Manual assignment** - Manually assign pending tasks via Tasks page > **info:** **Task assignment logic**: Plans always assign tasks to both control owners and asset owners. Ensure at least one level has owners. ### Control attributes cannot be added Both the title and the value have to be individually confirmed with 'Add item' before the attribute itself will save. **Error scenarios:** - "Add attribute" button doesn't work - Title or value fields don't accept input - Attributes disappear after saving **Troubleshooting:** 1. **Add item** - Title and value must each be individually confirmed with the 'Add item' button after filling in. 2. **Check field validation** - Title and value cannot be empty 3. **Use dropdown suggestions** - Select existing values where possible **Attribute workflow:** 1. **Click "Add attribute"** 2. **Fill in title** and press Enter or click "Add item" 3. **Fill in value** and press Enter or click "Add item" 4. **Click "Add"** to save definitively **Attribute management tips:** - Reuse existing titles for consistency - Use short, clear values - Delete via trash icon on mouse hover ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Policies ## Policies URL: https://tidalcontrol.com/docs/policies The policy documents your frameworks require, pre-filled and awaiting content. Write them in the editor, upload existing files, or link to ones held elsewhere. ### Writing and editing policies URL: https://tidalcontrol.com/docs/policies/creating-and-editing-policies Four ways to get a policy into Tidal Control. Start from a Tidal template, write it in the editor, upload a file, or link to one held in another system. There are four ways to get a policy into Tidal: start from the Tidal template for that policy, write it in the built-in editor, upload an existing file, or link to one held elsewhere. This article covers all four, plus the formatting, ownership, and version history that apply once the policy exists. ## Starting from a Tidal template Most policies ship with a template we wrote: the whole document, structured and worded, with the parts only you can answer marked for you to fill in. Choosing **Start with template** copies it into a new draft, and from that point it is an ordinary policy in the editor. ![A template opened in the editor](/images/help/policy_template_instructions.png) Every template opens with a yellow INSTRUCTIONS box. It tells you what to replace on the first version, what approving the document proves, and how often to review it afterwards. The yellow box is guidance for you, not part of your policy. Delete the whole block before approving, or it ships into the document your auditor reads. The same goes for the yellow highlights in the body once you have answered them. Work through it in this order: 1. **Replace `[Company Name]`** and any other bracketed placeholder. Nothing fills these in for you, and the templates use them heavily. 2. **Read the whole document** and adjust it to how your organisation actually works. A template that describes something you do not do is worse than no template. 3. **Remove the yellow help texts** as you answer them. 4. **Delete the INSTRUCTIONS box**, then approve. > **info:** A few required documents are spreadsheets rather than pages, such as the authorisation matrix and the record of processing activities. Those arrive as a workbook you download, fill in and upload again, so they do not open in the editor. > **note:** **Not every policy has a template.** The option appears only where one exists. On a free trial you can start three of them; the rest are still listed, and say they need an upgrade rather than quietly disappearing. ## Using the Policy Editor The Policy Editor is our built-in editor that allows you to create and edit professional policy documents. When you choose "Create with editor", you'll be taken to the editor. ### First steps in the editor Initially, the editor is loaded with a standard template that gives you a good starting point: ![Initial template](/images/help/policy_initial_template.png) In the editor you see: - **Policy title** - Automatically filled in based on your policy - **Document status** - Approved or Draft - **Policy version number** - For version control - **Document content** - Your actual policy text - **Action buttons** - For editing, approving, downloading etc. - **Menu button (three horizontal lines)** - Opens the sidebar with more information and version history > **info:** When you first open the editor, you are in **view mode**. The document can only be edited after you click the "Edit draft" button. ### Editing documents When you click the "Edit draft" button, the editor toolbar appears with all editing capabilities: ![Editor toolbar](/images/help/policy_editor_toolbar.png) The editor contains a complete set of word processing functionalities: - **Text formatting** - Bold, italic, underlined - **Lists** - Numbered and bullet points - **Headings** - Different levels for structure - **Tables** - For structured information - **Links** - To external sources or internal documents - **Images** - For visual support > **tip:** Some options are not visible in the toolbar but can be found in the menu bar. Explore the different menus to discover all functionalities. ### Templates and structure #### Standard template The standard template contains typical sections for policy documents: - **Purpose and scope** - Why does this policy exist? - **Responsibilities** - Who does what? - **Procedures** - How is the policy applied? - **Compliance and monitoring** - How is compliance controlled? #### Creating your own structure You are not bound to the standard template. You can: - Add or remove sections - Create your own heading structure - Add specific content that fits your organisation > **caution:** **Watch out with approved policies!** When you click "Create new draft" in an approved policy, a new draft is automatically created with the same content as the approved document. The current approved document will only be replaced on the main page when you approve this new draft. ## Uploading existing documents If the policy already exists as a file, upload it instead of rewriting it in the editor. Uploaded policies are recognisable by a paperclip icon. ### Upload process When you choose "Upload file or use already uploaded document", you get an upload interface: ![Upload your file](/images/help/policy_upload_file.png) You can upload files by: 1. **Drag & Drop** - Drag files directly to the upload box 2. **Click** - Opens a new File Explorer selection screen 3. **Search for a document** - Select a document that is already in Tidal **Supported file formats:** - PDF documents - Microsoft Word documents (.doc, .docx) - Microsoft Excel documents (.xls, .xlsx) - ...and many more ### Upload management After upload, you see in the overview that uploaded files are recognisable by the paperclip icon: ![Policies overview](/images/help/policy_overview.png) #### Uploading new versions When you have a new version of your document ready: 1. Go to the "Policy Options" menu of the policy 2. Click on "Link other document" 3. Upload your new file When uploading a new version, the approval status is automatically reset. Your new document has "Draft" status and must be approved again. ### Advantages and limitations Uploading keeps your existing workflow intact, but editing that document still has to happen outside Tidal. **Advantages of uploaded documents:** - Maintain your current workflows and templates - No retraining of your team needed - Familiar software and formatting options **Limitations:** - Limited editing capabilities within Tidal - Manual version management - No integrated collaboration features ## Linking external policies If your policies live in another system, link to them by URL and Tidal will track their status without holding the content. ### URL-based management For organisations that manage their policy documents elsewhere, Tidal offers the possibility to link external URLs: ![URL input menu](/images/help/policy_url.png) ### Setup process 1. **Choose "Link to an external location"** in the start menu 2. **Enter the URL** of your external policy document 3. **Click "Add link"** to save the url ### URL management The URL is stored in a file within Tidal, allowing you to still use: - Approval workflows - Review cycles - Compliance tracking > **tip:** **Version history in Tidal for external policies:** You can still maintain version history within Tidal by manually editing the URL in the policy editor when a new version is available. ### Best practices for external policies An external policy is only as reliable as its URL, so keep that link stable and accessible to everyone who needs it. **Documentation:** - Keep track of which URL refers to which version, or; - Ensure stable URLs that don't change **Accessibility:** - Check that URLs are accessible to all relevant users - Set proper permissions in your external system - Test links regularly for validity Externally managed policies are not indexed in Tidal, so their content is not known to our AI assistance. ## Content formatting and styling The editor supports the formatting a policy actually needs: headings, tables, and internal and external links. ### Structuring text #### Effective heading structure Use a logical hierarchy of headings: - **H1** - Chapter titles - **H2** - Section titles - **H3** - Paragraph titles #### Lists and enumerations Use the list type that matches the content: ordered for a sequence, unordered for options. - **Bullet points** for unordered items - **Numbered lists** for procedures and steps - **Nested lists** for hierarchical information ### Using tables Tables are ideal for: - **Roles and responsibilities** overviews - **Procedure steps** with actors - **Compliance requirements** with deadlines - **Contact information** displayed in structured format ### Links and references #### Internal links Link to other Tidal content directly, using the article's own URL. - Link to other policies within Tidal - Refer to related controls - Link to relevant frameworks #### External links Link out to legislation or standards this policy is based on. - Reference legislation and standards - Link to external procedures - Refer to additional documentation > **note:** **Preventing broken links:** Check external links regularly and update them if necessary. Broken links can cause compliance problems and confusion for users. ## Policy detail page and sidebar The sidebar is where a policy's metadata lives: its owners, its version history, and its changelog. ### Opening the sidebar When you are in the Policy Editor, you can find additional information and functions via the sidebar: 1. **Click the menu button (three horizontal lines)** at the top right of the editor 2. **The sidebar slides open** on the right side of your screen 3. **Here you find** ownership, version history, frameworks and more details ![Policy side bar](/images/help/policy_editor_side_menu.png) ### Assigning owner(s) via the Policy detail page To assign owners to a specific policy: 1. **Go to a specific policy** by clicking on the title 2. **Click the menu button (three horizontal lines)** to open the sidebar 3. **Find the "Owners" section** in the sidebar 4. **Click the user icon** to add an owner 5. **Select users** from the available list > **info:** You can assign multiple owners to one policy. This is useful when different departments are responsible for different aspects of the policy. ### Navigating version history In the policy editor sidebar (three horizontal lines) you find the complete version history: - **Active version** is marked in blue - **Click on a version** to view it - **Draft versions** can still be edited - **Approved versions** are read-only This function is useful to: - **Compare changes between versions** - **Go back** to an earlier version - **Check** which version is currently active ### Updating policy information In the sidebar you can also check: - **Next review date** - When the policy needs to be reviewed - **Frameworks** - Which compliance frameworks are linked - **History** - Complete audit trail of changes > **tip:** **Automatic review reminders**: Tidal automatically sends notifications when policies are due for review. Set realistic review cycles to avoid overloading your team. ### Editing changelog For each version in the history you can: 1. **Click the pencil icon** next to a version 2. **Edit the change comment** to explain changes 3. **Adjust the version number** if desired 4. **Save the changes** > **note:** Editing changelog information does not affect the approval date or author of the document. It only helps in maintaining clear version information. ## Best practices for policy writing A policy is read by people who did not write it, so structure and plain language matter more than completeness. ### Structure and flow 1. **Start with context** - Why does this policy exist? 2. **Define scope** - Who and what does it apply to? 3. **Describe procedures** - How is it executed? 4. **Specify responsibilities** - Who does what? 5. (optional) **Explain monitoring** - How is compliance controlled? - often not needed because Tidal handles compliance. ### Language use A policy written in active voice, without jargon, is one people actually read and follow. **Clear and unambiguous:** - Use active instead of passive sentences - Avoid jargon and technical terms where possible - Define important concepts **Actionable content:** - Use verbs that indicate clear actions - Specify deadlines and frequencies - Give concrete examples where useful > **tip:** **Template consistency:** If you manage multiple policies, develop a standard template with consistent sections and formatting. This makes it easier for users to find information and ensures professional appearance. ### Getting started with Policies URL: https://tidalcontrol.com/docs/policies/getting-started Policies lists what your frameworks require. What the overview shows, what each status means, how you start one from a template, and what puts it in scope. Policies knows which policies your frameworks require. The overview lists the ones you have started; the ones you have not are behind the **Add policy** button. Starting one gives you four routes: open the Tidal template for that policy, write it in the built-in editor, upload an existing file, or link to one held elsewhere. ## Policies overview and filters When you open Policies, you'll see the policies you have started, with the progress cards above them counting everything your frameworks require: ![Policies overview](/images/help/policy_initialised_overview_page.png) The list is what exists. A policy you have not started yet has no row, and the "Not started" number in the **Needs attention** card is how you see how many are left. **Add policy** is where you start one. > **info:** Every policy that ships a Tidal template offers it as a starting point, on every plan. A free trial can start three of them; the rest are still listed, marked as needing an upgrade. Read more in [Writing and editing policies](/docs/policies/creating-and-editing-policies). > **note:** **Do you see an empty screen or are policies missing? Do you see them in the 'Out of scope' tab?** Then these policies are not yet linked to controls in your environment. See "In scope vs Out of scope" below for how to bring them in scope. For each policy you see: ### Policy fields - **Status** (Draft, Approved, To Review) - **Name** - **Owners** (if already assigned) - **Last version** - **Last approval** (if applicable) - **Actions** (the row menu, for renaming, resetting and the rest) ### Status meanings - **Draft**: Document available but not yet approved - **Approved**: Approved document within the last 12 months - **To Review**: No recent approval (older than 12 months) ### Search and filter - **In scope / Out of scope tabs** - Switch between policies that count towards compliance and policies that don't - **Search bar** - Type policy names or Tidal IDs to find specific policies - **Status filter** - Filter on Draft, Approved, or To Review - **Framework filter** - Show only policies required by a specific framework > **tip:** Use the status filter to work efficiently: filter on "Draft" to find policies ready for approval, or on "To Review" to catch up on overdue reviews. ## In scope vs Out of scope Scope decides which policies count. A policy is in scope when a control asks for it, and out of scope when no control does — the same rule that governs tests. ### What determines scope Every policy and required document has its own **policy test** in Tidal, named after the policy (for example "Acceptable use policy"). That test decides the scope: **In scope policies:** - **Policy test is linked** to at least one control in your ISMS - **Count towards** framework progress and compliance scoring - **Shown by default** when you open Policies or Documents **Out of scope policies:** - **Policy test is linked to no control** at all - **No effect** on your scores - the policy isn't required in your environment - **Only visible** under the "Out of scope" tab > **info:** A policy test is an ordinary Tidal test, so it follows the ordinary scope rule: linked to a control means in scope. Read more about this in [Getting started with Tests](/docs/tests/getting-started). ### Bringing a policy in scope 1. **Open Policies** (or **Documents**) and click the **"Out of scope"** tab 2. **Find the policy** you want to add and note its name 3. **Go to Controls** and open the control that should require this policy 4. **Go to the "Tests" tab** of the control 5. **Select the text field** and search for the policy name - policy tests sit under the "Tidal Control" group 6. **Choose the test** - the link saves automatically 7. **Return to Policies** - the policy now sits under "In scope" and can be started > **tip:** Not sure which control belongs to a policy? Filter your controls on the relevant framework and pick the control whose requirement the policy describes. A policy may be linked to several controls; one link is enough to make it in scope. ### Taking a policy out of scope 1. **Go to Controls** and open the control its policy test is linked to 2. **Go to the "Tests" tab** and **click the X** on the chip of the policy test 3. **Repeat for every control** the policy test is linked to - as long as one link survives, the policy stays in scope 4. **The policy moves** to the "Out of scope" tab and stops counting towards your scoring > **note:** Taking a policy out of scope deletes nothing. Drafts, approved versions and version history all survive, and reappear the moment you bring the policy back in scope. For the steps on the control side, see [Editing and managing controls](/docs/controls/editing-and-managing-controls). ## Policies and Documents Required documentation is split over two menu items: - **Policies** - Directive documents you establish and approve, such as an access control policy or an acceptable use policy - **Documents** - Required documents, such as an internal audit report, an organisation chart, or your information security objectives The screens are the same: same overview, same statuses, same editor, same three routes for filling a document, and the same In scope / Out of scope mechanism described above. What differs is what accumulates over time. A policy is one document you maintain, so approving it produces versions of the same thing. A required document is a recurring obligation, so each cycle adds a separate document — the 2026 audit report sits alongside the 2025 one rather than replacing it. > **info:** Read more about that difference, and how to file each cycle, in [Getting started with Required Documents](/docs/required-documents/getting-started). > **info:** Looking for uploaded files you attach to tasks as evidence? Those live under **Settings → Evidence**, not on the Documents page. Read more about this in [Evidence management and overview](/docs/evidence/managing-documents). ## Starting your first policy Click **Add policy**. Tidal asks which policy you want to start, listing everything your frameworks require that you have not started yet, with the controls each one satisfies: ![Add a policy](/images/help/policy_add_modal.png) Search by name if the list is long. Once you pick one, Tidal asks how you want to fill it. ### Choice menu ![Start menu](/images/help/policy_choice_modal.png) **1. Create with editor** - Create policies from scratch with our built-in editor - Full word processing capabilities - Automatic version control - Integrated approval and review flow > **tip:** We recommend new users start with the Policy Editor. This offers the most functionality and is easiest to get started with. You can always switch to another method later. **2. Start with template** - Opens the Tidal template for this policy, already written - Adapt it to your organisation instead of starting from a blank page - Same editor, same version control, same approval and review flow - Not every policy has one, so the option appears only where a template exists **3. Upload file or use already uploaded document** - Upload PDF or Word documents - Maintain your current documents and workflows - Easy version replacement (each 'upload' is a new version) - Integrated approval and review flow **4. Link to an external location** - Link policies that are managed externally - Use URLs to your existing documentation management system - Maintain overview without duplicating documents - Integrated approval and review flow ## Understanding policy types The choice you make affects how you proceed with this policy. Below is a brief explanation of the main functionalities per policy type: ### Internally managed policies - Created and edited in Policies - Full functionality available - Automatic PDF generation with metadata ### Uploaded documents - Recognisable by paperclip icon - Download/Upload capability - Editing outside Tidal - Each 'upload' is a new version ### Externally managed policies - URL-based - Editing and version management outside Tidal - Approvals and reviews possible in Tidal > **warning:** With externally managed policies, you are responsible for version management yourself. Make sure your external system provides sufficient audit trails. You can still use the approval and review flows within Tidal to demonstrate compliance. ### Approving and managing Policies URL: https://tidalcontrol.com/docs/policies/managing-policies What happens to a policy once it has content. Assigning owners, approving it, revoking that approval, switching its type, and working through version history. This article covers what happens to a policy after it has content: assigning owners, approving it, revoking that approval, switching its type, and working through the version history. Approval is the important one, since it is what makes a policy the current valid version for employees. ## Policies overview and filters In Policies you see the policies your organisation has started, in a clear table. Use the tools at the top to quickly find what you're looking for, and **Add policy** to start one that is not there yet: ![Policies overview](/images/help/policy_overview.png) ### Search and filter - **Search bar** - Type policy names or Tidal IDs to find specific policies - **Status filter** - Filter on Draft, Approved, or To Review - **Framework filter** - Show only policies required by a specific framework > **tip:** Use the status filter to work efficiently: filter on "Draft" to find policies ready for approval, or on "To Review" to catch up on overdue reviews. ## Assigning or changing policy owners Every policy should have at least one owner, responsible for its content and for keeping it current. ### Assigning owners Each policy can have one or more owners who are responsible for the content and currency. You assign them as follows: 1. **Select one or more policies** with the checkboxes on the left in the overview 2. **The "Assign to" label appears** at the top of the table 3. **Click "Assign to"** and choose a user from the dropdown 4. **The selected user is added** to all selected policies ### Removing owners To remove an owner, follow the same explanation as for assigning an owner. When you select the current owner of the Policy, they will be deselected from the list in this way, and thus removed as owner of the policy. ### Changing owners Changing owners is nothing more than removing the current owner and adding the new owner in the same step. ## Approving policies It is important to approve policies. First, to give employees clarity about the current, valid policy. Second, this may be a requirement from e.g. ISO-related standards. > **info:** Everything in this section applies to required documents under **Documents** as well — the approval, bulk approval and revoke flows are the same. Read "policy" as "required document". Read more about what is different about them in [Getting started with Required Documents](/docs/required-documents/getting-started). ### Individual approval For one policy: 1. **Open the policy** by clicking on the title 2. **Check the content** in view mode 3. **Click "Approve"** at the top of the page 4. **Add a version number and comment** 5. **Confirm the action** > **info:** **Version comments (Changelog comments)** help your team understand what has changed between versions. These are included in version history and PDF exports, and are mandatory for ISO standards. ### Bulk approval For multiple policies at once: 1. **Filter on "Draft" status** to find policies ready for approval 2. **Select the desired policies** with the checkboxes 3. **Click "Approve"** (appears instead of the filter buttons) 4. **Confirm the bulk approval** ![Approving multiple policies](/images/help/policy_multi_approve.png) > **caution:** With bulk approval, the **most recent draft** of each policy is automatically approved. The version number is then automatically incremented by one (v1.1 becomes v1.2) and a comment "Approval" is automatically added. Make sure these are the desired actions before you confirm. ## Managing approvals An approval can be revoked, and when it is, Tidal falls back to the previously approved version if there is one. ### Revoking approval When you want to remove the approval of a policy: 1. **Go to the "Policy Options" menu** of the policy 2. **Select "Revoke approval"** 3. **Confirm the action** ### Fallback to previous version If you revoke an approval and there is an earlier approved version available: - **Tidal automatically uses** the last approved version as fallback - **Your compliance status remains intact** - **Tests continue to function** with the previous version When you revoke an approval and there is no earlier approved version available, this can affect: - **Test results** linked to this policy - **Control status** that depends on this policy - **Compliance scores** in dashboards ## Changing policy type A policy can move between the three types after the fact, in either direction. ### From uploaded to internally managed To switch from uploaded documents (paperclip icon) to the Policy Editor: 1. **Go to the "Policy Options" menu** 2. **Select "Reset Policy"** 3. **Confirm the reset** - this removes all linked files and history 4. **Click Add policy**, pick the policy again, and choose "Create with editor" ![Start policy options](/images/help/policy_choice_modal.png) > **note:** A reset puts the policy back to "Not started", which means it leaves the list. It has not been deleted: it is waiting behind **Add policy** along with everything else you have not started. **Reset Policy** clears the version history and also resets the owner(s) of a policy. All previous Policy versions are also disconnected; These are still available via 'Documents'. This action **cannot be undone**. ### From internal to externally managed For the reverse route: 1. **Reset the policy** (see steps above) 2. **Start again** and choose "Link to an external location" 3. **Enter the URL** of your external document ## Advanced management functions Version history and policy metadata are both reached from the editor sidebar. ### Viewing and adjusting version history In the policy editor sidebar (three horizontal lines) you find the complete version history: - **Active version** is marked in blue - **Click on a version** to view it - **Draft versions** can still be edited - **Approved versions** are read-only - **Version comments** can also still be edited (icon with pencil) ### Updating policy information In the sidebar you can also check: - **Next review date** - When the policy needs to be reviewed - **Frameworks** - Which compliance frameworks are linked - **History** - Complete audit trail of changes > **tip:** **Automatic review reminders**: Tidal automatically sends notifications for the annual policy review. This review frequency cannot be changed. ## Bulk operations Selecting several policies at once lets you approve or reassign them in a single action. ### Working efficiently with selections For large quantities of policies: 1. **Use filters** to refine your selection 2. **Select All checkbox** to select all filtered items 3. **Bulk actions** appear automatically in the interface **Available bulk actions:** - **Assign owners** - Assign responsible persons - **Approve policies** - Approve multiple drafts > **info:** **Real-time updates**: Changes in policy status are immediately calculated in all linked reports and dashboards. Your compliance score is automatically updated. ## Best practices for policy management Policy administration stays manageable when ownership is explicit and drafts do not accumulate. ### Organisational structure A policy with a clear owner and a review date set before the deadline rarely goes stale. **Clear ownership:** - Assign at least one owner per policy document - Distribute responsibilities by area of expertise - Provide backup owners for absences if needed **Review planning:** - Plan reviews **before** the deadline - Combine related policies in one review session > **info:** You don't need a separate reminder for the deadline. Every policy has its own test, and that test only passes while there is an approval less than a year old. Once the last approval passes the one-year mark the policy moves to "To Review", its test starts failing, and the control it's linked to loses effectiveness — so an out-of-date policy surfaces in your compliance status on its own. That only applies while the policy is in scope. A policy whose test is linked to no control doesn't count towards anything, so an expired approval there goes unnoticed. Read more about this in [Getting started with Policies](/docs/policies/getting-started). ### Workflow optimisation Keeping the draft count low and changelog entries specific is what keeps version history actually useful. **Draft management:** - Keep the number of drafts limited - Approve in time to avoid confusion - Use clear changelog comments **Change tracking:** - Document changes with specific reasons - Use consistent version numbering - Remove version tables from documents themselves, or ensure they are consistent with automatic version management in Tidal ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/policies/troubleshooting-and-faq Policy questions are mostly about the approval lock. Approved policies are read-only, which makes their status and version history trustworthy. Plus fixes. Policy questions are mostly about the approval lock: approved policies are read-only, which is what makes their status and version history trustworthy. The rest covers empty overviews, PDF downloads, changelogs, and links inside policy documents. ## Frequently asked questions ### Why don't I see any policies in my overview? This is almost always a missing control link or the Out of scope tab, not a real access problem. **Possible causes:** - Your policies are not yet linked to controls - Policies are in the "Out of scope" tab - You don't have access rights for these policies **Solution:** 1. **Check the Out of scope tab** - Click "Out of scope" at the top of the overview 2. **Link policies to controls** - Go to the Controls section and link policy-tests 3. **Check your permissions** - Ask your administrator for access > **note:** New environments without a licence for policy templates start with all policies in the "Out of scope" tab. These must be activated by linking them to controls. ### Can't I edit an approved policy anymore? **This is normal behaviour.** Approved policies are read-only to ensure compliance. **Solution:** 1. **Click "Create new draft"** in the approved policy 2. **Tidal automatically creates a new draft** with the same content 3. **Edit the draft** as desired 4. **Approve the new version** when ready > **info:** The old approved version remains available until you approve the new draft. This keeps your compliance intact during editing. ### Where do I find my downloaded policy PDF? Every PDF export includes the full document, its approval metadata, and a version table on the last page. **PDF downloads contain:** - The complete policy document - Metadata header with approval information - Version table as last page **Finding your download:** 1. **Check your Downloads folder** - Default location in most browsers 2. **Filename format** - Usually: `PolicyName_Version_Date.pdf` 3. **Browser download history** - Ctrl+J (Chrome) or Ctrl+Shift+Y (Firefox) > **tip:** PDF downloads contain automatically generated metadata and version history. You don't need to add these manually to your document. ## Common problems ### Policy status is incorrect This is usually a stale browser cache rather than the status actually being wrong. **Symptoms:** - Policy shows "Draft" but should be "Approved" - Status doesn't update after approval - Test results don't match policy status **Possible causes:** - **Browser cache** - Old information is displayed - **Simultaneous editing** - Multiple users editing at the same time - **Synchronization delay** - Status update is still in progress **Solutions:** 1. **Refresh the page** - F5 or Ctrl+R 2. **Clear browser cache** - Ctrl+Shift+R for hard refresh 3. **Wait 30 seconds** - Let synchronization complete 4. **Check other browsers** - Test in incognito/private mode ### Changelog and versions don't match **Problem:** Version numbers don't match the actual changes. **Solution:** 1. **Open the policy editor** 2. **Click menu button (three horizontal lines)** 3. **Go to version history** in the sidebar 4. **Click pencil icon** next to the version 5. **Update changelog and version number** > **caution:** Changelog edits do not change the approval date or author. They only help in maintaining clear version information. ### Links don't work in policy documents For a policy written in Tidal, check the URL is complete and test it in preview before publishing. **For internally managed policies:** - **Check URL format** - Use complete URLs (https://) - **Test links before publication** - Click links in preview mode - **Update broken links** - Edit document and replace links **For uploaded documents:** - **Links in PDFs** - Check that links are clickable in original document - **Word documents** - Links must be active before upload - **Test after upload** - Download and test the uploaded version ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Plans ## Plans URL: https://tidalcontrol.com/docs/plans The schedules that generate your recurring compliance tasks, so an annual policy review or quarterly user check happens without anyone remembering to create it. ### Creating and configuring plans URL: https://tidalcontrol.com/docs/plans/creating-and-configuring-plans A plan needs four things. A frequency, a scope of controls or assets, a task description, and a workflow. How to set each one up and update it afterwards. A plan is the schedule that generates your recurring compliance tasks. Setting one up takes four things: a frequency, a scope of controls or assets, a task description, and activation. It generates nothing until all four are in place. ## Adding new plans Creating a plan sets its name and frequency. Scope, workflow, and activation all come afterwards. ### Creating a plan Creating a new plan starts with basic configuration that determines automatic task generation. **Plan creation steps:** 1. **Click "Add plan" button** in the top right of Plans overview 2. **Plan creation dialog opens** with basic configuration fields 3. **Fill in plan information** according to your compliance needs 4. **Click "Create"** to create the plan ![Creating new plan](/images/help/plans_add_plan.png) ### Filling in basic plan information Only a name and frequency are required to create a plan. **Required fields:** **Name:** - **Clear description** of compliance cycle - **Tip: Add PDCA phase and frequency** for structure - **Examples:** "Plan phase (annually)", "Check phase (quarterly)", "Monthly access reviews" **Frequency:** - **Daily** - For operational monitoring - **Weekly** - Regular operational controls - **Monthly** - Standard compliance reviews - **Quarterly** - Strategic assessments - **Semiannually** - Strategic assessments - **Annually** - Management reviews and planning **Valid From:** - **Start date** for automatic task generation - **Default:** "Today's date" to activate the new plan immediately - **Use:** Set to future date when implementation is phased **Valid To (optional):** - **End date** for plan cycle - **Default:** "Not set" for continuous cycles - **Use:** For project-bound compliance or temporary cycles > **warning:** **Important:** Valid From and Frequency cannot be changed after the plan is created. Plan these carefully for optimal timing. ## Configuring plan details After your plan is created, you can adjust basic information and create the workflow to activate the plan. ![Plan workflow configuration](/images/help/plans_details.png) ### Updating plan basic information - **Name** - Can be changed after creation - **Custom ID** - Optional unique identifier (e.g. P.01) - **Valid From/To** - Only Valid To can be changed - **Frequency** - Not changeable after creation - **Description** - Description of plan purpose ## Configuring Plan Workflow After plan details are filled in, configure automatic task generation via "Build workflow". ### Setting up workflow ![Workflow configuration](/images/help/plans_add_task.png) **Task configuration steps:** **Selecting task type:** - **Ask users to** dropdown - Choose what users should do. If you choose 'Assess the control' the Plan will create an Assessment task. In all other cases the Plan will create an Execution task. - **Execute the control** - Default option for control implementation - Other options available for different task types > **tip:** Leave this field on default and use other task types ONLY if you plan to create a complex workflow with multiple steps. **Timing configuration:** - **Create tasks on** - When tasks are created (e.g. 1-9-2025) - **Their due date is on** - Deadline for completion (e.g. 28-2-2026) - **Time between creation and deadline** determines how much time teams get **Writing task instructions:** Each Plan automatically adds the Control and/or Asset description to generated tasks. Additionally, via the 'Task instructions' it's possible to add one **additional** instruction to **all** tasks created by the Plan. - **Write tab** - Use (markdown) editor for detailed instructions - **Preview tab** - Check how instructions look - **Markdown support** - Use headings, lists and links for clarity - **Write specific instructions** - Describe exactly what needs to happen **Task instructions template:** ``` ### What needs to be done [Describe concrete steps] ### Required information [What data is needed] ### Expected result [What is the desired outcome] ### Evidence [Which documents to upload] ``` > **warning:** The task instructions are additional instructions added to **all** tasks created by this Plan. **Completing workflow:** 1. **Click "Add task"** to add a new task to the workflow 2. **Repeat process** for different task types if needed 3. **Preview section** shows when tasks are automatically sent 4. **Check timing** - Start date, due date and execution time > **tip:** **Realistic deadlines**: Ensure sufficient time between task creation and due date. Teams need time for planning and execution. ## Defining plan scope The scope decides which items the plan generates tasks for. You pick either controls or assets, not both. ### Scope configuration options After basic configuration, define which items are automatically controlled by this plan. **Two scope methods:** - **Plan by Controls** - Focus on control implementations - **Plan by Assets** - Focus on business assets ### Plan by Controls Scope by controls when you're checking effectiveness against a framework or a policy, not a specific system. **When to use controls scope:** - Assess control effectiveness - Framework compliance (ISO 27001, SOC 2) - Check policy compliance - Conduct process evaluations **Selecting controls:** 1. **Go to Scope tab** in plan details 2. **Select "Plan by Controls" tab** 3. **Select controls** that belong in this cycle 4. **Check for inactive Controls** - tasks are only created for Controls that are themselves also active ![Plan by Controls scope](/images/help/plans_scope_controls.png) **Controls scope example:** ``` Annual ISMS planning: ✓ A.01 Context of the organisation documented ✓ A.02 Legal and contractual requirements identified ✓ A.03 Scope of the ISMS determined ✓ A.05 Roles and responsibilities defined ``` ### Plan by Assets Scope by assets when the review is really about a specific system, vendor, or business unit. **When to use assets scope:** - Technology assessments - Vendor evaluations - Infrastructure reviews - Business unit reviews **Selecting assets:** 1. **Go to Scope tab** in plan details 2. **Select "Plan by Assets" tab** 3. **Select assets** that belong in this cycle 4. **Check for inactive Assets** - tasks are only created for Assets that are themselves also active ![Plan by Assets scope](/images/help/plans_scope_assets.png) **Assets scope example:** ``` Quarterly cloud security review: ✓ Microsoft Azure Cloud (SYS.001) ✓ AWS (SYS.002) ✓ Public website (SYS.003) ✓ 1Password (SYS.004) ``` ## Plan preview and validation The preview shows the tasks the plan would generate over the coming period, which is the fastest way to catch a scope mistake before activating. ### Using preview functionality Check when tasks are automatically generated over the coming period. ![Plan preview timeline](/images/help/plans_preview.png) **Understanding preview information:** - **Task** - Type of task generated (Execution or Assessment) - **Period** - The period for which tasks are created - **Start date** - When tasks become available - **Due date** - Deadline for completion - **Time to execute** - Time between start and deadline - **Number of tasks** - How many tasks per cycle (corresponds to number of unique control-assets combinations) ### Plan status verification Four status checks on the right tell you whether the plan is actually valid and ready to activate. **Status indicators on the right:** - **Details: ✅ Plan is valid** - when current date falls within validity period - **Workflow: ✅ Tasks configured** - At least one workflow task configured with valid start and end date - **Scope: ✅ Controls / Assets assigned** - At least one scope object linked. - **Scope: ✅ All assigned Controls / Assets are active** - Each linked scope object is itself also active. **Status troubleshooting:** - **⚠️ Plan is currently not valid** - Set 'Valid to' date in the future - **⚠️ Plan has no tasks configured** - Configure at least one task in the Workflow builder. - **⚠️ Plan has no assets assigned** - Select at least one control or asset - **⚠️ Not all assigned controls are active** - Activate controls or remove from scope ## Practical configuration tips Two choices decide whether a plan helps or drowns you: how often it runs, and when in the period it lands. ### Frequency selection **Start by assigning law and regulation driven activities:** - **ISO 27001** - Management review annually, risk assessment quarterly - **GDPR** - Processing records periodic assessment, annual review of impact assessments - **SOC 2** - Control testing quarterly, management review annually **Add risk-based activities:** - **High risk** - Monthly or weekly - **Medium risk** - Quarterly assessments - **Low risk** - Annual reviews ### Timing optimisation Spread plans across the quarter rather than the first month, and avoid the December/January period entirely. **Workload distribution:** - **Avoid December/January** - Holidays and vacation - **Spread over quarter** - Not everything in first month - **Concurrent capacity** - How many plans simultaneously? - **Team availability** - Who does what when? ## Common configuration problems Almost every plan complaint is one of these two: the plan will not activate, or it activates but produces nothing. ### Plan remains inactive An empty scope, a future start date, or a missing workflow are the three usual causes. **Possible causes:** - **Empty scope** - No controls or assets selected - **Future start date** - Valid From still in the future - **Missing workflow** - Tasks not configured - **Owner problems** - Scope items without responsible persons **Solution steps:** 1. **Check scope tabs** - At least one item selected? 2. **Verify Valid From** - Date is today or earlier? 3. **Review owners** - All scope items assigned? 4. **Configure workflow** - Tasks set up for automation? ### Preview shows no or 0 tasks Check the scope, the Valid From date, and whether the linked controls or assets are themselves active. **Diagnosis checklist:** - **Scope definition** - Items selected in scope? - **Date configuration** - Valid From not too far in future? - **Controls and Assets active** - Check in Scope tab if controls and assets are active ## Plan activation workflow A plan only starts generating tasks once every part of it is complete. ### Activation checklist For automatic task generation everything must be complete: - ☐ **Basic configuration** - Name, frequency, dates filled in - ☐ **Scope defined** - Controls or assets selected - ☐ **Scope activated** - Controls or assets must themselves also be Active - ☐ **Workflow configured** - Task automation set up - ☐ **Preview checked** - Timeline matches expectations ## Next steps Now that you can create and configure plans: - **Start with one pilot plan** for known compliance cycle - **Configure task workflow** for automatic execution - **Monitor first task generation** and team reactions - **Optimise scope and timing** based on practical experience ### Getting started with Plans URL: https://tidalcontrol.com/docs/plans/getting-started Plans are the schedules behind your recurring compliance tasks. How to read the plan tiles, what active means, the PDCA types, and which frequency to choose. Plans are the schedules that generate your recurring compliance tasks, so that an annual policy review or a quarterly user check happens without anyone remembering to create it. This article covers reading the Plans overview, the frequencies available, and how to tell whether a plan is actually running. ## Navigating the Plans overview page The Plans page shows all automated compliance cycles in a tile-based overview. Each plan is displayed as a card with essential planning information. ![Plans overview](/images/help/plans_overview.png) **What you see in the overview:** - **Plan tiles** - Individual cards per compliance cycle - **Status filters** - Open vs Archived plans - **Search functionality** - Quickly find specific plans - **Sort options** - Organize plans as needed - **"Add plan" button** - Create new automated cycle ### Understanding plan tiles Each tile shows the plan's name, its status, how often it runs, and how many controls or assets it covers. **Information per plan tile:** - **Plan name and ID** - For example "Plan phase (annually)" with #691 - **Status indicator** - Active (green) or Inactive (gray) - **Frequency** - Annually, Semiannually, Quarterly, Monthly, Weekly, Daily - **Description** - Brief explanation of plan purpose - **Controls / Assets count** - Number of linked items in plan scope **Example plan information:** ``` Plan phase (annually) #691 Status: Active Frequency: Annually Description: Set objectives, evaluate risks, and make adjustments for the upcoming year 🔧 9 Controls ``` ### Active vs inactive plans A plan only turns active, and starts generating tasks, once its configuration is complete and it's inside its validity dates. **Status recognition:** - **Active plans** - Green status indicator, automatically generate tasks - **Inactive plans** - Gray status indicator, don't create new tasks **When is a plan active?** - **Configuration complete** - Scope and workflow are set - **Validity period** - Within Valid From and Valid To dates - **Controls / Assets linked** - At least items assigned to plan scope - **Controls / Assets active** - Tasks are only sent for Controls and Assets that are themselves valid. ## Plan types and PDCA cycle Plans in Tidal Control follow the **Plan-Do-Check-Act cycle** by default for systematic compliance management. **Plan phase:** - **Goal:** Set objectives and evaluate risks - **Activities:** Strategic planning, resource allocation - **Frequency:** Usually annually **Do phase:** - **Goal:** Implement planned measures and/or review implemented measures - **Activities:** Control implementations, process execution - **Frequency:** Monthly to annually **Check phase:** - **Goal:** Monitoring and evaluation of effectiveness - **Activities:** Audits, assessments, performance measurements - **Frequency:** Quarterly to annually **Act phase:** - **Goal:** Corrective measures and improvements - **Activities:** Control on operation issue handling, process optimisation - **Frequency:** Quarterly to annually > **tip:** **PDCA benefits**: By organising plans around PDCA you get a complete compliance cycle with clear responsibilities and timing for each phase. ## Understanding frequency options Frequency decides how often the plan generates its tasks, and it is the setting most worth getting right first. ### Available planning frequencies Five options are available, from daily operational checks to annual strategic reviews. **Daily:** - **Use:** Operational monitoring, log reviews - **Examples:** Security event monitoring, backup verifications - **Considerations:** High workload, only for critical processes **Weekly:** - **Use:** Regular checks, status updates - **Examples:** Vulnerability scans, access reviews - **Considerations:** Good balance between control and workload **Monthly:** - **Use:** Periodic assessments, standard reviews - **Examples:** Access rights audit, vendor reviews - **Considerations:** Popular choice for most compliance activities **Quarterly:** - **Use:** Strategic reviews, major assessments - **Examples:** Risk assessments, control effectiveness reviews - **Considerations:** Suitable for extensive evaluations **Annually:** - **Use:** Strategic planning, major updates - **Examples:** Policy reviews, management assessments - **Considerations:** For large, strategic compliance activities ### Frequency selection strategy Base the frequency on regulatory requirements and risk level, not on what feels easiest to schedule. **Determine frequency based on:** - **Regulatory requirements** - How often does regulation require control? - **Risk level** - Higher risks require more frequent control - **Resource availability** - Can team handle the workload? - **Business impact** - What are consequences of missed controls? ## Searching and organising plans Search matches plan names, and the Open and Archived tabs separate plans still in use from retired ones. ### Search functionality 1. **Click in search bar** at the top of the Plans page 2. **Type plan name** or part of it 3. **Results filter** automatically while typing 4. **Clear search** to show all plans ### Using sort options Sort plans by creation date, name, or ID, and combine that with the frequency filters. **Available sorting methods:** - **Newest** - Recently created plans first - **Oldest** - Longest existing plans first - **Name (A-Z)** - Alphabetical order - **Custom ID** - Numeric or custom order **Frequency filters:** - **Annually** - Annual assessments and reviews - **Semiannually** - Semi-annual assessments and reviews - **Quarterly** - Quarterly compliance or executive activities - **Monthly** - Monthly compliance or executive activities - **Weekly** - Weekly executive activities - **Daily** - Daily executive activities (least used) ### Open vs Archived organisation Open plans are part of your active compliance cycle; archive a plan once it should stop generating tasks. **Open plans:** - **Actively used** - Generate tasks and are executed - **Current compliance cycle** - Part of ongoing compliance program - **Archive a Plan** - to ensure it no longer creates tasks **Archived plans:** - **No longer used** - Don't create new tasks anymore - **Historical record** - Preserved for audit trail - **For the future** - Possible reuse for future cycles ## Plan status indicators A plan's colour tells you whether it is actually generating tasks, which is not the same as whether it has been configured. ### Status interpretation Gray covers several distinct causes: incomplete configuration, no scope, or dates outside the validity window. Check which one before assuming it's just unconfigured. **Green status (Active):** - Plan automatically generates tasks according to schedule - All configuration is complete and valid - Controls / assets are assigned - Plan is within validity period (between 'Valid from' and 'Valid to') **Gray status (Inactive):** - Plan doesn't generate tasks - Configuration possibly incomplete - No scope items assigned or scope items are themselves not active - Outside validity period (earlier than 'Valid from' or later than 'Valid to') ## Plans versus manual tasks Plans in Tidal Control automate your compliance work by generating **periodically recurring tasks** for controls and assets. Instead of manually creating tasks every month or quarter, a plan automatically sets up the right tasks with predefined deadlines and instructions. **Benefits of automated planning:** - **Consistent execution** - No forgotten compliance activities - **Predictable workload** - Teams know when which tasks are coming - **Standardised processes** - Same instructions and deadlines every cycle - **Compliance continuity** - Automatic compliance with periodic requirements - **Resource planning** - Look ahead to upcoming workload **Manual tasks are suitable for:** - Initial implementations - Ad-hoc measures and controls - Project specific activities **Plans are ideal for:** - Periodic recurring activities (e.g. user review) - Annual policy reviews and updates - Periodic system audits ## Next steps Now that you know the Plans interface: - **Identify repetitive compliance** work in your organisation - **Plan your PDCA cycle** for systematic compliance approach - **Start with one pilot plan** to learn workflow creation - **Monitor task generation** and adjust configuration for optimal results ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/plans/troubleshooting-and-faq Nearly every plan problem is a scope or activation problem. A plan makes no tasks until it is active and its scope holds eligible items. Fixes and timing tips. Nearly every plan problem is a scope or activation problem: a plan generates no tasks until it is active and its scope actually contains eligible items. The answers below cover frequency, the difference between scoping by controls and by assets, and how to diagnose a plan that produces nothing. ## Frequently asked questions ### How do I choose the right frequency for my compliance cycle? Let the framework's own required cadence set the frequency, rather than picking one that feels convenient. **Determine frequency based on various factors:** **Regulatory requirements first:** - **ISO 27001** - Management review annually, risk assessment quarterly - **GDPR** - Data subject requests monthly, DPIAs annually - **SOC 2** - Control testing quarterly, management review annually - **NIS 2** - Incident response annually, vulnerability management quarterly **Risk-based approach:** - **Critical assets/controls** - Quarterly or monthly - **High risk processes** - Quarterly assessment - **Medium risk** - Twice per year - **Low risk** - Annual review **Resource capacity considerations:** - **Team availability** - How much time available per cycle? - **Expertise requirements** - Are specialists available? - **Concurrent workload** - How many other compliance activities? - **Seasonal factors** - Avoid busy periods (Q4, holidays) **Practical guidelines:** ``` Daily: Only for automated monitoring Weekly: Use only for high risk AND high execution frequency processes Monthly: Standard operational reviews (most used) Quarterly: Assessments and operational reviews Annually: Policy updates and management reviews ``` ### What's the difference between Plan by Controls and Plan by Assets? Scope by controls when you're proving framework compliance; scope by assets when the review is really about one specific system. **Plan by Controls - Control-centric approach:** **Use when:** - **Framework compliance** - ISO 27001, SOC 2 implementation - **Control effectiveness** - Assessment of security measures - **Process assessments** - Evaluation of procedures and workflows - **Policy compliance** - Compliance with organisational guidelines **Benefits:** - **Compliance mapping** - Directly linked to framework requirements - **Consistent assessment** - Same controls, same criteria - **Audit preparation** - Framework-ready evidence gathering **Examples:** - Quarterly control effectiveness review (A.01 to A.14) - Annual ISMS policy compliance check - SOC 2 control testing cycle **Plan by Assets - Asset-centric approach:** **Use when:** - **Asset governance** - Specific systems or services - **Technology assessments** - Cloud platforms, applications - **Vendor management** - Third-party service evaluations - **Business unit reviews** - Countries, Entities, Regions **Benefits:** - **Business alignment** - Focus on business-critical assets - **Targeted assessment** - In-depth evaluation per asset - **Owner accountability** - Clear asset responsibility **Examples:** - Monthly cloud security review (AWS, Azure, GCP) - Quarterly vendor assessment (SaaS providers) - Annual business unit audit (e.g. Eurasia region) **Making the choice:** - **Control-driven compliance** → Plan by Controls - **Asset-driven risk management** → Plan by Assets - **Hybrid approach** → Different plans for different purposes ## Common problems ### No tasks are created by my plan **Check the following requirements for automatic task generation:** **Plan activation checklist:** - **Plan status is active** - Green indicator instead of gray - **Valid From date** is today or in the past - **Valid To date** is in the future - **Scope is configured** - Controls or assets selected - **Scope is active** - Controls or assets are themselves also active - **Workflow is built** - At least one task configured via "Build workflow" **Timing verification:** - **Frequency cycle** - Has the next generation date been reached? - **Create tasks on date** - Is timing in workflow configuration correct? - **Hourly processing** - Plans are checked every hour for task generation. If you need tasks created soon, plan them for after the next whole hour. > **info:** **Plan execution timing**: Tidal plans execute every hour (on the hour) to determine if new tasks should be created. **Workflow configuration check:** - **"Add task" executed** - Is the workflow actually saved? - **Task instructions** - Are instructions filled in and saved? - **Due date configuration** - Is deadline set correctly? **Using preview functionality:** 1. **Check Preview section** in plan details 2. **Verify task timeline** - Are future tasks shown? 3. **Check "Number of tasks"** - Is there a number > 0? > **tip:** **Debug strategy**: Start with Preview section to see if plan is configured correctly. If Preview shows no tasks, the problem is in configuration, not timing. ### Tasks come at wrong times - how do I adjust timing? Three settings control timing together: when a task is created, when it's due, and how much time sits between the two. **Understanding timing configuration:** **Workflow timing parameters:** - **"Create tasks on"** - When tasks are created and visible - **"Their due date is on"** - Deadline for task completion - **"Time to execute"** - Period between creation and due date **Timing strategy examples:** ``` Quarterly review: Create: 1 month before quarter end Due: 2 weeks after quarter end Execute time: 6 weeks Monthly check: Create: 25th of the month Due: 10th of next month Execute time: 2 weeks ``` **Making timing adjustments:** 1. **Edit existing plan** - Go to Details tab 2. **Change task timing** - Adjust "Create tasks on" and "Due date" 3. **Preview new timing** - Check impact on future tasks **Common timing problems:** - **Too short execute time** - Teams don't have time for planning - **Holiday conflicts** - Deadlines fall on holidays - **Workload concentration** - All tasks at once - **Resource conflicts** - Timing clashes with other compliance cycles **Timing optimisation tips:** - **Buffer time** - At least 1 week between creation and due date - **Avoid holidays** - Prevent December/January deadlines - **Spread workload** - Create multiple Plans with different timings - **Team consultation** - Ask input from executing teams ### Why is my plan inactive despite complete configuration? Start with the basics (the validity dates and frequency) before checking whether the scope itself is the problem. **Diagnosis steps for inactive plans:** **Basic configuration verification:** 1. **Valid From date** - Is this in the past or today? 2. **Valid To date** - Has this not been exceeded? 3. **Frequency setting** - Is the interval configuration correct? **Scope configuration check:** - **Controls/Assets selected** - At least one item in scope? - **Active controls/assets** - Are scope items themselves active? - **Owner assignment** - Do all scope items have owners? **Workflow configuration:** - **Tasks configured** - Has "Build workflow" been executed? - **Dates filled in** - Are creation date and due date filled in? **Status indicator meaning:** - **Green "Active"** - Plan works correctly - **Gray "Inactive"** - Configuration incomplete or invalid > **tip:** **Debug strategy**: Start with Preview section to see if plan is configured correctly. If Preview shows no tasks, the problem is in configuration, not timing. ### How can I create tasks immediately for multiple controls at once? **Using one-off plans for batch task creation:** Sometimes you want to create tasks immediately for multiple controls or assets. **Creating a one-off plan:** 1. **Create new plan** with appropriate name 2. **Set frequency** to any value (doesn't matter for one-off) 3. **Set "Valid From"** to today 4. **Set "Valid To"** to today or tomorrow - this makes the plan expire quickly 5. **Configure workflow** with "Create tasks on" set to today's date 6. **Select scope** - Choose all controls/assets that need immediate tasks 7. **Save and activate** - Tasks will be created within the hour **One-off plan benefits:** - **Batch creation** - Create dozens of tasks simultaneously - **Consistent instructions** - Same task description for all - **Automatic assignment** - Tasks go to appropriate owners - **Self-expiring** - Plan deactivates automatically after creation > **tip:** **One-off timing tip**: Set "Create tasks on" to the current time + 1 hour to ensure the plan is processed in the next hourly check. For example, if it's 14:30, set creation time to 15:00. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Tasks ## Tasks URL: https://tidalcontrol.com/docs/tasks All the compliance work assigned to you, most of it arriving automatically from plans rather than created by hand, with its conversation as the audit trail. ### Creating and managing tasks URL: https://tidalcontrol.com/docs/tasks/creating-and-managing-tasks The task record itself. Creating one, choosing a type, assigning owners and contributors, setting a deadline, and linking it to the assets and controls. This article covers the task record: creating one, choosing its type, assigning owners and contributors, setting a deadline, and linking it to the assets and controls it belongs to. For doing the work itself, see [Handling and completing tasks](/docs/tasks/handling-and-completing-tasks). ## Adding new tasks A task needs a name, a type, and ideally a due date; the type decides how it behaves later. ### Creating a task 1. **Go to the Tasks page** via the main menu 2. **Click "Add task"** in the top right of the overview 3. **The creation form opens** where you can fill in task information ![Creating new task](/images/help/tasks_add_task.png) ### Filling in task information Only the name and type are required; everything else can be filled in later. **Required fields:** - **Name** - Choose a clear, descriptive name for the work - For example: "Perform a management review" or "Test backup procedure" - **Task Type** - Select Execution or Assessment **Optional but recommended fields:** - **Assign owner** - Assign responsible person - **Description** - Detailed context and instructions > **tip:** **Clear naming**: Use action-oriented names that clearly indicate what needs to be done. "Perform management review" is better than "Review". ### Selecting task type Choosing the right type helps with workflow and assignment: **Execution - For implementation work:** - Execute technical configurations - Implement procedures - Provide training - Install systems - **Example:** "Configure new firewall rules" **Assessment - For evaluation work:** - Assess effectiveness - Conduct audits - Hold reviews - Check compliance - **Example:** "Assess effectiveness of access controls" **When to choose which type:** - **Execution** - If you need to build, install, or implement something - **Assessment** - If you need to check, assess, or evaluate something ### Saving the task 1. **Check all entered information** 2. **Click "Create"** to create the task 3. **The new task appears** in your overview with "Open" status ## Editing task details Open a task from the overview to change its fields. ### Opening task details 1. **Click on a task name** in the overview 2. **The details panel opens** on the right side 3. **Select the "Details" tab** for editable fields ![Editing task details](/images/help/tasks_details.png) ### Editable information Once created, a task's description, due date, and period can all still be changed. **Adjusting basic data:** - **Description** - Detailed instructions and context - **Due Date** - Set deadline for completion - **Period** - Time period in which task is relevant **Expanding instructions:** - **Step-by-step explanation** - What exactly needs to happen? - **Expected result** - What is the end result? - **Required resources** - What tools or access are needed? - **Acceptance criteria** - When is the task completed? **Automatic updates:** - Changes are saved immediately - Feed tab shows historical changes - Notifications to involved persons ## Owners and responsibilities A task has one owner who is accountable for it, plus any number of contributors who help. ### Assigning owners The owner is the person accountable for the task getting done. **Primary ownership:** 1. **Click in "Owners" section** on the right side 2. **Type username** and select from dropdown 3. **Multiple owners possible** for shared responsibility **Owner responsibilities:** - **Task planning** and resource allocation - **Progress monitoring** and quality control - **Final approval** of task completion - **Escalation** for problems or delays ### Adding contributors Contributors are the people who actually do the work and get notified automatically. **Involving executors:** 1. **Click "Assign" link** 2. **Select team members** working on execution 3. **Contributors receive** automatic notifications **Contributor roles:** - **Practical execution** of work - **Evidence collection** and documentation - **Progress updates** via comments - **Collaboration** with other stakeholders > **warning:** **Clear roles**: Ensure ownership and contributor roles are clear. Owners are ultimately responsible, contributors perform the work. ## Deadlines and planning The due date is what drives overdue reporting, so a task without one never counts as late. ### Setting Due Date Pick a due date that reflects how long the work realistically takes, not the earliest date that looks reasonable. **Determining deadline:** 1. **Click "Due Date" field** in Details tab 2. **Select realistic date** from calendar 3. **Consider complexity** and available resources **Deadline guidelines per type:** - **Execution tasks:** Depending on implementation complexity (days to weeks) - **Assessment tasks:** Often linked to audit cycles (months) - **Periodic tasks:** Automatically set by Plans - **Ad-hoc tasks:** Based on urgency and priority ### Period management The period groups a task into a reporting window, and Plans set it automatically for tasks they generate. **Setting time period:** - **Year 2025** - Default for ongoing tasks - **Periodic tasks:** Automatically set by Plans based on Plan frequency ## Managing task links Linking a task to assets and controls is what makes it count towards their compliance status. ### Linking assets Linking an asset records what the task actually affects, and rolls the task into that asset's status. **Why link assets:** - Clarify which business assets are involved - Define impact scope of the work - Set priorities based on asset criticality **Selecting assets:** 1. **View linked assets** in task details 2. **Assets are often automatically** linked via Plans 3. **Manual adjustments and linking multiple assets** possible if needed ### Linking controls Link the control the task actually validates, not every control the underlying work vaguely touches. **Why link controls:** - Clarify which controls the task contributes to - Task is included in status and progress indicators at control level - Tracking control status is required for various standards including ISO 27001 **Selecting controls:** 1. **View linked controls** in task details 2. **Controls are often automatically** linked via Plans 3. **Manual adjustments and linking multiple controls** possible if needed ### Linked tasks The Linked tasks tab shows the counterpart work in the same scope, so it lists Assessments when you open an Execution and Executions when you open an Assessment. **What appears here:** - Tasks of the opposite type that share a control, an asset, and an overlapping period - Cross-referencing that shows how the two pieces of work relate **Viewing related tasks:** 1. **Click on a task name** in the overview 2. **The details panel opens** on the right side 3. **Select the "Linked tasks" tab** ![Linked tasks](/images/help/tasks_linked_executions.png) **How to use this information:** - **Assess all execution tasks** - as part of the Assessment task - **Direct link to the counterpart tasks** - for review, reopening and other actions resulting from the Assessment - **Total overview** - Overview of all related activities and dependencies > **info:** **Nothing listed?** Tasks only link when they share a control, share an asset, and have overlapping periods. The exact matching rule, including how company-wide tasks behave, is in [Task types and the three lines model](/docs/core-concepts/three-lines-model). ## Task lifecycle management Tasks are either created by hand or generated by a plan, and both follow the same Open-to-Closed path. ### Status monitoring A task stays Open while work is genuinely in progress, and moves to Closed only once it's actually done. **Keep Open status when:** - Work still in progress - Waiting for evidence or approval - Dependencies not yet completed **Move to Closed status when:** - All work completed - Evidence collected and validated - Owner has approved completion ### Automatic task generation Most tasks are not created by hand: a Plan generates them on a fixed schedule with pre-written instructions. **Plans generate tasks:** - **Regular cycles** - Monthly, quarterly, annually - **Consistent execution** - Guaranteed compliance activities - **Template-based** - Predefined instructions and criteria **Manual tasks vs Automatic:** - **Manual tasks** - One-time or ad-hoc work - **Automatic tasks** - Periodic compliance activities - **Hybrid approach** - Combination for complete coverage > **tip:** Tasks are often automatically created by Plans linked to Controls (or Assets). This gives you an ongoing cycle of compliance activities without manual planning. Read more about this in [Creating and managing plans](/docs/plans/creating-and-configuring-plans) ## Task templates and standardisation Writing tasks to a consistent shape makes them easier to pick up and easier to audit. ### Consistent task creation A reusable template per task type keeps instructions consistent across every cycle. **Execution template:** ``` Name: [Action] - [Goal/Component] Description: - Goal: [What do you want to achieve] - Steps: [Concrete execution steps] - Required resources: [Tools, access, time] - Expected result: [End state] - Acceptance criteria: [When is it ready] ``` **Assessment template:** ``` Name: [Assessment] - [Subject] Description: - Scope: [What is being assessed] - Method: [How will you assess it] - Criteria: [What do you assess on] - Evidence: [What evidence do you collect] - Reporting: [How do you document findings] ``` ### Quality control Before assigning a task, check it against this list. **Review checklist:** - ☐ Task name is specific and actionable - ☐ Correct type selected (Execution/Assessment) - ☐ Owner has capacity and expertise - ☐ Deadline is realistic and justified - ☐ Description contains sufficient instructions - ☐ Expected result is clearly defined ## Best practices for task management Tasks stay manageable when they are scoped small, owned clearly, and reviewed before they go overdue. ### Effective planning A task is easiest to complete when it covers one clear action with a realistic scope and deadline. **Task scoping:** - **Atomic tasks** - One clear action per task - **Realistic scope** - Not too large or complex - **Measurable outcomes** - Clear definition of "done" - **Time-boxed** - Reasonable deadline with buffer ### Team coordination Regular check-ins and @mentions keep collaborators aligned without anyone having to chase updates. **Promoting collaboration:** - **Regular check-ins** - Weekly status updates - **Clear communication** - Use @mentions for urgent matters - **Share evidence** - Upload proof directly upon completion - **Knowledge transfer** - Document lessons learned ### Workflow optimisation Grouping similar tasks and automating the repetitive ones is where most of the time savings are. **Improving efficiency:** - **Group similar tasks** - Group similar work - **Automate where possible** - Use Plans for repetitive tasks - **Reuse descriptions** - Standardise common instructions - **Continuous improvement** - Evaluate and optimise processes > **tip:** **Start with standard tasks**: Begin with simple, well-defined tasks before implementing complex workflows. Build expertise gradually. ## Next steps Now that you can create and manage tasks: - **Plan your work** systematically with realistic deadlines - **Monitor progress** via dashboard and notifications - **Collaborate** effectively via conversation features - **Document results** for audit and compliance ### Getting started with tasks URL: https://tidalcontrol.com/docs/tasks/getting-started What tasks are in Tidal Control and how to read the Tasks page. What the status indicators mean, how execution and assessment types differ, and how to filter. The Tasks page collects all the compliance work assigned to you, most of which arrives automatically from plans rather than being created by hand. This article covers reading that overview: the status counters, the two task types, and how to filter down to what is yours. ## Navigating the Tasks page The overview opens on the tasks relevant to you, with four status counters above the table. ### Opening the Tasks page Go to the Tasks section via the main menu. You'll arrive at an overview page with all tasks relevant to you. ![Tasks overview](/images/help/tasks_overview.png) ### Understanding status indicators At the top of the page you see four important status categories: **Not due soon - Gray:** - Active tasks that need to be executed - Unfinished work - Main focus for daily work **Due within 14 days - Orange:** - Tasks that expire soon - Require priority and attention - Preventive warning for deadlines **Overdue - Red:** - Tasks that have missed their deadline - Immediate action required - Impact on compliance status **Closed - Green:** - Completed and approved tasks - Available for audit and reporting - Evidence of performed work ### What you see in the overview The tasks overview shows important information per task: - **Status** - Visual indicator of task status (orange dot for open) - **Period** - Time period in which task falls (e.g. "Year 2025") - **Name** - Descriptive title of the task - **Due Date** - Deadline for completion (if set) - **Tag** - Label for cycle phase for which the task was created (see Plans) - **Assets** - Number of linked business assets (📄) - **Controls** - Number of linked controls - **Assignee** - Assigned person for execution ## Understanding task types Tidal distinguishes different types of tasks: ### Execution **When to use:** Concrete implementation work **Examples:** - "Configure new firewall" - "Provide employee security training" - "Test backup procedure" **Characteristics:** Practical activities that are executed ### Assessment **When to use:** Evaluation and control work **Examples:** - "Assess effectiveness of access controls" - "Conduct internal audit" - "Hold management review" **Characteristics:** Assessment of existing measures and processes > **info:** **Task categorization**: Assessment tasks often require independent evaluation, while Execution tasks can be performed by implementation teams. **Task reviews vs. Assessments**: Task reviews offer a simpler alternative to Assessments. Read more about this in [Creating and managing tasks](/docs/tasks/creating-and-managing-tasks) ## Searching and filtering Search matches task names, and the filters narrow by status, type, owner, and the control or asset a task belongs to. ### Search functionality Nothing filters until you press Enter; there is no live-as-you-type result. **Using the search bar:** 1. **Click in the search bar** at the top of the overview 2. **Type task names** or keywords (e.g. "backup", "review", "training") 3. **Press 'Enter'** and your search results are displayed ### Filter options Use the filter dropdown menus to find specific tasks: **Open vs Closed:** - **Open (66)** - Active tasks requiring attention - **Closed (0)** - Completed tasks for historical overview **Filter by Controls:** - Show tasks linked to specific controls - Useful for control-based planning **Filter by Assets:** - Show tasks related to specific business assets - Useful for asset-focused work **Filter by Plans:** - Show tasks generated by specific plans - Perfect for periodic cycle monitoring **Filter by Assignee:** - Show tasks assigned to specific people - Essential for personal work lists > **tip:** **Create personal work list**: Filter on your name as Assignee to see only your own tasks. This gives you a clear overview of your priorities. ### Combining multiple filters You can use different filters simultaneously for very specific results: - **Example**: Filter on "Open" + your name + specific Plan to see your active cyclical tasks - **Reset filters**: Click away individual filters or refresh the page ## Task planning and automation Most tasks are not created by hand: plans generate them on a schedule, and their due dates are what drive the overdue counters. ### Automatic task generation A plan generating tasks on a schedule is what keeps compliance activities from being forgotten. **Plans generate tasks automatically:** - **Monthly cycles** - Regular controls and monitoring - **Quarterly reviews** - Periodic evaluations - **Annual audits** - Compliance assessments - **Ad-hoc triggers** - Event-based activities **Benefits of automation:** - **Consistency** - No forgotten compliance activities - **Efficiency** - Less manual planning - **Traceability** - Complete audit trail of work - **Compliance** - Guaranteed execution of mandatory tasks > **tip:** Tasks are often automatically created by Plans linked to Controls (or Assets). This gives you an ongoing cycle of compliance activities without manual planning. Read more about this in [Creating and managing plans](/docs/plans/creating-and-configuring-plans) ### Deadline management Most due dates are set automatically by a plan, and only the first missed deadline gets reported by email. **Understanding due dates:** - **Automatically set** by Plans according to schedule - **Manually adjustable** for specific circumstances - **Reported once** in the daily summary email after a deadline has passed - **Dashboard warnings** for approaching due dates ## What counts as a task Tasks in Tidal Control are concrete work activities that must be performed for compliance and risk management. The system helps you manage these systematically by: - **Organising work** - Collect and prioritise all tasks in one place - **Tracking progress** - Monitor status and deadlines per task - **Facilitating collaboration** - Team communication and evidence collection - **Supporting compliance** - Tasks linked to controls and assets - **Automation** - Automatically create periodic tasks via plans By systematically executing and documenting tasks in Tidal, you gain insight into compliance progress and can demonstrate that controls are effective. ## Next steps Now that you know how to navigate and interpret tasks, you can: - **Compile personal work list** with filters - **Set priorities** based on deadlines and importance - **Collaborate** via conversation features - **Track progress** of compliance activities > **note:** **No tasks visible?** This may mean that no plans are active yet or no tasks are assigned to you. Check with your administrator if Plans need to be configured. ### Handling and completing tasks URL: https://tidalcontrol.com/docs/tasks/handling-and-completing-tasks Doing a task means working in its conversation. Discuss it, attach evidence to a comment, and then close it. That conversation doubles as your audit trail. Doing a task in Tidal means working in its conversation: discussing it, attaching evidence to a comment, and then closing it. That conversation is also the audit trail, which is why the evidence goes there rather than somewhere separate. ## Working on tasks A task opens in a panel built around its conversation, which doubles as its audit trail. ### Opening a task 1. **Click on a task name** in the overview 2. **The details panel opens** on the right side of your screen 3. **Select the "Conversation" tab** for collaboration 4. **The panel shows** all communication and progress ![Task conversation panel](/images/help/tasks_conversation.png) ### Understanding the conversation interface The task panel is built around its own conversation: instructions at the top, then a running thread of updates. **What you see in the conversation:** - **Description section** - Description and instructions of the task - **Comments thread** - Chronological communication between team members - **Comment field** - Here you can post updates, ask questions and upload evidence > **tip:** **A good task description contains:** - **Goal of the work** - What needs to be achieved? - **Step-by-step instructions** - How do you execute the task? - **Required resources** - What tools, access or information do you need? - **Acceptance criteria** - When is the task successfully completed? - **Deadline context** - Why is timing important? ## Collaborating via comments Comments are the record of how the task was done, and @mentions pull the right people in. ### Adding comments A comment is how you log progress, and Markdown lets you structure a longer update. **Writing new comment:** 1. **Scroll down** to "Add your comment" section 2. **Type your message** in the text field 3. **Use Markdown** for structure (headings, lists, links) 4. **Click "Submit"** to post comment **Comment best practices:** - **Progress updates** - What have you done and what is the result? - **Questions and challenges** - What are you running into and what do you need? - **Milestone notifications** - Important steps that have been completed - **Evidence references** - Refer to uploaded files ### Using @Mentions An @mention notifies someone directly, so use it when you actually need their attention rather than just logging progress. **Notifying people:** 1. **Type @** followed by name or initials 2. **Select person** from dropdown list 3. **Person receives** automatic notification 4. **Use for** questions, escalations, or status updates **Effective @mentions:** ``` @john Can you check the new configuration? See attached screenshots. @sarah Training is completed. See attached certificates for evidence. @team Management review completed. See summary note below. ``` ## Collecting evidence Evidence is attached through a comment, so every file arrives with context about why it was added. ### Uploading files Drop a file into the comment field and it attaches itself to that comment automatically. **Adding documents:** 1. **Scroll to comment section** 2. **Click "Drop, or click to add files"** or drag files to the comment field 3. **Files are uploaded** and linked to comment 4. **Link appears automatically** in your comment ### What is good evidence? For an execution task, evidence should prove the change actually happened, not just describe it. **For Execution tasks:** - **Before/after screenshots** - Show configuration changes - **Installation evidence** - System configurations and settings - **Test results** - Proof that implementation works - **Certificates** - Training completion or system certificates - **Documentation** - New procedures or manuals **For Assessment tasks:** - **Audit checklists** - Completed evaluation forms - **Findings reports** - Structured assessment results - **Interview notes** - Conversations with stakeholders - **Compliance evidence** - Proof of regulatory compliance - **Recommendations** - Improvement points and next steps **For both types:** - **Timeline documentation** - When what was executed - **Communication logs** - Emails, meeting notes - **Photo evidence** - Physical implementations or configurations ## Completing tasks Close a task once the work is done and the evidence is attached. A closed task can be reviewed, and reopened if it was closed too early. ### When to complete A task is ready to close once the instructions are done, the evidence is in, and any required approval has been given. **Task is ready to close when:** - **All instructions** have been executed according to description - **Acceptance criteria** have been met - **Evidence** has been collected and validated - **Stakeholders** have given approval (if required) - **Documentation** has been updated where needed ### Closing tasks **Direct closing** 1. **Select the three-dots menu** in the top right of the Task details panel 2. **Select "Close task"** from the dropdown menu **Closing with a comment** 1. **Write the final comment** as a new comment 2. **Select "Submit and Close"** instead of just "Submit" > **tip:** After closing a task, it is only visible under 'closed' Tasks, and no longer in other overviews. Therefore, make sure a Task is completely resolved before closing it or create a new Task or Issue for tracking any remaining (long-term) actions. ### Reviewing tasks Through task review you can record that the task has been completed in the right way. A 'reviewed' label is added to the task. **Task review vs. Assessment tasks** - Task review is simpler to perform than creating a new Assessment task - Task reviews are 1:1 linked to the task they apply to. Assessments can be linked to multiple Controls and Assets. - Assessment tasks can be scheduled in a Plans workflow, task reviews cannot - Task reviews are often used by direct line management or quality assurance function. Assessments by compliance and audit functions. **Viewing a closed task** 1. **Navigate to 'closed' tasks** from the Tasks overview page 2. **Select the task** you want to review **Direct reviewing** 1. **Select the three-dots menu** in the top right of the Task details panel 2. **Select "Review"** from the dropdown menu 3. **The "Reviewed" label appears immediately** in the detail panel **Reviewing with a comment** 1. **Write the review comment** as a new comment 2. a. **Select "Submit and Review"** instead of just "Submit" or; 2. b. **Select "Submit and Reopen"** to reopen the task (in case the review shows that additional work is needed) > **tip:** After reviewing a task, the "Review" and "Submit and Review" buttons change to "Undo Review" and "Submit and Undo Review" respectively. This allows the review to be undone. ### Reopening tasks **Direct reopening** 1. **Select the three-dots menu** in the top right of the Task details panel 2. **Select "Reopen"** from the dropdown menu **Reopening with a comment** 1. **Write the reason for reopening** as a new comment 2. **Select "Submit and Reopen"** instead of just "Submit" ## Next steps After learning task handling, you can: - **Work systematically** on compliance activities - **Collaborate effectively** via conversation features - **Collect complete documentation** for audit purposes - **Apply continuous improvement** to task processes > **tip:** **Complete on time**: Close tasks as soon as they are actually completed. Postponing completion leads to backlogs and loss of momentum in compliance cycles. ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/tasks/troubleshooting-and-faq Task questions are mostly about classification and completion. Which type to choose, when a task is genuinely finished, and owners versus contributors. Task questions are mostly about classification and completion: which type to choose, when a task is genuinely finished, the difference between owners and contributors, and what to do when a task keeps being reopened. ## Frequently asked questions ### Which task type should I choose? **Choose based on what you're going to do:** **Execution - For implementation work:** - Configure or install systems - Roll out new procedures - Organize and conduct training - **Test:** Are you going to build, install or implement something? **Assessment - For evaluation work:** - Assess effectiveness of controls - Conduct audits and reviews - Check compliance - **Test:** Are you going to check, assess or evaluate something? **Practical tip:** If you're torn between both types, think about the end result. Execution delivers a working system or process, Assessment delivers a report or evaluation (effective / ineffective). > **tip:** **When in doubt choose Execution**: Most compliance work is implementation-focused. Use Assessment only for real evaluations and audits. ### When is a task actually completed? **A task is ready for closure when:** - **All instructions** from the description have been executed - **Evidence** has been collected and uploaded - **Testing** proves everything works (for implementations) - **Stakeholders** have given approval where needed - **Follow-up actions** have been identified and planned **Don't complete if:** - You're still waiting for approval from others - Evidence is missing or incomplete - Testing shows implementation doesn't work - Related tasks must be completed first ### What's the difference between owners and contributors? The owner is accountable for the outcome; contributors do the work that gets them there. **Owners:** - **Ultimately responsible** for task completion - **Approval** of the end result - **Escalation** for problems or delays - **Resource planning** and setting priorities - **Quality assurance** of deliverables **Contributors:** - **Practical execution** of work - **Collect evidence** and upload - **Progress updates** via comments - **Collaboration** with other contributors - **Provide input and expertise** **In practice:** - **One owner** is usually most effective - **Multiple contributors** can work in parallel - **Owner checks** before task is closed, or reviews the closed task - **Contributors** do the actual work ### How do I plan realistic deadlines? Base the deadline on real complexity and who's actually available, then add a buffer rather than assume nothing goes wrong. **Estimation factors:** - **Complexity** - How many steps and dependencies? - **Resources** - Who is available and when? - **Dependencies** - Which other tasks must be completed first? - **Time needed for testing** - Time for validation and corrections - **Buffer** - 20% extra for unexpected problems ## Common problems ### Task keeps getting reopened by owner This is almost always an incomplete fix or missing evidence, not a communication problem. **Possible causes:** - **Solution doesn't work** - Implementation has bugs or problems - **Insufficient evidence** - Owner cannot verify result - **Miscommunication** - Expectations about end result differ - **Scope expansion** - New requirements are added during execution **Direct solutions:** 1. **Ask for specific feedback** - What exactly is missing for closure? 2. **Test more thoroughly** - Check if implementation really works 3. **Collect more evidence** - Screenshots, logs, test results 4. **Plan review meeting** - Discuss expectations face-to-face **Prevention for next time:** - Ask owner to define **closure criteria** upfront - Test solution **together with owner** before closing - Document **agreed steps** in the control description for next time ### Linked tasks are not visible or don't match Linking tasks is what shows the dependency between them and lets evidence get reused instead of re-collected. **Why linking is important:** - **Workflow understanding** - How tasks build on each other - **Dependency tracking** - Which tasks must be completed first - **Evidence sharing** - Reuse of evidence - **Complete overview** - of related activities **If links are missing:** 1. **Check task configuration** - Are tasks linked to the same controls, assets and period? 2. **Verify task types** - Assessments link ONLY to Executions and vice versa 3. **Empty fields don't link** - Tasks must always contain at least one control, asset and/or period otherwise tasks don't link ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Tests ## Tests URL: https://tidalcontrol.com/docs/tests Automated checks Tidal Control runs for you, against your own Tidal data or a connected system such as Azure or GitHub. You do not create or edit them yourself. ### Executing and monitoring tests URL: https://tidalcontrol.com/docs/tests/executing-and-monitoring-tests Tests refresh on their own schedule, but you can force one before an audit or straight after fixing a configuration. Reading results and linking controls too. Tests refresh on their own schedule, but you can force one at any time, which is what you normally do before an audit or straight after fixing a configuration. This article covers refreshing them, reading a result, and getting integration tests running in the first place. ## Manually refreshing tests Tests in Tidal Control can be manually refreshed to get the most current compliance status, especially useful after configuration changes or for audit preparation. ### Individual test refresh Refresh a single test after a related change, or whenever you suspect its result is stale. **When to use individual refresh:** - After changes in related controls or assets - For important tests before management reporting - When suspecting outdated test results - For validation after remediation actions **Individual refresh process:** 1. **Click on test name** in Tests overview to open details 2. **Find Refresh button** top right in test detail page 3. **Click "Refresh"** to re-execute test 4. **Wait for completion** - Test status update may take several seconds 5. **Check new results** in Last results section ![Test detail refresh](/images/help/tests_detail_page.png) ### Bulk test refresh Refresh in bulk after a broad configuration change, or when preparing your whole compliance status for an audit. **When to use bulk refresh:** - After major configuration changes in your ISMS - For complete compliance status update before audits - During systematic remediation of multiple failed tests - For periodic system assessments **Bulk refresh process:** 1. **Go to Tests overview page** 2. **Select desired tests** via checkboxes in first column 3. **Bulk action bar appears** at top 4. **Click "Refresh" button** in bulk action bar 5. **Tests are executed in parallel** for fast results ![Bulk test selection and refresh](/images/help/tests_bulk_refresh.png) ## Viewing and interpreting test details A test's detail page explains why the check matters, how to fix a failure, and which controls it counts towards. ### Navigating test detail page Each test has an extensive detail page with context information and remediation guidance. **Access to test details:** 1. **Click on test name** in Tests overview table 2. **Test detail page opens** with complete information 3. **Tabs available:** Details, Previous results 4. **Refresh** button top right 5. **Download test results** button available in side panel ![Test detail page](/images/help/tests_detail_page.png) ### Understanding "Why is it important?" section This section explains the regulatory and business reason the test exists, not just what it checks. **Compliance context explanation:** - **Regulatory background** - Which standards require this control - **Business impact** - Why compliance is important for organisation - **Risk implications** - Consequences of non-compliance - **Best practice guidance** - Why this test is industry standard ### Following "How to fix it?" instructions This section gives the concrete steps to resolve a failure, not just a description of the problem. **Practical steps to fix tests:** - **Specific steps** to resolve test failure - **Links to relevant** controls or assets - **Timeline guidance** for implementation - **Verification steps** to confirm success ### Linking controls A test is "In scope" when it is linked to at least one control. Tests without any linked controls are "Out of scope" and don't affect your compliance status. 1. **Find the Controls section** in the test detail page 2. **Use the "Link control(s)" selector** to add controls 3. **Test automatically becomes** "In scope" and affects your compliance status 4. **Remove a control** by clicking the X on a control chip > **tip:** Don't see the control you're looking for? Go to the [Controls overview](/docs/controls/editing-and-managing-controls) to create a new control or link tests from the control detail page. ## Downloading test results Export a test's results when you need the detail outside Tidal, typically for an audit. ### Using download functionality The download button in test details allows you to export detailed test results for reporting and audit purposes. **Download process:** 1. **Open test detail page** of desired test 2. **Click Download button** (⬇️) in side panel next to "Last result" 3. **Test result file** is downloaded to your computer 4. **Open downloaded file** for detailed analysis > **warning:** Test results are downloaded as a .json file. Your system may not have a default application for this. However, JSON files can be opened in regular text editors and also imported into MS Excel. ## Test monitoring strategies How often you need to refresh depends on the kind of test: Tidal tests keep themselves current, integration tests run on a schedule. ### Tidal tests Tidal tests refresh automatically as soon as something changes in the situation they relate to. You typically don't need to refresh these manually. For example: - Policy tests refresh when a Policy changes status (in the Policies page) - Risk tests refresh when Risk details are adjusted and when Risk assessments are performed or adjusted - Control tests refresh when Control details are adjusted or Control status changes etc. ### Integrations When to refresh? - **System being tested is modified** - after a major software release or configuration update - **Specific remediation actions performed in system** - 2FA is enabled causing the Failed test to now Pass - **As part of PDCA cycle** - when there's a task open under the Control 'Compliance monitored' and you need new results - **Periodically** - even when no changes are known, it's still wise to run Tests periodically to confirm the situation hasn't changed ## Configuring integrations for external tests An integration test cannot run until its integration is connected, which is done once in Settings. ### Prerequisites for external test activation An external test can't run until its integration is fully configured and connected. **Understanding integration requirements:** - **Settings → Integrations** configuration must be complete first - **API credentials** and permissions correctly set - **Network connectivity** to external systems verified - **Verify scope** - Which external data is relevant ### Settings → Integrations configuration process Every integration is set up from the same place: Settings, then Integrations, then the configuration wizard for that tool. **Integration activation steps:** 1. **Go to Settings** in left navigation menu 2. **Select Integrations** section 3. **Choose desired integration** from available options 4. **Follow configuration wizard** for specific tool 5. **Test connectivity** to verify working status Each Integration has its own connection process and guide. Read more about this in [Integrations](/docs/integrations). ## Next steps Now that you can execute and monitor tests: - **Develop periodic monitoring** routine for critical tests - **Implement monthly or quarterly review** process for trend analysis - **Configure relevant integrations** for complete compliance coverage - **Optimise test scope** based on priority and requirements ### Getting started with Tests URL: https://tidalcontrol.com/docs/tests/getting-started Tests are automated checks Tidal runs on your own data or a connected system. How to read the dashboard, the tests table, statuses and the results timeline. Tests are automated checks that Tidal runs for you, either against your own Tidal data or against a connected system such as Azure or GitHub. You cannot create or edit them; you read their results and link them to the controls they prove. This article covers the overview, the four statuses, and what "in scope" means. ## Navigating the Tests overview page The Tests page shows an overview of all available compliance tests with their current status and results. ![Tests overview](/images/help/tests_overview.png) **What you see in the overview:** - **Dashboard statistics** - Passed, Failed and Error percentages - **Tests table** - All available tests with status information - **Search functionality** - Quickly find specific tests - **Filter options** - In scope, Out of scope, Integrations, Controls, Status - **Bulk actions** - Manage multiple tests simultaneously ### Understanding dashboard statistics The dashboard splits your tests into passed, failed, and error, both as a percentage and as a raw count. **Compliance score indicators:** - **Passed (35%)** - Number of tests that executed successfully and comply with requirements - **Failed (31%)** - Number of tests that failed and require attention - **Error (0%)** - Number of tests with technical problems during execution **Count information:** - **17 Passed tests** of 48 total - Number of tests currently passing - **15 Failed tests** of 48 total - Number of tests currently requiring action - **0 Error tests** of 48 total - Number of tests with technical problems detected > **info:** The statistics only count 'In scope' tests. 'Out of scope' tests are excluded. ### Tests table interface Each row shows what a test checks, which controls it counts towards, and its five most recent results. **Column information:** - **Name** - Description of what the test checks - **Controls** - Number of linked controls (e.g. 🔗 1) - **Integration** - Which system the test runs on (Tidal Control or external tool) - **Last executed** - When test was last run - **Last results** - 5 most recent test results **Example test information:** ``` All assets should be assessed | 🔗 1 | Tidal Control | 5 days ago | F P P P P ``` This shows an asset assessment test linked to 1 control, executed within the Tidal Control environment (Assets page), last run 5 days ago, with recent failed test (F) but earlier successes (P). ## Recognising test statuses A test reports one of four statuses, and anything other than Passed marks the controls it is linked to red. ### Status indicators in results A passed test is compliant and needs nothing further; anything else needs a look. **Passed (P) - Green indicator:** - **Test executed successfully** and requirement is complied with - **Compliance is achieved** for this specific control - **No action required** at this time - **Contributes positively** to overall compliance score **Failed (F) - Red indicator:** - **Test failed** and requirement is not complied with - **Compliance problem detected** requiring attention - **Action needed** to make test pass - **Negative impact** on compliance score **Error (E) - Orange/yellow indicator:** - **Technical error** during test execution - **Test could not be completed** due to system problem - **No compliance conclusion** possible - **Integration or configuration** problem to resolve **Not executed yet:** - **Test not yet executed** since configuration - **Waiting for first run** or manual refresh - **No result** available for analysis ### Test results timeline The five most recent results are shown in order, so you can see whether a test is trending towards or away from compliant. **Multiple results per test:** ``` P F F E E - Last 5 runs ``` **Interpretation:** Of the last 5 times this test ran: - **The first 2 runs** resulted in errors - **Run 3 and 4** ran, but showed non-compliant results - **The 5th and latest run** showed all results are now compliant ## Understanding Types of Tests Tidal Control uses two main types of tests for complete compliance monitoring. ### Tidal Tests **Tidal tests** run within the Tidal platform and check the quality of your Tidal configuration against standard requirements. **Policy Tests (largest group) examples:** - **"Establish the policy for acceptable use of information"** - Checks existence and currency of this policy - **"Establish the access control policy"** - Checks existence and currency of this policy **Risk Tests examples:** - **"All risks should have risk owners assigned"** - Verifies ownership assignment - **"All risks should be assessed"** - Checks if all risks are (properly) assessed **Control Tests examples:** - **"All controls should have control owners assigned"** - Verifies ownership assignment - **"All controls should be assessed 'Effective'"** - Checks if all controls are assessed as Effective - **"All controls need to have at least one linked risk"** - Checks that all controls are linked to a risk - **"All controls need to have at least one linked risk with treatment 'reduce'"** - Checks that all controls are linked to a risk that aims to mitigate this risk through control implementation **Asset Tests examples:** - **"All assets should have asset owners assigned"** - Verifies ownership assignment - **"All assets should be assessed"** - Checks if all assets have been recently assessed etc. > **info:** New Tidal tests are regularly added. Send suggestions via email to support@tidalcontrol.com ### Integrations **Integrations** retrieve real-time data from other systems to verify compliance based on actual configurations. **Cloud Provider Integration examples:** - **Data encryption settings** - Checks encryption configuration in Cloud environments (AWS, Azure, GCP) - **User access controls** - Verifies access rights and multi-factor authentication - **Mobile device configuration** - Checks security configuration on laptops and other mobile equipment **Other external integrations:** - **Software development platforms** secure configuration and code analysis to production (Github, Gitlab, etc.) - **ITSM Tools** timely resolution of (security/compliance) tickets (Jira, etc.) **Benefits of external tests:** - **Real-time data** - Current status of system configurations - **Objective measurements** - No manual interpretation needed - **Automatic updates** - Tests reflect current system state - **Comprehensive coverage** - Technical and procedural controls combined > **info:** Integration tests can only deliver results after the relevant Integration has been connected to Tidal. Read more about this in [Getting started with Integrations](/docs/integrations/getting-started). ## In scope vs Out of scope concept A test only affects your compliance score once it is linked to at least one control. Unlinked tests are out of scope and count for nothing. ### Understanding scope filtering Use the In scope / Out of scope filter to check which of your tests actually count towards compliance and which don't yet. **In scope tests:** - **Linked to at least one control** in your ISMS - **Results count** in control effectiveness calculation - **Priority for monitoring** and remediation **Out of scope tests:** - **Not linked to controls** in current ISMS configuration - **Informative** but no impact on compliance scores - **Optional monitoring** but can provide valuable insights ![In scope vs Out of scope filtering](/images/help/tests_overview.png) > **tip:** You change a test's scope by linking or unlinking controls, not from this overview. That works from either side: on the control's "Tests" tab, or with the Controls selector on the test detail page. Read more about this in [Editing and managing controls](/docs/controls/editing-and-managing-controls) and [Executing and monitoring tests](/docs/tests/executing-and-monitoring-tests). ## Searching and filtering tests Search matches test names, and the filters separate in-scope from out-of-scope tests and narrow by status and integration. ### Using search functionality 1. **Click in search bar** "Press 'Enter' to search" at top of Tests page 2. **Type test name** or part of description 3. **Results filter** automatically while typing 4. **Clear search (X)** to show all tests ### Using filter options Filter between in-scope and out-of-scope tests, or by which integration a test runs against. **In scope / Out of scope:** - **Switch between tabs** to find relevant tests - **Focus on priority** tests that have compliance impact - **Explore available** tests for scope expansion **Integrations filter:** - **Tidal Control** - Filter on internal tests - **Microsoft** - Show only Microsoft integration tests - **Other integrations** - Specific external tool tests **Controls filter:** - **Focus on specific control(s)** - **Tests can** be linked to multiple controls **Status filter:** - **Pass** - Show only successful tests - **Fail** - Focus on tests requiring attention - **Error** - Identify technical problems - **Executed** - Find all tests that have one of the above statuses - **Not executed** - Find tests that need refresh ## Tests versus manual tasks Tests in Tidal Control are **automated quality controls** that measure the effectiveness of your technical controls and work in Tidal against requirements from compliance standards relevant to you. **Core functionalities:** - **Real-time quality measurements** - Direct feedback on effectiveness of technical controls and activities performed in Tidal - **Integration with external systems** - Retrieve data from other tools for complete compliance picture - **Objective compliance scores** - Measurable results for audit and management reporting - **Proactive problem identification** - Identify issues before they have impact **Tests** are ideal for: - Real-time monitoring of compliance requirements - Objective measurements of ISMS quality - Automated detection of deviations **Manual tasks** are still needed for: - Executing and documenting compliance activities performed outside Tidal (e.g. Management review) - Documenting evidence for systems Tidal cannot yet integrate with - Organisation-specific requirements that deviate from standard test logic ## Next steps Now that you know the Tests interface: - **Explore In scope tests** to understand current compliance status - **Configure external integrations** for complete compliance monitoring - **Analyse Failed tests** to identify priorities for improvement - **Develop monitoring routine** for proactive compliance management ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/tests/troubleshooting-and-faq Tests are managed by Tidal Control, so you cannot create or edit them. The difference between Tidal and integration tests, and what an Error status means. Tests are managed by Tidal Control, so you cannot create or edit them yourself. The answers below explain that, the difference between Tidal tests and integration tests, how results feed your compliance score, and what an Error status means. ## Frequently asked questions ### Why can't I create or modify tests? **Tests are fully managed by Tidal Control** and can only be modified by Tidal to ensure consistency and compliance quality. **Why tests aren't editable:** - **Standardisation** - Tests are based on recognised compliance frameworks - **Quality control** - Tidal ensures accurate test logic and up-to-date requirements - **Consistency** - All organisations use the same test criteria for comparability - **Maintenance** - Updates for new regulations are automatically rolled out **What you can adjust:** - **Test in or out of scope** - Link tests to relevant controls via control configuration - **Test frequency** - Determine how often you refresh tests - **Integration settings** - Configure or not configure external tool connections **Custom test requests:** 1. **Document business necessity** - Why is a new test needed? 2. **Describe test criteria** - What should the test check exactly? 3. **Support compliance framework** - Which standard or requirement supports this? > **tip:** Send your requests via email to support@tidalcontrol.com or fill out the 'Request Feature' form in Tidal, and we'll get in touch as soon as possible. ### What's the difference between internal and external tests? **Internal Tests (Tidal Control) focus on the quality of processes you execute within Tidal:** **Characteristics:** - **Platform native** - Run within Tidal Control itself - **Configuration checks** - Check your setup quality **Examples:** - **"All assets should be assessed"** - Checks accuracy and completeness of asset assessments - **"All risks should have owners assigned"** - Verifies completeness of ownership assignment - **Policy tests** - Check existence and presence of periodic review of required policies **External Tests (Integrations) focus on technical system compliance:** **Characteristics:** - **External connectivity** - Retrieve data from other systems - **Technical validation** - Check actual system configurations - **Real-time data** - Reflect current state of external tools - **Dependent on configured integrations** - Require active integration configuration **Examples:** - **Microsoft encryption** settings - Data security configuration in Microsoft tools - **AWS security** baseline compliance - Cloud security configurations - **Identity provider** settings - Multi-factor authentication configuration **When to use which type:** - **Internal tests** for management process maturity (Governance) and compliance documentation completeness - **External tests** for technical control effectiveness and system compliance - **Combination** for comprehensive compliance requirements coverage ### How do test results affect my compliance scores? **Automatic compliance score calculation via test-control links:** **In scope test impact:** - **Test linked to control** → Test result counts in control effectiveness - **Control effectiveness** → Contributes to overall framework compliance score - **Framework score** → Affects organisation compliance percentage **Score calculation example:** ``` Control A.01 has 3 linked tests: - Test 1: Passed (✓) - Test 2: Failed (✗) - Test 3: Passed (✓) Control effectiveness: 67% (2 of 3 tests passed) ``` **Out of scope test impact:** - **No impact** on compliance scores or control effectiveness - **Informative** for monitoring and future scope expansion - **Available** for trend analysis and improvement insights ### When are tests automatically executed? **Tidal tests** refresh automatically as soon as something changes in the situation they relate to. You typically don't need to refresh these manually. For example: - Policy tests refresh when a Policy changes status (in the Policies page) - Risk tests refresh when Risk details are adjusted and when Risk assessments are performed or adjusted - Control tests refresh when Control details are adjusted or Control status changes etc. **Integrations** must always be refreshed manually. When to refresh? - **System being tested is modified** - after a major software release or configuration update - **Specific remediation actions performed in system** - 2FA is enabled causing the Failed test to now Pass - **As part of PDCA cycle** - when there's a task open under the Control 'Compliance monitored' and you need new results - **Periodically** - even when no changes are known, it's still wise to run Tests periodically to confirm the situation hasn't changed > **info:** Work is underway on automatic test refresh. This will be made available in a future release. ### Can I request custom tests for my organisation? A request needs the business reason, the exact criteria, and which framework requirement it supports. **Custom test requests:** 1. **Document business necessity** - Why is a new test needed? 2. **Describe test criteria** - What should the test check exactly? 3. **Support compliance framework** - Which standard or requirement supports this? Send your requests via email to support@tidalcontrol.com or fill out the 'Request Feature' form in Tidal, and we'll get in touch as soon as possible. ## Common problems ### Test remains in "Error" status **Error status implies a technical problem** during test execution requiring direct action. > **tip:** The Error message in the Tests result details often immediately provides insight into the cause of the problem. Read further if the Error message doesn't give clear indication of the cause ("Something went wrong"). **Common causes:** **If the test has never worked:** - **Integration: "Tidal Control"?** Contact support@tidalcontrol.com immediately - **Is the Integration active?** Check in Settings -> Integrations if the Integration for the relevant system is active - **Check in (the logs of) the relevant system if login credentials (API key or user credentials) are correct and active** - Tidal needs an active API key or user credential with the right permissions to retrieve data - **Have you enabled the functionality?** Some Integrations are dependent on services that need to be enabled in the source system. For instance, in a Microsoft environment, laptops can only be monitored when you have bought and setup Microsoft Intune first. **If the test previously worked, but now doesn't:** Check the following possible causes: - **Have API credentials or usage rights expired or changed?** - Many platforms require periodic update of API credentials for security reasons - **Is the system reachable?** - Verify that the providing system is online for API access (e.g. via the status page) - **Has anything changed recently?** - Sometimes software updates on the side of the system Tidal integrates with, or to Tidal, lead to failure of tests that previously worked > **info:** Work is underway on more detailed Error reporting that can help solve common problems ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Integrations ## Integrations URL: https://tidalcontrol.com/docs/integrations Connect Tidal Control to the systems you already run, so compliance tests read your real configuration instead of someone attesting to it. All read-only. Tidal control automations, to make your tasks easier. ### Aikido URL: https://tidalcontrol.com/docs/integrations/aikido Connect Aikido Security to Tidal Control so compliance tests read your code and cloud findings. All access is read-only, nothing is created, changed or deleted. Tidal Control's Aikido integration monitors your Aikido Security environment for compliance purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in Aikido. ## What this integration monitors - **Issues:** Open security findings and their severity - **Repositories:** Connected code repositories - **Cloud accounts:** Connected cloud environments - **Containers:** Container images under scan - **Virtual machines:** Connected VMs - **Domains:** Monitored domains - **Teams & users:** Team membership and users ## Requirements - Super User role in Tidal Control - An Aikido account with permission to create API credentials ## Configuration step-by-step plan We'll create an **Aikido OAuth2 API client** (Client ID and Client Secret), then add the connection in Tidal Control. **Configuration steps:** 1. **Create an API client in Aikido** 2. **Configure the integration in Tidal Control** ## Step 1: Create an API client in Aikido - Log in to [Aikido](https://app.aikido.dev) - Go to **Integrations › API** - Create a new API client - **Copy the Client ID and Client Secret**: the secret is only shown once > **warning:** **Save the Client Secret immediately.** Aikido only shows the secret once at creation. If you close the dialog without copying it, you will need to create a new API client. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Aikido** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Aikido` - **Client ID:** The Client ID from step 1 - **Client Secret:** The Client Secret from step 1 - **Region (optional):** The Aikido region your account uses (defaults to **EU**) - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Aikido`, `Aikido Production` **Client ID:** - The Aikido OAuth2 client identifier - Created in step 1 **Client Secret:** - The secret part of the Aikido OAuth2 client - Created in step 1 - Keep this value secure **Region (optional):** - The Aikido data region your account uses - Leave on the default (EU) unless your account is hosted in another region
RegionEndpoint
EUapp.aikido.dev (default)
USapp.us.aikido.dev
MEapp.me.aikido.dev
## Verification The integration is working when all of the following are true: - Settings → Integrations shows Aikido under **Configured Integrations** - Aikido tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control make changes in Aikido?** No. The integration is read-only and only reads data from the Aikido public API. **Which region should I choose?** Use the region where your Aikido account is hosted. Most accounts are on the EU region (`app.aikido.dev`), which is the default. If you sign in at `app.us.aikido.dev` or `app.me.aikido.dev`, choose US or ME respectively. ## Common problems **"Aikido OAuth2 authentication failed"** - Check that the Client ID and Client Secret are correct and were not truncated - The secret is only shown once. If you did not copy it, create a new API client **Tests fail with an authorization error** - Confirm the API client still exists in Aikido and has not been revoked **No data or wrong data returned** - Confirm the selected **Region** matches the region where your Aikido account is hosted ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Anthropic URL: https://tidalcontrol.com/docs/integrations/anthropic Connect your Claude Console organisation to Tidal Control for AI governance and access control tests. Read-only, and no model prompts or completions are read. Tidal Control's Anthropic integration monitors your Claude Console organisation for AI governance and access control purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your Anthropic organisation. > **warning:** **Anthropic or Claude Enterprise?** Anthropic offers two separate products with two separate keys. Use **this** integration if your company builds with the **Anthropic API** through the Claude Console (`platform.claude.com`). If your employees use Claude for chat and projects on `claude.ai`, use the [Claude Enterprise](/docs/integrations/claude-enterprise) integration instead. The keys are not interchangeable. If you use both products, connect both integrations. ## What this integration monitors - **Organisation members:** Email, name, organisation role (admin, developer, billing, user), and when they were added - **Workspaces:** Name, creation date, archival state, data residency, and default inference region - **Workspace members:** Who can act in each workspace and at what workspace role - **API keys:** Name, status, workspace scope, expiry date, and the user who created the key - **Invites:** Pending invites with their invited role and expiry date ## Requirements - Super User role in Tidal Control - A Claude Console organisation (the Admin API is not available for individual accounts) - The **admin** organisation role in the Claude Console, since only admins can create Admin API keys ## Configuration step-by-step plan We'll create an **Admin API key** in the Claude Console, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an Admin API key in the Claude Console** 2. **Configure the integration in Tidal Control** ## Step 1: Create an Admin API key in the Claude Console - Sign in to the [Claude Console](https://platform.claude.com) as an organisation admin - Go to **Settings → Admin keys** - Click **Create key** - Enter a name (e.g. `Tidal Control`) and optionally set an expiration - Click **Create key** - **Copy the key**: it starts with `sk-ant-admin01-` and is only shown once > **warning:** **Save the Admin API key immediately.** Anthropic only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. > **info:** **Admin keys have no scopes.** A Console Admin key carries full Admin API access, so there is nothing to select during creation. Tidal Control only reads organisation members, workspaces, API key metadata, and invites. It never reads or sends messages, and never retrieves secret key values. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Anthropic** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Anthropic` - **Admin API Key:** The key from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Anthropic`, `Anthropic Console` **Admin API Key:** - The Claude Console Admin API key, starting with `sk-ant-admin01-` - Created in step 1 - A regular Anthropic API key (`sk-ant-api03-`) will not work. It cannot call the Admin API - Keep this value secure ## Available checks The integration runs the following checks, grouped by the area they cover: **AI governance (ISO/IEC 42001):** - Who has access to the AI provider organisation and at what role - Which workspaces exist, which are archived, and where their data resides - Which credentials are live, as evidence of governance over your AI supply chain **Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1):** - Organisation and workspace role assignments for least-privilege reviews - Privileged access: organisation admins and workspace admins - API key inventory, including keys without an expiry date and who created them **Identity management (ISO 27001 A.5.16, SOC 2 CC6.2, CC6.3):** - Member roster with joining dates - Pending invites that were never accepted or have expired - Archived workspaces and inactive API keys as de-provisioning evidence ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Anthropic under **Configured Integrations** - Anthropic tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control read our Claude conversations?** No. The integration only reads organisation governance data: members, workspaces, API key metadata, and invites. **Does this integration cover usage and cost reporting?** No. It covers identity, access, and credential governance only. Usage and cost reports are not retrieved. **Can I use a regular Anthropic API key?** No. Only an Admin API key can call the Admin API. A regular API key returns an authentication error. **Are MFA and SSO settings included?** No. The Admin API does not expose organisation MFA or SSO enforcement settings, so verify those manually in the Console. ## Common problems **Authentication fails with a 401 error** - Confirm the key starts with `sk-ant-admin01-`. A regular API key cannot call the Admin API - Check that the key was copied in full and has not expired or been revoked - Confirm the account that created the key still has the **admin** organisation role **No workspaces or members are returned** - Confirm the key belongs to the organisation you want to monitor - Individual accounts without an organisation have no Admin API data to read **Test refresh is slow for large organisations** - Workspace membership is read per workspace, so organisations with many workspaces take longer to refresh ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Atlassian Admin URL: https://tidalcontrol.com/docs/integrations/atlassian-admin Connect your Atlassian organisation to Tidal Control with an API key, so compliance tests read organisation-level settings and user administration. Read-only. The Atlassian Admin integration enables Tidal Control to automatically execute compliance tests on your Atlassian organisation via an API key configuration. Atlassian Admin is used for central management of Atlassian products, allowing administrators to manage users, groups, security policies and compliance settings. ## Requirements - Super User role in Tidal Control - Atlassian Admin account with organisation management rights - Access to Atlassian Admin portal - API key creation permissions ## Configuration step-by-step plan We'll create an **Atlassian Admin API key with scopes** in your Atlassian organisation that allows Tidal to retrieve compliance data. A scoped API key is an Atlassian mechanism that enables external applications (Tidal) to securely access specific organisation resources with limited rights. **Configuration steps:** 1. **Create API key with scopes** 2. **Complete integration** ## Step 1: Create API key with scopes - Go to **Atlassian Admin portal** at http://admin.atlassian.com - **Select your organisation** from available organisations - Click **"Settings"** in top navigation bar - Select **"API Keys"** in left menu - Click **"Create API Key"** top right **Select API key type:** - Select **"API key with scopes"** - Click **"Next"** **API key configuration:** - **Descriptive name:** `Tidal Control Integration` - **Expiry date:** Select desired validity period (max. 1 year) - Click **"Next"** **Assign scopes:** Select the following scopes in the **"Read"** section: - `Classification levels` - `Domains` - `Policies` - Click **"Next"** **Complete API key:** - Check API key details - Click **"Create API Key"** - **Copy API key value** immediately (no longer visible after closing) - Click **"Done"** > **info:** **API key validity:** Atlassian Admin API keys have a maximum validity period of one year. When your API key expires, Tidal Control can no longer retrieve data from your Atlassian Admin environment. ## Step 2: Complete integration - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to Atlassian Admin - Fill in configuration: - **Name:** `Atlassian Admin Production` - **API Key:** Copied API key value (from step 1) - Click **"Create"** to save integration ## Setup for multiple organisations If you need to connect multiple Atlassian organisations to Tidal Control: 1. **Repeat API key creation** for each Atlassian organisation 2. **Configure separate integration** in Tidal per organisation 3. **Use descriptive names** to distinguish organisations (e.g. "Atlassian Admin EU", "Atlassian Admin US") ## Verification After successful configuration, Settings → Integrations shows Atlassian Admin under **Configured Integrations**, Atlassian-specific tests are available in the Tests section, and test refreshes deliver results without authentication errors. > **warning:** **Save API key:** Note the API key securely - it's no longer visible after creation and uniquely needed for troubleshooting ## Troubleshooting If the integration does not connect, check the following: - Verify that API key is correctly copied (no extra spaces) - Check API key expiry date has not been reached - Confirm correct permissions selected (Classification levels, Domains, Policies) - Verify that Atlassian Admin account has organisation management rights **For more information about Atlassian Admin API management:** See [official Atlassian documentation](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/) ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Amazon Web Services (AWS) URL: https://tidalcontrol.com/docs/integrations/aws Connect your AWS environment to Tidal Control with a cross-account IAM role using the SecurityAudit policy, so compliance tests read your real configuration. The AWS integration enables Tidal Control to automatically execute compliance tests on your AWS environment via a cross-account role configuration. ## Requirements - Super User role in Tidal Control - AWS IAM role management rights - Access to AWS Management Console ## Configuration step-by-step plan We'll create a **cross-account role** in your AWS account that allows Tidal to retrieve compliance data. A cross-account role is an AWS mechanism that enables an external AWS account (Tidal) to securely access specific resources in your account without sharing credentials. **Configuration steps:** 1. **Note Tidal information** 2. **Create AWS IAM role** 3. **Assign permissions** 4. **Retrieve Role ARN** 5. **Complete integration** ## Why SecurityAudit? The **SecurityAudit** policy is an AWS-managed, read-only policy designed for compliance and security monitoring tools. It gives Tidal read access to configuration metadata across your AWS services, never to the data stored within them. All access is read-only. Tidal Control never writes, modifies, or deletes anything in your AWS environment.
Service areaWhy we need access
IAMWe check user and role configurations: MFA enforcement, access key rotation, password policies, unused credentials, privilege levels, and whether an IAM access analyzer is configured.
EC2 & networkingWe verify instance configurations, security group rules, network ACLs, VPC flow logging, EBS encryption, public IP assignments, and network exposure of services.
S3We check bucket access controls, public access block settings, encryption at rest, access logging, and lifecycle configuration.
RDS & databasesWe verify database encryption, public accessibility, backup configuration, multi-AZ setup, and monitoring settings.
ECSWe check container task definition security: privilege levels, network mode, logging configuration, and secret handling.
CloudWatch & CloudTrailWe verify that alarms are configured for critical security events, such as root user activity, unauthorised API calls, and infrastructure configuration changes.
Secrets Manager & KMSWe check that secrets are rotated on schedule and that encryption keys are not publicly accessible and have rotation enabled.
## Step 1: Note Tidal information - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to Amazon Web Services - Note the **Tidal Account ID** from the dialogue screen - Note the **suggested External ID** (Tidal automatically generates a secure ID) - Save these values - you'll need them for AWS configuration ## Step 2: Create AWS IAM role - Log in to **AWS Management Console** - Navigate to **IAM → Roles → Create role** - Select **"AWS account"** → **"Another AWS account"** - Enter the **Tidal Account ID** (from step 1) - Tick **"Require external ID"** - Enter the **External ID** (from step 1) - Click **"Next"** ## Step 3: Assign permissions - Search for policy **"SecurityAudit"** - Select **SecurityAudit** policy - Click **"Next"** to continue - (Optional) Add tags and click **"Next"** ## Step 4: Retrieve Role ARN - Give the role the name **"Tidal Integration"** - Add description: **"Read-only role for Tidal Control compliance monitoring"** - Click **"Create role"** - Go to **Roles overview** and search for your new role - Click on **role name** to open details - Copy the **Role ARN** (save for Tidal configuration) ## Step 5: Complete integration - Return to **Tidal dialogue screen** - Enter **recognisable name** for integration - Paste the **Role ARN** (from step 4) - Check **External ID** is correctly carried over - Open the **Regions** dropdown and select the AWS regions where your services run. You can select multiple regions. Check the top right of the AWS Console to see your current region. - Click **"Create"** to save the connection > **tip:** **Region setting:** Select the regions where your AWS services run. Without a selection, the integration defaults to `aws-global`, which only covers global services like IAM, CloudFront, and Route 53. ## Verification After successful configuration, Settings → Integrations shows AWS under **Configured Integrations**, AWS-specific tests are available in the Tests section, and test refreshes deliver results without authentication errors. > **warning:** **Save External ID:** Note the External ID securely - it's unique and needed for troubleshooting ## Troubleshooting If the integration does not connect, check the following: - Verify Role ARN correctly copied (no extra spaces) - Check External ID matches between AWS and Tidal - Confirm SecurityAudit policy linked to role - Verify AWS Region correctly selected ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Microsoft Azure URL: https://tidalcontrol.com/docs/integrations/azure Connect Microsoft Azure to Tidal Control so compliance tests run against your Azure environment and Entra ID configuration, from subscriptions to identities. The Microsoft Azure integration enables Tidal Control to automatically execute compliance tests on your Azure environment and Entra ID configuration. ## Requirements - Super User role in Tidal Control - Entra ID app registration rights - Azure subscription access for role assignments ## Required permissions The Azure integration uses two distinct permission sets: one for Entra ID (Azure AD) and one for Azure resources. All access is read-only. Tidal Control never writes, modifies, or deletes anything in your Azure environment. ### Microsoft Graph API permissions These permissions give Tidal read access to your Entra ID configuration:
Permission(s)Why we need it
User.Read.All, Directory.Read.AllWe check for stale user accounts and pending forced password changes.
Policy.Read.All, Organization.Read.AllWe verify conditional access policies, such as MFA enforcement for administrators and access restrictions to the Entra admin portal.
Device.Read.All, DeviceManagementManagedDevices.Read.AllWe verify Intune MDM enrollment, device encryption status, and whether devices have synced recently.
Group.Read.All, GroupMember.Read.All, Application.Read.AllWe resolve group memberships used in conditional access policies and verify application registrations.
### Reader role on Azure subscriptions The Reader role gives Tidal read access to your Azure resource configurations:
Resource typeWhy we need access
Virtual machinesWe verify auto-patching configuration, Trusted Launch (Secure Boot), and disk encryption at rest.
Storage accountsWe check for public blob access, HTTPS enforcement, soft delete and retention policies, and encryption at rest.
Key VaultWe verify that key vaults do not have public network access enabled.
AKS (Kubernetes)We check whether Kubernetes API servers are publicly accessible and whether automatic upgrade channels are configured.
PostgreSQL Flexible ServerWe verify public network access, backup retention, maintenance window, TLS settings, and encryption at rest.
### Microsoft Defender for Endpoint API permissions The Microsoft Defender tests use the Microsoft Defender for Endpoint API. These are **application permissions on the WindowsDefenderATP API**. They are separate from the Microsoft Graph permissions and the Reader role above. Without them, the Defender tests fail with an authorization error even though the rest of the integration is connected.
PermissionWhy we need it
Machine.Read.AllWe retrieve onboarded devices and their antivirus health status.
Vulnerability.Read.AllWe read the vulnerabilities detected on your devices.
SecurityRecommendation.Read.AllWe read Defender security recommendations (Threat & Vulnerability Management).
Alert.Read.AllWe read Defender security alerts.
## Configuration methods There are two ways to connect Azure. App integration is the recommended route; a service principal is for cases where you cannot use it. ### App integration (recommended) App integration is faster to set up and Tidal manages the credentials for you. **Benefits of app integration:** - **Faster and simpler** - Fewer manual steps and configuration - **Less error-prone** - Automatic permissions setup - **No credential management** - Tidal manages authentication automatically **Setup process:** 1. **Go to Settings → Integrations** in Tidal Control 2. **Click Microsoft Azure tile** 3. **Select "App integration (recommended)"** 4. **Click "Click here to get started"** 5. **Log in via Azure portal** when redirected 6. **Review permissions** and click "Accept" ### Service Principal Use a service principal only when your organisation's security policy blocks external app integrations outright. **When to use service principal:** - **Full control** over app registration and permissions required - **Organisation security policy** doesn't allow external app integrations - **Custom credential** management desired **Service principal disadvantages:** - **More configuration steps** and higher chance of errors - **Manual credential** management (expiration tracking) - **Risk of incomplete permissions** causing test failures **Service principal configuration:** The goal of these steps is to create a service principal in Azure and collect the required values to enter into Tidal later. **Note the following values during configuration:** - Tenant ID - Client ID - Client Secret - Integration name **Azure app registration:** 1. **Go to Azure portal → Entra ID → App registrations** 2. **Click "New registration"** - Name: `Tidal Control - Integration` - Account types: `Single tenant` 3. **Note Application (client) ID** (save for Tidal configuration) 4. **Note Directory (tenant) ID** (save for Tidal configuration) **Generate client secret:** 1. **Go to "Certificates & secrets"** 2. **Click "New client secret"** - Description: `Tidal Control - Integration` - Expires: 12 months 3. **Click "Add"** 4. **Note secret value immediately** (no longer visible after leaving page) > **warning:** **Important**: Note all values (Tenant ID, Client ID, Secret) in a secure location. You'll need these for Tidal configuration and the client secret cannot be retrieved later. **Configure API permissions:** 1. **Go to "API permissions" → "Add a permission"** 2. **Select Microsoft Graph → Application permissions** 3. **Add all permissions:** - `Directory.Read.All` - `User.Read.All` - `Device.Read.All` - `Application.Read.All` - `DeviceManagementManagedDevices.Read.All` - `GroupMember.Read.All` - `Group.Read.All` - `Organization.Read.All` - `Policy.Read.All` 4. **Add the Microsoft Defender for Endpoint permissions** (required for the Defender tests): - **Add a permission → APIs my organization uses → search "WindowsDefenderATP" → Application permissions** - `Machine.Read.All` - `Vulnerability.Read.All` - `SecurityRecommendation.Read.All` - `Alert.Read.All` 5. **Click "Grant admin consent"** for your tenant **Complete integration in Tidal:** 1. **Go to Settings → Integrations → Microsoft Azure** 2. **Select "Service Principal"** 3. **Fill in noted values:** - **Name**: Recognisable name for the integration - **Tenant ID**: Directory (tenant) ID from Azure - **Client ID**: Application (client) ID from Azure - **Client Secret**: The created client secret ## Azure subscription access Assign the Reader role separately for every subscription you want Tidal to test: For each Azure subscription you want to monitor: 1. **Azure portal → Subscriptions → [Select subscription]** 2. **Access control (IAM) → Add role assignment** 3. **Select "Reader" role** 4. **Search for your Tidal integration** (name you used in step 1) 5. **Select integration** and click "Assign" > **tip:** **Reader role**: Gives Tidal read-only access for compliance monitoring without security risks. Sufficient for all Azure tests. ## Integration verification in Tidal The integration is working when all of the following are true: - **Settings → Integrations** shows Azure under **Configured Integrations** - **Test refresh** delivers results without (authentication) errors If the integration does not connect, check the following: - Verify all credentials are correctly entered - Check admin consent has been granted for API permissions - Confirm Reader role is assigned to relevant subscriptions - If only the Microsoft Defender tests fail with an authorization error, confirm the WindowsDefenderATP permissions (`Machine.Read.All`, `Vulnerability.Read.All`, `SecurityRecommendation.Read.All`, `Alert.Read.All`) have been added to the app registration and admin consent granted ## Microsoft Sentinel integration Microsoft Sentinel is configured as a **separate integration** from the Microsoft Azure integration above. It runs compliance tests against a single Sentinel workspace by reading its incidents, analytics (alert) rules, and data connectors. Set it up only if you want to run the Sentinel tests. It has its own credentials and does not reuse the Azure integration above. ### Required permission Sentinel access is granted through an Azure RBAC role rather than API permissions. Assign the built-in **Microsoft Sentinel Reader** role to a service principal, scoped to the resource group that contains your Sentinel (Log Analytics) workspace. This grants read-only access to `Microsoft.SecurityInsights` resources (incidents, alert rules, and data connectors), sufficient for all Sentinel tests. ### Setup process Registering the app in Entra ID gives you the two IDs and secret that Sentinel's own setup then needs. **1. Register an app (service principal):** 1. **Go to Azure portal → Entra ID → App registrations → New registration** - Name: `Tidal Control - Sentinel` - Account types: `Single tenant` 2. **Note the Application (client) ID and Directory (tenant) ID** 3. **Go to "Certificates & secrets" → "New client secret"**, then **note the secret value immediately** (it cannot be retrieved later) > **tip:** You can reuse your existing Azure integration's app registration instead of creating a new one. Just assign it the Microsoft Sentinel Reader role in the next step and reuse its tenant ID, client ID, and client secret in Tidal. **2. Assign the Microsoft Sentinel Reader role:** 1. **Go to the resource group that contains your Sentinel workspace → Access control (IAM) → Add role assignment** 2. **Select the "Microsoft Sentinel Reader" role** 3. **Search for the app registration** you created and **assign** it **3. Gather the workspace details** you'll enter in Tidal: - Subscription ID - Resource group name - Log Analytics workspace name (the workspace Sentinel runs on) **4. Complete the integration in Tidal:** 1. **Go to Settings → Integrations → Microsoft Sentinel** 2. **Fill in the values:** - **Name**: Recognisable name for the integration - **Tenant ID**, **Client ID**, **Client Secret**: from the app registration - **Subscription ID**, **Resource group name**, **Workspace name**: from step 3 > **tip:** If the Sentinel tests fail with an authorization error, confirm the **Microsoft Sentinel Reader** role is assigned to the app registration at the resource group (or workspace) scope, and that the subscription ID, resource group, and workspace name exactly match the workspace Sentinel runs on. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Azure DevOps URL: https://tidalcontrol.com/docs/integrations/azure-devops The two-way Azure DevOps integration. Connect with a Personal Access Token so tests read your organisation, and sync Tidal tasks and issues to work items. The Azure DevOps integration connects Tidal Control to your Azure DevOps organisation using a Personal Access Token (PAT). It is a **two-way** integration: - **Azure DevOps → Tidal Control**: Tidal periodically reads your repositories and work items to run automated compliance and security tests (for example branch-protection rules and bug-handling SLAs). - **Tidal Control → Azure DevOps**: from a Tidal task or issue you can create (or link) an Azure DevOps work item. This lets your first line keep working in Azure DevOps while your second line works in Tidal Control, with both sides staying in sync. ## Requirements - Super User role in Tidal Control - An Azure DevOps organisation with at least one project - Permission to create a Personal Access Token in Azure DevOps ## How the integration works Both directions run over a single Personal Access Token. Nothing is deleted in Azure DevOps; Tidal only reads data and, when you explicitly ask it to, creates or links work items.
DirectionWhat happens
Azure DevOps → Tidal ControlOn a recurring schedule, Tidal reads repositories and work items and evaluates them against Azure DevOps compliance tests. Results appear in the Tests section.
Tidal Control → Azure DevOpsWhen you add an external issue to a task or issue, Tidal creates a work item in the selected Azure DevOps project (or links an existing one). A status badge on the Tidal task then reflects the work item.
## Configuration step-by-step plan We'll create a **Personal Access Token (PAT)** in Azure DevOps and use it to connect your organisation to Tidal Control. A PAT is an Azure DevOps mechanism that lets an external application (Tidal) securely access your Azure DevOps resources on your behalf. **Configuration steps:** 1. **Create a Personal Access Token** 2. **Add the integration in Tidal Control** ## Step 1: Create a Personal Access Token - Sign in to your Azure DevOps organisation at `https://dev.azure.com/{your-organization}` - Click your **profile icon** (top right) → **`Personal access tokens`** - Click **`+ New Token`** - **Token configuration:** - **Name:** `Tidal Control Integration` - **Organization:** select the organisation you want to monitor - **Expiration:** choose a validity period according to your security policy - **Scopes:** select the scopes below - Click **`Create`** - **Copy the token value** immediately. It is no longer visible after you close the dialog **Required scopes:**
ScopeAccessWhy we need it
CodeReadRead repository settings for the repository and branch-protection tests (Azure DevOps → Tidal).
Work ItemsRead & writeRead work items for the bug/SLA tests (Azure DevOps → Tidal) and create work items when you push a task or issue from Tidal (Tidal → Azure DevOps).
> **info:** **Read-only monitoring only?** If you only want the compliance tests (Azure DevOps → Tidal) and do not need to create work items from Tidal, a PAT with **Code (Read)** and **Work Items (Read)** is enough. Work item creation will then be unavailable. > **warning:** **Save the token securely:** The PAT is shown only once. Store it in a safe place. You'll need it again if you ever reconfigure the integration. ## Step 2: Add the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Under **Available Integrations**, click the **plus icon** next to **Azure DevOps** - Fill in the configuration: - **Name:** a recognisable name, e.g. `Azure DevOps Production` - **Organization URL:** your organisation URL in the format `https://dev.azure.com/your-organization` - **Personal Access Token:** the token value you copied in step 1 - Click **`Create`** to save the integration ![Create a new Azure DevOps connection](/images/help/azure_devops_config_dialog.png) After saving, the connection appears under **Configured Integrations**. ![Azure DevOps listed under configured integrations](/images/help/azure_devops_integrations.png) ## Compliance tests (Azure DevOps → Tidal Control) Once connected, Azure DevOps tests become available in the **Tests** section. Tidal runs them automatically on a recurring schedule and reports the result. Examples include: - Default branch requires pull request reviews - Default branch requires designated reviewers - Projects are private - Repositories are active - High priority bugs have an assignee - High priority bugs are resolved within 3 days (SLA) - No high priority bugs are abandoned without recent activity You can filter the Tests overview by the **Azure DevOps** integration to see all of them. ![Azure DevOps compliance tests in the Tests overview](/images/help/azure_devops_tests.png) > **tip:** **Bring tests in scope:** Link an Azure DevOps test to a control to make it count towards your compliance posture. Until then it shows under **Out of scope**. ## Sending tasks and issues to Azure DevOps (Tidal Control → Azure DevOps) From any Tidal task or issue you can create an Azure DevOps work item (or link an existing one), and Tidal keeps the work item's status in sync in the task overview. When adding an external issue, select your Azure DevOps connection, the **Project**, and the **Issue type**; the rest of the flow is the same for every issue tracker. See **[External issues](/docs/integrations/external-issues)** for the full create / link / sync workflow and the task-overview status column. ## Verification The integration is working when all of the following are true: - **Settings → Integrations** shows Azure DevOps under **Configured Integrations** - Azure DevOps tests appear in the **Tests** section and refresh without authentication errors - The **"Add external issue"** icon is available on tasks and issues ## Troubleshooting If the integration does not connect, check the following: - Verify the **Organization URL** uses the format `https://dev.azure.com/your-organization` - Confirm the PAT is copied correctly (no extra spaces) and has not expired - Check that the PAT has the required scopes (**Code: Read**, **Work Items: Read & write**) - If work item creation is unavailable, confirm the PAT includes **Work Items: Read & write** - Make sure the token owner has access to the Azure DevOps project(s) you want to use **For more information about Azure DevOps Personal Access Tokens:** [See the official Microsoft documentation](https://learn.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate) ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Claude Enterprise URL: https://tidalcontrol.com/docs/integrations/claude-enterprise Connect your Claude Enterprise deployment to Tidal Control for AI governance and access control tests. Read-only, covering organisation settings and membership. Tidal Control's Claude Enterprise integration monitors your Claude Enterprise deployment for AI governance and access control purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your Claude organisation. > **warning:** **Claude Enterprise or Anthropic?** Anthropic offers two separate products with two separate keys. Use **this** integration if your **employees use Claude** for chat and projects through Claude Enterprise (`claude.ai`). If your company builds with the Anthropic API through the Claude Console, use the [Anthropic](/docs/integrations/anthropic) integration instead. The keys are not interchangeable. If you use both products, connect both integrations. ## What this integration monitors - **Organisations:** The linked organisations under compliance governance - **Users:** Full name, email, organisation role, and when the account was created - **Roles:** The role catalogue each organisation can assign - **Groups:** Name, description, granted roles, and whether the group is managed directly or provisioned through SCIM - **Group members:** Who belongs to each group - **Organization settings:** Data retention periods, content redaction, IP allowlist configuration, and SSO provisioning mode - **Compliance API keys:** Name, granted scopes, active state, expiry date, and the user who created the key ## Requirements - Super User role in Tidal Control - A **Claude Enterprise** plan (the Compliance API is not available on Claude Team or Pro) - The Compliance API enabled for your organisation - The **primary owner** role for a key that covers every linked organisation, or an **organisation owner** for a key scoped to that one organisation > **info:** **Not on Enterprise?** If **claude.ai → Organization settings** has no **API** page, your organisation is either not on the Enterprise plan or the Compliance API has not been enabled yet. On Claude Enterprise, enabling it is self-service, and it happens at the parent organisation level and cascades to every linked organisation. ## Configuration step-by-step plan We'll create a **Compliance API key** with the two read scopes this integration needs, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a Compliance API key in Claude** 2. **Configure the integration in Tidal Control** ## Step 1: Create a Compliance API key in Claude - Sign in to [claude.ai](https://claude.ai) as the primary owner or an organisation owner - Go to **Organization settings → API** and find the **Keys** section - Click **Create key** and enter a name (e.g. `Tidal Control`) - Select **both** scopes: - `read:compliance_org_data`: organisations, roles, groups, settings, and key inventory - `read:compliance_user_data`: organisation users and group members - Click **Create key** - **Copy the key**: it starts with `sk-ant-api01-` and is only shown once > **warning:** **Save the Compliance API key immediately.** Anthropic only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. > **warning:** **Treat this key as a production secret.** A Compliance API key with `read:compliance_user_data` can read chats, files, and projects across every linked organisation. Tidal Control uses it strictly read-only, for governance and directory data only. It never reads chat or file content, and it never requests the `delete:compliance_user_data` scope. Store the key nowhere else and revoke it in Claude if you suspect it has been exposed. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Claude Enterprise** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Claude Enterprise` - **Compliance API Key:** The key from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Claude Enterprise`, `Claude Enterprise Production` **Compliance API Key:** - The Compliance API key from claude.ai, starting with `sk-ant-api01-` - Created in step 1 - A Claude Console Admin key (`sk-ant-admin01-`) will not work. The Compliance API rejects it - Needs both `read:compliance_org_data` and `read:compliance_user_data` - Keep this value secure ## Available checks The integration runs the following checks, grouped by the area they cover: **AI governance (ISO/IEC 42001):** - Data retention periods configured for the organisation - Whether content redaction is enabled - SSO provisioning mode - Who can access the AI deployment and at what role **Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1):** - Organisation user roles and the role catalogue - Which roles each group grants, and who belongs to those groups - Compliance API key inventory: active keys, keys without an expiry date, granted scopes, and who created them **Identity management (ISO 27001 A.5.16):** - Whether groups are provisioned through SCIM or managed directly - User and group membership lifecycle **Network security (ISO 27001 A.8.20, SOC 2 CC6.6):** - Whether the IP allowlist is enabled and which ranges it permits **Information deletion (ISO 27001 A.8.10):** - The configured data retention periods > **info:** **The activity feed is not read.** The Compliance API also exposes an activity and event feed covering several years of events. That is an unbounded stream better suited to SIEM ingestion than to compliance snapshots, so this integration deliberately leaves it alone. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Claude Enterprise under **Configured Integrations** - Claude Enterprise tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control read our Claude conversations, files, or projects?** No. The integration reads governance and directory data only: organisations, users, roles, groups, settings, and key metadata. **Can I use this on Claude Team or Pro?** No. The Compliance API is only available on Claude Enterprise. **Do I need the primary owner role?** Only if you want one key to cover every linked organisation. An organisation owner can create a key scoped to their own organisation. **Can I skip the `read:compliance_user_data` scope?** You can, but the user and group member checks will then fail with an authorization error. The other checks continue to work. ## Common problems **Authentication fails with a 401 error** - Confirm the key starts with `sk-ant-api01-`. A Console Admin key (`sk-ant-admin01-`) is rejected by the Compliance API - Check that the key was copied in full and has not expired or been revoked **User or group member checks fail with a 403 error** - The key is missing the `read:compliance_user_data` scope - Scopes cannot be added to an existing key. Create a new key with both scopes and update the integration **Organization settings return no data** - Compliance settings are not enabled for that linked organisation - Confirm the settings are configured in **Organization settings** for the organisation itself, not only the parent organisation **There is no API page under Organization settings** - Your organisation is not on the Enterprise plan, or the Compliance API has not been enabled yet **Test refresh is slow for large deployments** - Users, roles, and settings are read per organisation, and group members per group, so large deployments take longer to refresh ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Cloudflare URL: https://tidalcontrol.com/docs/integrations/cloudflare Connect your Cloudflare account to Tidal Control with a read-only API token, so compliance tests read your account and zone security settings. Read-only. Tidal Control's Cloudflare integration reads the configuration of your Cloudflare account and zones for compliance purposes. It authenticates with a bearer API token against the Cloudflare API (`https://api.cloudflare.com/client/v4`), and covers both account access hygiene and the TLS and DNS posture of every zone you run. ## What this integration monitors - **Members:** MFA enforcement across account members, and pending invitations left open - **API tokens:** Whether tokens carry an expiry, whether they are IP restricted, and whether any have gone stale - **Zones:** Whether each zone is active rather than paused or stuck in development mode - **TLS:** Minimum TLS version, Always Use HTTPS, and whether SSL mode is Full or Strict - **DNS:** Whether DNSSEC is enabled per zone ## Requirements - Super User role in Tidal Control - A Cloudflare account, and permission to create account API tokens - Your Cloudflare **Account ID** ## Configuration step-by-step plan We'll copy your **Account ID**, create a read-only **API token** with two policies, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your Account ID** 2. **Create a read-only API token** 3. **Configure the integration in Tidal Control** ## Step 1: Find your Account ID - Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) - Select your account, then open any zone's **Overview** - Copy the **Account ID** from the right-hand panel ## Step 2: Create a read-only API token This integration only reads, so create a custom token with **two policies**: one for account-scoped data and one for zone-scoped data. - Select the account you want to connect, then go to `Manage account` → `Account API tokens` - Click `Create token` and enter a descriptive `Token name`, for example `Tidal Control` - Under `Permission policies`, click `Start from scratch` - Configure the account policy for members, roles and the token inventory: - Leave the resource selector set to `Entire Account`. This scopes the policy to the selected account - Use `Search for permission groups` to find `Account Settings` and `Account API Tokens`, and select `Read` for each - Close the policy editor to return to the policy summary - Click `Add policy` to configure zone inventory, TLS settings and DNSSEC: - Change the resource selector from `Entire Account` to `All Domains`, or choose `Specified Domains` and select the domains you want covered. Zone permissions appear after selecting a domain scope - Find `Zone`, `Zone Settings` and `DNS`, and select `Read` for each - Close the policy editor. The summary shows the selected zone scope and three read permissions - Choose a `Token expiration` and plan to replace the token in Tidal Control before it expires. `No expiration` leaves the token valid until revoked - If using `Client IP address filtering`, allow the outbound IP addresses used by Tidal Control. Confirm these with support before setting a restriction; leaving the filter empty allows all IP addresses - Click `Review token` and check the account, both policies, expiration and IP filtering - Click `Create token` and copy it immediately ![Cloudflare permission policies with read access to zones, zone settings, DNS, account API tokens and account settings](/images/help/cloudflare_token_permissions.png) > **warning:** **Both policies are needed.** An account-only token cannot read TLS or DNSSEC settings, and a zone-only token cannot read members or the token inventory. A token with one policy leaves half the checks unable to evaluate. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Cloudflare** - Fill in the configuration: - **Name:** A descriptive name, for example `Cloudflare` - **Account ID:** The identifier from step 1 - **API token:** The token from step 2 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Cloudflare` **Account ID:** - The unique identifier of your Cloudflare account - Required, and found in step 1 **API token:** - The custom read-only token from step 2 - Required, and stored as a secret ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Cloudflare under **Configured Integrations** - Cloudflare tests are available in the Tests section - Test refresh delivers results without authentication errors, for both account and zone checks ## Frequently asked questions **Can I use a Global API Key instead?** Use a scoped API token. A global key carries full account write access, which this integration neither needs nor should hold. **Should the token be account-owned or user-owned?** Account-owned, created under `Manage account` → `Account API tokens`. A user-owned token stops working when that person's access is removed. **Why does Tidal Control read our API token inventory?** Because a token without an expiry, without IP restrictions, or unused for months is an access risk in itself. The integration reads token metadata, never token values. ## Common problems **Member or token checks return nothing, zone checks work** - The token is missing the account policy. Add `Account Settings` → Read and `Account API Tokens` → Read **TLS or DNSSEC checks return nothing, member checks work** - The token is missing the zone policy. Add `Zone`, `Zone Settings` and `DNS` → Read **Some zones are missing from results** - The zone policy is scoped to specific zones. Set it to `All Domains`, or add the missing ones under `Specified Domains` **Authentication fails** - Confirm the Account ID matches the account the token was created in ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### CockroachDB Cloud URL: https://tidalcontrol.com/docs/integrations/cockroachdb Connect your CockroachDB Cloud organisation to Tidal Control with a service account API key, so compliance tests read its real configuration. Read-only. Tidal Control's CockroachDB Cloud integration reads security and compliance evidence from your CockroachDB Cloud organisation. It authenticates with an API key belonging to a service account, and covers cluster inventory and data residency, network restrictions, managed backups, encryption, log export and the organisation audit log. ## What this integration monitors - **Clusters:** Plan type, cloud provider, regions and data residency, version currency and delete protection - **Databases and SQL users:** The inventory on each cluster - **Network:** IP allowlist entries, whether any range is open to the world, and PrivateLink endpoint services - **Backups:** Whether managed backups are enabled, their frequency and retention - **Encryption:** Customer-managed encryption keys per region, on Advanced-tier clusters - **Log export:** Whether cluster logs reach an external sink, and whether delivery is healthy - **Access:** API keys, service accounts, and organisation role grants including SSO-group inheritance - **Audit log:** Who changed what, from which address ## Requirements - Super User role in Tidal Control - A CockroachDB Cloud organisation - Permission to create a service account under **Access Management** > **info:** **There is no personal API key in CockroachDB Cloud.** Only users can sign in to the console, and only service accounts can call the API. Every API key belongs to a service account, so creating one is part of the setup rather than an optional extra. ## Choosing roles for the service account An API key is scoped to one organisation, so no separate organisation or account ID is needed. What the key can read depends entirely on the roles you give its service account, and the right combination depends on whether your organisation offers the **Auditor** role at all.
RolesWrite accessCoverage
Auditor + Cluster Developer (preferred)NoneEverything, including the audit log
Cluster Developer onlyNoneEverything except the audit log
Org Admin + Cluster AdminYes, both roles can change thingsEverything, including the audit log
The split is worth stating because it is not obvious: **Cluster Developer** carries the cluster inventory, databases and SQL users, while **Auditor** carries backups, encryption keys, log export, API keys, service accounts, role grants and the audit log. Neither reaches everything on its own, and neither can change anything. > **warning:** **Auditor is not offered in every organisation.** It is absent from the console's role picker for some organisations, so you may find you cannot select it at either organisation or cluster scope. If that is the case, do not grant Org Admin just to close the gap. Use **Cluster Developer** alone and accept that one test cannot evaluate, as explained below. ### If you cannot select Auditor Only Org Admin and Auditor can read the organisation audit log, so without Auditor you have to choose which trade-off you prefer: - **Cluster Developer alone (recommended).** The key stays read-only. Every check works except **Audit log records recent activity**, which fails because no events can be fetched. That failure is honest: it reports that the evidence is missing rather than passing while having verified nothing. - **Org Admin + Cluster Admin.** Covers the audit log too, but both roles can change your infrastructure, and the service account will then fail **Service accounts are not Org Admin** by design. Tidal Control does not exempt its own service account from that check. Granting a read-only compliance tool the ability to modify production is usually the worse trade, which is why Cluster Developer alone is the recommendation until Auditor becomes available to you. ## Configuration step-by-step plan We'll create a **service account**, generate an **API key** for it, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a service account** 2. **Create an API key** 3. **Configure the integration in Tidal Control** ## Step 1: Create a service account - Sign in to [cockroachlabs.cloud](https://cockroachlabs.cloud) and open **Access Management** - On the **Service Accounts** tab, click **Create** and name the account, for example `Tidal Control` - Assign the roles you chose above, at organisation scope ## Step 2: Create an API key - Open the service account you just created - Click **Create API Key** - **Copy the secret immediately**: it is shown only in that dialog > **warning:** **The key is shown once.** If you close the dialog without copying it, delete the key and create a new one. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **CockroachDB Cloud** - Fill in the configuration: - **Name:** A descriptive name, for example `CockroachDB Cloud` - **API key:** The secret from step 2 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `CockroachDB Cloud`, `CockroachDB Production` **API key:** - The service account API key from step 2 - Required, and stored as a secret - The key already identifies its organisation, so there is no organisation field to fill in ## Verification The integration is working when all of the following are true: - Settings → Integrations shows CockroachDB Cloud under **Configured Integrations** - CockroachDB tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Do I need an organisation ID?** No. An API key is scoped to a single CockroachDB Cloud organisation, so the key alone is enough. **Is Org Admin required?** No, and it is best avoided. Org Admin is not needed for any endpoint this integration reads, and a service account holding it will fail the check that service accounts are not Org Admin. **Why do the encryption, log export and PrivateLink tests report nothing?** Customer-managed encryption keys, log export and PrivateLink endpoint services are Advanced-tier features. On a Basic or Standard cluster those endpoints return no data, and the cluster is recorded as not configured. **Can Tidal Control see the data in my databases?** No. The integration reads the Cloud API, which exposes configuration and inventory. It lists database and SQL user names, never table contents. ## Common problems **"API Key is required"** - The field is empty, or the copied value was lost. Create a new key on the service account **Audit log test fails with no events** - The service account lacks the Auditor role. Either add it, or accept the failure as documented above **Cluster inventory is empty but other checks work** - The service account is missing Cluster Developer. Add it at organisation scope **Backup, encryption or role grant checks return nothing** - These need Auditor. Without it they cannot read the underlying endpoints ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Datadog URL: https://tidalcontrol.com/docs/integrations/datadog Connect Datadog to Tidal Control so compliance tests read your security configuration, users and monitoring setup. Read-only access to your organisation. Tidal Control's Datadog integration monitors your organisation's security configuration, users, and monitoring setup for compliance purposes. ## What this integration monitors - **Users:** MFA status and account configuration - **Organisation settings:** SAML configuration and authentication settings - **API keys:** Usage and staleness - **Application keys:** Scope configuration - **Monitors:** Priority settings and active downtimes - **Security monitoring rules:** Whether detection rules are enabled - **CSM findings:** Cloud Security Management failed findings - **Synthetics tests:** Test status and location configuration ## Requirements - Super User role in Tidal Control - Datadog account with access to Organisation Settings ## Configuration step-by-step plan We'll create a **Datadog API key** and **application key**, then add the connection in Tidal Control. If your organisation uses a Datadog site other than the default US region, you'll also configure the site field. **Configuration steps:** 1. **Create an API key** 2. **Create an application key** 3. **Configure the integration in Tidal Control** ## Step 1: Create an API key - Log in to your Datadog account - Click your **organisation name** in the bottom-left corner - Select **Organisation Settings** - Navigate to **API Keys** in the left sidebar - Click **New Key** - Enter a name (e.g. `Tidal Control`) - Click **Create Key** - **Copy the key value**: it is only shown once > **warning:** **Save the API key immediately.** Datadog only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. ## Step 2: Create an application key Datadog uses application keys to authorise access to specific data. The application key controls what the integration can read. - Stay in **Organisation Settings** - Navigate to **Application Keys** in the left sidebar - Click **New Key** - Enter a name (e.g. `Tidal Control`) - Click **Create Key** - **Copy the key value**: it is only shown once > **info:** **Scoped application keys:** Datadog allows you to restrict application keys to specific permissions. If you use scoped keys, make sure the key has read access to: users, monitors, organisation settings, API keys, application keys, security monitoring rules, CSM findings, and Synthetics tests. An unscoped key will work with full read access. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Datadog** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Datadog` - **API Key:** The API key from step 1 - **Application Key:** The application key from step 2 - **Site:** Leave blank if your organisation uses the default US region (`datadoghq.com`). Enter your site if you use a different Datadog region (see below) - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Datadog`, `Datadog Production` **API Key:** - Identifies your Datadog organisation - Created in step 1 - Keep this value secure **Application Key:** - Authorises Tidal Control to read data from your Datadog account - Created in step 2 - Keep this value secure **Site (optional):** - The Datadog regional site your organisation uses - Leave blank to use the default (`datadoghq.com`) - Enter only the domain, without `https://` (e.g. `datadoghq.eu`, not `https://datadoghq.eu`)
SiteRegion
datadoghq.comUS1 (default)
datadoghq.euEU
us3.datadoghq.comUS3
us5.datadoghq.comUS5
ap1.datadoghq.comAP1 (Asia Pacific)
ap2.datadoghq.comAP2 (Australia)
ddog-gov.comUS1-FED (US Government)
## Verification The integration is working when all of the following are true: - Settings → Integrations shows Datadog under **Configured Integrations** - Datadog tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Can I use the same API key and application key for multiple Tidal Control environments?** Yes, you can reuse the same keys across different Tidal Control instances. **Where do I find my Datadog site?** Check the URL when logged in to Datadog. If you use `app.datadoghq.eu`, your site is `datadoghq.eu`. If you use `app.datadoghq.com`, leave the site field blank. **Do I need to be a Datadog admin to create keys?** You need sufficient permissions in Datadog to create API keys and application keys. Typically this requires an admin or owner role in your Datadog organisation. ## Common problems **"The Datadog API key does not have the required permissions"** - Check that both the API key and application key are entered correctly - If you use a scoped application key, verify it has read access to the required data types - Try creating a new unscoped application key to confirm the connection works **"Site must not include a protocol prefix"** - Remove `https://` or `http://` from the site field - Enter only the domain, for example `datadoghq.eu` **"Site must be one of..."** - Check that the site value exactly matches one of the supported site domains listed in the configuration fields table above ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### DigitalOcean URL: https://tidalcontrol.com/docs/integrations/digitalocean Connect DigitalOcean to Tidal Control so compliance tests read your cloud infrastructure's security configuration through the DigitalOcean API. Read-only. Tidal Control's DigitalOcean integration monitors your cloud infrastructure's security configuration for compliance purposes. It reads your account through the DigitalOcean v2 REST API using a single Personal Access Token. ## What this integration monitors - **Droplets:** Public exposure, VPC placement, backups and monitoring coverage - **Volumes:** Block storage inventory and orphaned (unattached) volumes - **Firewalls:** Inbound and outbound rules, including open `0.0.0.0/0` sources - **VPCs:** Network isolation and default-VPC placement - **Load balancers:** TLS cipher policy and TLS passthrough configuration - **Managed databases:** SSL enforcement and private network placement - **Database firewall rules:** Which sources may connect to each database cluster - **Kubernetes clusters:** Version currency, auto-upgrade, high availability, control-plane firewall and SSO enforcement - **Certificates:** TLS certificate inventory and expiry dates - **SSH keys:** Account-level SSH credential inventory - **Spaces keys:** Object storage credentials and per-bucket grants - **Container Registry:** Registry configuration and storage usage ## Requirements - Super User role in Tidal Control - DigitalOcean account with access to **API → Personal access tokens** ## Configuration step-by-step plan We'll create a **read-only Personal Access Token** in the DigitalOcean control panel, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a Personal Access Token** 2. **Configure the integration in Tidal Control** ## Step 1: Create a Personal Access Token - Log in to the [DigitalOcean control panel](https://cloud.digitalocean.com) - Navigate to **API → Personal access tokens** - Click **Generate New Token** - Give it a name, e.g. `Tidal Control` - Select **Read** scope only. No write permissions are needed for compliance scanning - Click **Generate Token** - **Copy the token**: it is shown only once > **warning:** **Save the token immediately.** DigitalOcean only shows the full token value once at creation. If you close the page without copying it, you will need to generate a new token. > **info:** **Read access is enough.** A token with the **Read** scope can see everything Tidal Control monitors: Droplets, Firewalls, VPCs, Databases, Kubernetes, Load Balancers, Volumes, Certificates, SSH Keys, Spaces Keys and Container Registry. Granting write scopes is unnecessary and not recommended. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **DigitalOcean** - Fill in the configuration: - **Name:** A descriptive name, e.g. `DigitalOcean` - **API Token:** The Personal Access Token from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `DigitalOcean`, `DigitalOcean Production` **API Token:** - The DigitalOcean Personal Access Token created in step 1 - Only the **Read** scope is required - Keep this value secure ## What cannot be checked automatically Some DigitalOcean security settings are not exposed by the v2 API and must be verified manually in the control panel: - **Two-factor authentication (2FA) status** of individual users cannot be queried. - **"Require Secure Sign-In"** (team-level 2FA enforcement, under **Settings → Security** in the control panel) is not exposed by the API. Verify it manually. See the [DigitalOcean documentation](https://docs.digitalocean.com/platform/teams/how-to/require-secure-sign-in/). - **Team members and roles** are only visible in the control panel. - **Active Personal Access Tokens** cannot be listed via the API. - **Account activity / audit history** (who did what, from which IP) is only available in the control panel UI. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows DigitalOcean under **Configured Integrations** - DigitalOcean tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does the token need write access?** No. Compliance scanning only reads configuration, so a token with the **Read** scope is sufficient. **Why are there no results for MFA or team members?** The DigitalOcean v2 API does not expose two-factor authentication status, team rosters, or "Require Secure Sign-In" enforcement. These must be checked manually in the control panel. **My Container Registry shows no data. Is something wrong?** No. DigitalOcean allows at most one registry per account, and the integration returns nothing if no registry is configured. ## Common problems **"API Token is required"** - Make sure you pasted the Personal Access Token - The token is only shown once. If you did not copy it, generate a new one **Authentication errors after refreshing tests** - The token may have been revoked or regenerated in the DigitalOcean control panel - Generate a new **Read** token and update the integration **Tests show no data for certain resource types** - Confirm those resource types are actually deployed in your DigitalOcean account - A token limited to specific scopes may not see all resources. Use a token with the **Read** scope ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### External issues URL: https://tidalcontrol.com/docs/integrations/external-issues Turn a Tidal Control task or issue into a work item in your own issue tracker and keep the two statuses in sync, across Jira, Azure DevOps and TOPdesk. When you connect an **issue tracker** to Tidal Control, you can turn a Tidal **task** or **issue** into a work item in your own tooling, and keep its status in sync. This lets your first line keep working in their own issue tracker while your second line works in Tidal Control, with both sides aligned. The workflow on this page (**creating**, **linking** and **syncing** external issues) works the same way for every supported issue tracker. Only the connection setup (authentication and, for some, which compliance tests run) differs per provider; see the provider's own page for that. ## Supported issue trackers
IntegrationCompliance tests (→ Tidal)External issues (Tidal →)Setup
Azure DevOpsYesYesAzure DevOps
Jira CloudYesYesJira Cloud
TOPdeskYesYes, incidents and changesTOPdesk
Support for additional issue trackers is planned. > **info:** **Prerequisite:** Configure the issue-tracker integration first (see the Setup links above). The **external issue** actions described below only appear once a compatible integration is connected, and creating work items requires the integration's write permission. ## Creating an external issue From any Tidal **task** or **issue**: 1. Open the task (or issue) 2. Click the **external issue** icon in the panel header (tooltip: **"Add external issue"**) 3. On the **Create new** tab, choose: - **Integration:** the issue tracker to use - **Project / destination:** where the work item is created (e.g. an Azure DevOps project, a Jira project) - **Issue type:** the work item type (e.g. Issue, Bug, Task) - **Title / Description:** pre-filled from the Tidal item; adjust if needed - **Assignee / Due date:** optional 4. Click **`Create`** ![Creating an external issue from a Tidal task (Azure DevOps shown as example)](/images/help/azure_devops_external_issue.png) Tidal creates the work item in your issue tracker and links it to the task. A status badge on the Tidal task then reflects the work item, and the tracker's logo links straight to it. ![Tidal task showing the linked work item and its synced status](/images/help/azure_devops_linked_issue.png) > **note:** **Fields vary per provider.** The exact fields in the dialog depend on the selected issue tracker. Azure DevOps and Jira use *Project* and *Issue type*. TOPdesk differs most: you first pick a **Type**, either an incident or a change, and then get TOPdesk's own fields (a site, category and subcategory for an incident; a change template and requester for a change). See [TOPdesk](/docs/integrations/topdesk) for those. The overall flow is always the same. ## Linking an existing issue If the work item already exists in your issue tracker, use the **Link existing** tab in the same dialog. Select the integration and the destination, then pick the existing issue to connect it to the Tidal task or issue. No new work item is created. ## Tracking status in the task overview Once a task is linked to an external issue, Tidal keeps the work item's **status** in sync (issue tracker → Tidal). The status is refreshed on the same recurring schedule as the compliance tests, so the overview reflects the current state in your issue tracker. In the **Tasks** overview an **External Issue** column shows the synced status (for example **To Do**) next to the tracker's logo. Click the status badge to open the work item in the issue tracker. ![Task overview with the External Issue column showing synced status](/images/help/azure_devops_overview_status.png) You can also filter the overview with the **External issue** filter in the toolbar, for example to find every task that still has no linked work item, or every task whose work item is **To Do**. ![Filtering the task overview by external issue status](/images/help/azure_devops_overview_filter.png) > **tip:** **Keep first and second line aligned:** Because the status is synced back from the issue tracker, second-line users can track progress from the Tidal task overview while first-line engineers keep updating the work item in their own tool. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Getting started with Integrations URL: https://tidalcontrol.com/docs/integrations/getting-started Integrations connect Tidal Control to the systems you already run, so compliance tests read your real configuration instead of someone attesting to it. Integrations connect Tidal Control to the systems you already run, so that compliance tests read your real configuration instead of someone attesting to it. All of them are read-only, and each one is set up once in Settings with credentials you create in the other system. ## Navigating the Integrations overview page The Integrations page in Settings shows all available external system connections and your current configuration status. ![Integrations overview](/images/help/integrations_overview.png) **What you see in the overview:** - **Configured Integrations** - Active integrations already set up - **Available Integrations** - Available systems for new connections - **Integration tiles** - Visual cards per external system ### Configured vs Available Integrations Configured integrations are already running tests; available ones are one click away from being connected. **Configured Integrations section:** - **Active connections** already set up and working - **Test execution** possible via these integrations **Available Integrations section:** - **Available systems** for new connections - **Click the plus icon** to configure integrations for use **Initial setup status:** ``` "You have not configured any integrations yet." ``` This means you haven't connected any external systems yet and all integrations are still available for configuration. ## Understanding available integrations Tidal Control supports 32 integrations, grouped below by what kind of system they connect to. Which ones matter depends entirely on where your systems already live, so most organisations configure a handful rather than all of them. ### Cloud providers Cloud integrations check the security configuration of the platform itself: identity and access, encryption, network rules and backups. - [Amazon Web Services (AWS)](/docs/integrations/aws) - [Microsoft Azure](/docs/integrations/azure) - [Google Cloud Platform](/docs/integrations/google-cloud-platform) - [Cloudflare](/docs/integrations/cloudflare) - [CockroachDB Cloud](/docs/integrations/cockroachdb) - [DigitalOcean](/docs/integrations/digitalocean) - [Hetzner Cloud](/docs/integrations/hetzner) - [Neon](/docs/integrations/neon) - [OVHcloud](/docs/integrations/ovhcloud) - [Scaleway](/docs/integrations/scaleway) - [STACKIT](/docs/integrations/stackit) - [Supabase](/docs/integrations/supabase) - [Vercel](/docs/integrations/vercel) ### Source code management Code platform integrations check repository and pipeline security: branch protection, scanning and dependency risk. - [GitHub](/docs/integrations/github) - [GitLab](/docs/integrations/gitlab) - [Azure DevOps](/docs/integrations/azure-devops) - [Atlassian Admin](/docs/integrations/atlassian-admin) ### Issue trackers These connect the systems your teams already work in, so findings and remediation live where the work happens. Several also serve as external issue targets. - [Jira Cloud](/docs/integrations/jira-cloud) - [Linear](/docs/integrations/linear) - [TOPdesk](/docs/integrations/topdesk) - [Notion](/docs/integrations/notion) - [Google Workspace](/docs/integrations/google-workspace) ### Security scanners Scanners bring existing vulnerability and threat findings into your compliance evidence. - [Aikido](/docs/integrations/aikido) - [Datadog](/docs/integrations/datadog) - [Microsoft Sentinel](/docs/integrations/microsoft-sentinel) - [Web Security Scanner](/docs/integrations/web-security-scanner) ### Observability Observability tools receive production data, so their access and privacy configuration is in audit scope in its own right. - [Sentry](/docs/integrations/sentry) - [PostHog](/docs/integrations/posthog) - [Datadog](/docs/integrations/datadog) ### Mobile device management Device management integrations provide the endpoint evidence auditors ask for on encryption and enrolment. - [Kandji (now Iru)](/docs/integrations/kandji) - [Microsoft Azure](/docs/integrations/azure) ### AI providers AI integrations check how your organisation's use of model providers is configured and governed. - [Anthropic](/docs/integrations/anthropic) - [OpenAI](/docs/integrations/openai) - [Claude Enterprise](/docs/integrations/claude-enterprise) ### Document management These check how documents shared outside your organisation are protected. - [Papermark](/docs/integrations/papermark) ### CRM - [HubSpot](/docs/integrations/hubspot) > **info:** **Some integrations appear in more than one family.** Datadog covers both security scanning and observability, and Microsoft Azure covers both the cloud platform and device management, so they are listed under each. ## Integration activation process Every integration follows the same shape: create read-only credentials in the other system, then paste them into Tidal. ### General activation steps **For each integration, follow a similar process:** 1. **Select integration** from Available Integrations section 2. **Click plus icon** to start setup 3. **Follow configuration wizard** for specific integration 4. **Configure authentication** (API keys, OAuth, service accounts) 5. **Test connectivity** to verify operation ### Authentication and security When setting up authentication, pay attention to the following security measures: - **Least privilege principle** - Don't give Tidal integration more rights than necessary. It's often sufficient to give Tidal read rights to specific system functionality. - **Encrypted connections** to all external systems - **Regular credential** rotation according to best practices > **info:** Tidal stores credential information securely in a protected 'key vault' and only communicates with encrypted connections. **Suspect credentials are compromised?** Change or remove them immediately, and send an email to support@tidalcontrol.com ## Integration impact on Tests Connecting an integration is what makes its tests available; until then they cannot run at all. ### How integrations activate Tests Which tests become available depends on which integration you connect: each one unlocks a different set. **Integration configuration enables external tests:** 1. **Integration becomes active** after successful configuration 2. **External tests become available** for that integration 3. **Tests can retrieve data** from connected systems 4. **Real-time compliance** monitoring becomes possible > **tip:** Read more about [using automatic tests](/docs/tests). ## Integrations versus manual controls **Integrations** enable Tidal Control to connect with external systems and tools for **real-time compliance monitoring**. By configuring integrations, external tests can automatically retrieve data from your existing IT infrastructure. **Core functionalities:** - **Real-time data retrieval** from external systems for compliance validation - **Automatic compliance tests** based on actual system configurations - **Centralised monitoring** of distributed IT infrastructure - **Objective compliance measurements** without manual data collection - **Continuous compliance** monitoring instead of periodic audits ### Integrations vs manual compliance controls Integrations suit anything a system can report on itself; a manual control is still needed for judgment calls a system can't make. **Integrations are ideal for:** - Technical configuration validation (encryption, access control) - Real-time security baseline monitoring - Automatic collection of compliance evidence - Large-scale infrastructure compliance monitoring **Manual controls remain necessary for:** - Procedural compliance (training, awareness) - Qualitative assessments (policy effectiveness) - Business process evaluations - Strategic compliance decisions ## Next steps Now that you understand Integrations: - **Identify critical external systems** for compliance monitoring - **Prioritise integrations** based on business and compliance impact - **Start with one integration** to learn the process - **Select specific integration** from articles below for detailed setup instructions For specific integration setup instructions, see the individual articles in this section for each available integration. ### GitHub URL: https://tidalcontrol.com/docs/integrations/github Connect GitHub to Tidal Control through the Tidal Control GitHub app, so compliance tests read your repositories, branch protection and access settings. The GitHub integration enables Tidal Control to automatically execute compliance tests on your GitHub environment via the Tidal Control GitHub app. ## Requirements - Super User role in Tidal Control - GitHub organisation admin rights - Access to GitHub organisation where monitoring is desired ## Configuration step-by-step plan We'll install the **Tidal Control GitHub app** in your GitHub organisation(s). This app gets read-only access to repository configurations for security compliance monitoring. **Configuration steps:** 1. **Start Tidal integration** 2. **GitHub authentication** 3. **Configure repository access** 4. **Complete app installation** 5. **Additional organisations** ## Required permissions When you install the Tidal Control GitHub app, GitHub shows which permissions the app requests. All access is **read-only**. Tidal Control never writes, modifies, or deletes anything in your GitHub environment. ### Currently active
PermissionWhy we need it
AdministrationReads branch protection rules and rulesets. Used to verify: is force push to the default branch disabled, is a PR review required before merging, and is code owner approval required.
Pull requestsVerifies that recently merged pull requests were approved before merging.
MetadataBasic repository information: name, visibility (public/private), fork status, and default branch name.
### Present for future tests The following permissions are included in the app but not yet actively used. They are reserved for additional compliance checks we plan to build:
PermissionPlanned use
CodeCheck whether a CODEOWNERS file is present and correctly configured, or whether a SECURITY.md (responsible disclosure policy) exists. We read only metadata files, not your business logic or intellectual property.
Dependabot alertsVerify whether Dependabot is active and whether there are open critical vulnerabilities in dependencies.
Secret scanning alertsCheck whether secret scanning is enabled and whether there are open reports of leaked credentials.
ChecksVerify whether mandatory CI checks are configured as a condition for merging pull requests.
Security events, repository advisories, deployments, issuesReserved for future compliance checks.
> **info:** **Prefer limited access?** You can restrict the app to specific repositories instead of your entire organisation. Choose **"Selected repositories"** in step 3. ## Step 1: Start Tidal integration - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to GitHub - Click **"Click here to get started"** - You'll be automatically **redirected to GitHub** ## Step 2: GitHub authentication - Enter your **GitHub login credentials** - Click **"Sign in"** - Select the **organisation** where you want to install the app - If app already installed: click **"Configure"** for settings ## Step 3: Configure repository access - Choose access level: - **All repositories** - Complete organisation monitoring - **Selected repositories** - Selective compliance monitoring - Select desired repositories if specific chosen ## Step 4: Complete app installation - Review the **permissions** that Tidal Control requests - Click **"Install"** for direct installation - Or click **"Request"** if organisation approval required - Wait for **approval** from organisation owner (if applicable) ## Step 5: Additional organisations - Repeat **steps 1-4** for each additional organisation - Each organisation needs **own app installation** - Configure **per organisation** which repositories are monitored ## Verification The integration is working when all of the following are true: - **Settings → Integrations** shows GitHub under **Configured Integrations** - **Test refresh** delivers repository data without (permission) errors ## Troubleshooting If the integration does not connect, check the following: - Verify GitHub app installation in organisation settings - Check repository permissions for Tidal Control app - Ask if organisation admin has approved the app - Verify there are no conflicting security policies in GitHub ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### GitLab URL: https://tidalcontrol.com/docs/integrations/gitlab Connect GitLab to Tidal Control with an access token, so compliance tests read your GitLab environment. Read-only, and no configuration is ever changed for you. The GitLab integration enables Tidal Control to automatically execute compliance tests on your GitLab environment via an access token configuration. ## Requirements - Super User role in Tidal Control - GitLab account with token creation rights - Access to GitLab environment (gitlab.com or self-hosted) ## Configuration step-by-step plan We'll create a **GitLab access token** in your GitLab account that allows Tidal to retrieve compliance data. An access token is a GitLab mechanism that enables external applications (Tidal) to securely access specific GitLab resources without sharing your password. **GitLab host configuration:** - **Default:** `https://gitlab.com` (GitLab.com SaaS) - **Self-hosted:** Use your own GitLab server URL (e.g. `https://gitlab.company.com`) - **GitLab Enterprise:** Custom enterprise instance URL **Configuration steps:** 1. **Create GitLab access token** 2. **Configure token** 3. **Complete integration** ## Step 1: Create GitLab access token - Go to your **GitLab environment** and log in - Click your **profile icon** in the top right - Select **"Edit profile"** - Click **"Access Tokens"** in left sidebar - Click **"Add new token"** under Personal Access Tokens ## Step 2: Configure token - **Token name:** `Tidal Control` - **Description:** `Read-only token for Tidal Control compliance monitoring` - **Expiration date:** Leave blank for maximum validity (or set according to organisation policy) - **Scopes:** Select **"read_api"** for read-only access - Click **"Create personal access token"** ## Step 3: Complete integration - **Copy token value** immediately (no longer visible after leaving page) - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to GitLab - Fill in configuration: - **Name:** `GitLab Production` - **Host:** `https://gitlab.com` (or your self-hosted URL) - **Access Token:** Copied token value - Click **"Create"** to save integration > **tip:** **Token validity:** Leave expiration date blank for longest validity, unless organisation policy requires otherwise ## Verification After successful configuration, Settings → Integrations shows GitLab under **Configured Integrations**, GitLab-specific tests are available in the Tests section, and test refreshes deliver results without authentication errors. > **warning:** **Save token:** Note the access token securely - it's no longer visible after creation and uniquely needed for troubleshooting ## Troubleshooting If the integration does not connect, check the following: - Verify access token correctly copied (no extra spaces) - Check token expiration date not yet reached - Confirm "read_api" scope selected during token creation - Verify GitLab host URL correctly entered ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Google Cloud Platform (GCP) URL: https://tidalcontrol.com/docs/integrations/google-cloud-platform Connect Google Cloud Platform to Tidal Control so compliance tests read your GCP resources, IAM settings and security configuration. Read-only throughout. Tidal Control's Google Cloud Platform integration monitors your GCP resources, IAM settings, and security configurations for compliance purposes. ## What this integration monitors - **Resources:** Virtual machines, storage, databases, and other GCP services - **IAM:** Users, roles, and permissions within your GCP project - **Security:** Security settings and access controls ## Requirements - Super User role in Tidal Control - Google Cloud Platform project access - Access to Google Cloud Console ## Configuration step-by-step plan We'll create a **Google service account** with the necessary permissions to access your GCP resources through secure APIs. **Configuration steps:** 1. **Create service account** 2. **Assign role and generate JSON key** 3. **Enable APIs** 4. **Configure integration** ## Required permissions Tidal Control uses the **Viewer** role (Basic → Viewer) to read your GCP resource configurations. All access is read-only. Tidal Control never writes, modifies, or deletes anything in your GCP environment.
Resource typeWhy we need access
Cloud StorageWe check bucket security settings: public access prevention, uniform bucket-level access, versioning, access logging, encryption, and retention policy configuration.
Compute EngineWe verify VM security settings: whether external IP addresses are assigned, serial port access is disabled, OS Login is enabled, default service accounts are avoided, and security features like Shielded VM and Confidential Computing are configured.
IAM & service accountsWe check that service accounts are active and that any custom IAM roles are in a production-ready state.
ProjectsWe verify that projects are active and properly labelled for asset management purposes.
## Step 1: Create service account - Go to **Google Cloud Console** at https://console.cloud.google.com - Log in with account that has **project access** - Select your **Google Cloud project** in project selector - Navigate to **IAM & Admin → Service Accounts** - Click **"+ CREATE SERVICE ACCOUNT"** - Fill in service account details: - **Service account name:** `Tidal Control GCP` - **Service account ID:** `tidal-control-gcp` - **Description:** `Service account for Tidal Control GCP monitoring` ## Step 2: Assign role and generate JSON key - **Select role:** Basic → **Viewer** - Click **"Continue"** and skip next step - Click **"Done"** to create service account - **Select new service account** from list - Go to **"KEYS"** tab - Click **"ADD KEY"** → **"Create new key"** - Select **JSON** format - **Download JSON file** automatically to computer - **Store file securely** - needed for integration setup ## Step 3: Enable APIs - Navigate to **APIs & Services → Library** in Google Cloud Console - **Search and enable** each of the APIs below, clicking **"ENABLE"** for each one The integration reads nine GCP APIs. Enable every API that covers a resource type you run. The checks in the "what we monitor" table only return data for APIs that are enabled.
What we checkAPI to enable
Organisations, folders and projects (the backbone every test builds on)Cloud Resource Manager API
Asset inventory and organisation-wide IAM policy checksCloud Asset API
IAM roles and service accountsIdentity and Access Management (IAM) API
Cloud Storage bucketsCloud Storage API
Compute Engine instances and firewall rulesCompute Engine API
GKE clustersKubernetes Engine API
Cloud SQL instancesCloud SQL Admin API
KMS crypto keysCloud KMS API
Cloud DNS managed zonesCloud DNS API
> **warning:** **A passing test does not prove full coverage.** When an API is disabled, the checks for that service skip silently and return no data instead of failing, so the test still turns green. Enable every API for the resource types you actually run; otherwise those resources are never assessed. > **note:** **Some checks read at the organisation level.** The organisation-wide IAM policy and asset inventory checks query at the organisation scope. If you granted the Viewer role on a single project only, these checks may return no data. For full coverage, grant the role at the organisation (or folder) level. ## Step 4: Configure integration - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Google Cloud Platform** - Fill in configuration: - **Name:** `GCP Production Account` - **Service Account JSON:** Upload or paste contents of JSON file - Click **"Create"** to save integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this integration - For example: `GCP Production Account`, `GCP Staging` **Service Account JSON:** - Contains authentication credentials for your service account - Downloaded in step 2 during service account creation - Keep this file secure - it provides access to your GCP environment > **info:** **No additional configuration needed.** GCP integration only requires the integration name and the JSON key file. Domain-wide delegation and impersonation settings are not needed for GCP. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Google Cloud Platform under **Configured Integrations** - Google Cloud test available in Tests section - Test refresh delivers results without authentication errors > **warning:** **JSON key security:** Store the JSON key file securely - it provides access to your Google environment and cannot be downloaded again ## Frequently asked questions **Can I use the same service account for multiple Tidal Control environments?** Yes, you can reuse the same service account JSON key across different Tidal Control instances. **Do I need Google Workspace to use the GCP integration?** No, GCP integration works independently. If you also want to monitor Google Workspace or Google Drive, configure those as separate integrations via the Google Workspace guide. **Do I need to add the `https://www.googleapis.com/auth/cloud-platform` OAuth scope?** No. Unlike the Google Workspace and Drive setup (where you paste OAuth scopes into the Admin Console for domain-wide delegation), GCP uses the service account's own identity. There is no domain-wide delegation and no scope configuration; authorization comes entirely from the IAM role and the APIs you enabled in Step 3. **How often does Tidal Control sync GCP data?** Data is synchronized according to your configured test schedule, typically every few hours. ## Common problems **"Authentication failed" errors** - Verify the JSON key file is correctly uploaded - Check that the service account has the correct Viewer role in GCP - Confirm that all required APIs are enabled **"API not enabled" errors** - Ensure all required APIs from Step 3 are enabled in your GCP project - Wait a few minutes after enabling APIs before testing the integration **"Permission denied" errors** - Verify the service account has the Basic → Viewer role assigned - Check that the JSON key belongs to the correct service account ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Google Workspace URL: https://tidalcontrol.com/docs/integrations/google-workspace Connect Google Workspace to Tidal Control so compliance tests read your users, groups and admin settings. Read-only, and also usable to import personnel. Tidal Control's Google Workspace integration monitors your organisation's users, groups, and admin settings for compliance purposes. ## What this integration monitors - **Users:** Account status, permissions, and security settings - **Groups:** Membership and access controls - **Admin settings:** Security policies and configurations - **Devices:** Security configurations of mobile devices and ChromeOS devices via Endpoint Verification (optional) ## Requirements - Super User role in Tidal Control - Google Workspace super admin rights - Access to Google Cloud Console and Google Admin Console (admin.google.com) ## Configuration step-by-step plan We'll create a **Google service account** with domain-wide delegation and the necessary permissions to access your Google Workspace admin data through secure APIs. If you also want to set up Google Drive, we'll add the required configuration at each step. **Configuration steps:** 1. **Create service account** 2. **Generate JSON key** 3. **Set up domain-wide delegation** 4. **Configure API scopes** 5. **Enable APIs** 6. **Configure integrations** ## Required permissions Tidal Control uses read-only OAuth scopes (via domain-wide delegation) to access your Google Workspace admin data. All access is read-only. Tidal Control never writes, modifies, or deletes anything in your Google Workspace or Drive environment. > **info:** **Partial configuration works:** You only need to configure the scopes for the features you want to use. For example, if you only configure the Workspace scopes, the Workspace tests will run normally. Drive and device tests will simply not be available. You can always add additional scopes later.
FeatureOAuth scopeWhy we need access
Usersadmin.directory.user.readonlyWe check user account status, security settings, and admin privilege levels.
Groupsadmin.directory.group.readonly, admin.directory.group.member.readonlyWe verify group memberships and access controls to check who has access to what.
Admin rolesadmin.directory.rolemanagement.readonlyWe check which admin roles are assigned and to whom, to verify privilege management.
Google Drive (optional)drive.readonlyWe check file sharing settings and external access configurations of Drive files and folders.
Mobile devices (optional)admin.directory.device.mobile.readonlyWe verify security configurations of managed mobile devices via Endpoint Verification.
ChromeOS devices (optional)admin.directory.device.chromeos.readonlyWe verify security configurations of ChromeOS devices via Endpoint Verification.
## Step 1: Create service account - Go to **Google Cloud Console** at https://console.cloud.google.com - Log in with account that has **project access** - Select your **Google Cloud project** in project selector - Navigate to **IAM & Admin → Service Accounts** - Click **"+ CREATE SERVICE ACCOUNT"** - Fill in service account details: - **Service account name:** `Tidal Control Workspace` - **Service account ID:** `tidal-control-workspace` - **Description:** `Service account for Tidal Control Google Workspace monitoring` ## Step 2: Generate JSON key - **Skip role assignment** by clicking **"Continue"** twice - Click **"Done"** to create service account - **Select new service account** from list - Go to **"KEYS"** tab - Click **"ADD KEY"** → **"Create new key"** - Select **JSON** format - **Download JSON file** automatically to computer - **Store file securely** - needed for integration setup ## Step 3: Set up domain-wide delegation - Go back to **service account details** in Google Cloud Console - Click **"Advanced settings"** section to expand - **Copy Client ID** (save for next step) - Go to **Google Admin Console** at https://admin.google.com - Navigate to **Security → Access and data control → API controls → Domain-wide delegation** - Ensure you have **super admin rights** in Google Workspace ## Step 4: Configure API scopes - Click **"Add new"** in the domain-wide delegation screen - **Paste Client ID** of the service account (from step 3) - Enter the **OAuth Scopes** you need (comma separated): **For Google Workspace:** ``` https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly ``` **For Google Drive, add this scope:** ``` https://www.googleapis.com/auth/drive.readonly ``` **For Endpoint Verification (device security monitoring), add these scopes:** ``` https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly ``` > **warning:** **Endpoint Verification requires additional admin rights:** The impersonation user must have the **Mobile Device Management** admin privilege (or be a Super Admin) in Google Workspace. Without this, device monitoring tests will return a permission error. > **tip:** **Combining scopes:** If you are setting up multiple features, combine all scopes in a single comma-separated entry. - Click **"AUTHORISE"** to assign permissions ## Step 5: Enable APIs - Return to **Google Cloud Console** - Navigate to **APIs & Services → Library** - **Search and enable** the following API: - **Admin SDK API** - **Click "ENABLE"** for the API **For Google Drive, also enable:** - **Google Drive API** ## Step 6: Configure integrations - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Google Workspace** - Fill in configuration: - **Name:** `Google Workspace` - **Service Account JSON:** Upload or paste contents of JSON file - **Impersonation user email:** Email of a Google Workspace admin user (e.g. `admin@company.com`) - Click **"Create"** to save integration > **warning:** **The impersonation user email must be a real Google Workspace admin user** (e.g. `admin@company.com`). This is not the service account email (which ends in `@project.iam.gserviceaccount.com`). The service account uses this email to impersonate a Workspace admin and access admin APIs. **For Google Drive, add this:** - Click the **plus icon** next to **Google Drive** - Fill in configuration: - **Name:** `Google Drive` - **Service Account JSON:** Upload same JSON file - **Impersonation user email:** Same Workspace admin email (e.g. `admin@company.com`) - Click **"Create"** to save integration > **tip:** **One service account, multiple integrations:** You can use the same JSON key file for both Google Workspace and Google Drive integrations. ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this integration - For example: `Google Workspace`, `Google Drive` **Service Account JSON:** - Contains authentication credentials for your service account - Downloaded in step 2 during service account creation - Keep this file secure - it provides access to your Google environment **Impersonation user email:** - Email of a Google Workspace admin user that the service account will impersonate - This user must have **super admin rights** in Google Workspace - For example: `admin@company.com`, `it-admin@organisation.org` - Required for access to Workspace admin APIs and Drive > **info:** **This is not the service account email.** The impersonation user email is a real person's Workspace account with admin rights, not the technical service account address (name@project.iam.gserviceaccount.com). ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Google Workspace under **Configured Integrations** - Google Workspace test available in Tests section - Test refresh delivers results without authentication errors > **warning:** **JSON key security:** Store the JSON key file securely - it provides access to your Google environment and cannot be downloaded again ## Frequently asked questions **Can I use the same service account for multiple Tidal Control environments?** Yes, you can reuse the same service account JSON key across different Tidal Control instances. **What happens if I disable domain-wide delegation?** The integration will stop working immediately as Tidal Control won't be able to access Workspace admin APIs. **How often does Tidal Control sync Workspace data?** Data is synchronized according to your configured test schedule, typically every few hours. ## Common problems **"Authentication failed" errors** - Verify the JSON key file is correctly uploaded - Check that domain-wide delegation is configured with the correct Client ID - Confirm the impersonation user email belongs to a user with super admin rights **"API not enabled" errors** - Ensure Admin SDK API is enabled in your Google Cloud project - Wait a few minutes after enabling APIs before testing the integration **"Permission denied" errors** - Verify OAuth scopes are correctly configured in domain-wide delegation - Check that the impersonation user email is a real Workspace admin user, not the service account email ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Hetzner Cloud URL: https://tidalcontrol.com/docs/integrations/hetzner Connect Hetzner Cloud to Tidal Control so compliance tests read your cloud infrastructure's security configuration. All access is read-only, nothing changes. Tidal Control's Hetzner Cloud integration monitors your cloud infrastructure's security configuration for compliance purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your Hetzner project. ## What this integration monitors - **Servers:** Configuration and exposure of cloud servers - **Firewalls:** Rules and applied resources - **Networks:** Private network configuration - **Load balancers:** Services and TLS configuration - **Certificates:** Managed certificates and expiry - **Volumes:** Block storage configuration - **Floating & Primary IPs:** Public IP assignments - **DNS zones:** Zone configuration - **SSH keys:** Registered public keys - **Images:** Snapshots and backups ## Requirements - Super User role in Tidal Control - A Hetzner Cloud project with permission to create API tokens ## Configuration step-by-step plan We'll create a read-only **Hetzner Cloud API token** for the project you want to monitor, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a read-only API token** 2. **Configure the integration in Tidal Control** ## Step 1: Create a read-only API token - Log in to the [Hetzner Cloud Console](https://console.hetzner.cloud) - Select the **project** you want to monitor - Go to **Security → API Tokens** - Click **Generate API token** - Enter a description (e.g. `Tidal Control`) - Set the permission to **Read**. Tidal Control only needs read access - Click **Generate API token** - **Copy the token**: it is only shown once > **warning:** **Save the token immediately.** Hetzner only shows the full token value once at creation. If you close the dialog without copying it, you will need to generate a new token. > **info:** **API tokens are project-scoped.** Each Hetzner Cloud API token grants access to a single project. To monitor more than one project, create a separate token per project and add one Tidal Control integration for each. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Hetzner Cloud** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Hetzner Cloud` - **API Token:** The read-only token from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Hetzner Cloud`, `Hetzner Production` **API Token:** - The read-only Hetzner Cloud API token - Created in step 1 - Scoped to a single Hetzner Cloud project - Keep this value secure ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Hetzner Cloud under **Configured Integrations** - Hetzner Cloud tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control make changes to my Hetzner project?** No. The integration is read-only and only reads configuration data. **Can I use one token for multiple projects?** No. Hetzner Cloud API tokens are scoped to a single project. Create one token and one integration per project you want to monitor. **Do I need a read & write token?** No. A **Read** token is sufficient and recommended. It grants only the access Tidal Control needs. ## Common problems **"API Token is required"** - Make sure you pasted the token value from step 1 - The token is only shown once. If you did not copy it, generate a new one **Tests show no data for certain resource types** - Confirm those resources exist in the project the token belongs to - Remember that each token covers only one project **Authentication errors after refresh** - The token may have been revoked or regenerated in the Hetzner Cloud Console. Generate a new token and update the integration ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### HubSpot URL: https://tidalcontrol.com/docs/integrations/hubspot Connect HubSpot to Tidal Control so compliance tests read your CRM's user management, security settings and data configuration. Read-only access throughout. Tidal Control's HubSpot integration monitors your CRM's user management, security settings, and data configuration for compliance purposes. ## What this integration monitors - **Users:** Inactive accounts and super admin count - **Roles:** Roles defined on the portal - **Owners:** Portal user association - **Teams:** Team configuration - **Account:** Data hosting location (EU vs. US) - **Subscriptions:** Default opt-in settings on communication types - **Audit log, login activity and security changes:** Audit events, sign-in activity, and security configuration changes such as MFA/SSO toggling (Enterprise only; see below) ## Requirements - Super User role in Tidal Control - HubSpot account with permission to create Private Apps ## Configuration step-by-step plan We'll create a **HubSpot Private App** and copy its access token, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a Private App in HubSpot** 2. **Configure the integration in Tidal Control** ## Step 1: Create a Private App in HubSpot - Log in to your HubSpot account - Click the **settings icon** (gear) in the top navigation bar - Navigate to **Integrations → Private Apps** in the left sidebar - Click **Create a private app** - On the **Basic info** tab, enter a name (e.g. `Tidal Control`) and optionally a description - Switch to the **Scopes** tab and add the following scopes:
ScopePurpose
crm.objects.owners.readRead CRM owners
settings.users.readRead users and roles
settings.users.teams.readRead team configuration
communication-preferences.readRead subscription / consent types
account-info.security.readRead audit log, login activity and security configuration changes (requires Enterprise)
> **info:** **The audit log, login activity and security change checks require a HubSpot Enterprise subscription** and the `account-info.security.read` scope. On lower tiers these endpoints return no data and the corresponding tests stay empty. The rest of the integration still works. The data-hosting (EU/US) check uses the default `oauth` scope that every Private App has, so no extra scope is needed for it. - Click **Create app** - In the confirmation dialog, click **Continue creating** - **Copy the access token** shown on the app detail page > **warning:** **Save the access token immediately.** The full token value is only displayed once after creation. If you navigate away without copying it, you can rotate the token to get a new one, but the old token will stop working. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **HubSpot** - Fill in the configuration: - **Name:** A descriptive name, e.g. `HubSpot` - **Access Token:** The access token from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `HubSpot`, `HubSpot Production` **Access Token:** - The Private App access token from HubSpot - Created in step 1 - Keep this value secure ## Verification The integration is working when all of the following are true: - Settings → Integrations shows HubSpot under **Configured Integrations** - HubSpot tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Can I reuse the same Private App token for multiple Tidal Control environments?** Yes, the same access token can be used across different Tidal Control instances. **What happens if I add more scopes than listed?** Additional scopes do not affect the integration. Tidal Control only uses the data it needs for the configured tests. **Do I need to be a HubSpot super admin to create a Private App?** You need sufficient permissions in HubSpot to manage integrations. Typically this requires a super admin role or an account with the "App Marketplace Access" permission. ## Common problems **"Access Token is required"** - Make sure you entered the access token value, not the app name or ID - HubSpot Private App tokens start with `pat-` **Tests show authentication errors after connecting** - Verify the access token is still valid. Tokens can be rotated in HubSpot's Private App settings - Check that all required scopes were added when creating the Private App **Audit log, login activity or security change tests show no data** - These checks require a HubSpot **Enterprise** subscription and the `account-info.security.read` scope - Confirm the scope was added to the Private App, and that your HubSpot plan includes the account activity API **"HUBSPOT_DATA_HOSTED_IN_EU" test fails** - This test checks that your HubSpot account is hosted in the EU data centre - This is a configuration of your HubSpot account, not the integration. Contact HubSpot support to change your data hosting location ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Jira Cloud URL: https://tidalcontrol.com/docs/integrations/jira-cloud Connect Jira Cloud to Tidal Control with an API token, so compliance tests read your Jira environment and Tidal tasks can become work items in your project. The Jira Cloud integration enables Tidal Control to automatically execute compliance tests on your Jira environment via an API token configuration. Jira Cloud is a powerful tool for issue tracking and project management that helps teams plan, assign, track, report and manage work within various projects. Because Jira Cloud is also an issue tracker, the integration works in **two directions**: Tidal runs compliance tests on your Jira environment (Jira → Tidal), and you can create, link and sync work items in Jira from Tidal tasks and issues (Tidal → Jira). See [External issues](/docs/integrations/external-issues) for that workflow. ## Requirements - Super User role in Tidal Control - Jira Cloud account with project access - Atlassian account management rights - Access to Jira Cloud instance ## Configuration step-by-step plan We'll create a **Jira API token** in your Atlassian account that allows Tidal to retrieve compliance data. An API token is an Atlassian mechanism that enables external applications (Tidal) to securely access your Jira resources. **Configuration steps:** 1. **Create API token** 2. **Complete integration** ## Step 1: Create API token - Go to **Atlassian Account API Tokens** at https://id.atlassian.com/manage-profile/security/api-tokens - Log in with your **Jira Cloud account** - Click **`Create API token`** top right - **Token configuration:** - **Label:** `Tidal Control Integration` - Click **`Create`** - **Copy token value** immediately (no longer visible after closing) - Click **`Close`** > **info:** **Token validity:** Jira Cloud API tokens have a maximum validity period of one year. When your API token expires, Tidal Control can no longer retrieve data from your Jira Cloud environment. ## Step 2: Complete integration - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to Jira Cloud - Fill in configuration: - **Name:** `Jira Production` - **Username:** The email address you use to log into Jira (and that was used to create the API token) - **API url:** Your Jira instance URL (format: `https://yourcompany.atlassian.net`) - **API token:** Copied token value (from step 1) - Click **"Create"** to save integration > **tip:** **API URL format:** Always use complete URL including https:// (e.g. `https://company.atlassian.net`) ## Setup for multiple sites If you need to connect multiple Jira sites to Tidal Control: - **Repeat token creation** for each Jira site - **Configure separate integration** in Tidal per site - **Use descriptive names** to distinguish sites (e.g. "Jira Development", "Jira Operations") ## Sending tasks and issues to Jira (Tidal Control → Jira) From any Tidal task or issue you can create a Jira work item (or link an existing one), and Tidal keeps its status in sync in the task overview. When adding an external issue, select your Jira connection, the **project**, and the **issue type**; the rest of the flow is the same for every issue tracker. See **[External issues](/docs/integrations/external-issues)** for the full create / link / sync workflow and the task-overview status column. ## Verification After successful configuration, a link icon will be present in Tidal Tasks and Issues, and Jira-specific tests are available in the Tests section. Test refreshes now deliver results without authentication errors. > **warning:** **Save API token:** Note the API token securely - it's no longer visible after creation and uniquely needed for troubleshooting ## Troubleshooting If the integration does not connect, check the following: - Verify API token is correctly copied (no extra spaces) - Check API URL format including https:// and correct domain - Confirm username matches the email address of the person who created the token - Check that token expiry date has not been reached **For more information about Jira Cloud API management:** [See official Atlassian documentation](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/) ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, which steps you've already tried, and screenshots of the problem. This significantly speeds up the solution. ### Kandji (now Iru) URL: https://tidalcontrol.com/docs/integrations/kandji Connect your Kandji tenant, now Iru, to Tidal Control with a read-only API token, so compliance tests read the encryption and enrolment state of your Macs. Tidal Control's Kandji integration reads the device state from your Kandji tenant for compliance purposes. Kandji rebranded to **Iru** in October 2025; the platform and its API are unchanged, and the integration tile in Tidal Control is still labelled **Kandji**. It authenticates with an API token against your own Kandji API URL, and provides the device evidence that auditors ask for on endpoint encryption and mobile device management. ## What this integration monitors - **FileVault encryption:** Whether full-disk encryption is enabled on each Mac - **Data volume encryption:** Whether the data volume itself is encrypted - **MDM enrolment:** Whether each device is still actively enrolled - **Device supervision:** Whether devices are supervised - **Recovery Lock:** Whether recovery lock is set ## Requirements - Super User role in Tidal Control - A Kandji tenant, and permission to manage API tokens - Your Kandji **API URL**, which is specific to your tenant ## Configuration step-by-step plan We'll find your tenant's **API URL**, create an **API token**, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your API URL** 2. **Create an API token** 3. **Configure the integration in Tidal Control** ## Step 1: Find your API URL - Sign in to your Kandji tenant - Go to **Settings → Access → API Token** - Copy the **API URL** shown there. It is specific to your tenant and looks like `https://yourtenant.api.kandji.io` > **warning:** **The API URL must include the scheme.** Tidal Control rejects a value that does not start with `http`, so enter the full `https://...` URL rather than a bare hostname. ## Step 2: Create an API token - On the same **Settings → Access** page, add a new **API Token** - Grant it the device-read permissions, so it can list devices and their details - **Copy the token immediately**: Kandji shows it only once ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Kandji** - Fill in the configuration: - **Name:** A descriptive name, for example `Kandji` - **API URL:** The tenant URL from step 1 - **API key:** The token from step 2 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Kandji` **API URL:** - Your tenant's Kandji API URL, including `https://` - Required **API key:** - The API token from step 2 - Required, and stored as a secret ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Kandji under **Configured Integrations** - Kandji tests are available in the Tests section - Test refresh returns device results without authentication errors ## Frequently asked questions **Why is the API URL tenant-specific?** Kandji hosts each tenant on its own subdomain, so there is no single shared API host to default to. You have to copy yours from the tenant. **Does this cover devices other than Macs?** The checks cover the Apple device estate Kandji manages. Devices Kandji does not manage cannot appear, so treat Kandji coverage as part of your device inventory review. **Does Tidal Control read anything from the devices themselves?** No. It reads device records from the Kandji API, which reports management state rather than user files. ## Common problems **"API URL is required" or "API URL must start with http"** - Enter the full URL including the scheme, for example `https://yourtenant.api.kandji.io` **"API Key is required"** - The token was not pasted, or was lost after creation. Create a new token in Kandji **Device checks return no devices** - The token lacks device-read permission, or the API URL points at a different tenant ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Linear URL: https://tidalcontrol.com/docs/integrations/linear Connect Linear to Tidal Control so compliance tests track how high-priority work is managed across your teams. Read-only, and usable as an external tracker. Tidal Control's Linear integration monitors your issue tracker for compliance purposes, tracking how high-priority work is managed across your teams. ## What this integration monitors - **Issues:** Assignment and resolution of urgent and high-priority issues - **Users:** Active user presence in your workspace ## Requirements - Super User role in Tidal Control - Linear account with API access ## Configuration step-by-step plan We'll create a **Linear API key**, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an API key** 2. **Configure the integration in Tidal Control** ## Step 1: Create an API key - Log in to your Linear account - Click your **profile picture** or name in the bottom-left corner - Select **Settings** - Navigate to **API** in the left sidebar - Under **Personal API keys**, click **Create key** - Enter a label (e.g. `Tidal Control`) - Click **Create key** - **Copy the key value**: it is only shown once > **warning:** **Save the API key immediately.** Linear only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Linear** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Linear` - **API Key:** The API key from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Linear`, `Linear Production` **API Key:** - Your personal Linear API key - Created in step 1 - Keep this value secure ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Linear under **Configured Integrations** - Linear tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Can I use a team API key instead of a personal one?** Tidal Control uses personal API keys. Make sure the account that creates the key has access to the teams and issues you want to monitor. **Does the integration read all teams in my workspace?** Yes, the integration reads all teams, issues, and users that are accessible to the account that created the API key. **Do I need admin access in Linear to create an API key?** No, any Linear user can create a personal API key in their own settings. ## Common problems **"API Key is required"** - Make sure you entered the API key value, not the key label - The key should start with `lin_api_` **Tests show no data after connecting** - Confirm the Linear account has access to at least one team and its issues - Try refreshing the tests manually ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Microsoft Sentinel URL: https://tidalcontrol.com/docs/integrations/microsoft-sentinel Connect your Microsoft Sentinel workspace to Tidal Control with an Azure app registration, so compliance tests read your SIEM configuration. Read-only. Tidal Control's Microsoft Sentinel integration reads the configuration of one Sentinel workspace for compliance purposes. It authenticates as an Azure app registration and reads the `Microsoft.SecurityInsights` resources on your Log Analytics workspace, which is the evidence auditors ask for on security monitoring and incident response. ## What this integration monitors - **Open incidents:** Whether any high-severity incident is still unresolved - **Analytics rules:** Whether the workspace has alert rules configured at all - **Data connectors:** Whether the workspace is actually receiving security telemetry ## Requirements - Super User role in Tidal Control - An Azure subscription with a Microsoft Sentinel workspace - Permission to create an app registration in Microsoft Entra ID, and to assign a role on the workspace ## Configuration step-by-step plan We'll create an **app registration** with a client secret, give it read access to the Sentinel workspace, collect the workspace identifiers, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an app registration** 2. **Grant it read access to the workspace** 3. **Collect the workspace identifiers** 4. **Configure the integration in Tidal Control** ## Step 1: Create an app registration - In the [Azure portal](https://portal.azure.com), open **Microsoft Entra ID → App registrations** - Click **New registration**, name it, for example `Tidal Control`, and register it - Copy the **Application (client) ID** and the **Directory (tenant) ID** - Open **Certificates & secrets → New client secret**, then **copy the secret value immediately**: it is shown only once ## Step 2: Grant it read access to the workspace - Open your Sentinel **Log Analytics workspace**, or the resource group containing it - Go to **Access control (IAM) → Add role assignment** - Assign **Microsoft Sentinel Reader** to the app registration from step 1 > **info:** **Reader is enough.** Microsoft Sentinel Reader grants read access to incidents, analytics rules and data connectors, which is everything this integration needs. A Contributor or Owner role would let a compliance tool change your SIEM, so avoid it. ## Step 3: Collect the workspace identifiers From the workspace's **Overview** page, note: - The **Subscription ID** it belongs to - The **Resource group** containing it - The **workspace name** ## Step 4: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Microsoft Sentinel** - Fill in the configuration: - **Name:** A descriptive name, for example `Microsoft Sentinel` - **Tenant ID:** The directory ID from step 1 - **Client ID:** The application ID from step 1 - **Client secret:** The secret value from step 1 - **Subscription ID:** From step 3 - **Resource group:** The resource group holding the workspace - **Workspace name:** The Log Analytics workspace name - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Microsoft Sentinel` **Tenant ID, Client ID and Client secret:** - The app registration credentials from step 1 - All three are required. The client secret is stored as a secret **Subscription ID, Resource group and Workspace name:** - Which Sentinel workspace to read - All three are required, and all identify one workspace > **warning:** **One connection covers one workspace.** All three location fields are required and point at a single Log Analytics workspace. If you run Sentinel in more than one workspace, add a separate connection for each. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Microsoft Sentinel under **Configured Integrations** - Sentinel tests are available in the Tests section - Test refresh returns results without authentication or authorisation errors ## Frequently asked questions **Is this the same as the Microsoft Azure integration?** No. The Azure integration covers the cloud platform's own configuration. This one reads Sentinel, the SIEM, and needs its own connection and its own role assignment. **Does the client secret expire?** Yes. Azure client secrets have an expiry date you choose at creation. When it lapses the integration stops authenticating, so note the date and rotate the secret in Tidal Control before it passes. **Why does the analytics rules test matter if we have incidents?** A workspace can hold historic incidents while having no active rules, which means nothing new is being detected. The two checks answer different questions. ## Common problems **Authentication fails** - Check the tenant, client and secret values, and that the secret has not expired **Authorisation fails, or every test returns nothing** - The role assignment is missing or scoped elsewhere. Assign Microsoft Sentinel Reader on the workspace or its resource group **"Resource group is required" or "Workspace name is required"** - All three location fields must be filled in. Copy them from the workspace Overview page **Results are empty but the portal shows incidents** - The connection points at a different workspace. Confirm the subscription, resource group and workspace name together ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Neon URL: https://tidalcontrol.com/docs/integrations/neon Connect your Neon Postgres organisation to Tidal Control with a bearer token, so compliance tests read its security configuration. Read-only, never your data. Tidal Control's Neon integration monitors your Neon Postgres organisation's security configuration for compliance purposes. It authenticates with a bearer token against the Neon API (`https://console.neon.tech/api/v2`). ## What this integration monitors - **Projects:** IP allowlists, branch protection, connection pooling, auto-suspend, block-public-connections, logical replication and HIPAA settings - **Security guarantees:** Password storage, data anonymization, encryption, patching and backup - **Neon Auth:** Authentication configuration - **Account API keys:** Key hygiene for the account - **Organization API keys:** Key hygiene for the organisation - **Organization members:** MFA enforcement - **VPC endpoints:** Network isolation ## Requirements - Super User role in Tidal Control - Neon account with access to your organisation settings - Your Neon **Organization ID** (always required; see below) > **warning:** **The Organization ID is required.** Without it, organisation-level checks (member MFA, organisation API keys, VPC endpoints) cannot run, and a personal access token cannot even list projects. Always configure the Organization ID so every test evaluates real data instead of passing without checking anything. ## Choosing a credential Neon supports two token types, and they behave differently:
Token typeWhere to create itScope
Organization API key (recommended)Neon Console → Organisation → Settings → API keysBound to one organisation
Personal access token (PAT)Neon Console → Account settings → API keysYour user, across every organisation you belong to
**Prefer an organisation API key** for a shared, org-wide integration. A personal access token is tied to an individual and is unusable without an Organization ID anyway (Neon's `GET /projects` endpoint returns `HTTP 400 "org_id is required"` for a PAT). The account-level API-keys check only reflects real data when a PAT is used; with an organisation API key it is legitimately empty, because an organisation key cannot enumerate a person's personal keys. ## Configuration step-by-step plan We'll create a **Neon API key**, copy the **Organization ID**, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your Organization ID** 2. **Create an API key** 3. **Configure the integration in Tidal Control** ## Step 1: Find your Organization ID - Log in to the [Neon Console](https://console.neon.tech) - Open your **organisation settings** - Copy the **Organization ID**. It looks like `org-...` ## Step 2: Create an API key Neon offers two kinds of key, and the organisation key is the one to prefer for a shared integration. **Recommended: Organization API key** - In the Neon Console, go to your **Organization → Settings → API keys** - Create a new API key and give it a name, e.g. `Tidal Control` - **Copy the key**: it is shown only once **Alternative: Personal access token** - Go to **Account settings → API keys** - Create a new key and copy it > **warning:** **Save the key immediately.** Neon only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Neon** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Neon` - **API Key:** The organisation API key or personal access token from step 2 - **Organization ID:** The `org-...` identifier from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Neon`, `Neon Production` **API Key:** - A Neon organisation API key (recommended) or personal access token - Created in step 2 - Keep this value secure **Organization ID:** - The unique identifier of your Neon organisation (`org-...`) - Found in step 1 - **Required**: all tests need it to evaluate real data ## How the configuration affects which tests run With the Organization ID configured, all tests run correctly regardless of token type. The combinations behave as follows:
ConfigurationProject testsOrg-level tests (MFA, org keys, VPC)Account API-key test
PAT, no Org ID❌ all error (org_id is required)⚠️ no data✅
API key, no Org ID✅⚠️ pass without checking anything⚠️ pass without checking
PAT + Org ID✅✅✅
API key + Org ID✅✅⚠️ empty (an org key can't see personal account keys)
> **warning:** **Why "no Organization ID" is dangerous, not just incomplete.** When an organisation-level test has no data, an "all rows pass" check passes *vacuously*. It shows green while having verified nothing. An integration with only an API key and no Organization ID would report, for example, "All organisation members have MFA enabled" as passing even though zero members were ever fetched. That is a false compliance signal. Tidal Control therefore now fails these tests loudly (*"This Neon account requires an Organization ID"*) instead of passing vacuously. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Neon under **Configured Integrations** - Neon tests are available in the Tests section - Test refresh delivers results without authentication errors, and organisation-level tests no longer report the "requires an Organization ID" message ## Frequently asked questions **Which token type should I use?** An organisation API key, for a shared integration. A personal access token is tied to an individual and requires an Organization ID to work at all. **Why is the account API-keys test empty with an organisation key?** An organisation API key cannot enumerate a person's personal account keys. This is expected. That check only reflects real data when a personal access token is used. **Do I really need the Organization ID if I use an organisation API key?** Yes. The organisation key resolves its org implicitly for projects, but the organisation-level checks (member MFA, organisation API keys, VPC endpoints) still need the Organization ID to run at all. ## Common problems **Project tests error with `org_id is required`** - You are using a personal access token without an Organization ID - Add the `org-...` Organization ID to the integration **Organisation-level tests report "This Neon account requires an Organization ID"** - The Organization ID is missing. Add it so the checks evaluate real data **"API Key is required"** - Make sure you pasted the key. It is only shown once at creation ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Notion URL: https://tidalcontrol.com/docs/integrations/notion Connect your Notion workspace to Tidal Control with an internal integration key, so compliance tests read how your pages are shared. Read-only access. Tidal Control's Notion integration reads the sharing and membership state of your Notion workspace for compliance purposes. It authenticates with an internal integration key, and the checks focus on the ways a workspace quietly leaks information: pages published to the web, content left in trash, and integrations owned by individuals. ## What this integration monitors - **Public pages:** Pages published to the web, readable by anyone with the URL - **Trash:** Pages left in trash rather than actually removed - **Personal bot integrations:** Integrations owned by an individual instead of the workspace - **Inline databases:** Databases embedded inline, where permissions are easy to lose track of - **Users without email:** Accounts with no email address recorded ## Requirements - Super User role in Tidal Control - Notion workspace owner access, to create an internal integration - Ability to share the pages you want covered with that integration ## Configuration step-by-step plan We'll create an **internal integration** in Notion, connect it to the content you want covered, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an internal integration** 2. **Give it access to your content** 3. **Configure the integration in Tidal Control** ## Step 1: Create an internal integration - Go to [notion.so/my-integrations](https://www.notion.so/my-integrations) - Click **New integration**, name it, for example `Tidal Control`, and associate it with your workspace - Keep the capabilities read-only: **Read content** and **Read user information** are enough - Copy the **Internal Integration Secret** ## Step 2: Give it access to your content Notion integrations see nothing until content is explicitly shared with them. - Open a top-level page you want covered - Use the page menu → **Connections** → add your `Tidal Control` integration - Repeat for each top-level page whose subtree you want included > **warning:** **Notion grants access per page, not per workspace.** An integration key with no pages connected authenticates successfully and returns nothing, so the checks would evaluate an empty workspace. Connect your top-level pages so the results reflect real content. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Notion** - Fill in the configuration: - **Name:** A descriptive name, for example `Notion` - **API key:** The internal integration secret from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Notion` **API key:** - The internal integration secret from step 1 - Required, and stored as a secret ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Notion under **Configured Integrations** - Notion tests are available in the Tests section - Results list real pages rather than an empty workspace ## Frequently asked questions **Why do results look empty?** Almost always because no pages are connected to the integration. Notion shares content with integrations per page, so step 2 is not optional. **Does Tidal Control read our page contents?** It reads page metadata and sharing state, which is what the checks need. It does not mine page bodies for their text. **What is a personal bot integration, and why does it matter?** An integration owned by one person rather than the workspace. It keeps working against your content after that person's role changes, so it is access nobody is reviewing. ## Common problems **"API Key is required"** - The secret was not pasted. Copy it again from the integration page **Checks return no pages** - No content is connected. Add the integration under **Connections** on your top-level pages **A page you expected is missing** - Its subtree is not shared with the integration. Connect it, or connect a parent page ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### 1Password URL: https://tidalcontrol.com/docs/integrations/onepassword Connect 1Password to Tidal Control with an Events API token, a Users API application, or both, so compliance tests read your account posture and its members. Tidal Control's 1Password integration answers two questions about your password manager: whether one is actually in use, and whether the account is configured the way you say it is. It reads no vault contents. Neither credential it accepts can open a vault. The integration takes two separate credentials, and they do not have the same plan requirement. Most of the work in setting it up is deciding which of them your account can issue. ## What this integration monitors - **A password manager is connected to Tidal Control:** passes on the saved connection alone, with no API call. Either credential satisfies it - **1Password members can be listed for access review:** the member list, with each member's state as `ACTIVE` or `SUSPENDED`. Users API - **Two-factor authentication has not been disabled in 1Password:** an audit event that switched two-factor authentication off fails the test and names who did it. Events API - **Single sign-on has not been disabled in 1Password:** the same shape, over the SSO audit events. Events API - **Successful 1Password sign-ins used a second factor:** a sign-in that succeeded at the credential step and was never asked for a second factor fails the test. Events API ## Requirements - Super User role in Tidal Control - A 1Password Teams or Business account - Owner, administrator, or Security group membership in 1Password - 1Password **Business** for the Events API credential. Teams accounts cannot issue it ## The plan requirement is split, and the console does not explain it The **Users API** credential works on 1Password **Teams and Business**, verified against a Teams account. The **Events API** credential is **Business only**. On a Teams account the Events Reporting section is absent from Integrations → Directory: nothing to click, and no message saying why. What makes this confusing is that the OAuth Application section stays visible on Teams, so the Users API looks available while you hunt for an Events Reporting section that is not there. A Teams customer gets the member list and the evidence that a password manager is in use. None of the posture evidence is available. > **warning:** **The Teams "Try for free" Reports trial does not unlock the Events API.** It adds the Reports and Audit log screens to the sidebar without changing the plan, so the account looks upgraded while Events Reporting stays absent. `op account get --format=json` returns `"type"` as `TEAM` or `BUSINESS`, and settles it. ## Configuration step-by-step plan We'll confirm which plan you are on, issue the credentials your plan allows, then add one connection per credential in Tidal Control. **Configuration steps:** 1. **Confirm your plan** 2. **Create the Events API token** (Business only) 3. **Create the Users API OAuth application** 4. **Add the connection in Tidal Control** ## Step 1: Confirm your plan - Install the [1Password CLI](https://developer.1password.com/docs/cli/) and sign in - Run `op account get --format=json` - `"type": "BUSINESS"` means both credentials are available. `"type": "TEAM"` means the Users API only, and you can skip step 2 Read the plan from the CLI rather than from the console, for the reason in the warning above. ## Step 2: Create the Events API token Business accounts only. - Sign in to 1password.com as an owner or administrator - Go to **Integrations → Directory** and find the **Events Reporting** section - Add an integration and pick any SIEM in the list. The token is the same whichever you choose - Name it, for example `Tidal Control` - Select **audit events** and **sign-in attempts** - Leave **item usage events** off - Set **Expires After** to **Never** - Issue the token and copy it > **warning:** **Leave item usage events off, and set the expiry to Never.** Tidal Control never reads the item usage feed, and that feed records which items were accessed, by whom, and from which IP address. A finite expiry is worse than it looks: the connection stops collecting evidence on the day the token lapses, and nothing announces it. ## Step 3: Create the Users API OAuth application - Sign in to 1password.com as an owner or administrator, or as a member of the Security group - Go to **Integrations** and add an **OAuth Application** - Select the **list users** scope, and nothing else - Leave **suspend user** and **reactivate user** unselected. Tidal Control never writes to a 1Password account - Set a **Redirect URL**. The console requires one and it must be HTTPS, but the client credentials grant never uses it, so any HTTPS URL on a domain you control is fine - Copy the **client ID** and the **client secret** ### Finding your Account ID The Account ID is the field that goes wrong most often. It is a 26-character identifier such as `56YE2TYN2VFYRLNSHKPW5NVT5E`, made of letters and digits with no hyphens. It is not your sign-in subdomain, and it is not the OAuth client ID. Pasting the subdomain returns `400 invalid account UUID`. 1Password does not display it in the console. Run `op account list --format=json` and read it from `account_uuid`. An Events API token carries the same value, so if you already have one from step 2 you can take it from there. > **info:** **The Users API does not work on accounts that provision users automatically through an identity provider.** If your 1Password account is provisioned from Okta, Entra ID or another directory, the Users API half is unavailable and only the Events API credential applies. ## Step 4: Add the connection in Tidal Control Each connection carries one credential type, and the type is fixed once the connection is saved. A Business account that wants both halves adds **two** 1Password connections, one per credential. - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **1Password** - Choose the **Credential type**: **Events API** or **Users API** - Fill in the fields for that type, and pick the **Region** - Click **"Create"** to save the integration - Repeat for the second credential if you have both ## Configuration fields explained The integration dialog asks for the following values. **Name:** - A descriptive name for this connection - For example: `1Password events` and `1Password users`, so the two connections are told apart **Credential type:** - **Events API** or **Users API** - Fixed once the connection is saved. To switch, create a new connection **Events API token:** - The token from step 2 - Required for an Events API connection, and stored as a secret **Account ID:** - The 26-character account identifier from step 3 - Required for a Users API connection **Client ID** and **Client secret:** - The OAuth application credentials from step 3 - Both required for a Users API connection. The secret is stored as a secret **Region:** - **United States**, **Europe** or **Canada** - Required ## Region Both credentials are regional, and the region has to match where your 1Password account is hosted: `1password.com`, `1password.eu` or `1password.ca`. A mismatch talks to the wrong host, so a credential that is otherwise correct still fails. ## What the integration does and does not check Five tests ship. The connector reads no vault contents, and it cannot: neither credential can open a vault. No 1Password API returns the current state of an account policy. Authentication policy, account password policy and firewall rules are console-only, and the Insights report that lists members without two-factor authentication exports to CSV rather than to an endpoint. So the two audit tests are detective rather than preventive. They read a window of audit events, the last 120 days, and fail on a change inside that window that weakened the account. They do not prove that two-factor authentication is switched on right now. A setting enabled before the window opened emits no event at all, and Tidal Control does not read that silence as proof of anything. The sign-in test is the one positive measurement in the set. A successful sign-in whose second factor was never demanded is evidence of a real gap, rather than an inference from an empty audit log. If you are comparing Tidal Control against a vendor claiming "MFA enforcement monitoring", that is the distinction worth asking them about. Whether the policy is configured correctly right now stays a document or attestation control. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows 1Password under **Configured Integrations** - 1Password tests are available in the Tests section - A Users API connection returns your member list, with the states you expect - An Events API connection returns audit events and sign-in attempts without authentication errors ## Frequently asked questions **Can Tidal Control read the contents of my vaults?** No, and it could not if it wanted to. The Events API token is scoped to event feeds and the Users API application to the member list. Neither is a secrets-retrieval credential, and no vault or item endpoint is called. **Why does one 1Password account need two connections?** The two credentials are different things: a bearer token issued under Events Reporting, and an OAuth client with a client ID and secret. Tidal Control stores one credential per connection, so both halves mean two connections against the same account. **We are on Teams. What do we lose?** The three posture tests, which all read the Events API. You keep the member list for access review and the evidence that a password manager is in use. **How far back do the audit tests look?** 120 days. An event older than that is outside the window and cannot be read. **Can I connect two separate 1Password accounts?** Not usefully today. Both clients fetch whole collections, so the results from two accounts merge into one set and a test cannot tell them apart. Connect one account. ## Common problems **`400 invalid account UUID`** - The Account ID is wrong. It is the 26-character identifier from `op account list --format=json`, not the sign-in subdomain and not the OAuth client ID **`403 permission denied`** - The Account ID is well formed but the credential cannot reach that account. Check that the client ID and secret belong to the same account, and that the region matches **Events Reporting is missing from Integrations → Directory** - The account is on Teams. Run `op account get --format=json` to confirm, and note that an active Reports trial does not change this **"Events API token is required" or "Account ID is required"** - A field for the selected credential type was left empty. The dialog shows the Events API field or the Users API fields, never both **The member list test fails on an empty result** - That is deliberate. An account always has at least its owner, so an empty member list means the fetch is broken rather than that nobody has access. Check the credential, the Account ID and the region **Two-factor or SSO tests report no results** - No matching audit event fell inside the 120-day window. That is the expected state for an account nobody has weakened, and it is not a failure ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### OpenAI URL: https://tidalcontrol.com/docs/integrations/openai Connect your OpenAI organisation to Tidal Control for AI governance and access control tests. It reads organisation-level governance data, never model content. Tidal Control's OpenAI integration monitors your OpenAI organisation for AI governance and access control purposes. It reads organisation-level governance data, not model usage. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your OpenAI organisation. ## What this integration monitors - **Users:** Email, name, organisation role (owner or reader), and when they were added - **Invites:** Pending, accepted, and expired invites with their invited role - **Projects:** Name, creation date, status, and archival date - **Project members:** Per-project role assignments - **Service accounts:** Non-human identities per project - **Project API keys:** Name, creation date, last used date, redacted key value, and whether the key is owned by a user or a service account - **Admin API keys:** Organisation-level keys with their creation and last used dates - **Rate limits:** Request and token limits per model, per project ## Requirements - Super User role in Tidal Control - An OpenAI organisation on the OpenAI platform (`platform.openai.com`) - The organisation **owner** role, since only owners can create admin keys ## Configuration step-by-step plan We'll create an **admin key** in the OpenAI platform settings, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an admin key in OpenAI** 2. **Configure the integration in Tidal Control** ## Step 1: Create an admin key in OpenAI - Sign in at [platform.openai.com](https://platform.openai.com) as an organisation owner - Go to **Settings → Organization → Admin keys** - Click **Create admin key** - Enter a name (e.g. `Tidal Control`) - Click **Create admin key** - **Copy the key**: it starts with `sk-admin-` and is only shown once > **warning:** **Save the admin key immediately.** OpenAI only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. > **info:** **Tidal Control never reads secret key values.** The API key endpoints only return a redacted value such as `sk-...abcd`. The integration inventories your keys. It cannot recover them. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **OpenAI** - Fill in the configuration: - **Name:** A descriptive name, e.g. `OpenAI` - **Admin API Key:** The admin key from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `OpenAI`, `OpenAI Production` **Admin API Key:** - The OpenAI organisation admin key, starting with `sk-admin-` - Created in step 1 - A regular project API key (`sk-proj-`) will not work. It cannot call the Organization API - Keep this value secure ## Available checks The integration runs the following checks, grouped by the area they cover: **AI governance (ISO/IEC 42001):** - Inventory of AI platform projects and which of them are still active - Which human and non-human identities can reach models - Which credentials reach those models **Access control (ISO 27001 A.5.15-A.5.18, SOC 2 CC6.1-CC6.3):** - Organisation and per-project role assignments for least-privilege reviews - Review of organisation owners as privileged access - Pending and stale invites as provisioning evidence **Credential hygiene (SOC 2 CC6.1):** - Never-used keys, both project keys and organisation admin keys - Key age, for rotation checks - Human-owned versus service-account-owned keys > **info:** **Plan-dependent checks.** Some OpenAI governance settings (mTLS certificates, zero data retention, per-project model permissions, and spend alerts) are only exposed by the API when your organisation is entitled to them. If your plan does not include a setting, the corresponding check returns no data rather than failing. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows OpenAI under **Configured Integrations** - OpenAI tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control read our ChatGPT conversations or prompts?** No. The integration only reads organisation governance data: users, invites, projects, service accounts, and API key metadata. **Do I need to be an organisation owner?** Yes. Only owners can create admin keys in OpenAI. **Are archived projects included?** Archived projects appear in the project inventory so you keep the lifecycle record, but their members, service accounts, and keys are not read. **Are audit logs included?** No. Audit logs and usage exports are separate OpenAI endpoints that this integration does not read. ## Common problems **Authentication fails with a 401 error** - Confirm the key starts with `sk-admin-`. A project key (`sk-proj-`) cannot call the Organization API - Check that the key was copied in full and has not been revoked - Confirm the account that created the key still has the organisation **owner** role **Tests fail with a 403 error** - The key exists but the organisation is not entitled to the requested data - Confirm you can open **Settings → Organization** in OpenAI with the same account **Test refresh is slow for large organisations** - Project members, service accounts, and API keys are read per project, so organisations with many active projects take longer to refresh **The zero data retention check fails** - Zero data retention is a plan entitlement. If your organisation is not eligible, the check reports that rather than passing ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### OVHcloud URL: https://tidalcontrol.com/docs/integrations/ovhcloud Connect OVHcloud to Tidal Control with an OAuth2 service account using the client credentials flow, so compliance tests read your account's security settings. Tidal Control's OVHcloud integration monitors your account's security configuration for compliance purposes. It uses an **OAuth2 service account** (client credentials flow) to authenticate against the OVHcloud v1 and v2 APIs. ## What this integration monitors - **IAM users (sub-users):** Account identity inventory - **IAM groups:** Group membership - **IAM policies:** Access policy configuration - **Legacy API applications and credentials:** Older API access - **OAuth2 service accounts:** Service-account inventory - **Public Cloud projects:** Project inventory - **Cloud project users:** Per-project users - **SSH keys:** Cloud SSH credential inventory - **Cloud instances:** Compute inventory - **Managed databases:** Database services - **KMS resources:** Key Management Service inventory ## Requirements - Super User role in Tidal Control - OVHcloud account with access to the API console and IAM - The EU endpoint (`https://api.eu.ovhcloud.com`), the only region supported at this time > **info:** **Security groups are not included.** OVHcloud security groups are only available through the OpenStack API, not the OVHcloud REST API, so the connector does not monitor them. ## Configuration step-by-step plan We'll create an **OAuth2 service account**, copy its **identity URN**, create an **IAM policy** granting read-only access, then add the connection in Tidal Control. **Configuration steps:** 1. **Create an OAuth2 client (service account)** 2. **Copy the service account's identity URN** 3. **Create an IAM policy** 4. **Configure the integration in Tidal Control** ## Step 1: Create an OAuth2 client (service account) In the [OVHcloud Manager API console](https://manager.eu.ovhcloud.com/beta/#/api), execute: ``` POST /me/api/oauth2/client { "callbackUrls": [], "flow": "CLIENT_CREDENTIALS", "name": "tidal-control", "description": "Tidal Control security compliance connector" } ``` Save the returned `clientId` and `clientSecret`. Alternatively, go to **Account & Billing → My Account → My identities → Service accounts → Create**. > **warning:** **Save the client secret immediately.** The `clientSecret` is shown only once. If you lose it, create a new OAuth2 client. ## Step 2: Copy the service account's identity URN After creating the client, call: ``` GET /me/api/oauth2/client/{clientId} ``` Copy the `identity` field. It looks like: ``` urn:v1:eu:identity:credentialOAuth2:{nicHandle}/EU.xxxxxxxxxxxxxxxx ``` Your **nicHandle** is shown in the top-right menu of the OVHcloud Manager (e.g. `hw53544-ovh`). ## Step 3: Create an IAM policy Create a read-only IAM policy for the service account. You can do this in **IAM → Policies → Create a policy** in the Manager, or via the API. > **warning:** **Use explicit resource URNs, not a wildcard.** Using `urn:v1:eu:resource:*:*` fails with an error such as *"a policy can't target subusers of another account"*, because the wildcard expands to resources from every account linked to the root account. List each resource explicitly instead. **Resources.** Add one entry per resource type you have:
Resource typeURN format
Account (for me/* and iam/* endpoints)urn:v1:eu:resource:account:{nicHandle}
Cloud project (one per project)urn:v1:eu:resource:publicCloudProject:{projectId}
KMS (one per resource)urn:v1:eu:resource:okms:{kmsId}
**Allowed actions.** Grant exactly these read actions. Note that cloud-project actions use the `publicCloudProject:apiovh:` prefix, not `account:apiovh:cloud/project/`:
PurposeAction
IAM sub-usersaccount:apiovh:me/identity/user/get
IAM groupsaccount:apiovh:me/identity/group/get
Legacy API applicationsaccount:apiovh:me/api/application/get
Legacy API credentialsaccount:apiovh:me/api/credential/get
Service accounts (OAuth2 clients)account:apiovh:me/api/oauth2/client/get
IAM policiesaccount:apiovh:iam/policy/get
Public Cloud projectspublicCloudProject:apiovh:get
Cloud project userspublicCloudProject:apiovh:user/get
SSH keyspublicCloudProject:apiovh:sshkey/get
Cloud instancespublicCloudProject:apiovh:instance/get
Managed databasespublicCloudProject:apiovh:database/service/get
KMS resourcesokms:apiovh:resource/get
Creating the policy via the API: ```bash # First get a token TOKEN=$(curl -s -X POST https://www.ovh.com/auth/oauth2/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -u "$CLIENT_ID:$CLIENT_SECRET" \ -d "grant_type=client_credentials&scope=all" | jq -r '.access_token') # Create the IAM policy curl -s -X POST https://api.eu.ovhcloud.com/v2/iam/policy \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "name": "tidal-control", "description": "Tidal Control read-only access", "identities": ["urn:v1:eu:identity:credentialOAuth2:{nicHandle}/EU.xxxxxxxxxxxxxxxx"], "resources": [ "urn:v1:eu:resource:account:{nicHandle}", "urn:v1:eu:resource:publicCloudProject:{projectId}", "urn:v1:eu:resource:okms:{kmsId}" ], "permissions": { "allow": [ {"action": "account:apiovh:me/identity/user/get"}, {"action": "account:apiovh:me/identity/group/get"}, {"action": "account:apiovh:me/api/application/get"}, {"action": "account:apiovh:me/api/credential/get"}, {"action": "account:apiovh:me/api/oauth2/client/get"}, {"action": "account:apiovh:iam/policy/get"}, {"action": "publicCloudProject:apiovh:get"}, {"action": "publicCloudProject:apiovh:user/get"}, {"action": "publicCloudProject:apiovh:sshkey/get"}, {"action": "publicCloudProject:apiovh:instance/get"}, {"action": "publicCloudProject:apiovh:database/service/get"}, {"action": "okms:apiovh:resource/get"} ] } }' ``` Replace `{nicHandle}`, `{projectId}`, `{kmsId}` and the identity URN with your actual values. Add one `resources` entry per cloud project and per KMS resource. ## Step 4: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **OVHcloud** - Fill in the configuration: - **Name:** A descriptive name, e.g. `OVHcloud` - **Client ID:** The `clientId` from step 1 (e.g. `EU.xxxxxxxxxxxxxxxx`) - **Client Secret:** The `clientSecret` from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `OVHcloud`, `OVHcloud Production` **Client ID:** - The `clientId` of the OAuth2 service account created in step 1 - For example: `EU.xxxxxxxxxxxxxxxx` **Client Secret:** - The `clientSecret` of the OAuth2 service account - Shown only once at creation. Keep it secure > **info:** **How authentication works.** The connector requests a token from `https://www.ovh.com/auth/oauth2/token` using HTTP Basic auth (`Authorization: Basic base64(clientId:clientSecret)`) with `grant_type=client_credentials&scope=all`, then calls the EU API base `https://api.eu.ovhcloud.com`. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows OVHcloud under **Configured Integrations** - OVHcloud tests are available in the Tests section - Test refresh delivers results without authentication errors ## Finding additional action names If more OVHcloud endpoints need to be covered in the future, the full list of IAM action names can be retrieved from the IAM reference API: ```bash curl -s -H "Authorization: Bearer $TOKEN" \ "https://api.eu.ovhcloud.com/v2/iam/reference/action?resourceType=publicCloudProject" \ | jq '.[].action' ``` Use `resourceType=account` for `me/*` endpoints and `resourceType=okms` for KMS. ## Common problems **`"invalid identity ... a policy can't target subusers of another account"`** - You used the wildcard resource `urn:v1:eu:resource:*:*` - Replace it with explicit resource URNs (see step 3) **`"unknown action"` errors** - A cloud-project action used the wrong prefix - Cloud-project actions must use `publicCloudProject:apiovh:` (e.g. `publicCloudProject:apiovh:instance/get`), not `account:apiovh:cloud/project/...` **Authentication fails** - Confirm the Client ID and Client Secret are correct and the OAuth2 client uses the `CLIENT_CREDENTIALS` flow - Confirm you are using the EU account (`https://api.eu.ovhcloud.com`) **Tests show no data for certain resource types** - Confirm the IAM policy includes the matching action and an explicit resource URN for that resource ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Papermark URL: https://tidalcontrol.com/docs/integrations/papermark Connect your Papermark team to Tidal Control with a read-only API token, so compliance tests read how your shared documents are protected. Metadata only. Tidal Control's Papermark integration reads the configuration of your Papermark team for compliance purposes. It authenticates with a bearer API token against the Papermark API (`https://api.papermark.com`), and covers how your shared documents and data rooms are protected, and who has been viewing them. ## What this integration monitors - **Share links:** Whether links require an email, a password or a verified domain, and whether they expire - **Data rooms:** Access configuration for grouped document collections - **Documents:** The inventory published through your team - **Viewers:** Who opened a link, and when - **View events:** Access history behind each shared link ## Requirements - Super User role in Tidal Control - A Papermark team, on Papermark Cloud or self-hosted - Permission to create API keys in team settings ## Configuration step-by-step plan We'll create a **read-only API key** in Papermark, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a read-only API key** 2. **Configure the integration in Tidal Control** ## Step 1: Create a read-only API key - Sign in to [Papermark](https://www.papermark.com) - Open **General Settings → API Keys** - Click **Create API Key** and select **Read Only** - Grant all five read scopes:
ScopeCovers
links.readShare links and their protection settings
datarooms.readData rooms
documents.readDocuments
visitors.readViewers
analytics.readView events per link
- **Copy the token** (`pm_live_...`) immediately: it is shown only once > **warning:** **`analytics.read` is easy to miss.** View events come from the link views endpoint, which Papermark guards with `analytics.read` rather than `links.read`. Without it, link and document checks work while access history stays empty. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Papermark** - Fill in the configuration: - **Name:** A descriptive name, for example `Papermark` - **API token:** The `pm_live_...` token from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Papermark` **API token:** - The read-only token from step 1 - Required, and stored as a secret - The token identifies its own team, so there is nothing else to configure ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Papermark under **Configured Integrations** - Papermark tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does this work with a self-hosted Papermark?** Yes. A self-hosted deployment serves the same API, and the same read-only token applies. **Does Tidal Control read the documents themselves?** No. It reads metadata and configuration: which links exist, how they are protected, and who viewed them. Document contents are never fetched. **Why does the integration need viewer data?** Because a share link with no protection is only a finding once you can see it was actually opened. Viewer and view records turn a weak setting into evidence of exposure. ## Common problems **"API Token is required"** - The field is empty, or the token was not copied at creation. Create a new key **Link and document checks work but access history is empty** - The key is missing `analytics.read`. Create a new key with all five scopes **Authentication fails after a key rotation** - Papermark tokens are not reused. Paste the new `pm_live_...` value into the integration ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### PostHog URL: https://tidalcontrol.com/docs/integrations/posthog Connect your PostHog organisation to Tidal Control with a read-only personal API key, so compliance tests read its privacy and access settings. Read-only. Tidal Control's PostHog integration reads the configuration of your PostHog organisation for compliance purposes. It authenticates with a personal API key against the PostHog REST API. Because PostHog ingests behavioural event data, often including IP addresses and full session recordings of real users, its configuration matters for both privacy and access-control audits. ## What this integration monitors - **Organisation policy:** Two-factor enforcement, verified-domain SSO, who may invite members or create projects, public sharing and AI data-processing settings - **Members and invitations:** Per-user MFA, membership level, dormant accounts, unverified email and stale pending invites - **Domains:** SSO enforcement per domain, JIT provisioning and SCIM presence - **Project privacy:** IP anonymisation, session replay opt-in and sample rate, input masking, console log capture, recording domain allowlists and event retention - **Project secret API keys:** Rotation, last use and scope breadth - **Feature flags:** Flags left active after a rollout, ownership and unencrypted remote-config payloads - **Dashboards:** Public sharing links that expose analytics to anyone with the URL ## Requirements - Super User role in Tidal Control - A PostHog account with organisation-level access - Your PostHog **regional API URL** ## Configuration step-by-step plan We'll find your regional API URL, create a **personal API key**, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your API URL** 2. **Create a personal API key** 3. **Configure the integration in Tidal Control** ## Step 1: Find your API URL PostHog's management API lives on your **regional** host.
RegionAPI URL
US Cloudhttps://us.posthog.com
EU Cloudhttps://eu.posthog.com
Self-hostedYour own base URL
> **warning:** **This is not the ingestion host.** Event capture uses `*.i.posthog.com`, which does not serve the management API this integration reads. Use `us.posthog.com` or `eu.posthog.com`, matching the region your PostHog account lives in. ## Step 2: Create a personal API key - In PostHog, open your account menu and go to **Personal API keys** - Click **Create personal API key** and give it a name, for example `Tidal Control` - Grant these read-only scopes:
ScopeCovers
organization:readOrganisation settings, domains and roles
organization_member:readMembers and pending invitations
project:readProjects and project secret API keys
feature_flag:readFeature flags
dashboard:readDashboards
- **Copy the key** (`phx_...`) immediately: it is shown only once > **warning:** **A project secret API key cannot be used.** A `phs_` project key is scoped to a single project, so every organisation endpoint refuses it, and that covers five of the nine things this integration reads. Use a personal API key (`phx_...`). ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **PostHog** - Fill in the configuration: - **Name:** A descriptive name, for example `PostHog` - **API URL:** The regional host from step 1 - **Personal API key:** The `phx_...` key from step 2 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `PostHog`, `PostHog EU` **API URL:** - Your regional PostHog host, including the `https://` scheme - **Required.** There is no working default, so an empty value is rejected **Personal API key:** - The `phx_...` key from step 2 - Required, stored as a secret, and must not contain spaces ## Verification The integration is working when all of the following are true: - Settings → Integrations shows PostHog under **Configured Integrations** - PostHog tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Why a personal API key and not OAuth?** PostHog supports OAuth, but Tidal Control does not yet implement an authorisation-code flow for integrations. A personal API key is the credential that works today. **The key is tied to a person. What happens when they leave?** The key stops working when that account is removed, and the integration then fails to authenticate. Create the key on an account that outlives individual staff changes, and treat it as shared infrastructure. **Does Tidal Control read our analytics events?** No. It reads configuration only: organisation and project settings, members, keys, flags and dashboard sharing state. Event data and session recordings are never fetched. ## Common problems **"API URL is required"** - The field is empty. Enter `https://us.posthog.com` or `https://eu.posthog.com` **"API URL must start with http"** - Include the scheme, for example `https://us.posthog.com` rather than `us.posthog.com` **"API Key must not contain whitespace"** - The pasted value picked up a space or line break. Paste it again **Organisation tests error while project tests work** - The key is a project secret key (`phs_...`), or is missing `organization:read`. Use a personal key with all five scopes ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Scaleway URL: https://tidalcontrol.com/docs/integrations/scaleway Connect Scaleway to Tidal Control so compliance tests read your cloud infrastructure's security configuration. Read-only, with nothing created or modified. Tidal Control's Scaleway integration monitors your cloud infrastructure's security configuration for compliance purposes. ## What this integration monitors - **IAM users:** MFA status - **API keys:** Expiry date configuration - **Instances:** Deletion protection on publicly accessible instances - **Security groups:** Default inbound policy - **Databases:** Public access and backup retention - **KMS keys:** Rotation configuration - **Container Registry:** Namespace and image visibility - **Kubernetes clusters:** Private network usage and pending upgrades - **Load balancers:** TLS configuration on frontends - **Serverless:** Container and function privacy settings - **Transactional Email:** SPF and DKIM configuration on domains - **Cockpit:** Managed alert configuration ## Requirements - Super User role in Tidal Control - Scaleway account with access to IAM settings ## Configuration step-by-step plan We'll create a **Scaleway IAM API key** and retrieve the **organisation ID**, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your organisation ID** 2. **Create an IAM API key** 3. **Configure the integration in Tidal Control** ## Step 1: Find your organisation ID - Log in to the [Scaleway Console](https://console.scaleway.com) - Click your **organisation name** in the top-right corner - Select **Organisation Settings** - Copy the **Organisation ID** shown on this page ## Step 2: Create an IAM API key - In the Scaleway Console, navigate to **IAM → API Keys** - Click **Generate an API key** - Choose **Myself** as the bearer, or select a dedicated IAM application - Enter a description (e.g. `Tidal Control`) - Set an optional expiry date - Click **Generate API key** - **Copy the secret key**: it is only shown once > **warning:** **Save the secret key immediately.** Scaleway only shows the full secret key value once at creation. If you close the dialog without copying it, you will need to generate a new API key. > **info:** **Permissions:** The API key needs read access to the resources Tidal Control monitors. If you use IAM policies, make sure the key or its bearer has at least read permissions on: instances, databases, KMS, IAM, Kubernetes, Container Registry, serverless containers and functions, load balancers, Transactional Email, VPC, and Cockpit. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Scaleway** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Scaleway` - **Secret Key:** The secret key from step 2 - **Organisation ID:** The organisation ID from step 1 - **Zones (optional):** Leave blank to use all default zones, or enter a comma-separated list of zones to limit monitoring - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Scaleway`, `Scaleway Production` **Secret Key:** - The secret part of the Scaleway IAM API key - Created in step 2 - Keep this value secure **Organisation ID:** - The unique identifier of your Scaleway organisation - Found in step 1 **Zones (optional):** - A comma-separated list of Scaleway zones to include in monitoring - Leave blank to use all default zones: `fr-par-1`, `nl-ams-1`, `pl-waw-1` - Enter only zone identifiers, for example: `fr-par-1,nl-ams-2`
ZoneLocation
fr-par-1Paris, France (AZ 1, default)
fr-par-2Paris, France (AZ 2)
fr-par-3Paris, France (AZ 3)
nl-ams-1Amsterdam, Netherlands (AZ 1, default)
nl-ams-2Amsterdam, Netherlands (AZ 2)
nl-ams-3Amsterdam, Netherlands (AZ 3)
pl-waw-1Warsaw, Poland (AZ 1, default)
pl-waw-2Warsaw, Poland (AZ 2)
pl-waw-3Warsaw, Poland (AZ 3)
## Verification The integration is working when all of the following are true: - Settings → Integrations shows Scaleway under **Configured Integrations** - Scaleway tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Can I use the same API key for multiple Tidal Control environments?** Yes, the same API key can be used across different Tidal Control instances. **Why does the integration use specific zones instead of all zones?** Scaleway resources are zone-specific. The default zones cover the three main Scaleway regions. If your organisation uses resources in additional zones, add them to the zones field. **Do I need to be a Scaleway owner to create an API key?** You need sufficient permissions in Scaleway to create API keys. Organisation owners can always create API keys. IAM users can create API keys if their policy allows it. ## Common problems **"Secret Key is required"** - Make sure you entered the secret key, not the access key ID - The secret key is only shown once. If you did not copy it, generate a new one **"Organisation ID is required"** - Find your organisation ID in **Organisation Settings** in the Scaleway Console **Tests show no data for certain resource types** - Check that the API key or its IAM application has read permissions for those resource types - Confirm that those resource types are deployed in the zones configured for this integration ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Sentry URL: https://tidalcontrol.com/docs/integrations/sentry Connect your Sentry organisation to Tidal Control with a read-only internal integration token, so compliance tests read its real configuration. Read-only. Tidal Control's Sentry integration reads the configuration of your Sentry organisation for compliance purposes. It authenticates with a bearer auth token against the Sentry Web API v0 (`https://sentry.io/api/0`), and because Sentry receives production error payloads, its privacy and access settings are squarely in audit scope. ## What this integration monitors - **Organisation access:** MFA enforcement, SSO presence, open membership, member invite permissions and the default member role - **Members:** Per-member MFA, SSO linkage, IdP provisioning, dormant accounts and stale invitations - **Data scrubbing:** Organisation-wide and per-project PII scrubbing, IP address scrubbing, sensitive field lists and crash report storage - **Projects:** Owning teams, environments, public visibility, allowed domains and SSL verification - **Client keys:** Ingestion rate limits and quota protection - **Releases:** Commit and deploy tracking, so an error traces back to a change - **Alerting:** Issue alert rules, detectors, workflows and cron monitors, including alerts that route nowhere ## Requirements - Super User role in Tidal Control - A Sentry account with access to your organisation settings - Your Sentry **organisation slug** > **warning:** **An organisation auth token will not work.** Tokens created under **Settings > Developer Settings > Organization Tokens** are scoped for CI and release uploads, and cannot read members or organisation settings. Create an internal integration token instead, as described below. ## Configuration step-by-step plan We'll create an **internal integration** in Sentry, copy its token and your organisation slug, then add the connection in Tidal Control. **Configuration steps:** 1. **Find your organisation slug** 2. **Create an internal integration token** 3. **Configure the integration in Tidal Control** ## Step 1: Find your organisation slug - Log in to [Sentry](https://sentry.io) - Open Settings > Organization > General Settings and copy the Organization Slug - You can also find it in the URL: both `acme.sentry.io` and `sentry.io/organizations/acme/` use the slug `acme` - Copy only the slug, without `https://`, `.sentry.io` or any path ## Step 2: Create an internal integration token - In Sentry, go to **Settings > Integrations > Custom Integrations** - Click Create New Integration, choose Internal Integration, then click Next - Give it a name, for example `Tidal Control` - Under Permissions, set the following entries to Read. The scope names identify the corresponding API permissions:
Permission in SentryAccessScopeCovers
OrganizationReadorg:readOrganisation settings and data scrubbing policy
MemberReadmember:readMembers, MFA status and pending invitations
ProjectReadproject:readProjects, project settings, client keys and releases
AlertsReadalerts:readAlert rules, detectors, workflows and monitors
- Leave the other permissions at No Access, Continuous Integration (CI) unchecked and webhook fields empty - Click Save Changes, then scroll to Tokens on the saved integration page - If the token list is empty, click New Token and follow the dialog to generate one - Copy the generated token from Tokens. Client ID and Client Secret are different values and cannot be used in the Auth token field ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Sentry** - Fill in the configuration: - **Name:** A descriptive name, for example `Sentry` - **Organisation slug:** The slug from step 1 - **Auth token:** The token from step 2, without `Bearer`, quotes or surrounding spaces - **API URL (self-hosted only):** Leave empty for Sentry Cloud - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Sentry`, `Sentry Production` **Organisation slug:** - The short name of your organisation, as it appears in Sentry URLs - Required **Auth token:** - The internal integration token from step 2 - Required, and stored as a secret **API URL (self-hosted only):** - Only for a self-hosted Sentry, for example `https://sentry.example.com/api/0` - Leave empty for Sentry Cloud > **warning:** **Do not point the API URL at a regional host.** Sentry Cloud splits its API between a control host (`sentry.io`) and regional hosts such as `de.sentry.io`. The control host serves every endpoint this integration uses, including for an EU-region organisation. A regional host returns a bare 404 for `/integrations/`, so the connected-integrations evidence goes silently missing while everything else keeps working. Leave the field empty unless you self-host. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Sentry under **Configured Integrations** - Sentry tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Which token type do I need?** An internal integration token, created under **Settings > Integrations > Custom Integrations**. A personal token also works. An organisation auth token does not. **Does Tidal Control read my error data?** No. The integration reads configuration only: organisation and project settings, members, keys, releases and alert rules. It does not read event payloads or stack traces. **Are my client key secrets stored?** No. The Sentry API returns a secret and a DSN secret on each client key, and the integration maps neither. Only the key's rate-limit and activity settings are kept. **Why do both alert rules and detectors appear?** They are two representations of the same alerting configuration, and a live organisation returns both. Neither set being empty is a problem. ## Common problems **Tests error with an authentication failure** - Confirm that the saved value comes from Tokens on your internal integration page, rather than Client ID, Client Secret or Organization Tokens - Paste the complete token without `Bearer`, quotes or surrounding spaces - If the token was revoked, create a new token on the internal integration page and update the connection before refreshing the tests **Member MFA results look empty or incomplete** - The token is missing the `member:read` scope. Add it in the integration's **Permissions** **Connected integrations evidence is missing** - The API URL points at a regional host such as `de.sentry.io`. Clear the field for Sentry Cloud **Cron monitor tests report nothing** - Cron monitors are gated by your Sentry plan. On a plan without them, Sentry returns no monitors ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### STACKIT URL: https://tidalcontrol.com/docs/integrations/stackit Connect your STACKIT cloud project to Tidal Control so compliance tests read its security configuration. All access is read-only, nothing is ever modified. Tidal Control's STACKIT integration monitors the security configuration of your STACKIT cloud project for compliance purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your STACKIT project. ## What this integration monitors - **Service accounts:** Identity inventory, including internal accounts - **Service account keys:** Active state, creation date, validity, and key algorithm - **Members:** Role assignments per project, for least-privilege reviews - **Projects:** Name, lifecycle state, and creation time - **Kubernetes clusters:** Kubernetes version, API server IP allowlist, allowed CIDRs, privileged container policy, and credential rotation state - **Servers:** Status, key pair, attached service accounts, and security groups - **Security groups:** Firewall rules, including direction, IP range, and port range - **Object storage buckets:** Region and object lock (WORM) configuration - **KMS keys:** State, algorithm, purpose, protection level, and scheduled deletion - **VPN gateways:** State and routing type - **Secrets Manager:** Instances, IP allowlist ACLs, and per-user read or write access ## Requirements - Super User role in Tidal Control - A STACKIT project with permission to create service accounts and service account keys - The **Reader** role on the project for the service account, at minimum ## Configuration step-by-step plan We'll create a **STACKIT service account**, give it read access to the project, generate a **service account key**, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a service account and grant it read access** 2. **Create a service account key** 3. **Configure the integration in Tidal Control** ## Step 1: Create a service account and grant it read access - Log in to the [STACKIT Portal](https://portal.stackit.cloud) - Select the **project** you want to monitor - Go to **Service Accounts** - Click to create a new service account, or select an existing one - Assign the service account the **Reader** role on the project > **info:** **Least privilege:** Grant **Reader**, and no editor or owner role. Reader covers most of what this integration reads. Individual STACKIT services can still refuse it, either because the service is not activated on the project or because it wants its own read role, which shows up as a permission error on those tests alone. See *Common problems* below. ## Step 2: Create a service account key - Open the service account from step 1 - Go to **Keys** and click **Create Key** - **Download the JSON key file**: it is only offered once The JSON file contains the key ID, the issuer email and the private key. Tidal Control needs the whole file, not just one field from it. > **warning:** **Save the JSON key file immediately.** STACKIT only offers the key for download once at creation. If you close the dialog without downloading it, you will need to create a new key. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **STACKIT** - Fill in the configuration: - **Name:** A descriptive name, e.g. `STACKIT` - **Service Account Key:** Paste the entire contents of the JSON file from step 2 - **Project ID:** The project ID from your project overview page - **Region:** The region your project's services run in, e.g. `eu01` - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `STACKIT`, `STACKIT Production` **Service Account Key:** - The complete JSON key file downloaded in step 2, pasted as-is - Tidal Control uses it to sign a token request. The private key never leaves the key vault - Keep this value secure **Project ID:** - The identifier of the STACKIT project you want to monitor - Found on the project overview page in the STACKIT Portal **Region:** - The region your project's services run in, for example `eu01` - Required, because Kubernetes, compute, object storage, Secrets Manager, and KMS are all region-scoped > **info:** **One connection per project and region.** The service account key, project ID, and region together scope a single connection. To monitor several projects (or several regions within one project), add one STACKIT integration per combination. ## Available checks The integration runs the following checks, grouped by the area they cover: **Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1-CC6.3):** - Members holding the `owner` role, for privileged access review - Service account inventory, including orphaned and internal accounts - Secrets Manager users with write access **Credential hygiene (ISO 27001 A.8.3):** - Service account keys with no expiry date - Inactive keys still present in the project - Key algorithm strength and key age, for rotation checks **Network security (ISO 27001 A.8.20, NIS2):** - Security group rules that allow ingress from `0.0.0.0/0` - Kubernetes clusters whose API server has no IP allowlist - Secrets Manager ACLs and the IP ranges they permit - VPN gateway inventory **Configuration hardening:** - Kubernetes version currency - Clusters allowing privileged containers - Clusters whose credentials have never been rotated **Data protection (ISO 27001 A.8.10):** - Object storage buckets without object lock, so logs and backups have no WORM protection - KMS key state, algorithm, and scheduled deletion ## Verification The integration is working when all of the following are true: - Settings → Integrations shows STACKIT under **Configured Integrations** - STACKIT tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control make changes in my STACKIT project?** No. The integration is read-only and only reads configuration data. **Can one connection cover several projects?** No. A service account key, project ID, and region scope one connection. Add one integration per project and region you want to monitor. **Which region should I enter?** The region your project's services run in. For most STACKIT projects this is `eu01`. Check the region shown on your resources in the STACKIT Portal. **Can Tidal Control tell me whether a service account key is still in use?** No. The STACKIT API does not expose a last-used timestamp for service account keys, so staleness cannot be detected automatically. The integration does report keys that never expire and keys that are inactive. ## Common problems **Authentication fails after saving the integration** - Confirm you pasted the **entire** JSON key file, not just the private key - Check that the key has not been deleted or deactivated in the STACKIT Portal - Confirm the service account still has the **Reader** role on the project **Tests return no data for certain resource types** - Confirm those resources exist in the project and region this connection points at - Region-scoped services such as Kubernetes, object storage, Secrets Manager, and KMS only return resources from the configured region **A test reports "The STACKIT credentials do not have the required permissions"** - One STACKIT service refused the service account, not STACKIT as a whole, which is why tests for other services keep working - In the STACKIT Portal, check that the service is activated on the project and that the service account may read that service, not only the project - Re-run the tests from the Tests section afterwards. Saving the integration again does not re-run them **Only the project list returns data** - The service account is probably missing the **Reader** role on the project - Grant Reader and refresh the tests ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Supabase URL: https://tidalcontrol.com/docs/integrations/supabase Connect Supabase to Tidal Control with a scoped token, so compliance tests can read your organisations' and projects' security settings without table data. Tidal Control's Supabase integration reads security and compliance evidence from your Supabase organisations and projects. It authenticates with a personal access token against the Supabase Management API (`https://api.supabase.com`), and covers organisation access control, end-user authentication policy, public data exposure, encryption in transit, and backup posture. ## What this integration monitors - **Organisation members:** MFA enrolment per member, and who holds the Owner or Administrator role - **API keys:** Whether the non-revocable legacy `anon` and `service_role` keys are still in use - **Storage buckets:** Buckets that serve every object over a public URL - **Edge functions:** Functions deployed without JWT verification, which are open endpoints on the internet - **Security advisor:** Supabase's own findings, such as tables in the public schema without row-level security - **Database:** SSL enforcement, IP allowlist, connection logging, and the row limit on the generated data API - **Backups:** Point-in-time recovery and the age of the most recent completed backup - **Authentication:** Password policy, MFA availability, email confirmation, refresh token rotation, access token lifetime, and captcha on sign-up - **JWT signing keys:** Whether tokens are signed with an asymmetric key rather than the legacy shared secret - **Preview branches:** Branches created with a copy of production data Tidal Control reads configuration only. It never queries table rows, saved SQL snippets, or edge function source code. ## Requirements - Super User role in Tidal Control - A Supabase account with a role on the organisation you want to assess - Permission to create access tokens under **Account → Access Tokens** > **warning:** **Treat the token as a privileged credential.** The integration needs read access to project API keys so it can report whether legacy keys are still in use. That same permission returns the secret and `service_role` keys, which grant full data access and bypass row-level security. Tidal Control discards the key material and stores only the key type and prefix, but anyone holding the token could retrieve those keys themselves. Create the token from a dedicated service account, not from a personal one. ## Choosing a token Supabase issues two kinds of personal access token. Both start with `sbp_` and both work, but they differ in what they can reach.
Token typePrefixBound to
Scoped token (recommended)sbp_fc...The organisations, projects and permissions you choose at creation
Classic tokensbp_...Everything the issuing account can do, including organisations it joins later
Prefer a scoped token. It lets you limit the integration to one organisation and to the read permissions listed below. A scoped token can only narrow what the issuing account already has, so the account's own organisation role still sets the ceiling. The weakest role that satisfies every permission is **Read-Only**, which is available on Team and Enterprise plans; on Free and Pro the weakest available role is Developer. Project API keys (`anon`, `service_role`, `publishable`, `secret`) are a different thing. They reach a project's data plane, not the Management API, and the integration cannot use them. ## Permissions for a scoped token Grant **Read** on each of the following. Nothing needs Write, and the integration does not request Database, Logs, Edge Function Secrets or SQL Snippets.
Permission (Read)Used for
Organizations, Organization SettingsOrganisation inventory and plan
Organization MembersMFA enrolment and roles per member
Projects, Project SettingsProject inventory, region and service health
AdvisorsSecurity advisor findings, including row-level security
Network Restrictions, SSL EnforcementDatabase network and transport checks
Database BackupsPoint-in-time recovery and backup freshness
Auth Config, Auth Signing KeysAuthentication policy and JWT signing keys
StoragePublic bucket check
Edge FunctionsJWT verification check
API KeysLegacy key check
Data API Config, Database ConfigRow limit and connection logging
Production BranchesPreview branch data check
A missing permission does not stop the whole run. The checks that depend on it fail with an authorisation error, and the rest continue. ## Configuration step-by-step plan We'll create a personal access token in the Supabase dashboard, then add the connection in Tidal Control. Choose a scoped token when it is available to your account. **Configuration steps:** 1. **Create a personal access token** 2. **Configure the integration in Tidal Control** ## Step 1: Create a personal access token - Sign in to the [Supabase dashboard](https://supabase.com/dashboard) with the service account - Go to **Account → Access Tokens**, or open https://supabase.com/dashboard/account/tokens directly - Click **Generate new token** and name it, for example `Tidal Control` - If permission selection is available, choose a **scoped** token, select the organisation to assess, and grant the Read permissions from the table above - If permission selection is missing, scoped tokens are not yet enabled for your account. [Request early access from Supabase](https://supabase.help), or create a classic token using the dedicated service account. A classic token has all of that account's permissions across every organisation it belongs to - Check the token's expiry and plan to rotate it before that date - **Copy the token immediately**: it is shown only once > **warning:** **The token is shown once.** If you close the dialog without copying it, revoke it and generate a new one. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Supabase** - Fill in the configuration: - **Name:** A descriptive name, for example `Supabase` - **Personal access token:** The `sbp_...` token from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Supabase`, `Supabase Production` **Personal access token:** - The scoped or classic token from step 1, starting with `sbp_` - Required, and stored as a secret - No organisation or project ID is needed. The token identifies the organisations it can reach ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Supabase under **Configured Integrations** - Supabase tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Do I need an organisation or project ID?** No. A scoped token already carries the organisations you selected, and a classic token reaches every organisation the account belongs to. **Can Tidal Control see the data in my database?** No. The integration reads the Management API, which exposes configuration. It never queries tables, saved SQL snippets or edge function source, and it never requests the Database or SQL Snippets permissions. **Why do the network restriction and point-in-time recovery tests fail on my Free-plan organisation?** Both are paid entitlements. On a Free plan the endpoints report the feature as unavailable, and the tests fail because the protection is absent, whichever the reason. The organisation plan is recorded in the evidence so a reviewer can tell an entitlement gap from a misconfiguration. **What happens to paused projects?** A paused project still appears in the inventory, but it answers few per-project endpoints and contributes no buckets, functions or advisor findings. Read absence against the project status rather than as a pass. **How do I rotate the token?** Supabase supports a custom expiry for personal access tokens. Check the expiry configured for your token and rotate it before that date to keep evidence collection running. Generate a new token, update the connection in Tidal Control, then revoke the old one. Revoking one token does not affect others. ## Common problems **"Personal access token is required"** - The field is empty, or the copied value was lost. Generate a new token **Authentication error on every test** - The token is wrong, expired, revoked or malformed. Check its expiry and replace it if it has expired. Check that it starts with `sbp_` and is a personal access token, not a project `anon` or `service_role` key **Some tests fail with an authorisation error while others pass** - The scoped token is missing a Read permission from the table above, or the account's organisation role is too weak. Add the permission, or issue the token from an account with at least the Read-Only role **A project shows no buckets, functions or advisor findings** - Either the project has none, or it is paused. Check the project status in the Supabase dashboard ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### TOPdesk URL: https://tidalcontrol.com/docs/integrations/topdesk The two-way TOPdesk integration. Compliance tests read operator access and incident handling, and you can raise TOPdesk incidents and changes from Tidal. Tidal Control's TOPdesk integration connects to your TOPdesk ITSM instance for compliance purposes. It is a **two-way** integration: - **TOPdesk → Tidal Control**: compliance tests read operator access, incident handling and change management. - **Tidal Control → TOPdesk**: from a Tidal task or issue you can raise a TOPdesk **incident** or **change**, and Tidal keeps its status in sync. This lets your first line keep working in TOPdesk while your second line keeps oversight in Tidal Control. Nothing is modified or deleted in TOPdesk. Tidal reads data and, only when you explicitly ask it to, creates a new incident or change. ## What this integration monitors - **Operators:** Login permission, email, job title, branch, department, and ITSM role flags (first line, second line, change coordinator, installer, problem manager) - **Operator groups:** Group membership per operator - **Permission groups:** Which permission groups exist in your instance - **Incidents:** Status, category, urgency, priority, response and completion dates, and major-call flag - **Change requests:** Change type, status, phase, requester, category, impact, priority, and closing date ## Requirements - Super User role in Tidal Control - A TOPdesk operator account with API access and permission to create application passwords - The **Change Management** module (optional), needed for the change management checks and for raising TOPdesk changes from Tidal ## Configuration step-by-step plan We'll set up the required permissions on a TOPdesk operator account, create an **application password** for that account, then add the connection in Tidal Control. **Configuration steps:** 1. **Set the required permissions on the operator account** 2. **Create an application password in TOPdesk** 3. **Configure the integration in Tidal Control** ## Step 1: Set the required permissions on the operator account Use a dedicated operator account for the integration rather than a personal one. Permissions in TOPdesk are assigned per permission group, so set them on the permission group the account belongs to.
PermissionAccessNeeded for
API access → REST APIReadAll API calls
API access → Use application passwordsWriteAuthenticating with an application password
Supporting Files → OperatorsReadOperators, and the operator list in the external-issue dialog
Supporting Files → Operator GroupsReadOperator groups, and the Operator group field
Supporting Files → BranchesReadThe Site field when raising an incident
Supporting Files → PersonsReadThe Requester field when raising a change
Supporting Files → Permission GroupsReadPermission groups
Call Management → First line callsCreateRaising a TOPdesk incident from Tidal (optional)
Call Management → Second line callsCreateRaising a TOPdesk incident from Tidal (optional)
> **info:** **Read-only monitoring only?** If you only want the compliance tests (TOPdesk → Tidal), leave the **Call Management** create permissions off. Everything else on this list is Read, apart from **Use application passwords**, which TOPdesk requires as Write in order to authenticate at all. Raising incidents from Tidal will then be unavailable. **Raising changes as well as incidents?** Creating a TOPdesk *change* needs create rights in the **Change Management** permission block, on the change types your instance uses. TOPdesk's own partner-integration template covers incidents only, so confirm the exact change permissions with your TOPdesk administrator. ## Step 2: Create an application password in TOPdesk An application password is a separate token for API access. Use it instead of the operator's login password. - Log in to your TOPdesk instance as the operator account from step 1 - Click your **avatar** in the top-right corner and choose **My settings** - Scroll to **Application passwords** and click **Add** - Enter a name (e.g. `Tidal Control`) and optionally an expiry date - Click **Save** - **Copy the generated password**: it is only shown once > **warning:** **Save the application password immediately.** TOPdesk only shows the password once at creation. If you close the dialog without copying it, you will need to create a new one. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **TOPdesk** - Fill in the configuration: - **Name:** A descriptive name, e.g. `TOPdesk` - **API URL:** Your TOPdesk instance URL, e.g. `https://yourcompany.topdesk.net` - **Login name:** The login name of the operator account from step 1 - **Application password:** The password from step 2 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `TOPdesk`, `TOPdesk Production` **API URL:** - The base URL of your TOPdesk instance, including `https://` - For SaaS instances this is `https://yourcompany.topdesk.net` - For self-hosted instances, use the URL you normally log in to - Do not add a path such as `/tas/api`. Tidal Control appends that itself **Login name:** - The login name of the operator account, not its email address - This must be the same account the application password was created for **Application password:** - The token generated in step 2, not the operator's login password - Keep this value secure ## Available checks The integration runs the following checks, grouped by the area they cover: **Access control (ISO 27001 A.9.2, A.9.4):** - Which operators have login access to the service desk - Which ITSM roles each operator holds, for least-privilege and segregation-of-duties reviews - Operator group and permission group membership as evidence for access reviews **Incident management (ISO 27001 A.16.1):** - Open and resolved security incidents with their category and priority - Response and completion dates as SLA evidence - Major incidents flagged for follow-up **Change management (ISO 27001 A.12.1.2):** - Change requests with their type, status, and phase as RFC lifecycle evidence - Requester and handling operator for the change audit trail ## Raising TOPdesk incidents and changes (Tidal Control → TOPdesk) From any Tidal task or issue you can raise a TOPdesk ticket, so the person doing the work stays in the tool they already use while the Tidal task keeps the compliance record. Click the **Add external issue** icon on a task or issue, choose your TOPdesk connection, then pick a **Type**. TOPdesk is the only issue tracker with two kinds of ticket, and the fields differ per kind:
TypeFields
IncidentSite (required), plus optional Category, Subcategory, Operator group, Operator and Due date
ChangeChange template and Requester, both required
Tidal fills the title and description from the Tidal item, and records itself as the caller on the incident. Once the ticket exists, its status is synced back to Tidal on the same schedule as the compliance tests, and appears in the **External issue** column of the Tasks overview. > **note:** **TOPdesk's fields are not the generic ones.** Other issue trackers ask for a project and an issue type. TOPdesk asks for a site, a category and a subcategory for incidents, or a change template and a requester for changes. See [External issues](/docs/integrations/external-issues) for the parts of the workflow that are the same everywhere: linking an existing ticket, the status column, and filtering the overview. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows TOPdesk under **Configured Integrations** - TOPdesk tests are available in the Tests section - Test refresh delivers results without authentication errors - If you granted the create permissions, the **Add external issue** icon offers TOPdesk on tasks and issues ## Frequently asked questions **Does Tidal Control make changes in TOPdesk?** It never modifies or deletes anything. It reads operator, incident and change data, and it creates a new incident or change when you explicitly raise one from a Tidal task or issue. If you do not grant the Call Management create permissions, it cannot write at all. **Can I use the operator's normal login password?** No. Use an application password. TOPdesk's REST API requires one, and it can be revoked without changing the operator's password. **Does this work with a self-hosted TOPdesk instance?** Yes. Enter the URL you normally log in to as the API URL. The account and permission requirements are the same. **Do I need the Change Management module?** Only for the change management checks. Everything else works without it. ## Common problems **Authentication fails with a 401 error** - Check that the **Login name** is the operator's login name, not its email address - Confirm the application password was copied in full and belongs to that same operator account - The password may have expired or been revoked. Create a new one and update the integration **Tests fail with a 403 error** - The operator's permission group is missing one of the permissions from step 1 - Check **API access → REST API (Read)** and **API access → Use application passwords (Write)** in particular **TOPdesk is missing from the "Add external issue" dialog** - The operator account has no create rights. Add **Call Management → First line calls (Create)**, or Second line calls, on its permission group **Raising an incident fails on the Site field** - **Site** is required for an incident, and its list comes from **Supporting Files → Branches (Read)**. Add that permission if the list is empty **Raising a change fails or offers no template** - Creating a change needs the Change Management module and create rights on it, and both **Change template** and **Requester** must be set **Change management checks return no results** - The Change Management module is probably not licensed or enabled on your instance - Confirm you can open the **Changes** module in TOPdesk yourself with the same account **No operators or permission groups are returned** - Add **Supporting Files → Operators (Read)** and **Supporting Files → Permission Groups (Read)** to the operator's permission group ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Vercel URL: https://tidalcontrol.com/docs/integrations/vercel Connect Vercel to Tidal Control so compliance tests read your deployment platform's security configuration, from team access to project settings. Read-only. Tidal Control's Vercel integration monitors your deployment platform's security configuration for compliance purposes. ## What this integration monitors - **Teams:** SAML enforcement - **Team members:** Confirmation status and provisioning origin - **Project members:** Admin privilege configuration - **Projects:** Deployment protection settings - **Environment variables:** Encryption (no plain text secrets) - **Deployments:** Production deployments from Git only - **Firewall:** Web Application Firewall status - **Domains:** Verification status and auto-renew configuration - **Certificates:** Auto-renew configuration ## Requirements - Super User role in Tidal Control - Vercel account with access to account or team settings ## Configuration step-by-step plan We'll create a **Vercel access token**, then add the connection in Tidal Control. If your Vercel account uses teams, you'll also provide the team ID to scope monitoring to a specific team. **Configuration steps:** 1. **Create an access token** 2. **Find your team ID (if applicable)** 3. **Configure the integration in Tidal Control** ## Step 1: Create an access token - Log in to your Vercel account - Click your **profile picture** in the top-right corner - Select **Account Settings** (or navigate to **Settings** from the dashboard) - Navigate to **Tokens** in the left sidebar - Click **Create** - Enter a name (e.g. `Tidal Control`) - Select a scope: choose **Full Account** or the specific team you want to monitor - Set an expiry date (optional but recommended) - Click **Create Token** - **Copy the token value**: it is only shown once > **warning:** **Save the token immediately.** Vercel only shows the full token value once at creation. If you close the dialog without copying it, you will need to create a new token. ## Step 2: Find your team ID (if applicable) If your Vercel account uses teams and you want to scope the integration to a specific team: - Navigate to the team's **Settings** in Vercel - Go to **General** - Copy the **Team ID** shown on this page (starts with `team_`) If you created the token with full account scope, you can leave the team ID blank to monitor all teams. ## Step 3: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Vercel** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Vercel` - **Access Token:** The access token from step 1 - **Team ID (optional):** The team ID from step 2, if you want to scope monitoring to a specific team - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Vercel`, `Vercel Production` **Access Token:** - Your Vercel personal access token - Created in step 1 - Keep this value secure **Team ID (optional):** - Scopes the integration to a specific Vercel team - Leave blank to monitor all teams accessible to the access token - Must start with `team_` ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Vercel under **Configured Integrations** - Vercel tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Can I use the same access token for multiple Tidal Control environments?** Yes, the same access token can be used across different Tidal Control instances. **What is the difference between using a team ID and not using one?** Without a team ID, the integration monitors all resources accessible to the access token. With a team ID, monitoring is scoped to that specific team. **Do I need a Vercel Pro or Enterprise plan?** Some features (such as SAML enforcement and advanced deployment protection) are only available on Pro or Enterprise plans. The integration will still work on the Hobby plan, but those tests may not return any results. ## Common problems **"Access Token is required"** - Make sure you entered the token value and not the token name **Tests show authentication errors after connecting** - Verify the access token is still valid. Tokens can expire or be revoked in Vercel's token settings - Check that the token scope includes the team you are trying to monitor **"VERCEL_TEAMS_SAML_ENFORCED" test fails for all teams** - SAML is an Enterprise feature in Vercel. This test will fail if your plan does not support it - If you have Enterprise, enable SAML enforcement in the team's Security settings **No environment variable tests run** - Environment variables are only checked for non-system-generated variables - Ensure your projects have manually created environment variables configured ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. ### Web Security Scanner URL: https://tidalcontrol.com/docs/integrations/web-security-scanner Add a public hostname to Tidal Control and it grades your website's security headers through the MDN Observatory. No credentials and no API key needed. Tidal Control's Web Security Scanner grades the security headers of a public website through the MDN Observatory. It is the simplest integration to set up, because it needs no credentials at all: you give it a hostname, and it reports the grade and score that the Observatory assigns. ## What this integration monitors - **MDN Observatory grade and score:** Whether the host scores above a B, based on its HTTP security headers and HTTPS configuration ## Requirements - Super User role in Tidal Control - A **publicly reachable** hostname. The Observatory scans from the internet, so an internal-only host cannot be graded ## Configuration step-by-step plan There is nothing to create in another system. You only add the hostname. **Configuration steps:** 1. **Configure the integration in Tidal Control** ## Step 1: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Web Security Scanner** - Fill in the configuration: - **Name:** A descriptive name, for example `Website` - **Host name:** The bare hostname, for example `example.com` - Click **"Create"** to save the integration > **warning:** **Enter a bare hostname, without a scheme.** Tidal Control rejects a value starting with `https`, so use `example.com` rather than `https://example.com`. Leave off any path as well. ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Website`, `Marketing site` **Host name:** - The bare hostname to scan, for example `example.com` - Required, and must not start with `https` - This is the only field. There is no credential, because the Observatory scans public information ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Web Security Scanner under **Configured Integrations** - The Web Security Scanner test is available in the Tests section - The test result shows a grade and score for your host, and links to the full Observatory report ## Frequently asked questions **Do I need an account or API key for the Observatory?** No. The scan uses public information about a public host, so there is nothing to authenticate. **Can I scan more than one site?** Yes. Add one connection per hostname, each with its own name. **Can it scan an internal application?** No. The Observatory reaches your host from the internet. A host behind a VPN or firewall cannot be graded, so use a manual control for those instead. **How do I improve the grade?** Follow the recommendations in the linked Observatory report. The usual wins are adding the standard security headers and enforcing HTTPS. ## Common problems **"Host must not start with https"** - Remove the scheme. Enter `example.com`, not `https://example.com` **"Host is required"** - The field is empty. Enter the hostname to scan **The test reports no score** - The host could not be reached from the internet. Confirm it resolves publicly and serves HTTPS ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably. --- # Issues ## Issues URL: https://tidalcontrol.com/docs/issues Everything that went wrong or could be better, in one place. Audit findings, control gaps, incidents and improvement actions, with an owner and a deadline each. ### Creating and managing issues URL: https://tidalcontrol.com/docs/issues/creating-and-managing-issues Register an issue, choose its type and priority, assign it, set a deadline, and link it to what it affects. Resolving and closing is covered in its own article. This article covers the issue record: registering one, choosing its type and priority, assigning it, setting a deadline, and linking it to what it affects. For resolving and closing issues, see [Handling and closing issues](/docs/issues/handling-and-closing-issues). ## Adding new issues An issue needs a name, a type, and a priority; the type and priority are what route it and rank it later. ### Creating an issue 1. **Go to the Issues page** via the main menu 2. **Click "Add issue"** in the top right of the overview 3. **The creation form opens** where you can fill in non-conformity information ![Creating new issue](/images/help/issues_add_issue.png) ### Filling in issue information Only the name is required; type and priority can be set now or corrected later. **Required fields:** - **Name** - Choose a clear, descriptive name for the non-conformity - For example: "Employee forgets laptop on train" or "Backup missed on multiple dates" **Optional but recommended fields:** - **Issue type** - Select the correct category from 7 available types - **Priority** - Set urgency (High, Medium, Low) - **Assign owner** - Assign responsible person - **Description** - Detailed context and background information > **tip:** **Clear naming**: Use specific, action-oriented names. "MFA not active for administrators" is better than "Login problem". ### Selecting issue type Choosing the right type helps with workflow, reporting and assignment: **Generic - For general organisational matters:** - Policy needs to be created or updated - Procedures missing for new processes - Organisational changes require adjustments - **Example:** "Implement employee screening procedure" **Audit finding - For formal audit findings:** - External auditor identifies non-conformities - Internal audit finds compliance shortcomings - Certification body sets requirements - **Example:** "ISO auditor missing management review documentation" **Control gap - For missing controls:** - GAP analysis shows required controls that are missing - New risks require additional measures - Compliance frameworks introduce new requirements - **Example:** "Access control admin accounts insufficiently restricted" **Incident - For actual security incidents:** - Phishing attacks and malware infections - Data breaches and unauthorised access - Physical security breaches - **Example:** "Phishing attack compromises employee account" **Action plan - For planned improvement projects:** - Rollout of new security measures - Training and awareness programs - Implementation of new systems - **Example:** "Q2 rollout security awareness training program" **Control deficiency - For failing existing controls:** - Implemented controls not working correctly - Technical problems with security tools - Process not effectively executed - **Example:** "Encryption fails leaving data unencrypted" **Opportunity for improvement - For optimisation:** - Efficiency improvements of working processes - Cost saving opportunities - User experience improvements - **Example:** "Speed up onboarding for faster security training" ### Determining priority Priority routes and ranks the issue, so set it based on urgency and impact rather than the default. **Assign High Priority for:** - **Compliance deadlines** within 30 days - **Critical security risks** that directly threaten - **Audit findings** that endanger certification - **Active incidents** with ongoing impact **Medium Priority for:** - **Planned improvements** with quarterly deadline - **Control gaps** without direct threat - **Action plans** with clear planning - **Normal audit findings** without urgency **Low Priority for:** - **Long-term optimisations** (> 6 months) - **Nice-to-have improvements** without compliance impact - **Opportunities** depending on other projects - **Minor administrative** adjustments ### Saving the issue 1. **Check all entered information** 2. **Click "Create"** to create the issue 3. **The new issue appears** in your overview with "Open" status ## Editing issue details Open an issue from the overview to change its fields. ### Opening issue details 1. **Click on an issue name** in the overview 2. **The details panel opens** on the right side 3. **Select the "Details" tab** for editable fields ![Editing issue details](/images/help/issues_details.png) ### Editable information Once created, an issue's description, type, priority, due date, and period can all still be changed. **Adjusting basic data:** - **Description** - Detailed background and context - **Type** - Change category if incorrectly assigned - **Priority** - Adjust urgency based on new insights - **Due Date** - Set deadline for solution - **Period** - Time period in which issue is relevant **Automatic updates:** - Changes are saved immediately - Feed tab shows historical changes - Notifications to involved persons ## Owners and responsibilities An issue has one owner who is accountable for resolving it, plus contributors who do parts of the work. ### Assigning owners The owner is the person accountable for resolving the issue. **Primary ownership:** 1. **Click in "Owners" section** on the right side 2. **Type username** and select from dropdown 3. **Multiple owners possible** for shared responsibility **Owner responsibilities:** - **Prioritisation** of issue resolution - **Resource allocation** for execution - **Progress monitoring** and escalation - **Final approval** of issue closure ### Adding contributors Contributors are the people who actually implement the fix and get notified automatically. **Involving executors:** 1. **Click "Add contributor(s)" link** 2. **Select team members** working on solution 3. **Contributors receive** automatic notifications **Contributor roles:** - **Technical implementation** of solutions - **Evidence collection** and documentation - **Testing and validation** of fixes - **Progress updates** via comments > **warning:** **Clear roles**: Ensure ownership and contributor roles are clear. Too many owners can lead to confusion about final responsibility. ## Deadlines and planning The due date drives the overdue reporting on issues, and the optional period groups them into a reporting window. ### Setting Due Date The due date is what makes an issue overdue, so base it on how urgent the underlying type genuinely is. **Determining deadline:** 1. **Click "Due Date" field** in Details tab 2. **Select realistic date** from calendar 3. **Consider complexity** and available resources **Deadline guidelines per type:** - **Incidents:** 1-7 days (depending on severity) - **Audit findings:** Before next audit (usually 3-12 months) - **Control gaps:** 30-90 days (depending on implementation) - **Action plans:** Project timeline (weeks to months) - **Opportunities:** Flexible (months to year) ### Period management (optional) The period groups an issue into a reporting window, useful for anything that spans more than one year. **Setting time period:** - **Year 2025** - Default for ongoing issues - **Custom periods** - For multi-year projects ## Issue lifecycle management An issue stays Open until it is genuinely resolved, and its links determine what it counts against. ### Status monitoring An issue stays Open while it's genuinely unresolved, and moves to Closed only once the work is actually done. **Keep Open status when:** - Active work is ongoing - Waiting for external dependencies - In review or test phase - Not yet fully resolved **Move to Closed status when:** - Problem completely resolved - Measures implemented and tested - Evidence collected and approved - Owner has validated closure ### Managing issue links Linking an issue to the assets and controls it affects is what rolls it into their status. **Linking assets:** - Which business assets are involved in this issue? - Document impact on critical systems - Determine recovery priorities **Linking controls:** - Which controls are related? - New controls being implemented - Existing controls being modified ## Bulk operations Selecting several issues at once lets you apply the same owner, priority, or status change to all of them. ### Managing multiple issues simultaneously Selecting several issues at once lets you reassign or delete them in a single action. **Available bulk operations:** - **Change assignee** - Assign new owner to group of issues - **Delete** - Remove multiple issues from system at once **Bulk workflow:** 1. **Select issues** with checkboxes on left in overview 2. **Relevant buttons appear** at top of table 3. **Choose desired action** and confirm **Not possible for bulk:** - Edit issue descriptions - Set due dates individually - Complex relationship management - Closing - Adjust Type or Priority ## Issue templates and standardisation Issues written to a consistent shape are easier to triage and hold up better in an audit. ### Consistent issue creation A template per issue type keeps the level of detail consistent across similar findings. **Template examples per type:** **Incident template:** ``` Name: [Incident type] - [Affected system/person] Description: - What happened: [Brief description] - When discovered: [Time] - Immediate actions: [First response] - Impact: [Affected systems/users] - Root cause analysis: [To be investigated] ``` **Audit finding template:** ``` Name: [Auditor finding] - [Affected control/process] Description: - Audit details: [Internal/external auditor, date] - Finding: [Specific non-conformity] - Required action: [What needs to be resolved] - Audit reference: [Finding number/section] ``` ### Quality control Before assigning an issue, check it against this list. **Review checklist:** - ☐ Issue name is specific and actionable - ☐ Correct type selected for category - ☐ Priority fits urgency and impact - ☐ Owner has capacity and expertise - ☐ Deadline is realistic and justified - ☐ Description contains sufficient context ## Best practices for issue management Issues work best when they are found deliberately rather than incidentally, communicated as they change, and measured over time. ### Proactive issue monitoring Issues surface fastest when you actively look for them, not only when someone reports a problem. **Regular sources:** - **Monthly system reviews** - Monitoring alerts and logs - **Quarterly assessments** - Control effectiveness evaluations - **Annual audits** - Formal compliance reviews - **Incident analysis** - Lessons learned sessions ### Effective communication How often you update stakeholders should scale with the issue's priority. **Issue updates protocol:** - **Weekly progress** - Brief status update for high priority - **Monthly summary** - Overview for medium priority - **Milestone reporting** - For significant progress - **Escalation triggers** - When deadline is threatened ### Continuous improvement Tracking resolution time and recurrence over time is what turns individual issues into process fixes. **Track metrics:** - **Time to resolution** - Average resolution time per type - **Recurrence rate** - How often similar issues return - **Owner effectiveness** - Which assignees resolve fastest - **Root cause patterns** - Identify structural problems > **tip:** **Preventive approach**: Use issue patterns to develop proactive measures. If many incidents of the same type occur, consider preventive controls. ## Next steps Now that you can create and manage issues: - **Systematically register** all non-conformities you encounter - **Monitor deadlines** and progress via dashboard - **Collaborate** on solutions via comments and evidence - **Analyse trends** for preventive improvements ### Getting started with Issues URL: https://tidalcontrol.com/docs/issues/getting-started What issues are in Tidal Control and how to read the Issues page. What the statuses mean and how the issue types differ, from audit findings to control gaps. The Issues page is where everything that went wrong or could be better is recorded: audit findings, control gaps, incidents, and improvement actions. This article covers reading that overview, the seven issue types, and how priority is meant to be assigned. ## Navigating the Issues page The overview lists every issue with its status, priority, and the control or asset it affects. ### Opening the Issues page Go to the Issues section via the main menu. You'll arrive at an overview page where all non-conformities from your organisation are displayed. ![Issues overview](/images/help/issues_overview.png) ### What you see in the overview The issues overview shows important information per non-conformity: - **Status** - Orange dot for Open issues, green for Closed - **Period** - Time period in which issue is registered (e.g. "Year 2025") - **Name** - Descriptive title of the non-conformity - **Due Date** - Deadline for solution (if set) - **Priority** - Urgency level (High, Medium, Low) - **Issue Type** - Category of the non-conformity (7 different types) - **Assets** - Number of linked business assets - **Controls** - Number of linked controls - **Assignee** - Assigned person for solution ### Understanding status An issue's status runs from unresolved and active to closed once the work is genuinely done. **Open issues (orange dot):** - Unresolved non-conformities - Actively being worked on or not yet picked up - Visible in daily work lists - Counted in compliance calculations **Closed issues (gray):** - Resolved and approved non-conformities - Visible via "Closed" tab for historical overview - No longer active in workflows - Available for audit and reporting ## Understanding issue types Tidal distinguishes 7 different categories of non-conformities: ### 1. Generic - Default Type **When to use:** General problems and administrative matters **Example:** "Employee screening procedure must be implemented" **Characteristics:** Broad organisational improvement points ### 2. Audit finding **When to use:** Problems identified during internal or external audits **Example:** "External auditor identifies missing document for required policy X" **Characteristics:** Formal findings that threaten compliance ### 3. Control gap **When to use:** Missing or insufficient controls **Example:** "Access control system doesn't fully restrict admin rights" **Characteristics:** Identified during GAP analysis, requires new controls ### 4. Incident **When to use:** Security incidents and actual breaches **Example:** "Phishing attack compromises employee account" **Characteristics:** Reactive handling of actual events ### 5. Action plan **When to use:** Structured improvement projects and implementations **Example:** "Employee training program rollout in Q2 for security awareness" **Characteristics:** Proactive planning of future activities ### 6. Control deficiency **When to use:** Existing controls that don't function effectively **Example:** "Encryption process has errors leaving data unencrypted" **Characteristics:** Implemented measures that fail in practice ### 7. Opportunity for improvement **When to use:** Functional processes that can be optimised **Example:** "Improve onboarding documentation for faster security training" **Characteristics:** Preventive optimisation for better efficiency > **info:** **Type selection**: Choose the most specific type for your issue. This helps with filtering, reporting and assigning to the right experts in your organisation. ## Interpreting priorities Priority is set by hand, not derived, so it is only useful if everyone applies the same rule for what counts as High. ### Priority levels High priority means immediate, daily attention; low priority is fine to leave for later. **High - Red:** - Critical security risks - Compliance threats - Immediate action required - Daily monitoring needed **Medium - Orange:** - Important improvement points - Planned implementation within weeks - Regular follow-up sufficient - Standard priority for most issues **Low - Green:** - Nice-to-have improvements - Long-term planning - Implementation when time available - Low impact on compliance ### Priority assignment tips Base priority on real deadlines and active risk, not on how loud someone is about it. **Assign High priority for:** - Audit findings that threaten certification - Security incidents with ongoing risk - Compliance deadlines within 30 days - Issues that disrupt business operations **Medium priority for:** - Planned improvement projects - Control gaps without direct threat - Action plans with quarterly deadlines - Opportunities with measurable benefit ## Searching and filtering Search matches issue names, and the filters narrow by status, type, priority, owner, and the control or asset involved. ### Search functionality Nothing filters until you press Enter; there is no live-as-you-type result. **Using the search bar:** 1. **Click in the search bar** at the top of the overview 2. **Type issue names** or keywords (e.g. "phishing", "backup", "training") 3. **Press 'Enter'** and your search results are displayed ### Filter options Use the filter dropdown menus to find specific issues: **Open vs Closed:** - **Open (6)** - Active issues requiring attention - **Closed (0)** - Handled issues for historical overview **Filter by Controls:** - Show issues linked to specific controls - Useful for impact analysis of control problems **Filter by Assets:** - Show issues related to specific business assets - Useful for asset-based problem analysis **Filter by Assignee:** - Show issues assigned to specific people - Perfect for personal work lists **Filter by Priority:** - **High** - Critical issues requiring immediate attention - **Medium** - Standard priority issues - **Low** - Low priority improvement points **Filter by Issue Type:** - Select specific categories (Generic, Audit finding, etc.) - Combine with other filters for targeted views > **info:** It's not possible to create your own filters because attributes are missing for Issues. ### Combining multiple filters You can use different filters simultaneously for very specific results: - **Example**: Filter on "Audit finding" + "High" priority + "Open" status to see critical audit findings - **Reset filters**: Click away individual filters or refresh the page ## What counts as an issue Issues in Tidal Control are non-conformities, findings and improvement points that can impact your Information Security Management System (ISMS). The system helps you systematically register, assign and resolve these by: - **Recording non-conformities** - Document non-conformities and compliance problems - **Registering incidents** - Track security incidents and breaches - **Planning improvement actions** - Manage opportunities and action plans - **Monitoring progress** - Track status and deadlines of solutions - **Facilitating collaboration** - Team communication and evidence collection By registering and monitoring issues in Tidal, you gain insight into compliance status, outstanding problems and the effectiveness of your improvement actions. > **tip:** Issues can be linked to controls and assets. This creates a complete picture of which problems apply where and how they affect your compliance. Read more about this in [Creating and managing issues](/docs/issues/creating-and-managing-issues) ## Next steps Now that you know how to find and interpret issues, you can: - **Register new non-conformities** you encounter - **Assign issues** to the right team members - **Collaborate** on solutions via comments - **Monitor progress** of outstanding problems > **note:** **No issues visible?** This may mean that no non-conformities have been registered yet in your Tidal environment. Start by adding your first issue via the "Add issue" button. ### Handling and closing issues URL: https://tidalcontrol.com/docs/issues/handling-and-closing-issues Resolving an issue means working in its conversation. Discuss it with comments and mentions, attach the evidence that shows it is fixed, and then close it. Resolving an issue in Tidal means working in its conversation: discussing it, attaching the evidence that shows it is fixed, and then closing it. A closed issue can be reviewed to record that it was closed properly. ## Working on issues An issue opens in a panel built around its conversation, which doubles as its audit trail. > **tip:** **Working on it somewhere else?** If the fix belongs in your own issue tracker, use the **Add external issue** icon to raise a Jira, Azure DevOps or TOPdesk item straight from this issue. Its status syncs back here, so the person doing the work stays in their tool while the issue keeps the compliance record. See [External issues](/docs/integrations/external-issues). ### Opening an issue 1. **Click on an issue name** in the overview 2. **The details panel opens** on the right side of your screen 3. **Select the "Conversation" tab** for collaboration 4. **The panel shows** all communication and progress ![Issue conversation panel](/images/help/issues_conversation.png) ### Understanding the conversation interface The issue panel is built around its own conversation: the description at the top, then a running thread of updates. **What you see in the conversation:** - **Description section** - Description of the issue - **Comments thread** - Chronological communication between team members - **Comment field** - Here you can enter your own comment, but also upload evidence and format text with markdown > **tip:** **A good Issue description contains the following components:** - **What happened?** - Factual description of the non-conformity - **Immediate actions taken** - First response and damage control - **Root cause analysis** - Investigation into underlying causes - **Action plan to eliminate root cause** - Planned solutions and prevention ## Collaborating via comments Comments are the record of how the issue was resolved, and @mentions pull the right people in. ### Adding comments A comment is how you log progress, and Markdown lets you structure a longer update. **Writing new comment:** 1. **Scroll down** to "Add your comment..." section 2. **Type your message** in the text field 3. **Use Markdown** for structure (headings, lists, links) 4. **Click "Submit"** to post comment **Comment best practices:** - **Specific updates** - What did you do, what was the result? - **Actionable information** - Mention concrete next steps - **Timeline context** - When do you expect results? - **Evidence references** - Refer to uploaded files ### Using @Mentions An @mention notifies someone directly, so use it when you need their attention rather than just logging progress. **Notifying people:** 1. **Type @** followed by name or initials 2. **Select person** from dropdown list 3. **Person receives** automatic notification 4. **Use for** escalations, questions, or updates **Effective @mentions:** ``` @john Can you check the firewall logs for period January 10-12? @maria The new procedure is ready for review. See attached document. @team We have identified the root cause. See update below. ``` ## Collecting evidence Evidence is attached through a comment, and what counts as good evidence depends on the issue type. ### Uploading files Drop a file into the comment field and it attaches itself to that comment automatically. **Adding documents:** 1. **Scroll to comment section** 2. **Click "Drop, or click to add files"** or drag files to the comment field 3. **Files are uploaded** and linked to comment 4. **Link appears automatically** in your comment ### What does good evidence look like? An incident needs a timeline and recovery proof; an audit finding needs the corrective action itself, not just a description of the gap. **For Incidents:** - **Timeline documentation** - When what was discovered and undertaken - **Impact assessment** - Which systems/users affected - **Response actions** - Concrete steps taken - **Recovery evidence** - Proof that systems are restored **For Audit findings:** - **Original finding** - Exact auditor feedback - **Gap analysis** - What is missing or failing - **Action plan** - How you will solve it - **Completion evidence** - Proof that issue is resolved **For Control gaps:** - **Current status** - How it works now - **Expected status** - What needs to be implemented - **Implementation evidence** - New configurations/procedures - **Test results** - Validation that control works ## Completing, reviewing, and reopening Close an issue once it is genuinely resolved. A review records that it was closed properly, and reopening is available if it was not. ### Closing issues **Direct closing** 1. **Select the three-dots menu** in the top right of the Issue details panel 2. **Select "Close issue"** from the dropdown menu **Closing with a comment** 1. **Write the final comment** as a new comment 2. **Select "Submit and Close"** instead of just "Submit" > **tip:** After closing an Issue, it is only visible under 'Closed' Issues, and no longer in other overviews. Therefore, make sure an Issue is completely resolved before closing it or create a new Issue for tracking any remaining (long-term) actions. ### Reviewing issues Through Issue Reviews you can record that the Issue has been completed in the right way. A 'Reviewed' label is added to the Issue. **Viewing a closed Issue** 1. **Navigate to 'Closed' issues** from the Issues overview page 2. **Select the issue** you want to review **Direct reviewing** 1. **Select the three-dots menu** in the top right of the Issue details panel 2. **Select "Review"** from the dropdown menu 3. **The "Reviewed" label appears immediately** in the detail panel **Reviewing with a comment** 1. **Write the review comment** as a new comment 2. a. **Select "Submit and Review"** instead of just "Submit" or; 2. b. **Select "Submit and Reopen"** to reopen the task (in case the review shows that additional work is needed) > **tip:** After reviewing a task, the "Review" and "Submit and Review" buttons change to "Undo review" and "Submit and Undo Review" respectively. This allows the review to be undone. ### Reopening issues **Direct reopening** 1. **Select the three-dots menu** in the top right of the Issue details panel 2. **Select "Reopen"** from the dropdown menu **Reopening with a comment** 1. **Write the reason for reopening** as a new comment 2. **Select "Submit and Reopen"** instead of just "Submit" ## Next steps After learning issue handling, you can: - **Systematically resolve issues** - Work on solutions in a structured way - **Ensure adequate documentation** - Correctly close issues with adequate evidence - **Team collaboration** - Effectively collaborate via the conversation tab - **Support continuous improvement** - Apply lessons learned to future issues For general problems and questions, see [Troubleshooting & FAQ](/docs/issues/troubleshooting-and-faq). > **tip:** **Close tasks timely**: Close issues as soon as they are actually resolved. Postponing this leads to administrative overhead and loss of context information. ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/issues/troubleshooting-and-faq Most issue questions are about classification and follow-up. Which type to pick, how to set priority, and what to do when an issue stalls or keeps reopening. Most issue questions are about classification and follow-up: which type to pick, how to set priority, and what to do when an issue stalls or keeps being reopened. ## Frequently asked questions ### Which issue type should I choose? Generic covers planned, administrative work; the other six types are for things that went wrong or need a formal response. **Choose based on origin and urgency:** **Generic - For general matters:** - Creating new procedures - Updating policies - Organisational changes - **Test:** Is this something you would execute as planned? **Incident - For acute problems:** - Security breaches - System outages - Data breaches - **Test:** Does this need to be resolved today? **Audit finding - For external findings:** - Auditor identifies deficiencies - Certification body demands action - Compliance review findings - **Test:** Does this come from an external party? **Control gap - For missing security:** - Required measures are missing - GAP analysis shows deficiencies - New risks require action - **Test:** Are we missing important protection? > **tip:** **When in doubt choose Generic**: If no specific type fits, use Generic. You can always adjust the type later in the Details tab. ### How do I determine the right priority? Base priority on how close the deadline is and how much damage is already happening, not on how it feels. **High priority for:** - **Compliance deadlines** within 30 days - **Active security risks** causing damage now - **Audit findings** threatening certification - **System outages** hindering business operations **Medium priority for:** - **Planned improvements** with quarterly deadline - **Preventive measures** without direct threat - **Normal audit findings** without urgency - **Organisational changes** with clear planning **Low priority for:** - **Optimisations** without compliance impact - **Long-term projects** (> 6 months) - **Nice-to-have improvements** that can wait - **Documentation updates** without deadline **Adjusting priority:** - Change in Details tab when situation changes - Higher priority as deadlines approach - Lower priority when urgency disappears ### How do I collaborate on an issue when my team doesn't respond? An @mention with a concrete deadline gets a response far more often than a comment alone; escalate to the owner if it still doesn't. **Activating team members:** - **Use @mentions** - @name in comments for direct notification - **Set deadlines** - Concrete date for response or action - **Escalate to owner** - If contributors don't respond - **Schedule meeting** - For complex topics face-to-face **Effective collaboration:** - **Clear questions** - What exactly do you expect from whom? - **Communicate timeline** - When do you need an answer? - **Provide context** - Why is their input important? - **Offer alternatives** - What happens if they don't respond? **Escalation steps:** 1. **Second @mention** after 48 hours no response 2. **Direct contact** - Phone or personal conversation 3. **Involve manager** - For structurally non-responsive 4. **Change owner** - If contributor consistently unavailable ## Common problems ### Issue keeps getting reopened by owner This is almost always an incomplete fix or missing evidence, not a communication problem. **Possible causes:** - **Solution is incomplete** - Problem manifests again - **Evidence missing** - Owner cannot verify solution - **Miscommunication** - Expectations about solution differ - **Scope expansion** - New requirements are added **Solutions:** 1. **Talk to owner** - What exactly is missing for closure? 2. **Collect more evidence** - Screenshots, tests, documentation 3. **Test more thoroughly** - Check if solution really works 4. **Document better** - Explain what you did and why **Prevention for next time:** - Ask owner for closure criteria upfront - Test solution together with owner - Document every step of implementation - Plan follow-up meeting after closure ### Missing deadlines and issue overruns Most overruns come down to underestimating complexity or scope creep during the work, not the original deadline being unreasonable. **Causes of delay:** - **Complexity underestimation** - Solution proved more difficult - **Resource conflicts** - Team has other priorities - **External dependencies** - Waiting for suppliers or approvals - **Scope creep** - Issue grows during execution **Take immediate action:** 1. **Update deadline** - Set realistic new date 2. **Communicate delay** - Inform owner and stakeholders 3. **Plan recovery** - What can be accelerated? 4. **Escalate if needed** - Request management support **Prevention measures:** - **Plan buffer time** - 20% extra time for unexpected problems - **Weekly check-ins** - Early detection of problems - **Dependency mapping** - Identify external dependencies - **Realistic scoping** - Split large issues into smaller parts ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Useful information for support:** Note which browser you're using, exact error messages, screenshots of the problem, and which steps you've already tried. This significantly speeds up the solution. --- # Vendors ## Vendors URL: https://tidalcontrol.com/docs/vendors The third parties you depend on, each with an assessment, a calculated risk rating and the documents that back it up, kept current by periodic re-assessment. ### Creating and managing vendors URL: https://tidalcontrol.com/docs/vendors/creating-and-managing-vendors A vendor record is built in a fixed order. Create it, complete the assessment questionnaire that produces its risk rating, then attach the supporting documents. A vendor record is built in a fixed order: create it, complete its assessment questionnaire, which produces a risk rating automatically, attach the supporting documents, and then approve it. It stays a Draft until you do. ## Creating a new vendor A vendor starts as a Draft and stays there until its assessment is complete. ### Vendor addition process 1. **Click "Add vendor"** top right in Vendors overview 2. **"Create a new Vendor" dialogue opens** 3. **Search for a vendor or add** - Type vendor name 4. **Assign owner** - Select responsible person (optional) 5. **Description** - Add description (optional, markdown supported) 6. **Click "Create"** to create vendor ![Create new vendor dialog](/images/help/vendors_add.png) **Initial vendor setup:** - **Status:** Automatically "Draft" - **Assessment:** Empty, must be completed - **Rating:** Determined after assessment completion - **Owner:** Assigned person or to be assigned later ## Completing vendor assessment The assessment determines risk classification and compliance requirements for the vendor. ### Completing assessment questionnaire **Go to Assessment tab** of vendor detail panel and answer all questions: ![Vendor Assessment Tab](/images/help/vendors_assessment_tab.png) **Data Access Level:** - **No access** - No access to systems or data - **Limited access** - Limited access to non-sensitive data - **Full access to sensitive/regulated data** - PII, financial, health data **Data Processing Type:** - **No data processing** - Physical services only - **Basic business data** - Non-sensitive operational data - **Sensitive personal data** - Names, addresses, contact details - **Regulated data** - Financial, health, government data **Business Criticality:** - **Low impact** - Minimal business disruption if unavailable - **Moderate impact** - Some operational impact - **Highly important** - Significant business impact from disruption - **Business critical** - Core operations dependent on service **Regulatory Jurisdictions (optional):** - Select relevant jurisdictions where vendor operates - For example: EU/EEA, US, Asia-Pacific - Influences compliance requirements **Vendor Scope (optional):** - **Limited scope** - Specific project or service - **Department level** - Service for one department - **Organisation wide** - Service for entire organisation ### Automatic risk rating determination After assessment completion, Tidal automatically calculates the risk rating: - **High:** Critical business services, sensitive data and/or legal scope - **Medium:** Moderate impact, limited data access and/or standard compliance - **Low:** Minimal impact, no data processing and/or low-risk services ## Configuring vendor details The Details tab holds the vendor's own information, separate from its assessment answers. ### Completing Details tab Nothing entered here affects the risk rating; that comes from the assessment itself. **Basic vendor information:** - **Description:** Description of vendor services - **Website:** Official vendor website URL - **Vendor contact:** Primary contact person on vendor side **Compliance and security information:** - **Security page:** Link to vendor security documentation - **Privacy policy:** URL to vendor privacy policy - **Jurisdiction:** Legal jurisdiction of vendor (e.g. UK/EU) **Internal management:** - **Owners:** Add internal owners of vendor relationship ![Vendor details configuration](/images/help/vendors_details_tab.png) ## Document management Vendor documents are the evidence behind the assessment: certifications, reports, and agreements. ### Document upload process 1. **Go to Documents tab** in vendor detail panel 2. **Click "Upload Document"** 3. **Document Type** manually select 4. **Select document** from computer ### Document types Which documents you need depends on the vendor's risk level, but a privacy policy and security assurance cover most cases. **Types of compliance documents:** - **Privacy Policy** - Vendor's privacy policy and personal data handling - **Security Assurance** - Security certifications and reports (e.g. ISO 27001, SOC 2) - **Data Processing Agreement** - GDPR/privacy compliant processor agreement - **Vendor Contract** - Primary contract with vendor **Document tracking:** - **Upload Date** - When document was added - **Uploaded By** - Who uploaded the document - **Document Type** - Categorisation for compliance ![Document management](/images/help/vendors_documents_tab.png) ## Vendor approval workflow Approving a vendor is a deliberate step after the assessment, and what you should require before approving depends on the risk rating. ### Draft to Approved process A vendor is ready to approve once its assessment, rating, and required documents are all in place. **Recommended approval requirements:** 1. **Assessment completed** - All mandatory questions answered 2. **Risk rating determined** - Classification assigned 3. **Required documents** uploaded per risk level 4. **Owner assigned** - Responsible person assigned **Approving a vendor:** 1. **Go to vendor** actions menu (three dots) 2. **Select "Approve Vendor"** 3. **Status changes to "Approved"** and "Approved" date is automatically set ![Vendor approval options](/images/help/vendors_approve.png) ### Recommended approval criteria per risk level What you should require before approving scales with the risk rating: more evidence and more frequent reassessment for high-risk vendors. **High risk vendors:** - **Risk assessment:** All questions answered and deemed acceptable - **Documents** - All documents uploaded and reviewed - **Quarterly or bi-annual** reassessment **Medium risk vendors:** - **Risk assessment:** Mandatory questions answered and deemed acceptable - **Documents** - At least contract and certification uploaded and reviewed - **Annual** reassessment **Low risk vendors:** - **Risk assessment:** Mandatory questions answered and deemed acceptable - **Documents** - At least contract uploaded and reviewed - **Annual or triennial** reassessment ### Managing multiple vendors simultaneously Selecting several vendors at once lets you reassign, approve, archive, or delete them in a single action. **Available bulk operations:** - **Change assignee** - Assign new owner to group of vendors - **Archive** - Archive multiple vendors at once - **Approve** - Approve multiple vendors at once - **Delete** - Remove multiple vendors from system at once **Bulk workflow:** 1. **Select vendors** with checkboxes on left in overview 2. **Relevant buttons appear** at top of table 3. **Choose desired action** and confirm ## Next steps Now you can create and manage vendors: - **Start with critical vendors** for immediate risk assessment - **Develop document templates** for efficient and consistent application of compliance requirements - **Plan periodic review cycles** for vendor portfolio management - **Train vendor owners** in assessment and approval procedures ### Getting started with Vendors URL: https://tidalcontrol.com/docs/vendors/getting-started The Vendors page tracks the third parties you depend on. How to read the table, recognise assessment statuses, and how a vendor's risk rating is determined. The Vendors page tracks the third parties you depend on, each with an assessment, a calculated risk rating, and the documents that back it up. This article covers reading that overview: the statuses, how the rating is arrived at, and the tabs on a vendor. ## Navigating the Vendors overview page The Vendors page shows all vendors with their assessment status, documentation and risk ratings in a clear table. ![Vendors overview](/images/help/vendors_overview.png) **What you see in the overview:** - **Vendors table** - All vendors with status information - **Filtering options** - Open vs Archived, Rating, Assignee, Status - **Search functionality** - Quickly find specific vendors - **Add vendor button** - Add new vendors - **Vendor actions** - Management options per vendor ### Understanding the vendors table Each row shows a vendor's name, its documents, its risk rating, and how far its assessment has got. **Column information:** - **Name** - Vendor name and identification - **Documents** - Number of uploaded compliance documents (📄 4) - **Rating** - Risk classification (High, Medium, Low) - **Assessment** - Assessment status (Draft, Approved) - **Approved** - Approval date for compliance tracking - **Assignee** - Responsible person for vendor management **Example vendor information:** ``` Microsoft | 📄 4 | Medium | Approved | 20 July 2025 | DA GitHub | - | High | Approved | 20 July 2025 | DA Amazon | - | High | Draft | - | DA ``` ### Filtering and searching Filter between open and archived vendors, or narrow the list to a specific risk rating. **Open vs Archived filtering:** - **Open (5)** - Active vendors in use - **Archived (0)** - Inactive vendor relationships - **Switch between tabs** for different vendor sets **Rating filter:** - **High** - Critical vendors with high business impact - **Medium** - Standard business services vendors - **Low** - Minimal risk vendors **Status and Assignee filters:** - **Assessment status** - Filter on Draft vs Approved - **Assignee** - Filter per responsible person - **Combine filters** for specific vendor sets ## Recognising vendor statuses A high-risk vendor can be Draft, and a low-risk one can be Approved; the two say different things. ### Assessment status indicators A vendor's status tracks how far its assessment has got, not how risky it is. **Draft:** - **New vendor** in assessment phase - **Assessment not completed** - Questions still to answer - **Documentation possibly missing** - **Not yet approved** for use **Approved:** - **Assessment completed** and reviewed - **Compliance documentation** validated - **Approval date** recorded - **Ready for use** within organisation **When status changes:** - **Draft → Approved** after successful assessment and document review - **Approved → Archived** when ending vendor relationship - **Status tracking** for compliance audit trails ## Understanding vendor ratings The risk rating is calculated from the assessment answers rather than chosen by hand. ### Risk classification system Rating is calculated from what the vendor can access and how critical they are to your business. **High Risk:** - **Critical business services** - Direct impact on operations - **Sensitive data processing** - PII, financial, health data - **Legal scope** - GDPR, SOX, healthcare compliance - **System access** - Direct access to critical systems **Medium Risk:** - **Standard business services** - Normal operational support - **Limited data access** - Non-sensitive business data - **Minimal system access** - Controlled access levels - **Standard compliance** requirements **Low Risk:** - **Minimal business impact** - Non-critical services - **No data processing** - Physical services, basic tools - **No system access** - Standalone services - **Basic compliance** requirements ### Risk rating determination Four factors feed the automatic rating: data access, business criticality, jurisdiction, and scope. **Factors influencing rating:** - **Data Access Level** - What data does vendor have access to - **Business Criticality** - Impact on core business processes - **Regulatory Jurisdiction** - Compliance complexity - **Service Scope** - Extent of vendor services ## Vendor detail panel navigation Each vendor has an extensive detail panel with various tabs for complete information management. ### Assessment tab ![Vendor Assessment Tab](/images/help/vendors_assessment_tab.png) **Risk assessment questionnaire with specific questions:** - **Data Access Level** - "What level of access does the vendor have to our systems and data?" - **Data Processing Type** - "What type of data will the vendor process, store, or transmit on our behalf?" - **Business Criticality** - "How critical is this vendor's service to our core business operations?" - **Regulatory Jurisdictions** - "In which regulatory jurisdictions does the vendor operate?" - **Vendor Scope** - "What is the scope and scale of the vendor relationship?" **Completing assessment:** - **Dropdown selections** for standardised answers - **Mandatory vs Optional** question marking - **Rating calculation** automatic based on answers ### Details tab ![Vendor Details Tab](/images/help/vendors_details_tab.png) **Vendor information management:** - **Description** - Description of vendor services - **Website** - Official vendor website - **Vendor contact** - Contact information for primary contact on vendor side - **Security page** - Links to security documentation - **Privacy policy** - Vendor privacy and data protection - **Jurisdiction** - Legal and compliance jurisdiction - **Owners** - Internal owners of vendor relationship ### Documents tab ![Vendor Documents Tab](/images/help/vendors_documents_tab.png) **Compliance documentation management:** - **Document upload** - "Upload Document" functionality - **Document types** - Privacy Policy, Security Assurance, Data Processing Agreement, Vendor Contract - **Upload tracking** - Upload Date and Uploaded By information - **Document access** - Who can view and manage documents ### Feed tab The Feed tab is the audit trail: every assessment, document, status, and ownership change on the vendor. **Activities and updates tracking:** - **Assessment changes** - Changes in risk assessment - **Document updates** - Upload and modification history - **Status changes** - Draft to Approved transitions - **Owner changes** - Ownership changes ## Vendor management workflows Vendor management is a rhythm rather than a one-off: a light daily check and a fuller periodic review. ### Daily vendor monitoring A quick daily check catches new drafts, expiring documents, and vendors stuck without an owner. **Routine checks:** - **New Draft vendors** - Which assessments need completing - **Document expiration** - Compliance documents needing updates - **Owner assignments** - Vendors without assigned owners - **Approval backlogs** - Vendors awaiting approval ### Periodic vendor reviews On a monthly or quarterly rhythm, revisit whether assessments, documentation, and ratings still hold up. **Monthly/quarterly activities:** - **Update assessments** - Changes in vendor services - **Upload new documentation** - New compliance documentation - **Review risk ratings** - Still accurate classification - **Validate ownership** - Correct owners still active ## Vendor management versus ad-hoc evaluations Vendor Management in Tidal Control enables you to **systematically assess vendor risks** and monitor compliance via structured workflows and documentation. **Core functionalities:** - **Structured risk assessments** - Questionnaires for vendor evaluation - **Document management** - Centrally manage compliance documentation - **Approval workflows** - From draft to approved vendor status - **Risk classification** - High, Medium, Low risk categorisation - **Ownership tracking** - Who is responsible for which vendor ### Vendor management vs ad-hoc vendor evaluations Full vendor management is for ongoing, recurring relationships; a quick ad-hoc check is enough for a one-off. **Vendor management is ideal for:** - Systematic third-party risk assessment - Compliance documentation management - Standardised vendor onboarding - Periodic vendor reviews and updates **Ad-hoc evaluations remain necessary for:** - One-off project vendors - Informal vendor screening - Quick impact assessments ## Next steps Now you know the Vendor Management interface: - **Inventory current vendors** needing assessment - **Identify risk classification** criteria for your organisation - **Plan document collection** for compliance requirements - **Develop approval workflows** for efficient vendor onboarding ### Vendor questionnaires URL: https://tidalcontrol.com/docs/vendors/questionnaires Create tailored vendor questionnaires, collect answers and supporting evidence, and complete assessments for your vendors with a clear record for review. Vendor questionnaires help you assess and manage the security posture of your vendors with questions tailored to your organisation. The built-in Vendor risk assessment includes five fixed questions. You can add your own questions to it or create separate questionnaires for different types of vendor. Collect answers and supporting evidence, then review the completed assessment before approving a vendor. This article explains how to build a questionnaire, start it for a vendor and finish the assessment. ## Getting started A questionnaire is a named set of questions for assessing a vendor. You can get started in two ways: - **Use Vendor risk assessment**, the existing questionnaire used by the standard vendor assessment. It contains the five standard questions. - **Add a questionnaire** to create a new set of questions for a particular type of vendor. All questionnaires in your organisation are listed here. Use the search field to find a questionnaire by name. ![Vendor questionnaires overview](/images/help/vendors_questionnaires_overview.png) Only Super users can use **Add questionnaire** or delete a questionnaire. Adding one creates an empty questionnaire that you can fill with questions for a particular type of vendor. ![Add a questionnaire dialog](/images/help/vendors_questionnaires_add.png) ## Writing questions Open a questionnaire to see its questions in the order they will be answered. ![Questionnaire detail with its questions](/images/help/vendors_questionnaires_detail.png) Select **Add question**, enter the question, choose a type and save it. ![Adding a question to a questionnaire](/images/help/vendors_questionnaires_question_editor.png) Six types are available: - **Text** for a free-form written answer - **Yes / No** for a straight declaration - **Date** for a certification expiry or an audit date - **Number** for a count or a duration - **Single choice** for a fixed set of answers you define, with 2 to 20 options - **Document** for evidence, which is uploaded and filed in your documents The built-in **Vendor risk assessment** contains the five standard questions. You can reorder them, but their wording and type are fixed. Only questions you add can be edited or deleted. ## Starting a questionnaire for a vendor Once you customise a questionnaire, every vendor has a **Questionnaires** tab next to Assessment, Details, Documents and Feed. ![Questionnaires tab on a vendor](/images/help/vendors_questionnaires_vendor_tab.png) If your organisation has one questionnaire, its questions appear directly on the vendor's **Questionnaires** tab. Answers save automatically, and **Finish questionnaire** completes it. If your organisation has more than one questionnaire, the tab lists those already started for the vendor. Select **Start questionnaire** to choose one and create an assessment. If the built-in questionnaire has not been started yet, select its **Start** button directly. Starting a questionnaire creates a copy for that vendor. The copy keeps the questions, wording, types and options as they were when you started it, even if the original questionnaire changes later. ## Answering and finishing Open a questionnaire to answer its questions. Add a comment when an answer needs context. ![Filling in a vendor questionnaire](/images/help/vendors_questionnaires_fill.png) **Save** keeps the questionnaire as a draft. **Finish** records who completed it and when, then locks it. Finished questionnaires cannot be edited. To correct an answer, start a new questionnaire for the vendor. A questionnaire can have three statuses: - **Not started**, available but not opened - **Draft**, opened and still editable - **Finished**, locked, with completion details ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/vendors/troubleshooting-and-faq Answers to common questions about vendor assessments, risk classifications, approvals and questionnaires, including ratings, evidence and review steps. This page answers common questions about vendor assessments, risk classifications and questionnaires. ## Frequently asked questions ### How do I determine the correct risk classification for a vendor? With the standard vendor assessment, **risk classification is automatically calculated** based on assessment answers: **High Risk indicators:** - Full access to sensitive/regulated data - Business-critical services - Regulated data processing (financial, health, personal data) - Organisation-wide scope **Medium Risk indicators:** - Limited data access - Moderate business impact - Basic business data processing - Department level services **Low Risk indicators:** - No data access - Minimal business impact - Physical services only - Limited project scope > **tip:** **Manual adjustment:** Correct the classification manually if the automatic classification doesn't fit the business context. ### Does finishing a questionnaire approve a vendor? No. Finishing records the answers and evidence for the vendor, but approval still happens through **Approve assessment** on the vendor's rating. A finished questionnaire gives reviewers the evidence behind that decision. If a vendor is approved without a finished questionnaire, the assessment records that none was available at the time. ### How is the vendor's risk rating set when I use questionnaires? When your own questionnaires are in use, you choose the vendor's risk rating. It is not calculated from the five built-in answers. ## Common problems ### Vendor risk classification is not being saved Complete all mandatory questions first ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. ### Vendor assessments URL: https://tidalcontrol.com/docs/vendors/vendor-assessments Assess each vendor's risk and keep that assessment current as the relationship evolves. Completing one, approving it, re-assessing periodically, and history. Assess each vendor's risk, and keep that assessment current as the relationship evolves. This article covers completing an assessment, re-assessing periodically, and the history Tidal keeps for each vendor. ## How vendor assessments work A vendor assessment captures the risk a vendor poses to your organisation: five questions, a resulting risk rating (Low, Medium or High), and an optional comment. An assessment starts as a **draft** and becomes **approved** once someone with administration rights on the vendor approves it. Tidal keeps every assessment, so you build up a history of how the vendor's risk profile changed over time. A vendor can have at most one draft at a time. New vendors start with an empty draft, so you can begin assessing right away. ## Completing an assessment 1. **Go to Vendors** via the main menu and click the vendor to open the detail panel. 2. **Open the "Assessment" tab.** 3. **Click "Continue Assessment"** (or **"New Assessment"** if there is no open draft) at the top of the panel. If the browser window is too narrow to fit it, the button sits in the three-dot menu ("Vendor options") next to the panel title instead. 4. **Answer the questions.** Each question has five answer levels, ordered from lowest to highest risk: - What level of access does the vendor have to our systems and data? - What type of data will the vendor process, store, or transmit on our behalf? - How critical is this vendor's service to our core business operations? - In which regulatory jurisdictions does the vendor operate that may impact our data? - What is the scope and scale of the vendor relationship? 5. **Add a comment** (optional) to record context for the rating, such as which certificates you reviewed. 6. **Your answers are saved as you pick them.** The footer shows "Saving..." while Tidal stores a change, then "All changes auto-saved". Click **"Close"** and the draft keeps everything you entered. 7. **Click "Approve Assessment"** once the assessment is complete. That saves and approves in one go. ![Vendor assessment dialog](/images/help/vendors_assessment_dialog.png) Tidal derives the **rating** from your answers while you work: the highest selected level determines whether the vendor is Low, Medium or High risk. The first three questions (access, data type and criticality) all need an answer before a rating appears, after which jurisdiction and scope can raise it further. You can override the rating manually in the same dialog; a manual choice always wins. > **info:** An assessment can only be approved once it has a rating. Until then "Approve Assessment" is greyed out, so answer the first three questions or pick a rating yourself. Approving stamps the approval date and approver, and sets the vendor's status to **Approved**. ## Periodic re-assessment An approved assessment is considered current for one year. After that, the vendor's status changes from **Approved** to **To be reviewed**: the vendor list shows an orange tag, the "To review" counter on the Vendors page increases, and the "All vendors are assessed" test starts failing. ![Vendor list showing the To be reviewed status](/images/help/vendors_to_be_reviewed.png) To re-assess, open the vendor's **Assessment** tab and click **"New Assessment"**. The new draft is pre-filled with the answers and rating of the latest approved assessment, so you only change what is different this year. The vendor keeps its current rating and status until the new draft is approved. ## Assessment history The Assessment tab lists all assessments of the vendor, newest first, with their date, status (Draft, or Approved with date and approver) and rating. Click any row to view it, or to edit it if it is still a draft. ![Assessment history on the vendor detail panel](/images/help/vendors_assessment_history.png) Each row has an actions menu (three dots) for users with administration rights on the vendor: - **Approve Assessment**: approves the newest assessment. Only shown when it is a draft with a rating. - **Revoke Approval**: withdraws the approval of the newest assessment, for example when it was approved by mistake. Only shown when the newest assessment is approved. - **Delete**: removes an assessment from the history, after a confirmation. Available on every row. ![Assessment row actions menu](/images/help/vendors_assessment_row_actions.png) > **warning:** Deleting an assessment cannot be undone. Deleting an approved assessment also removes it from the vendor's approval history. > **info:** Archived vendors are read-only: their assessments can be viewed but not created, changed or deleted. Unarchive the vendor first if you need to update its assessment. --- # Frameworks ## Frameworks URL: https://tidalcontrol.com/docs/frameworks The thirty-plus standards and regulations Tidal Control supports, from ISO 27001 to GDPR, and how activating one links your controls to its requirements. ### Activating frameworks and linking controls URL: https://tidalcontrol.com/docs/frameworks/activation-and-linking A framework activates the moment you link one control to one of its requirements. How to explore requirements, link controls, and read the progress dashboard. A framework activates itself the moment you link one control to one of its requirements, so there is no separate activation step to find. This article covers that first link, reading the progress percentages that follow, and linking or unlinking controls afterwards. ## Activating frameworks > **info:** Your licence on the Tidal platform is linked to one or more frameworks. These frameworks have already been activated by Tidal, including the mapping between framework requirements and applicable controls. Contact support if frameworks you have a licence for are showing as inactive in Tidal. ### From inactive to active A framework becomes automatically active as soon as you **link at least one control** to a framework requirement. This is the first crucial step toward a working compliance setup. **Activation process:** 1. **Click "Start" button** on a gray (inactive) framework tile 2. **Framework detail page opens** with all framework requirements 3. **Explore the framework structure** and identify priorities 4. **Link first control** to a requirement to complete activation ![Frameworks overview](/images/help/frameworks_overview.png) ### Exploring framework requirements A framework's requirements are organised into numbered sections you can expand one at a time. **Understanding structure:** - **Numbered sections** - For example 4.1, 4.2, 4.3 for ISO 27001 - **Section titles** - "Understanding the organization and its context" - **Individual requirements** - Specific requirements per section - **Expandable sections** - Click arrow to show requirements **Framework navigation tips:** - **Start with section 4.1** - Often the fundamental organisational context - **Look for quick wins** - Simple requirements you can address quickly - **Identify dependencies** - Which requirements build on each other - **Plan implementation order** - Logical progression through the framework > **tip:** **Strategic start**: Begin with organisational requirements (context, scope, policy) before moving to technical implementations. This provides a solid foundation for the rest of the framework. ## Understanding the progress dashboard Once a framework is active, three percentages tell you how far its requirements are covered. ### Interpreting progress indicators Once your framework is active, the dashboard shows three critical percentages that represent your compliance status. ![Frameworks overview](/images/help/frameworks_overview.png) **Assigned:** - **Percentage of controls** with owners assigned - **Team responsibility** - Who does what - **Prerequisite for** - assigning (recurring) tasks - **Goal:** 100% before sending tasks according to Plans **Implemented:** - **Percentage of controls** with all tasks and tests completed - **Actual implementation** - Controls are operational - **Prerequisite for** - demonstrating presence and implementation of measures - **Goal:** 100% before starting internal audit **Audited:** - **Percentage of completed assessment tasks** for linked controls - **Effectiveness verification** - Controls work as intended - **Prerequisite for** - demonstrating conducted internal audit - **Goal:** At least 100% before starting certification audit ## Linking controls There are two routes: reuse an existing control, which is what makes the framework cheap to cover, or create a new one for the requirement. ### "Link control" functionality The most efficient way to meet framework requirements is by **reusing existing controls**. This maximises your "test once, use often" advantage. **Control linking steps:** 1. **Click "Link control" button** to the right of a framework requirement 2. **Control search dialog opens** with all available controls 3. **Search and select** relevant controls 4. **Confirm linking** and check result ![Link control dialog](/images/help/frameworks_link_control.png) ### "Add control" workflow If no suitable existing control is available, you can directly create a new control and link it to the framework requirement. **Creating new control:** 1. **Click "Add control" button** to the right of a framework requirement 2. **Control creation dialog opens** 3. **Fill in control information** 4. **Control is automatically linked** to the requirement ![Creating new control](/images/help/frameworks_add_control.png) ### Filling in control information Only the name is required; everything else can be filled in later. **Required fields:** - **Name** - Clear, descriptive name for the control - For example: "Information security policy is established and maintained" **Optional but recommended fields:** - **Custom ID** - Own identification number for internal reference - **Assign owner** - Direct owner assignment for new control - **Description** - Detailed explanation of control purpose and implementation **Control naming best practices:** - **Result-oriented** - Start with the result the control aims to achieve - **Specific and measurable** - Clear what exactly needs to happen - **Consistent formatting** - Follow organisational conventions - **Future-proof** - Names that remain accurate with framework updates **Examples of good control names:** ``` ✓ "Access rights are reviewed and updated" ✓ "Backup procedures are tested" ✓ "Incident response plan developed and up to date" ✗ "Access control" (too general) ✗ "Monitoring" (unclear what is monitored) ✗ "Security stuff" (not professional) ``` ## Unlinking controls For unlinking framework requirements and existing controls, without deleting the controls. **"Unlink Control" functionality:** - **Select** the control(s) you want to unlink - **Click the newly appeared "Unlink Control" button** next to a linked control - **Controls remain** but are no longer linked to framework requirement - **Progress percentages** are automatically updated ![Unlinking controls](/images/help/frameworks_unlink_control.png) ## Next steps Now that you know how to activate frameworks and link controls: - **Start with one priority framework** relevant to your organisation - **Contact us** if you want to use Tidal mappings - **Map the remaining controls** yourself for maximum reuse efficiency - **Monitor progress** systematically via dashboard indicators ### Getting started with Frameworks URL: https://tidalcontrol.com/docs/frameworks/getting-started Test once, use often. How the Frameworks page presents the thirty-plus standards Tidal supports as tiles, what the tiles show, and how framework types differ. The Frameworks page lists the thirty-plus standards and regulations Tidal supports, from ISO 27001 to GDPR, as tiles you activate by linking controls to their requirements. The point of the page is reuse: one control can satisfy requirements in several frameworks at once. ## The "Test once, use often" principle Tidal Control is built on an efficient approach: **one control can cover multiple framework requirements**. This saves time and resources in compliance implementation. **Practical example:** - **A firewall control** can cover: - ISO 27001 requirement A.8.22 (Network segmentation) - SOC 2 CC6.1 (Logical access security) - NIST 800-53 AC-4 (Information flow control) **Benefits of reuse:** - **Less duplication** - Implement once, comply with multiple standards - **Consistent execution** - Same quality across frameworks - **Resource efficiency** - Team doesn't need to do the same work multiple times - **Holistic compliance** - Integrated approach instead of isolated frameworks > **tip:** **Smart compliance**: Start with the framework most relevant to your organisation. Add frameworks later that have significant overlap to maximise benefit from existing controls. ## Navigating the Frameworks overview page Every framework appears as a tile, and the tile tells you whether it is active and how far along it is. ### Understanding page layout The Frameworks page shows all available compliance frameworks in a tile-based overview. Each framework is displayed as a tile with essential information. ![Frameworks overview](/images/help/frameworks_cards.png) **What you see in the overview:** - **Framework tiles** - Individual tiles per compliance standard - **Search bar** - Quickly find specific frameworks - **Status indication** - Visual distinction between active and inactive frameworks ### Understanding framework tiles Each tile shows the framework's name and version, how many requirements it has, and how many controls already satisfy them. **Information per framework tile:** - **Framework name and version** - For example "ISO27001:2022" or "GDPR:2020" - **Description** - Brief explanation of the framework purpose - **2x2 icon with number** - Number of requirements in the framework - **Clipboards icon with number** - Number of unique controls linked to these requirements **Example of tile information:** ``` ISO27001:2022 ISO/IEC 27001 Information security management systems 🔵 123 📄 75 ``` This means: 123 references (requirements) and 75 linked controls. ### Active vs inactive frameworks A framework only turns active once at least one control is linked to one of its requirements. **Recognising status:** - **Active frameworks** - Full color tiles, framework is being used - **Inactive frameworks** - Gray tiles with "Start" button **When is a framework active?** - **At least 1 control** is linked to a framework reference **Activating inactive frameworks:** 1. **Click "Start" button** on gray framework tile 2. **Framework opens** with all available references 3. **Link first control** to a reference to complete activation ## Framework types and applications Tidal groups frameworks into three kinds, and which kind you are dealing with changes what counts as being finished. ### Certifiable/Reportable standards **ISO 27001 - Information Security Management** - **Purpose:** Systematic information security management - **For whom:** All organisations processing sensitive information - **Focus:** Management systems, risk assessment, control implementation - **Certification:** External audit by accredited certification body **ISO 9001 - Quality Management** - **Purpose:** Optimise quality management systems - **For whom:** Organisations wanting to demonstrate process quality - **Focus:** Customer satisfaction, continuous improvement, process approach - **Certification:** External audit by accredited certification body **SOC 2 - Service Organization Control** - **Purpose:** Trust services for cloud and SaaS providers - **For whom:** Technology service providers with B2B customers - **Focus:** Security, availability, processing integrity, confidentiality - **Reporting:** Type I (design) and Type II (operational effectiveness) ### Laws and regulations **GDPR - General Data Protection Regulation** - **Purpose:** Privacy protection for EU citizens - **For whom:** All organisations processing EU personal data - **Focus:** Data subject rights, privacy by design, breach notification - **Sanctions:** Up to 4% of annual turnover for non-compliance **NIS 2 - Network and Information Security Directive** - **Purpose:** Cybersecurity for critical sectors and important entities - **For whom:** Energy, transport, banking services, digital infrastructure, government - **Focus:** Risk management, incident reporting, cybersecurity governance - **Sanctions:** Up to €10 million or 2% of annual turnover (essential entities), €7 million or 1.4% (important entities), plus personal management liability **EU AI Act - Artificial Intelligence Act** - **Purpose:** Safe and trustworthy AI development and use - **For whom:** Organisations developing, importing or using AI systems in EU - **Focus:** Risk-based approach, prohibited AI practices, high-risk AI requirements - **Sanctions:** Up to €35 million or 7% of annual turnover for prohibited AI practices, lower percentages for other violations ### Other standards **NIST Cybersecurity Framework** - **Purpose:** Cybersecurity risk management - **For whom:** Critical infrastructure and large organisations - **Focus:** Identify, Protect, Detect, Respond, Recover - **Flexibility:** Adaptable to organisation-specific needs **CIS Controls** - **Purpose:** Prioritised cybersecurity best practices - **For whom:** Organisations seeking practical security guidelines - **Focus:** 18 prioritised controls from basic to advanced - **Implementation:** Step-by-step guidance with metrics > **tip:** Check the [Frameworks page](/frameworks/all) for an overview of all supported frameworks. ## Searching and filtering frameworks Search matches framework names, which matters because there are more than thirty of them. ### Using search functionality 1. **Click in search bar** at the top of the Frameworks page 2. **Type framework name** or part of it 3. **Results filter** automatically while typing 4. **Clear search** with X-button to show all frameworks **Effective search terms:** - **"ISO"** - Shows all ISO related frameworks - **"2022"** - Filters on specific versions - **"Security"** - Finds frameworks with security focus - **"Data"** - Shows data protection related frameworks ### Framework selection Start with the one framework your industry actually requires rather than trying to cover several at once. **For starting organisations:** - Start with **one primary framework** relevant to your industry - **ISO 27001** for general information security and for EU-based SaaS and cloud services - **GDPR** when processing personal data - **SOC 2** for SaaS and cloud services with focus on expansion to the USA **For advanced implementations:** - **Expand** with frameworks important to your (new) customers - **Leverage synergies** between related standards - **Optimise coverage** through strategic control mapping > **tip:** **Prevent framework fatigue**: Don't implement more than 2-3 frameworks simultaneously. Focus on quality over quantity and use the same controls across multiple frameworks for greater efficiency. ## What compliance frameworks are Compliance frameworks are structured sets of requirements that help organisations implement security and compliance measures. These frameworks provide guidelines for effective governance, risk management and compliance processes. **Examples of frameworks in Tidal Control:** - **ISO 27001** - International standard for information security - **GDPR** - General Data Protection Regulation for privacy - **SOC 2** - Service Organization Control for cloud services - **NIST** - National Institute of Standards and Technology frameworks - **CIS Controls** - Center for Internet Security security measures - **ISO 9001** - International standard for quality - **ISO 42001** - International standard for responsible A.I. ### Why use frameworks? A framework gives you a ready-made structure instead of inventing your own compliance program from scratch. **Benefits for your organisation:** - **Structure and direction** - Clear roadmap for compliance implementation - **Audit readiness** - Preparation for external certifications and audits - **Risk management** - Systematic approach to security risks - **Best practices** - Proven methods from the industry - **Stakeholder trust** - Demonstrable compliance for customers and partners ## Next steps Now that you know how the Frameworks page works: - **Explore frameworks** relevant to your organisation - **Activate your first framework** with the "Start" button - **Begin control linking** for core requirements - **Monitor progress** via dashboard indicators ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/frameworks/troubleshooting-and-faq Which framework to choose, how to decide which controls link to which requirements, reusing one control across frameworks, and why progress percentages differ. The questions below cover choosing a framework, deciding which controls to link to which requirements, reusing one control across several frameworks, and why the three progress percentages on a framework do not match each other. ## Frequently asked questions ### Which framework should I choose for my organisation? **Choose based on your industry and goals:** **For general information security maturity:** - **ISO 27001** - Broadly applicable, internationally recognised, certifiable - **NIST Cybersecurity Framework** - Flexible, practical, no certification required - **CIS Controls** - Concrete implementation guidance, priority-based **For specific compliance requirements:** - **GDPR** - Recommended when processing EU personal data - **SOC 2** - Essential for SaaS providers and cloud services with customers in the USA - **NIS 2** - Mandatory for critical sectors (energy, transport, finance) - **EU AI Act** - Recommended when developing or using AI systems **For different organisation sizes:** - **Startups/SMB** - Start with ISO 27001, CIS Controls or NIST Framework - **Expansion to US** - SOC 2 for reporting on historical control operation relevant to customers - **Large organisations** - Combination of ISO 27001 + sector-specific frameworks **Strategic considerations:** - **Customer requirements** - Which certification do your customers ask for? - **Industry standards** - What is common in your industry? - **Audit planning** - When do you want to be certified? - **Resource availability** - How much time and expertise do you have? > **tip:** **Start strategy**: Begin with the framework that has the highest business priority. Add overlapping frameworks later for maximum efficiency through control reuse. ### How do I determine which controls to link to which requirements? Read the requirement fully before searching for a control. Matching on a single keyword usually picks the wrong one. **Systematic approach for control mapping:** **First conduct requirements analysis:** 1. **Read requirements completely** - Understand what exactly is being asked 2. **Identify keywords** - Which activities, processes or assets? 3. **Determine scope** - What falls within/outside these requirements? 4. **Check dependencies** - Which other requirements are related? **Control assessment:** - **Functionality match** - Does the control do what the requirement asks? - **Scope coverage** - Does the control cover the complete requirement? - **Evidence quality** - Can the control provide adequate proof? - **Operational maturity** - Is the control actually implemented? **Check the mapping:** - **One-to-one mapping** - Ideally one control covers one requirement completely - **No gaps** - All aspects of requirement are covered - **No overlap** - Avoid duplicate controls for the same requirement - **Evidence matches** - The evidence shows that the requirement is met ### Can I use the same control for multiple frameworks? **Yes, this is exactly the power of Tidal Control - maximum reuse efficiency.** **Cross-framework mapping benefits:** - **Efficiency** - Implement once, comply with multiple standards - **Consistent quality** - Same control standards across frameworks - **Centralised governance** - One control owner for multiple compliance requirements - **Cost efficiency** - Less duplication of effort and resources **How to identify reuse:** 1. **Compare requirements** - Look for similar requirements between frameworks 2. **Control inventory** - Which controls are broadly applicable? 3. **Gap analysis** - Where are universally applicable controls missing? 4. **Strategic mapping** - Plan control architecture for multiple frameworks **Practical reuse examples:** ``` Firewall Management Control can cover: - ISO 27001: A.13.1.1 (Network controls) - SOC 2: CC6.1 (Logical access) - NIST: AC-4 (Information flow enforcement) - CIS Control 12 (Network monitoring) Backup & Recovery Control can cover: - ISO 27001: A.12.3.1 (Information backup) - SOC 2: CC6.2 (Availability) - NIST: CP-9 (Information system backup) - NIS 2: Backup requirements ``` ### Why don't my progress percentages match? Each percentage is calculated from a different denominator, so they're not meant to match. **Understanding progress calculation:** **"Assigned" percentage:** - **Numerator:** Number of controls with owners assigned - **Denominator:** Total number of controls linked to framework - **Update trigger:** When owners are assigned/changed **"Implemented" percentage:** - **Numerator:** Number of controls with OK status (all tasks completed and tests 'passed') - **Denominator:** Total number of controls linked to framework - **Update trigger:** When tasks or tests change status **"Audited" percentage:** - **Numerator:** Number of completed assessment tasks - **Denominator:** Total number of assessment tasks from controls linked to framework - **Update trigger:** When assessment tasks are marked as "Closed" **Common percentage discrepancies:** **Too low Implemented percentage:** - **Outstanding tasks** - Check task status in controls page - **Wrong task type** - Assessment tasks don't count for Implemented **Too low Audited percentage:** - **Assessment tasks missing** - Create one or more assessment tasks for linked controls - **Open assessments** - Assessment tasks are started but not completed **Inconsistent ratios:** - **Implemented > Assigned** - Controls without owners but with completed tasks. Especially during initial implementation and use of manual tasks. - **Audited > Implemented** - Assessments done before implementation completed ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # My account ## My Account URL: https://tidalcontrol.com/docs/my-account Manage your own Tidal Control account. Personal details, password, two-factor authentication, device activity and the applications connected to your profile. Learn how to manage your personal account settings, security, and authentication. ### Getting started URL: https://tidalcontrol.com/docs/my-account/getting-started Your account settings live in Keycloak, reached from the profile icon top right. Change your details and password, set up two-factor and review device activity. Your account settings live in Keycloak, reached from the profile icon in the top-right corner. That is where you change your personal details and your password, set up two-factor authentication, and review the devices and applications that have access to your account. ## Accessing your account settings To access your account settings, click on your profile icon in the top-right corner of the Tidal Control interface and select "My preferences" from the dropdown menu. Then click "Manage account & security" (opens in a new tab). This will take you to the Keycloak account management interface where you can manage all aspects of your account. ## Personal information management The **Personal info** section allows you to manage your basic account information. ![Personal Information](/images/help/keycloak_personal_info.png) ### Managing your profile In the Personal info section, you can view / update: - **Username**: Your unique identifier in Tidal Control (read-only) - **Email**: Your email address used for notifications and account recovery - **First name**: Your given name as it appears in the system - **Last name**: Your family name as it appears in the system To update your information: 1. Navigate to the **Personal info** tab 2. Click in any of the editable fields (Email, First name, Last name) 3. Make your changes 4. Click the **Save** button to confirm your changes 5. Click **Cancel** if you want to discard your changes ## Authentication and security The **Account security** section provides comprehensive options for securing your account. ![Authentication Settings](/images/help/keycloak_authentication.png) ### Password management Under the **Basic authentication** section, you can manage your password: - **View password details**: See when your password was created - **Update password**: Click the **Update** button to change your current password - Follow the password requirements set by your organisation ### Two-factor authentication (2FA) For enhanced security, you can set up two-factor authentication: 1. Navigate to the **Two-factor authentication** section 2. Under **Authenticator application**, click **Set up Authenticator application** 3. Follow the setup wizard to configure your authenticator app 4. Use apps like Google Authenticator, Authy, or Microsoft Authenticator > **tip:** We strongly recommend enabling two-factor authentication to protect your account from unauthorised access. ### Device activity The **Device activity** section allows you to: - View all devices that have accessed your account - See login times and locations - Sign out devices remotely if needed ## Applications The **Applications** section shows all applications that have access to your account, including: - Tidal Control main application - Any connected integrations - Third-party applications you've authorized ## Best practices To keep your account secure: 1. **Use a strong password** that meets your organisation's requirements 2. **Enable two-factor authentication** for an extra layer of security 3. **Regularly review device activity** to spot any unauthorised access 4. **Keep your contact information up to date** for account recovery purposes 5. **Review connected applications** periodically and remove any you no longer use ## Getting help If you need assistance with your account settings: - Contact your system administrator for organisation-specific policies - Check with your IT department for password requirements - Reach out to Tidal Control support for technical issues with the platform Your account security is important to us. If you notice any suspicious activity or have concerns about your account, please contact your administrator immediately. --- # Frequently asked questions ## FAQ URL: https://tidalcontrol.com/docs/frequently-asked-questions Answers to the questions we get most often about Tidal Control, from support hours and response times to when the platform sends you email and when it does not. ### What are your support hours and how do I contact support? URL: https://tidalcontrol.com/docs/frequently-asked-questions/faq-customer-service Support runs business hours, 9 to 17 Monday to Friday, and answers within two business days at the latest. How to reach us, and the first-aid checks to try. Support runs on business hours, 9-17 Monday to Friday, and answers within two business days at the latest. Before you write in, the first-aid checks below resolve the two most common problems. ## First aid Before you contact support, we ask you to try the following common solutions first: 1. **The app times out, gives connection errors, or is unresponsive**: verify that the Tidal Control service is running via https://status.tidalcontrol.com. If it is, try a hard refresh of the website, or otherwise try restarting your web-browser. If it still doesn't work, contact us. 2. **You are not able to log in**: Ask your company's contact point for Tidal Control to reset your password and/or account. ## Support hours We provide support during business hours (9-17) from Monday through Friday. Support may be limited during NL holidays. ## How do I contact support? Send an e-mail to support@tidalcontrol.com, and we'll contact you as soon as possible. ## How quick are you to act? We are constantly monitoring any errors that happen in production, also outside business hours. If you run into an error, chances are we're already working on it. Similar, if you log an incident or issue that has a high priority, we'll likely contact you within a couple of hours of early next day. In any case, we will respond to your support ticket within a maximum of 2 business days. ### When does someone get an email from Tidal Control? URL: https://tidalcontrol.com/docs/frequently-asked-questions/faq-tidal-control Tidal Control keeps email to a minimum. Which messages need direct action, what the daily summary contains, and why you may not have received one today. We try to limit the amount of emails we send to you, such that your inbox is not cluttered by us. There are a few specific moments when you will receive an email from Tidal Control, and we distinguish between the following priorities: 1. **When direct action is needed**: you will receive an email with a link to take action. 2. **To update you on changes in Tidal Control**: you will receive an email with a summary of the changes. This email is sent only once per day. ## Emails that require direct action The emails that require direct action are sent in the following cases: 1. **When you are invited to Tidal Control by a colleague or partner**: you will receive an email with a link to create your account. 2. **When you need to reset your account details**: you will receive an email with a link to reset your password. 3. **When you are mentioned in a comment**: you will receive an email with a link to the comment. 4. **When a group you belong to is linked to a policy**: you will receive an email with a link to read and approve that policy. 5. **When your request for access to a document is approved or rejected**: you will receive an email with the outcome. 6. **When an integration credential is about to expire**: you will receive an email so you can renew it before the connection stops working. 7. **When a certification is requested**: you will receive an email with a link to the request. ## The daily summary email The daily summary email is the only place where Tidal Control actively reminds you about deadlines. There are no separate "this task is almost overdue" emails, and the app does not send you a notification either. Inside the app, deadlines are only visible as the **Due within 14 days** and **Overdue** statuses in your [task overview](/docs/tasks/getting-started). You have to look them up yourself. You receive this email if you have at least one item in one of the categories below. If you have nothing outstanding, you do not get an email that day. It is sent once per day, in the morning. There is currently no setting to unsubscribe from it. The email covers the tasks assigned to you: executions, assessments and issues.
CategoryWhen a task appears in it
Deadline passedThe deadline has passed since yesterday 00:00 (the first summary after the deadline).
Deadline coming upStill open, with a deadline within the next 3 days (counted from today 00:00).
Newly assigned to youAssigned to you since yesterday 00:00.
CompletedClosed since yesterday 00:00.
Each task is listed with its name, its deadline and a direct link. Deadlines and dates are shown in the timezone and language of your environment. > **info:** **A passed deadline is reported once.** A task that has been overdue for a week does not appear in the summary again. There is no repeated reminder and no escalation. To see everything that is still outstanding, use your [task overview](/docs/tasks/getting-started) and filter on **Overdue** or **Due within 14 days**. ### Why you did not get a summary today The summary is skipped when there is nothing to report. You will not receive it if: - None of your tasks changed and none of them have a deadline in the next 3 days. - Your overdue tasks passed their deadline more than a day ago. Those were reported in an earlier summary and are not repeated. - The tasks you are working on have no deadline set. A task without a deadline can never appear in the two deadline categories. - Nothing is assigned to you. The summary only covers tasks where you are the assignee, not tasks you created for someone else. ## Introduction URL: https://tidalcontrol.com/docs Documentation for Tidal Control. How to get started, how each module works, how to connect the systems your tests read, and answers to common questions. Welcome to the documentation for Tidal Control. This guide will help you get started with our platform and understand how to make the most of our features. --- # Ai ## AI URL: https://tidalcontrol.com/docs/ai Connect AI assistants to Tidal Control and work with your compliance data from a normal conversation. Covers the MCP server, client setup and examples. Use AI assistants to work with your Tidal Control data. ### MCP server URL: https://tidalcontrol.com/docs/ai/mcp Connect AI assistants to Tidal Control with the Model Context Protocol. Setup for Claude Desktop, Claude Code, Codex, ChatGPT or any other MCP client. The MCP server lets you connect AI assistants to Tidal Control. Once connected, your assistant can search your compliance data, create and update records, manage relationships between entities, and summarise KPIs, all from a normal conversation. Your existing Tidal Control permissions apply. If you only have read access in the portal, your assistant can only read. ## What you can do Once connected, you can ask your AI assistant to help with your compliance work in Tidal Control. Here are some examples of what's possible. **Answer questions about your compliance data** - "How many high-severity risks don't have any controls linked to them?" - "Show me all vendors with overdue assessments." - "Which ISO 27001 requirements aren't covered by any of our controls?" - "What's the pass rate of our automated tests this month?" **Get KPIs and statistics** - "Summarise our framework compliance for SOC 2." - "How many assets are assigned, assessed, and compliant?" - "Give me the status of all issues created in the last 30 days." **Make bulk changes you'd normally click through** - "Create issue tasks for each of these 12 audit findings and link them to control AC-01." - "Archive all vendor assessments that expired more than a year ago." - "Add Server-1, Server-2, and Server-3 to the 'Quarterly Access Review' plan." **Link things together** - "Link controls CC6.1 through CC6.8 to risk R-042." - "Attach `backup-policy.pdf` as evidence to this quarter's backup verification execution." - "Add a reference from ISO 27001 A.8.1 to our Access Control Policy control." **Search documents by meaning** - "Which of our policies mentions remote work expectations?" - "Find the document that describes our incident response timeline." **Context-aware prompts** Your assistant knows who you are, which organisation you're in, and today's date, so you can say things like *"what's due next week for me?"* without spelling out names or dates. **More examples:** for a task-by-task walkthrough based on how clients actually use the MCP (including the tools each prompt triggers), see [Usage examples](/docs/ai/mcp/examples). ## Before you start You'll need your **organisation ID**. It's the part of the portal URL you log in with. For example, if you sign in at `portal.tidalcontrol.com/acme/...`, your organisation ID is `acme`. > **info:** We're adding your organisation ID to the portal **Settings** page soon. Until then, copy it from your browser's address bar after logging in. Replace `` in the URLs below with your own. ## Connecting Pick your client below. Every one of them needs your organisation ID, and each opens a browser once for you to sign in. ### Claude Desktop > **info:** An official Tidal Control connector for Claude is coming soon. Until then, use the custom connector flow below. 1. In the **message box** (where you type your prompts), click the **+** button 2. Go to **Connectors** → **Manage connectors** 3. Click the **+** next to **Connectors** → **Add custom connector** 4. Fill in: - **Name:** Tidal Control - **Remote MCP server URL:** `https://mcp.tidalcontrol.com/` 5. Sign in when your browser opens ### Claude Code Run this in your terminal: ```bash claude mcp add tidalcontrol --transport http https://mcp.tidalcontrol.com/ ``` A browser window opens for you to sign in. After that, the connection is ready. ### Codex Register the server and sign in: ```bash codex mcp add tidalcontrol --url https://mcp.tidalcontrol.com/ codex mcp login tidalcontrol ``` ### ChatGPT > **info:** MCP support is available on **Plus** (web only), **Business**, **Enterprise**, and **Edu** plans. The Tidal Control MCP server is remote-hosted, which is required by ChatGPT's MCP integration. 1. Go to **Settings** → **Plugins** and enable **Developer mode** at the bottom of the page 2. Click the **+** on the **Plugins** page to open the **New plugin** dialog 3. Enter a name (for example, "Tidal Control") and the MCP server URL: ``` https://mcp.tidalcontrol.com/ ``` 4. Leave the OAuth settings at their defaults 5. Sign in when prompted 6. Click **Create** 7. Open a new chat, click **+**, and select your plugin from the tools menu > **info:** **Plugins used to be called Connectors.** OpenAI renamed this section in July 2026. Older guides, including earlier versions of this page, say **Connectors**, **Create app**, or **Advanced Settings**. If your ChatGPT still shows those names, the steps are the same. After testing, an admin or owner on a Business, Enterprise, or Edu plan can make the plugin available to the whole workspace from **Workspace Settings** → **Plugins** → **Drafts** → **Publish**. Once published, team members can invoke the plugin with an `@` mention or via **+** → **More** → select the plugin. ### Any MCP client Any client that supports MCP over Streamable HTTP with OAuth 2.1 can connect. Point it at `https://mcp.tidalcontrol.com/`. The server advertises its OAuth endpoints via [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) and supports Dynamic Client Registration ([RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591)), so most clients can discover everything automatically. ## How it works When you connect, your AI tool discovers how to authenticate with Tidal Control. You sign in once through your browser using your normal Tidal Control credentials. After that, the connection stays active under your identity. **Your permissions apply.** The assistant can only do what your role in the portal allows. A read-only user cannot create or change records through MCP, just like in the portal. ## Areas the MCP server covers The MCP server exposes tools across all major areas of Tidal Control:
Area What your assistant can do
Risks Search, create, update, archive, delete. Manage risk assessments. Link to controls and assets.
Controls Search, create, update, archive, delete. Link to assets, risks, plans, and framework references.
Assets Search, create, update, archive, delete. Set CIA scores, RTO/RPO, and target service levels. Link to controls, risks, and plans.
Tasks Search, create, update, close, reopen, delete issues, assessments, and executions. Link to controls and assets.
Comments Add, update, and delete comments on tasks.
Evidence Link documents as evidence to tasks.
Documents Search by filter or by meaning (semantic). Create, update, delete.
Document classifications List, create, update, approve, and delete classifications linking documents to types.
Required documents List the documents required by your frameworks.
Frameworks Browse frameworks (ISO 27001, SOC 2, GDPR, and more) and their references.
Plans Search, create, update, archive, delete. Link to assets and controls. Manage activity configurations on a plan.
Vendors Search, create, update, archive, delete. Manage vendor assessments.
Personnel Search persons, groups, and platform users. Create and delete persons and groups.
Tests Browse automated tests and their results.
Insights & KPIs Get KPIs for assets, personnel, and vendors. Get statistics for tests, activities, and framework compliance.
Context Look up the current user, current organisation, and the current date and time in your timezone.
## Linking entities You can ask your assistant to link entities together, for example: - "Link control AC-01 to risk R-003" - "Add assets Server-1 and Server-2 to plan Quarterly Access Review" - "Remove the reference to ISO 27001 A.8.1 from this control" These actions add or remove individual links without affecting other existing relationships. --- ## For developers > **info:** The sections below are for developers building custom integrations or automated agents. ### Programmatic access (Device Authorization flow) For automated agents and scripts that cannot open a browser, use the [OAuth Device Authorization Grant (RFC 8628)](https://datatracker.ietf.org/doc/html/rfc8628): **Step 1: Request a device code** ```bash curl -s -X POST https://auth.tidalcontrol.com/realms//protocol/openid-connect/auth/device \ -d "client_id=portal" \ -d "scope=openid email profile roles portal-roles offline_access" ``` Response: ```json { "device_code": "abc123...", "user_code": "ABCD-EFGH", "verification_uri": "https://auth.tidalcontrol.com/realms//device", "expires_in": 600, "interval": 5 } ``` **Step 2: Authenticate in a browser** Open the `verification_uri`, enter the `user_code`, and sign in. This only needs to happen once. Store the refresh token for future sessions. **Step 3: Poll for a token** ```bash curl -s -X POST https://auth.tidalcontrol.com/realms//protocol/openid-connect/token \ -d "client_id=portal" \ -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \ -d "device_code=abc123..." ``` Returns `authorization_pending` until the user approves. Once approved: ```json { "access_token": "eyJ...", "refresh_token": "eyJ...", "expires_in": 300, "refresh_expires_in": 1800 } ``` **Step 4: Connect to MCP** ```bash curl -X POST https://mcp.tidalcontrol.com/ \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"method":"initialize","params":{...},"jsonrpc":"2.0","id":0}' ``` Refresh the token before it expires. The token carries your user identity and permissions. ### Pagination Search tools return paginated results with `content`, `hasNext`, and `totalElements`. Control pagination with: - **sortBy**: `name`, `createdDate`, `lastModifiedDate`, `notBefore`, or `expires` - **sortDirection**: `ASC` or `DESC` (default: `DESC`) - **maxResults**: 1 to 100 (default: 25) ### Supported standards
Standard Purpose
RFC 9728 OAuth Protected Resource Metadata
RFC 8414 Authorization Server Metadata
CIMD Client ID Metadata Documents
RFC 7591 Dynamic Client Registration
RFC 8628 Device Authorization Grant
PKCE (S256) Required for all authorization code flows
### Usage examples URL: https://tidalcontrol.com/docs/ai/mcp/examples Prompts drawn from how clients really use the Tidal Control MCP server, covering documents, controls, risks, assets, vendors, tasks, tests and insights. These prompts are drawn from how clients actually use the MCP server. Each one is something you can paste to your AI assistant once the [MCP server](/docs/ai/mcp) is connected. ## How clients use the MCP server These examples are based on real usage patterns from our clients. Each one is a natural-language prompt you can give your AI assistant once the [MCP server is connected](/docs/ai/mcp). Most traffic today comes from Claude Code and Claude on the web, with the rest from Codex and other MCP-capable clients. > **info:** The prompts are illustrative. You don't pick tools yourself. You describe your goal in plain language and the assistant sequences the right tools. The tool names below are shown only so you can see what's happening under the hood. ## Documents and policies Document work is the most common use, by a wide margin. Clients find, read, and update policies and procedures without leaving their assistant. **Find and read a document** > "Find our network segmentation policy and show me its current content." The assistant locates the document with `documentFind`, then reads the full text with `documentGetContent`. For meaning-based questions like *"where do we describe our incident-response timeline?"*, it uses `documentSearch` (semantic search) instead. **Read several documents at once** > "Read our change management policy and our secure development policy, and tell me where they contradict each other." The assistant pulls both texts in a single call with `documentGetContentBatch` rather than fetching them one by one. This is the usual opening move for consistency checks across a set of policies. **Update a section of a document** > "In the password policy, change the minimum length requirement from 8 to 12 characters, then show me the result." The assistant reads the current text with `documentGetContent`, applies a precise change with `documentEdit`, and reads the document back so you can see what landed. Reading back after an edit is the single most common two-step pattern on the server. > **info:** Documents that are the **approved content of a policy** can't be edited over MCP. The assistant will tell you which policy is involved. Amend the draft from the portal's policy editor instead. **Work on a draft without touching the approved version** > "Create a draft of the legal and contractual requirements register, rewrite the scope section, and leave the approved version alone." The assistant derives an editable draft with `documentClassificationCreateDraft`, then edits that draft with `documentEdit`. The approved version stays untouched until you sign the draft off. **Check and approve policy coverage** > "Which document is our access control policy, and has it been approved?" Uses `documentClassificationFind` to show which document fulfils that policy and its approval state. To sign it off (*"Approve the access control policy classification."*), the assistant calls `documentClassificationUpdate`. **See what your framework still requires** > "Which documents does ISO 27001 require that we don't have yet?" Uses `requiredDocumentFind` to list the required documents for your adopted frameworks and show which ones are still missing. This is a common first question before a certification round. ## Compliance controls Controls can be searched by topic, by the framework requirement they satisfy, and by the work attached to them. **Find controls by topic** > "List our access-control requirements that apply to remote workers." The assistant calls `controlFind` with the relevant search text and category. **See which controls mitigate a risk** > "Which controls do we have that mitigate the risk of unauthorised remote access?" The assistant finds the risk with `riskFind`, then lists the controls linked to it with `controlFind`. **Check what's happening on a control** > "Show me control C.06 and every task, review and execution attached to it." The assistant reads the control with `controlFind` and lists the linked work with `activityFind`. Moving from a control to its activities is one of the most widely used sequences on the server. **Count coverage** > "How many controls do we have tagged for internal audit, and how many are linked to risk R.IT.15?" Uses `controlCount`, which answers sizing questions without pulling the full list back into the conversation. **Check which frameworks you've adopted** > "Which frameworks have we adopted, and how far along is each one?" Uses `frameworkFind` for the adopted set. Clients typically ask this before planning a sequence, for example whether to take on NIS2 before or after an AI standard. **Map controls to clauses** > "Which ISO 27001 Annex A references are currently marked out of scope?" Uses `referenceFind` to list clause references and their state, and `referenceCount` to count the references attached to a given control. Useful when you're building a Statement of Applicability or a clause coverage matrix. ## Risks and risk assessments In Tidal Control a **risk** is the threat you're tracking; a **risk assessment** records its impact and likelihood scores over time. **Add a new risk** > "Add a new risk for the SCADA upgrade project: an external attacker reaching OT network zone 3." The assistant calls `riskCreate` with the name and description. **Score a risk** > "Assess that risk: impact 4, likelihood 3, treatment reduce." The assistant calls `riskAssessmentCreate` to record the impact, likelihood, residual scores, and treatment. **Revise a score after remediation** > "We've finished the patch cycle on the unpatched HMI firmware. Lower its residual likelihood from high to medium." The assistant locates the current assessment with `riskAssessmentFind`, then updates the score with `riskAssessmentUpdate`. **Review risks by residual level** > "Show me all risks with a high residual rating in the vendor-access category." Uses `riskFind` filtered by residual risk level. For questions about the shape of the register rather than its contents (*"how many risks carry a treatment other than reduce?"*), the assistant uses `riskCount`. **Find risks that still need a score** > "Which risks have no current assessment? Read each one, then tell me what's missing." The assistant lists the register with `riskFind` and reads each risk's score history with `riskAssessmentFind`. Clients use this to find register entries that were never valued. **Link a control to a risk** > "Link our ISMS documentation control to the risk about missing documentation." Uses `riskAddControls` to record which controls mitigate which risk, so the treatment decision has something behind it. ## Assets Assets can be created, rated, and linked to the risks and controls that apply to them. **Review the register** > "List every active asset and tell me which ones have no owner assigned." Uses `assetFind`, the most widely used tool in this area. `assetCount` answers the sizing version of the same question. **Add a missing asset** > "Add the container registry I found on the Azure network view: it isn't in our inventory yet." Uses `assetCreate`, then `assetUpdate` to fill in the details once the record exists. Clients most often reach for this after a review turns up something the register missed. **Set CIA ratings** > "Set the confidentiality, integrity, and availability of the customer database to 5, 4, and 5." The assistant calls `assetUpdate` with the CIA scores. **Set recovery objectives** > "Give the billing platform a 4-hour RTO and a 1-hour RPO." Uses `assetUpdate` to set the recovery time and point objectives. **Adjust a group of assets** > "For every cloud-resource asset, set the availability rating to 4." Uses `assetUpdate` once per matching asset. ## Vendors Vendors can be added, assessed, and checked for the evidence you're supposed to hold on them. **Add and assess a vendor** > "Add Acme Industrial as a new vendor (they supply the network switches for our OT environment) and start a vendor assessment with medium criticality and EU jurisdiction." The assistant creates the vendor with `vendorCreate`, then scaffolds the assessment with `vendorAssessmentCreate`. **Fill in an assessment that's already been scaffolded** > "Open the draft assessment for our password manager and record the agreed risk values." The assistant reads the current assessment with `vendorAssessmentFind` before writing to it with `vendorAssessmentUpdate`, so manual edits already in the record aren't overwritten. Read before write is how clients use this pair in practice. **Audit vendor completeness** > "Which vendors have no approved risk assessment, and which of their mandatory documents are missing?" The assistant lists vendors with `vendorFind`, checks their assessments with `vendorAssessmentFind`, and uses `evidenceFind` to see which supporting documents are on file. A vendor's risk rating and data-processing level determine which documents are mandatory. **Raise an issue from an assessment** > "Flag the missing processing agreement for this vendor as an issue and set a response deadline." The assistant creates the finding with `activityCreateIssue` while it's still in the assessment. Moving straight from an assessment into a tracked issue is a common way clients close the loop. ## Tasks and activities Tidal Control's work items are **issues** (findings and gaps), **assessments** (reviews and audits), and **executions** (scheduled control runs). **Review open findings** > "Show me all open issues created in the last 30 days." Uses `activityFind` filtered by type and date range. `activityCount` gives the totals when you only want the numbers. **Find overdue control runs** > "Which control executions are overdue?" Uses `activityFind` filtered by execution type and overdue status. **Turn findings into linked tasks** > "Create issue tasks for each of these 12 audit findings and link them to control AC-01." The assistant calls `activityCreateIssue` for each finding and links them with `activityIssueAddControls`. Creating a finding and immediately linking it to the control it belongs to is the standard shape of this work. **Set owners and deadlines on findings** > "Assign the CTO as owner of the audit finding about management roles, and set the due date to the end of next month." Uses `activityUpdateIssue` for the owner and the deadline, so the register reflects the corrective action plan. **Schedule and close control runs** > "Create a monthly follow-up round for corrective actions, and close the physical access review with the outcome recorded." The assistant schedules the recurring work with `activityCreateExecution`, links it to the control with `activityExecutionAddControls`, and closes a finished run with `activityCloseExecution` once the outcome is documented. **Record what happened** > "Add a note to this finding saying the processing agreement request went out in writing on the 12th." Uses `commentAdd`. To read the discussion back, the assistant uses `commentFind`. **Check the plan** > "Which plans is our annual governance phase attached to?" Uses `planFind` to show the plans a control or activity sits in. ## Automated tests > "Which automated tests are currently failing, and which controls do they cover?" Uses `testFind` filtered by status, then `controlFind` for the controls behind them. For pass/fail history over time, the assistant follows up with `testResultFind`. > "Has any of our integration tests ever run?" Auditors ask this one directly. `testFind` lists the configured tests and `testResultFind` shows whether results exist, which tells you where manual evidence is still needed. ## Insights and KPIs Six summary tools give you the state of the programme without reading a single record. They're read-only and cheap, which makes them a good opening prompt before a meeting or an audit. **Get a compliance snapshot** > "Give me a summary of our current ISO 27001 status, including open tasks and control effectiveness." Uses `insightsFrameworkStatistics` for posture per framework. The other five cover assets (`insightsAssetsKpi`), vendors (`insightsVendorsKpi`), personnel (`insightsPersonnelKpi`), activities (`insightsActivityStatistics`), and automated tests (`insightsTestStatistics`). **Size a gap before you dig in** > "How much of our asset register is assessed and compliant?" Uses `insightsAssetsKpi` to return the aggregate counts, so you can decide whether the detail is worth pulling. ## People and context Assistants orient themselves before they write anything, and you can ask these questions directly. **Check which tenant you're working in** > "Which Tidal Control environment am I connected to?" Uses `currentTenant`. Worth asking first if you have access to more than one environment. **Find the right person** > "List our platform users and tell me which documents each of them owns." Uses `userFind` and `personFind` to resolve names before you assign ownership. `currentUser` answers *"who am I signed in as?"*, and `groupFind` lists the groups people belong to. ## Tips for the best results - **Be specific about scope.** Mention project names, asset identifiers, zones, or categories when you have them. The tools use these to filter accurately. - **Chain operations naturally.** You don't need to call tools one by one; describe your goal and the assistant sequences the right tools. - **Ask for the result back.** Adding "then show me the result" makes the assistant read the record after writing to it, which is how most clients catch a change that didn't land the way they meant. - **If a tool seems missing, say so.** The server exposes more tools than most clients load at once. Telling the assistant what you're trying to do prompts it to look for the rest rather than give up. - **Mutations ask for confirmation.** Your AI client may prompt before running a change (updating a score, creating a record, deleting something). This is expected. - **Your permissions apply.** A read-only user can read through the MCP but can't create or change records, exactly as in the portal. - **Approved policies are protected.** Editing the approved version of a policy is blocked over MCP; amend the draft in the portal's policy editor. - **Some calls take a moment.** Semantic search, batch reads, and anything that reaches an external tracker are slower than a plain lookup. ## Tool reference The server exposes considerably more tools than are listed here. These are the ones clients use regularly. ### Documents and policies
Tool Type What it does
documentSearchReadSemantic search across document content
documentFindReadList or locate documents by name or type
documentGetContentReadRetrieve a document's full text
documentGetContentBatchReadRetrieve several documents' text in one call
requiredDocumentFindReadList the documents your adopted frameworks require
documentCreateMutatingCreate a new document
documentEditMutatingApply a precise inline change to a document's text
documentUpdateMutatingReplace a document's whole body
documentClassificationFindReadSee which document fulfils which policy, and its approval state
documentClassificationCreateMutatingRecord that a document fulfils a policy
documentClassificationCreateDraftMutatingDerive an editable draft, leaving the approved version intact
documentClassificationUpdateMutatingApprove or revoke a policy classification
documentClassificationAssignOwnerMutatingAssign a policy owner to a classification
### Controls and frameworks
Tool Type What it does
controlFindReadSearch controls; filter by risk, framework, or category
controlCountReadCount controls matching a filter
frameworkFindReadList adopted frameworks and their state
referenceFindReadList framework clause references, such as ISO 27001 Annex A
referenceCountReadCount the clause references attached to a control
### Risks
Tool Type What it does
riskFindReadList risks; filter by residual level, treatment, or links
riskCountReadCount risks matching a filter
riskCreateMutatingCreate a new risk
riskUpdateMutatingUpdate a risk's name, description, or category
riskAddControlsMutatingLink mitigating controls to a risk
riskAssessmentFindReadList a risk's assessments (its score history)
riskAssessmentCreateMutatingScore a risk: impact, likelihood, residual, treatment
riskAssessmentUpdateMutatingRevise an assessment's scores or treatment
### Assets
Tool Type What it does
assetFindReadList or locate assets in the register
assetCountReadCount assets matching a filter
assetCreateMutatingAdd an asset to the register
assetUpdateMutatingUpdate asset fields: CIA scores, RTO/RPO, category, dates
### Vendors
Tool Type What it does
vendorFindReadList or locate vendors
vendorCountReadCount vendors matching a filter
vendorCreateMutatingAdd a new vendor
vendorUpdateMutatingUpdate a vendor's details
vendorAssessmentFindReadRead a vendor's current assessment
vendorAssessmentCreateMutatingAssess a vendor: access, criticality, jurisdiction, rating
vendorAssessmentUpdateMutatingRecord or revise the values on an assessment
evidenceFindReadList the evidence held against a vendor, control, or activity
### Tasks and activities
Tool Type What it does
activityFindReadList compliance tasks: issues, assessments, executions
activityCountReadCount tasks matching a filter
activityCreateIssueMutatingCreate an issue (finding) task
activityUpdateIssueMutatingSet an issue's owner, due date, or status
activityCloseIssueMutatingClose a finding
activityIssueAddControlsMutatingLink an issue to the controls it concerns
activityCreateExecutionMutatingSchedule a control run
activityUpdateExecutionMutatingChange a run's due date, owner, or outcome
activityExecutionAddControlsMutatingLink a run to the controls it evidences
activityCloseExecutionMutatingClose a finished run
planFindReadList the plans a control or activity belongs to
commentFindReadRead the discussion on a record
commentAddMutatingAdd a note to a record
externalIssueCreateMutatingPush a finding to a connected tracker such as Jira or Linear
### Tests and insights
Tool Type What it does
testFindReadList automated tests and their pass/fail status
testResultFindReadHistorical pass/fail results for a test
insightsFrameworkStatisticsReadCompliance posture per framework
insightsTestStatisticsReadAggregate pass/fail counts across automated tests
insightsAssetsKpiReadAsset coverage: assigned, assessed, compliant
insightsVendorsKpiReadVendor coverage and assessment state
insightsPersonnelKpiReadPersonnel coverage: onboarding and document acceptance
insightsActivityStatisticsReadOpen, overdue, and completed task counts
### People and context
Tool Type What it does
currentTenantReadWhich Tidal Control environment the session is connected to
currentUserReadWhich account the session is signed in as
userFindReadList platform users
personFindReadList people in the personnel register
groupFindReadList groups and their members
--- # Api ## API Reference URL: https://tidalcontrol.com/docs/api Developer documentation for the Tidal Control GraphQL API. Authenticate, query with pagination and filters, export your compliance data and write evidence back. The Tidal Control API gives you programmatic access to your organisation's data. Use it to export data for reporting, feed it into other tools, or build custom dashboards. **Endpoint:** `https://portal.tidalcontrol.com/graphql` **Protocol:** GraphQL over HTTPS. All requests are `POST` with a JSON body. ### Adding evidence URL: https://tidalcontrol.com/docs/api/adding-evidence Write data with the Tidal Control GraphQL API. Upload an evidence file, create an execution task on a control and attach the file, with a full Python example. Most of this guide covers reading data, but the API can also **write** data through mutations. This page walks through a complete example: a custom integration that attaches an evidence file to a control by creating an execution task and adding the file to it. > **warning:** Mutations require a token with **write permissions**. Authenticate with the [Device Authorization Grant](/docs/api/authentication) so the token acts as a user with the **Regular User** or **Super User** role. Read-only [machine-to-machine credentials](/docs/api/authentication) cannot run mutations. ## How it works Evidence in Tidal Control is a **document** linked to an activity. Attaching evidence to a control is four steps: 1. Find the control you want to add evidence to 2. Upload the evidence file as a document 3. Create an execution task linked to the control 4. Attach the document to the task as evidence ## Step 1: Find the control Search for the control by name to get its `id`: ```graphql query FindControl($filter: ControlFilter) { controls_paged(first: 1, filter: $filter) { edges { node { id sequenceId name } } } } ``` Variables: ```json { "filter": { "search": "Access control policy" } } ``` ## Step 2: Upload the evidence file Documents are uploaded through a REST endpoint (not GraphQL), as `multipart/form-data` on the `files` field. Use the same Bearer token: ```bash curl -s -X POST https://portal.tidalcontrol.com/documents \ -H "Authorization: Bearer {access_token}" \ -F "files=@evidence.pdf" ``` The response is an array of the documents you uploaded: ```json [ { "id": "11111111-1111-1111-1111-111111111111", "name": "evidence.pdf", "type": "application/pdf" } ] ``` Keep the document `id` for the next steps. > **info:** The maximum upload size is **128 MB** per request. You can upload several files in one request by repeating the `files` field. ## Step 3: Create an execution task on the control Create an execution task and link it to the control from step 1 using the `controls` field: ```graphql mutation CreateExecution($input: ExecutionInput!) { addExecution(input: $input) { id sequenceId name } } ``` Variables: ```json { "input": { "name": "Quarterly access review", "controls": ["22222222-2222-2222-2222-222222222222"] } } ``` Only `name` is required. `controls` takes one or more control `id`s, and you can also set `description`, `expires`, `owners`, and `assets`. The mutation returns the new task's `id`. ## Step 4: Attach the evidence Attach the uploaded document to the task with `addEvidenceToExecution`: ```graphql mutation AddEvidence($activityId: ID!, $documentIds: [ID!]!) { addEvidenceToExecution(activityId: $activityId, documentIds: $documentIds) { id sequenceId evidence { id document { name } } } } ``` Variables: ```json { "activityId": "33333333-3333-3333-3333-333333333333", "documentIds": ["11111111-1111-1111-1111-111111111111"] } ``` The evidence now appears on the task, which is linked to your control. ## Complete Python example This script ties the four steps together. It reuses the `get_token()` and `graphql()` helpers from [Authentication](/docs/api/authentication). ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" DOCUMENTS_URL = "https://portal.tidalcontrol.com/documents" def find_control(search, access_token): query = """ query FindControl($filter: ControlFilter) { controls_paged(first: 1, filter: $filter) { edges { node { id sequenceId name } } } } """ data = graphql(query, {"filter": {"search": search}}, access_token) edges = data["controls_paged"]["edges"] if not edges: raise RuntimeError(f"No control found for '{search}'") return edges[0]["node"] def upload_document(file_path, access_token): with open(file_path, "rb") as f: r = requests.post( DOCUMENTS_URL, headers={"Authorization": f"Bearer {access_token}"}, files={"files": f}, ) r.raise_for_status() return r.json()[0] # first uploaded document def create_execution(name, control_id, access_token): mutation = """ mutation CreateExecution($input: ExecutionInput!) { addExecution(input: $input) { id sequenceId name } } """ data = graphql( mutation, {"input": {"name": name, "controls": [control_id]}}, access_token, ) return data["addExecution"] def add_evidence(activity_id, document_id, access_token): mutation = """ mutation AddEvidence($activityId: ID!, $documentIds: [ID!]!) { addEvidenceToExecution(activityId: $activityId, documentIds: $documentIds) { id sequenceId evidence { id document { name } } } } """ data = graphql( mutation, {"activityId": activity_id, "documentIds": [document_id]}, access_token, ) return data["addEvidenceToExecution"] if __name__ == "__main__": token = get_token() access_token = token["access_token"] control = find_control("Access control policy", access_token) document = upload_document("evidence.pdf", access_token) task = create_execution("Quarterly access review", control["id"], access_token) result = add_evidence(task["id"], document["id"], access_token) print(f"Added '{document['name']}' to task #{result['sequenceId']} on control {control['name']}.") ``` ## Attaching evidence to an existing task If a suitable execution task already exists, skip step 3. Find the task with the `activities_paged` query (see [Exporting tasks](/docs/api/tasks)), then call `addEvidenceToExecution` with its `id`. ### Exporting assets URL: https://tidalcontrol.com/docs/api/assets Export assets from the Tidal Control API with the assets_paged query, including CIA scores, linked controls, risks and information types, with a Python script. Assets are exported using the `assets_paged` query. Each asset includes its CIA scores (confidentiality, integrity, availability), linked controls, risks, and information types. ## Basic query ```graphql query ExportAssets($first: Int, $after: String, $filter: AssetFilter) { assets_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description notBefore expires archived confidentiality integrity availability mao rto rpo informationTypes controls { id sequenceId name } risks { id sequenceId name treatment } assignments { assignmentType user { name email } } attributes { key value } } } pageInfo { hasNextPage endCursor } } } ``` Variables to fetch the first page: ```json { "first": 50, "after": null, "filter": {} } ``` ## Key fields - `sequenceId`: the human-readable number shown in the UI (e.g. A-7) - `customId`: optional custom identifier set by your team - `confidentiality` / `integrity` / `availability`: CIA impact scores (1-3 scale) - `mao`: Maximum Acceptable Outage (ISO 8601 Duration, e.g. `PT4H`) - `rto`: Recovery Time Objective (ISO 8601 Duration) - `rpo`: Recovery Point Objective (ISO 8601 Duration) - `informationTypes`: types of information processed by this asset (e.g. `CUSTOMER_INFORMATION`, `FINANCIAL_RECORDS`) ## Complete export script (Python) This script authenticates, pages through every asset record, and writes the result to a CSV file: ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportAssets($first: Int, $after: String, $filter: AssetFilter) { assets_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description notBefore expires archived confidentiality integrity availability mao rto rpo informationTypes controls { id sequenceId name } risks { id sequenceId name treatment } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def export_assets(access_token, include_archived=False): assets = [] cursor = None asset_filter = {"archived": include_archived} if include_archived else {} while True: data = graphql( QUERY, {"first": 50, "after": cursor, "filter": asset_filter}, access_token, ) page = data["assets_paged"] assets.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return assets def to_csv(assets, output_path): if not assets: print("No assets found.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "ID", "Sequence ID", "Custom ID", "Name", "Description", "Not Before", "Expires", "Archived", "Confidentiality", "Integrity", "Availability", "MAO", "RTO", "RPO", "Information Types", "Linked Controls", "Linked Risks", "Owners", ]) for a in assets: owners = [ asgn["user"]["email"] for asgn in a["assignments"] if asgn["assignmentType"] == "OWNER" ] writer.writerow([ a["id"], a["sequenceId"], a.get("customId", ""), a["name"], a.get("description", ""), a.get("notBefore", ""), a.get("expires", ""), a["archived"], a.get("confidentiality", ""), a.get("integrity", ""), a.get("availability", ""), a.get("mao", ""), a.get("rto", ""), a.get("rpo", ""), ", ".join(a.get("informationTypes") or []), ", ".join(c["name"] for c in a["controls"]), ", ".join(r["name"] for r in a["risks"]), ", ".join(owners), ]) print(f"Exported {len(assets)} assets to {output_path}") if __name__ == "__main__": ACCESS_TOKEN = "eyJhbGci..." assets = export_assets(ACCESS_TOKEN) to_csv(assets, "assets_export.csv") ``` ## Filtering examples Pass a `filter` argument to narrow the export. These are the combinations asked for most often: **Assets with high impact:** ```json { "filter": { "impact": ["HIGH"] } } ``` **Assets linked to a specific control:** ```json { "filter": { "controls": ["control-uuid-here"] } } ``` **Assets assigned to a specific user:** ```json { "filter": { "assignees": ["user-uuid-here"] } } ``` **Assets linked to a specific framework:** ```json { "filter": { "frameworks": ["framework-uuid-here"] } } ``` ## Count only To check how many assets exist before exporting the full set: ```graphql query { assets_count(filter: { archived: false }) } ``` ### Authentication URL: https://tidalcontrol.com/docs/api/authentication Authenticate with the Tidal Control API. The OAuth 2.0 Device Authorization Grant for scripts and CLI tools, plus read-only machine-to-machine credentials. The Tidal Control API uses **Bearer tokens** for authentication. Tokens are issued by your tenant's Keycloak realm using the **OAuth 2.0 Device Authorization Grant** (RFC 8628). This flow is designed for scripts and CLI tools that cannot open a browser window themselves, and the token acts as you, with your permissions. If your integration runs unattended (a scheduled export into a BI tool, a server-to-server sync), use read-only **machine-to-machine credentials** instead. See **Machine-to-machine authentication** at the end of this page. ## Prerequisites You need your **tenant name**: the Keycloak realm identifier for your organisation. It is the organisation identifier in your portal URL: ``` https://portal.tidalcontrol.com/{your-tenant}/ ``` For example, if your portal URL is `https://portal.tidalcontrol.com/demo/`, your tenant name is `demo`. Throughout this guide, replace `{your-tenant}` with your actual tenant name. ## The authentication flow The Device Authorization Grant works in three steps: 1. Your script requests a device code from Keycloak 2. You (or the script user) log in via a browser URL 3. Your script polls for the access token once login is complete ### Step 1: Request a device code ```bash curl -X POST \ "https://auth.tidalcontrol.com/realms/{your-tenant}/protocol/openid-connect/auth/device" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_id=portal&scope=openid" ``` Response: ```json { "device_code": "...", "user_code": "ABCD-1234", "verification_uri": "https://auth.tidalcontrol.com/realms/{your-tenant}/device", "verification_uri_complete": "https://auth.tidalcontrol.com/realms/{your-tenant}/device?user_code=ABCD-1234", "expires_in": 600, "interval": 5 } ``` ### Step 2: Log in via browser Open `verification_uri_complete` in a browser and log in with your Tidal Control credentials. Your script waits while you do this. ### Step 3: Poll for the token Poll the token endpoint every `interval` seconds until login completes: ```bash curl -X POST \ "https://auth.tidalcontrol.com/realms/{your-tenant}/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=portal&device_code={device_code}" ``` Once the user has logged in, the response contains your access token: ```json { "access_token": "eyJhbGci...", "expires_in": 300, "refresh_token": "eyJhbGci...", "refresh_expires_in": 1800, "token_type": "Bearer" } ``` > **info:** Access tokens expire after **5 minutes**. Use the `refresh_token` to get a new access token without re-authenticating (see below). ## Making API requests Include the access token in every GraphQL request as a `Bearer` header: ```bash curl -X POST https://portal.tidalcontrol.com/graphql \ -H "Authorization: Bearer {access_token}" \ -H "Content-Type: application/json" \ -d '{"query": "{ tenant { name displayName } }"}' ``` ## Complete Python example This script handles the full authentication flow and saves the token for reuse: ```python TENANT = "{your-tenant}" BASE_URL = f"https://auth.tidalcontrol.com/realms/{TENANT}/protocol/openid-connect" CLIENT_ID = "portal" GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" def get_token(): # Step 1: Request device code r = requests.post( f"{BASE_URL}/auth/device", data={"client_id": CLIENT_ID, "scope": "openid"}, ) r.raise_for_status() device = r.json() print(f"\nOpen this URL in your browser to log in:") print(f" {device['verification_uri_complete']}\n") # Step 2: Poll for token interval = device.get("interval", 5) deadline = time.time() + device["expires_in"] while time.time() < deadline: time.sleep(interval) r = requests.post( f"{BASE_URL}/token", data={ "grant_type": "urn:ietf:params:oauth:grant-type:device_code", "client_id": CLIENT_ID, "device_code": device["device_code"], }, ) if r.status_code == 200: token = r.json() print("Authentication successful.") return token body = r.json() if body.get("error") == "authorization_pending": continue # Still waiting for user to log in if body.get("error") == "slow_down": interval += 5 continue r.raise_for_status() raise RuntimeError("Authentication timed out.") def refresh_token(refresh_tok): r = requests.post( f"{BASE_URL}/token", data={ "grant_type": "refresh_token", "client_id": CLIENT_ID, "refresh_token": refresh_tok, }, ) r.raise_for_status() return r.json() def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] if __name__ == "__main__": token = get_token() data = graphql("{ tenant { name displayName } }", {}, token["access_token"]) print(json.dumps(data, indent=2)) ``` ## Refreshing an expired token When the access token expires, use the refresh token instead of going through the full login flow again: ```python token = refresh_token(token["refresh_token"]) access_token = token["access_token"] ``` > **tip:** Refresh tokens also expire (typically after 30 minutes of inactivity). If a refresh fails, run the full `get_token()` flow again. ## Machine-to-machine authentication For unattended integrations that run without a person present (a nightly export into a BI tool, a scheduled server-to-server sync), use **machine-to-machine (M2M) credentials** instead of the device flow. An M2M credential is an OAuth 2.0 **Client Credentials** client: a `client_id` and `client_secret` pair that your script exchanges directly for an access token, with no browser step. M2M credentials are **read-only**. They can run queries but cannot run mutations. > **info:** M2M credentials are enabled per organisation. If you don't see the **API Credentials** page in your settings, email support@tidalcontrol.com to have it enabled. ### Creating a credential Creating credentials requires the **Super User** role. 1. Go to **Settings → API Credentials**. 2. Click **Create credential**, give it a label, and optionally set an expiry date. 3. Copy the **client secret** immediately. It is shown **once** and cannot be retrieved again. Store it in a secret manager or vault, never in plaintext config. You now have a `client_id` and a `client_secret`. Together these are your credential. ### Requesting a token Exchange the credential for an access token using the `client_credentials` grant. There is no browser step and no `scope` parameter: ```bash curl -X POST \ "https://auth.tidalcontrol.com/realms/{your-tenant}/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id={client_id}" \ -d "client_secret={client_secret}" ``` Response: ```json { "access_token": "eyJhbGci...", "expires_in": 300, "token_type": "Bearer" } ``` > **info:** This flow has **no refresh token**. When the access token expires (after about 5 minutes), request a new one with the same `client_credentials` call. Include the access token in every GraphQL request as a `Bearer` header, exactly as in **Making API requests** above. ### Complete shell example Set `CLIENT_SECRET` to the secret you copied, then fetch a token and call the API: ```bash export CLIENT_SECRET='' ACCESS_TOKEN=$(curl -s -X POST \ "https://auth.tidalcontrol.com/realms/{your-tenant}/protocol/openid-connect/token" \ -d "grant_type=client_credentials" \ -d "client_id={client_id}" \ -d "client_secret=$CLIENT_SECRET" \ | jq -r .access_token) curl -s https://portal.tidalcontrol.com/graphql \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"query": "{ currentTenant { name } }"}' ``` ### What a credential can read A read-only credential can read your organisation's **entire data set**: controls, evidence, personnel, KPIs, reports, and the user directory (names and email addresses). Treat a leaked secret as full-organisation data exposure and rotate it immediately. ### Rotating and revoking From **Settings → API Credentials**, use the row actions (kebab menu, three vertical dots) to: - **Rotate**: generate a new secret and invalidate the old one. Update your integration with the new secret. - **Revoke**: disable the credential permanently. > **tip:** Access tokens stay valid until they expire (about 5 minutes), so a rotate, revoke, or expiry takes effect within one token lifetime. Allow for up to a 5-minute window before the change is fully enforced. ### Exporting controls URL: https://tidalcontrol.com/docs/api/controls Export controls from the Tidal Control API with the controls_paged query, with category, effectiveness status, linked risks, assets and framework references. Controls are exported using the `controls_paged` query. Each control includes its category, effectiveness status, linked risks, assets, and framework references. ## Basic query ```graphql query ExportControls($first: Int, $after: String, $filter: ControlFilter) { controls_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description category notBefore expires archived risks { id sequenceId name treatment } assets { id name } assignments { assignmentType user { name email } } controlStatus { progress { effectiveness closedTasks totalTasks } issues { open closed } } attributes { key value } } } pageInfo { hasNextPage endCursor } } } ``` Variables to fetch the first page: ```json { "first": 50, "after": null, "filter": {} } ``` ## Key fields - `sequenceId`: the human-readable number shown in the UI (e.g. C-15) - `customId`: optional custom identifier (e.g. ISO 27001 control reference) - `category`: the control category, e.g. `ACCESS_CONTROL`, `DATA_SECURITY_AND_PRIVACY` - `controlStatus.progress.effectiveness`: `UNDETERMINED`, `INEFFECTIVE`, or `EFFECTIVE` - `controlStatus.progress.closedTasks` / `totalTasks`: task completion ratio ## Complete export script (Python) This script authenticates, pages through every control record, and writes the result to a CSV file: ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportControls($first: Int, $after: String, $filter: ControlFilter) { controls_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description category notBefore expires archived risks { id sequenceId name treatment } assets { id name } assignments { assignmentType user { name email } } controlStatus { progress { effectiveness closedTasks totalTasks } issues { open closed } } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def export_controls(access_token, include_archived=False): controls = [] cursor = None control_filter = {"archived": include_archived} if include_archived else {} while True: data = graphql( QUERY, {"first": 50, "after": cursor, "filter": control_filter}, access_token, ) page = data["controls_paged"] controls.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return controls def to_csv(controls, output_path): if not controls: print("No controls found.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "ID", "Sequence ID", "Custom ID", "Name", "Description", "Category", "Not Before", "Expires", "Archived", "Effectiveness", "Closed Tasks", "Total Tasks", "Open Issues", "Closed Issues", "Linked Risks", "Linked Assets", "Owners", ]) for c in controls: progress = c["controlStatus"]["progress"] issues = c["controlStatus"]["issues"] owners = [ a["user"]["email"] for a in c["assignments"] if a["assignmentType"] == "OWNER" ] writer.writerow([ c["id"], c["sequenceId"], c.get("customId", ""), c["name"], c.get("description", ""), c.get("category", ""), c.get("notBefore", ""), c.get("expires", ""), c["archived"], progress["effectiveness"], progress["closedTasks"], progress["totalTasks"], issues["open"], issues["closed"], ", ".join(r["name"] for r in c["risks"]), ", ".join(a["name"] for a in c["assets"]), ", ".join(owners), ]) print(f"Exported {len(controls)} controls to {output_path}") if __name__ == "__main__": ACCESS_TOKEN = "eyJhbGci..." controls = export_controls(ACCESS_TOKEN) to_csv(controls, "controls_export.csv") ``` ## Filtering examples Pass a `filter` argument to narrow the export. These are the combinations asked for most often: **Only effective controls:** ```python # Filter in Python after fetching (effectiveness is in controlStatus, not a top-level filter field) effective = [c for c in controls if c["controlStatus"]["progress"]["effectiveness"] == "EFFECTIVE"] ``` **Controls in a specific category:** ```json { "filter": { "categories": ["ACCESS_CONTROL"] } } ``` **Controls linked to a specific framework:** ```json { "filter": { "frameworks": ["framework-uuid-here"] } } ``` **Controls with open issues:** ```python with_issues = [c for c in controls if c["controlStatus"]["issues"]["open"] > 0] ``` ## Count only To check how many controls exist before exporting the full set: ```graphql query { controls_count(filter: { archived: false }) } ``` ### Exporting issues URL: https://tidalcontrol.com/docs/api/issues Export issues from the Tidal Control API with the issues_paged query. Findings, gaps, incidents and action plans linked to controls and assets, with a script. Issues are exported using the `issues_paged` query. Issues represent findings, gaps, incidents, and action plans linked to controls and assets. ## Basic query ```graphql query ExportIssues($first: Int, $after: String, $filter: IssueFilter) { issues_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name description priority issueType notBefore expires closedDate reviewedDate createdDate controls { id sequenceId name } assets { id name } assignments { assignmentType user { name email } } attributes { key value } } } pageInfo { hasNextPage endCursor } } } ``` Variables to fetch the first page: ```json { "first": 50, "after": null, "filter": {} } ``` ## Key fields - `sequenceId`: the human-readable number shown in the UI (e.g. I-23) - `priority`: `LOW`, `MEDIUM`, or `HIGH` - `issueType`: `GENERIC`, `AUDIT_FINDING`, `CONTROL_GAP`, `CONTROL_DEFICIENCY`, `ACTION_PLAN`, `IMPROVEMENT_OPPORTUNITY`, or `INCIDENT` - `closedDate`: set when the issue is closed; `null` if still open - `reviewedDate`: set when the issue has been reviewed ## Complete export script (Python) This script authenticates, pages through every issue record, and writes the result to a CSV file: ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportIssues($first: Int, $after: String, $filter: IssueFilter) { issues_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name description priority issueType notBefore expires closedDate reviewedDate createdDate controls { id sequenceId name } assets { id name } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def export_issues(access_token, closed=None, priority=None, issue_type=None): issues = [] cursor = None issue_filter = {} if closed is not None: issue_filter["closed"] = closed if priority: issue_filter["priority"] = priority if issue_type: issue_filter["type"] = issue_type while True: data = graphql( QUERY, {"first": 50, "after": cursor, "filter": issue_filter}, access_token, ) page = data["issues_paged"] issues.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return issues def to_csv(issues, output_path): if not issues: print("No issues found.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "ID", "Sequence ID", "Name", "Description", "Priority", "Type", "Not Before", "Expires", "Created Date", "Closed Date", "Reviewed Date", "Linked Controls", "Linked Assets", "Owners", ]) for i in issues: owners = [ a["user"]["email"] for a in i["assignments"] if a["assignmentType"] == "OWNER" ] writer.writerow([ i["id"], i["sequenceId"], i["name"], i.get("description", ""), i.get("priority", ""), i.get("issueType", ""), i.get("notBefore", ""), i.get("expires", ""), i.get("createdDate", ""), i.get("closedDate", "") or "", i.get("reviewedDate", "") or "", ", ".join(c["name"] for c in i["controls"]), ", ".join(a["name"] for a in i["assets"]), ", ".join(owners), ]) print(f"Exported {len(issues)} issues to {output_path}") if __name__ == "__main__": ACCESS_TOKEN = "eyJhbGci..." # Export all open high-priority issues issues = export_issues(ACCESS_TOKEN, closed=False, priority=["HIGH"]) to_csv(issues, "issues_export.csv") ``` ## Filtering examples Pass a `filter` argument to narrow the export. These are the combinations asked for most often: **Only open issues:** ```json { "filter": { "closed": false } } ``` **High-priority open issues:** ```json { "filter": { "closed": false, "priority": ["HIGH"] } } ``` **Audit findings only:** ```json { "filter": { "type": ["AUDIT_FINDING"] } } ``` **Issues linked to a specific control:** ```json { "filter": { "controls": ["control-uuid-here"] } } ``` **Overdue issues:** ```json { "filter": { "status": ["OVERDUE"] } } ``` ## Count only To check how many issues exist before exporting the full set: ```graphql query { issues_count(filter: { closed: false }) } ``` ### Querying data URL: https://tidalcontrol.com/docs/api/querying-data The pagination, filtering and sorting patterns every list query in the Tidal Control API shares. Learn them once, plus counting records and handling errors. All list queries in the Tidal Control API follow the same patterns for pagination, filtering, and sorting. Learn them once and they apply everywhere. ## Request structure Every GraphQL request is a `POST` to `https://portal.tidalcontrol.com/graphql` with a JSON body: ```json { "query": "...", "variables": { ... } } ``` Always use `variables` instead of inlining values into the query string. It keeps queries readable and avoids injection issues. ## Pagination All `*_paged` queries use **cursor-based pagination** following the Relay Connection spec. Request a page with `first` (page size) and `after` (cursor from the previous page): ```graphql query ExportRisks($first: Int, $after: String) { risks_paged(first: $first, after: $after) { edges { node { id name } } pageInfo { hasNextPage endCursor } } } ``` Variables: ```json { "first": 50, "after": null } ``` When `pageInfo.hasNextPage` is `true`, pass `pageInfo.endCursor` as `after` in the next request. ### Fetching all pages (Python) ```python def fetch_all(graphql_fn, query, page_size=50): """Fetch all pages of a paged query. graphql_fn(query, variables) must return data.""" results = [] cursor = None while True: data = graphql_fn(query, {"first": page_size, "after": cursor}) # Extract the first (and only) key from the response key = next(iter(data)) page = data[key] results.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return results ``` > **tip:** A page size of `50` is a good default. You can go higher, but very large pages may increase response time. ## Filtering Pass a `filter` argument to narrow results. Each entity has its own filter type with relevant fields. All filter fields are optional. Omit any field you don't need. This example fetches only open, high-priority issues: ```graphql query FilteredIssues($filter: IssueFilter) { issues_paged(first: 50, filter: $filter) { edges { node { id name priority } } pageInfo { hasNextPage endCursor } } } ``` Variables: ```json { "filter": { "closed": false, "priority": ["HIGH"] } } ``` ### Common filter fields A handful of fields work the same way across almost every entity. **Available on most entities:** - `archived: Boolean`: include or exclude archived records - `assignees: [UUID!]`: filter by assigned user IDs - `search: String`: free-text search on name/description **Activities (issues, tasks):** - `closed: Boolean`: open or closed activities - `controls: [UUID!]`: activities linked to specific controls - `assets: [UUID!]`: activities linked to specific assets - `status: [ActivityDueStatus!]`: `NOT_DUE_SOON`, `DUE_SOON`, `OVERDUE`, `NOT_SET` **Issues only:** - `priority: [Priority!]`: `LOW`, `MEDIUM`, `HIGH` - `type: [IssueType!]`: e.g. `AUDIT_FINDING`, `INCIDENT`, `CONTROL_GAP` **Risks and controls:** - `frameworks: [UUID!]`: linked to specific frameworks - `references: [UUID!]`: linked to specific framework references ## Sorting Pass a `sort` array to control the order of results. Each sort item specifies a `field` name and an optional `direction` (`ASC` or `DESC`): ```graphql query SortedRisks { risks_paged( first: 50, sort: [{ field: "sequenceId", direction: ASC }] ) { edges { node { sequenceId name } } pageInfo { hasNextPage endCursor } } } ``` You can pass multiple sort fields. Common sortable fields include `name`, `sequenceId`, `createdDate`, `notBefore`, and `expires`. ## Counting records Use `*_count` queries to get a total count without fetching all data: ```graphql query { risks_count controls_count(filter: { archived: false }) issues_count(filter: { closed: false, priority: ["HIGH"] }) } ``` ## Error handling A successful response always has HTTP status `200`, even when the GraphQL query itself has errors. Check the `errors` array in the response body: ```json { "data": null, "errors": [ { "message": "Unauthorized", "locations": [{ "line": 1, "column": 1 }] } ] } ``` Common errors: - **Unauthorized**: your token is missing or expired; re-authenticate - **Field does not exist**: check the field name against the schema - **Variable … expected type …**: a filter variable has the wrong type ### Reporting use cases URL: https://tidalcontrol.com/docs/api/reporting Build the reports compliance teams need from the Tidal Control API. Control effectiveness per period, overdue controls, combined status and department filters. These examples show how to build the operational reports that compliance teams commonly need: control effectiveness per period, overdue task tracking, and combined status overviews. > **info:** The API does not support server-side date range filters. All period filtering (e.g. "February only", "Q1") is done client-side by filtering on the `closedDate` field after fetching data. > **tip:** The scripts on this page use `get_token()` from the [Authentication](/docs/api/authentication) page. Copy that function into your script, or import it from a shared module. ## Control effectiveness report (by period) Assessments are the source of truth for effectiveness. Each assessment has a `closedDate` (when the task was completed) and an `effectiveness` value (`EFFECTIVE`, `INEFFECTIVE`, or `UNDETERMINED`). To report on a specific month or quarter, fetch all assessments and filter by `closedDate` in your script. ```python from datetime import date GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportAssessments($first: Int, $after: String, $filter: ActivityFilter) { activities_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name closedDate createdDate controls { id sequenceId name category } assets { id name } assignments { assignmentType user { name email } } ... on Assessment { effectiveness } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def fetch_all_assessments(access_token): results = [] cursor = None while True: data = graphql(QUERY, {"first": 50, "after": cursor, "filter": {"activityTypes": ["ASSESS"]}}, access_token) page = data["activities_paged"] results.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return results def filter_by_period(assessments, start: date, end: date): """Keep only assessments closed within [start, end] (inclusive).""" filtered = [] for a in assessments: closed = a.get("closedDate") if not closed: continue closed_date = date.fromisoformat(closed[:10]) if start <= closed_date <= end: filtered.append(a) return filtered def to_csv(assessments, output_path): if not assessments: print("No assessments found for this period.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "Sequence ID", "Name", "Effectiveness", "Closed Date", "Created Date", "Control", "Control Category", "Assets", "Executor", ]) for a in assessments: controls = a.get("controls", []) control_names = ", ".join(c["name"] for c in controls) control_categories = ", ".join(c.get("category", "") for c in controls) assets = ", ".join(x["name"] for x in a.get("assets", [])) executors = [ x["user"]["email"] for x in a.get("assignments", []) if x["assignmentType"] == "EXECUTOR" ] writer.writerow([ a["sequenceId"], a["name"], a["effectiveness"], a.get("closedDate", "")[:10] if a.get("closedDate") else "", a.get("createdDate", "")[:10] if a.get("createdDate") else "", control_names, control_categories, assets, ", ".join(executors), ]) print(f"Exported {len(assessments)} assessments to {output_path}") if __name__ == "__main__": token = get_token() access_token = token["access_token"] all_assessments = fetch_all_assessments(access_token) # February 2025 february = filter_by_period(all_assessments, date(2025, 2, 1), date(2025, 2, 28)) to_csv(february, "effectiveness_february_2025.csv") # Q1 2025 q1 = filter_by_period(all_assessments, date(2025, 1, 1), date(2025, 3, 31)) to_csv(q1, "effectiveness_q1_2025.csv") ``` ## Overdue controls report Fetch all tasks that are currently overdue, with the controls they belong to. ```python OVERDUE_QUERY = """ query OverdueTasks($first: Int, $after: String, $filter: ActivityFilter) { activities_paged(first: $first, after: $after, filter: $filter) { edges { node { sequenceId name expires controls { sequenceId name category } assets { name } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } """ def fetch_overdue_tasks(access_token): results = [] cursor = None while True: data = graphql( OVERDUE_QUERY, {"first": 50, "after": cursor, "filter": {"activityTypes": ["EXECUTE"], "status": ["OVERDUE"]}}, access_token, ) page = data["activities_paged"] results.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return results ``` ## Combined status report This example combines both overdue tasks and effectiveness results into a single per-control summary. ```python from collections import defaultdict def build_control_summary(overdue_tasks, assessments): """ Returns a dict keyed by control sequenceId with: - overdue_tasks: count of currently overdue tasks - effective: count of EFFECTIVE assessments - ineffective: count of INEFFECTIVE assessments - undetermined: count of UNDETERMINED assessments """ summary = defaultdict(lambda: { "name": "", "category": "", "overdue_tasks": 0, "effective": 0, "ineffective": 0, "undetermined": 0, }) for task in overdue_tasks: for control in task.get("controls", []): cid = control["sequenceId"] summary[cid]["name"] = control["name"] summary[cid]["category"] = control.get("category", "") summary[cid]["overdue_tasks"] += 1 for a in assessments: for control in a.get("controls", []): cid = control["sequenceId"] summary[cid]["name"] = control["name"] summary[cid]["category"] = control.get("category", "") eff = a["effectiveness"].lower() if eff in ("effective", "ineffective", "undetermined"): summary[cid][eff] += 1 return summary def summary_to_csv(summary, output_path): with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "Control ID", "Name", "Category", "Overdue Tasks", "Effective", "Ineffective", "Undetermined", ]) for cid, row in sorted(summary.items()): writer.writerow([ cid, row["name"], row["category"], row["overdue_tasks"], row["effective"], row["ineffective"], row["undetermined"], ]) print(f"Summary written to {output_path}") if __name__ == "__main__": token = get_token() access_token = token["access_token"] overdue = fetch_overdue_tasks(access_token) all_assessments = fetch_all_assessments(access_token) q1 = filter_by_period(all_assessments, date(2025, 1, 1), date(2025, 3, 31)) summary = build_control_summary(overdue, q1) summary_to_csv(summary, "control_summary_q1_2025.csv") ``` ## Filtering by department Tidal Control does not have a native "department" or "business unit" field on controls or tasks. There are two common ways to model this: **Using assets**: If your organisation links controls to assets that represent departments or business units, filter by asset name after fetching: ```python department = "Finance" dept_controls = [ c for c in controls if any(a["name"] == department for a in c.get("assets", [])) ] ``` **Using control attributes**: If your organisation uses custom attributes to tag controls with a department, filter on the `attributes` field: ```python department = "Finance" dept_controls = [ c for c in controls if any( attr["key"] == "department" and attr["value"] == department for attr in c.get("attributes", []) ) ] ``` > **tip:** If neither of these fits your setup, contact support@tidalcontrol.com to discuss how your organisation has structured department information in Tidal. ### Exporting risks URL: https://tidalcontrol.com/docs/api/risks Export risks from the Tidal Control API with the risks_paged query, including likelihood, impact and residual scores, treatment decisions and linked controls. Risks are exported using the `risks_paged` query. Each risk includes its assessment scores (likelihood, impact, residual scores), treatment decision, linked controls, and linked assets. ## Basic query ```graphql query ExportRisks($first: Int, $after: String, $filter: RiskFilter) { risks_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description notBefore expires archived likelihood impact residualLikelihood residualImpact treatment treatmentNotes appetite controls { id sequenceId name } assets { id name } assignments { assignmentType user { name email } } attributes { key value } } } pageInfo { hasNextPage endCursor } } } ``` Variables to fetch the first page: ```json { "first": 50, "after": null, "filter": {} } ``` ## Key fields - `sequenceId`: the human-readable number shown in the UI (e.g. R-42) - `customId`: optional custom identifier set by your team - `likelihood` / `impact`: inherent risk scores (1-5 scale) - `residualLikelihood` / `residualImpact`: residual risk scores after controls - `treatment`: one of `ACCEPT`, `AVOID`, `TRANSFER`, `REDUCE` - `appetite`: the organisation's risk appetite score for this risk ## Complete export script (Python) This script authenticates, pages through every risk record, and writes the result to a CSV file: ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportRisks($first: Int, $after: String, $filter: RiskFilter) { risks_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId customId name description notBefore expires archived likelihood impact residualLikelihood residualImpact treatment treatmentNotes appetite controls { id name } assets { id name } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def export_risks(access_token, include_archived=False): risks = [] cursor = None risk_filter = {"archived": include_archived} if include_archived else {} while True: data = graphql( QUERY, {"first": 50, "after": cursor, "filter": risk_filter}, access_token, ) page = data["risks_paged"] risks.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return risks def to_csv(risks, output_path): if not risks: print("No risks found.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "ID", "Sequence ID", "Custom ID", "Name", "Description", "Not Before", "Expires", "Archived", "Likelihood", "Impact", "Residual Likelihood", "Residual Impact", "Treatment", "Treatment Notes", "Appetite", "Controls", "Assets", "Owners", ]) for r in risks: owners = [ a["user"]["email"] for a in r["assignments"] if a["assignmentType"] == "OWNER" ] writer.writerow([ r["id"], r["sequenceId"], r.get("customId", ""), r["name"], r.get("description", ""), r.get("notBefore", ""), r.get("expires", ""), r["archived"], r.get("likelihood", ""), r.get("impact", ""), r.get("residualLikelihood", ""), r.get("residualImpact", ""), r.get("treatment", ""), r.get("treatmentNotes", ""), r.get("appetite", ""), ", ".join(c["name"] for c in r["controls"]), ", ".join(a["name"] for a in r["assets"]), ", ".join(owners), ]) print(f"Exported {len(risks)} risks to {output_path}") if __name__ == "__main__": # Paste your access token here, or load it from the authentication script ACCESS_TOKEN = "eyJhbGci..." risks = export_risks(ACCESS_TOKEN) to_csv(risks, "risks_export.csv") ``` ## Filtering examples Pass a `filter` argument to narrow the export. These are the combinations asked for most often: **Only active (non-archived) risks:** ```json { "filter": { "archived": false } } ``` **Risks with treatment REDUCE:** ```graphql # The RiskFilter does not filter by treatment directly. # Fetch all and filter in Python: risks_with_reduce = [r for r in risks if r.get("treatment") == "REDUCE"] ``` **Risks assigned to a specific user:** ```json { "filter": { "assignees": ["user-uuid-here"] } } ``` **Risks linked to a specific framework:** ```json { "filter": { "frameworks": ["framework-uuid-here"] } } ``` > **info:** To find user UUIDs or framework UUIDs, use the `users_paged` or `frameworks_paged` queries respectively. ## Count only To check how many risks exist before exporting: ```graphql query { risks_count(filter: { archived: false }) } ``` ### Schema introspection URL: https://tidalcontrol.com/docs/api/schema-introspection Use GraphQL introspection to discover which queries, mutations, types and fields the Tidal Control API exposes, and inspect a mutation before you ever call it. GraphQL has built-in introspection: you can query the schema itself to discover what queries, types, and fields are available. This is useful when building scripts or exploring what data you can access. All introspection queries use the same endpoint and authentication as regular queries. ## List all available queries ```graphql { __schema { queryType { fields { name description } } } } ``` This returns the full list of root query fields: `controls_paged`, `activities_paged`, `risks_paged`, and so on. ## List all available mutations Mutations work the same way. Query `mutationType` instead of `queryType`: ```graphql { __schema { mutationType { fields { name description } } } } ``` This returns every mutation you can call: `addExecution`, `addEvidenceToExecution`, and so on. > **info:** A read-only [machine-to-machine credential](/docs/api/authentication) can *introspect* mutations (read their names) but cannot *run* them. To execute a mutation, authenticate with the Device Authorization Grant so your token carries write permissions. ### Inspect a mutation's arguments Add `args` to see what input each mutation expects: ```graphql { __schema { mutationType { fields { name args { name description type { name kind ofType { name kind } } } } } } } ``` When an argument is an input object (for example `ExecutionInput`), inspect its fields with `__type` and `inputFields`: ```graphql { __type(name: "ExecutionInput") { inputFields { name description type { name kind ofType { name } } } } } ``` For a worked example that chains several mutations together, see [Adding evidence](/docs/api/adding-evidence). ## Inspect a specific type Use `__type` to see the fields available on any type: ```graphql { __type(name: "Activity") { fields { name description type { name kind ofType { name kind } } } } } ``` Replace `"Activity"` with any type name (`"Control"`, `"Risk"`, `"Issue"`, or `"Assessment"`). ## List enum values To see the valid values for an enum type: ```graphql { __type(name: "ActivityDueStatus") { enumValues { name } } } ``` Common enums worth inspecting: `ActivityDueStatus`, `Effectiveness`, `ControlCategory`, `Priority`, `IssueType`. ## Complete Python example This script authenticates and prints a summary of the schema: all query fields and the fields on a given type. ```python TENANT = "{your-tenant}" BASE_URL = f"https://auth.tidalcontrol.com/realms/{TENANT}/protocol/openid-connect" CLIENT_ID = "portal" GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" def get_token(): r = requests.post( f"{BASE_URL}/auth/device", data={"client_id": CLIENT_ID, "scope": "openid"}, ) r.raise_for_status() device = r.json() print(f"\nOpen this URL in your browser to log in:") print(f" {device['verification_uri_complete']}\n") interval = device.get("interval", 5) deadline = time.time() + device["expires_in"] while time.time() < deadline: time.sleep(interval) r = requests.post( f"{BASE_URL}/token", data={ "grant_type": "urn:ietf:params:oauth:grant-type:device_code", "client_id": CLIENT_ID, "device_code": device["device_code"], }, ) if r.status_code == 200: print("Authentication successful.") return r.json() body = r.json() if body.get("error") == "authorization_pending": continue if body.get("error") == "slow_down": interval += 5 continue r.raise_for_status() raise RuntimeError("Authentication timed out.") def graphql(query, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": {}}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def list_queries(access_token): data = graphql( "{ __schema { queryType { fields { name description } } } }", access_token, ) fields = data["__schema"]["queryType"]["fields"] print(f"\n{len(fields)} query fields available:\n") for f in sorted(fields, key=lambda x: x["name"]): desc = f.get("description") or "" print(f" {f['name']:<40} {desc}") def describe_type(type_name, access_token): data = graphql( f'{{ __type(name: "{type_name}") {{ fields {{ name description ' f'type {{ name kind ofType {{ name }} }} }} }} }}', access_token, ) t = data.get("__type") if not t: print(f"Type '{type_name}' not found.") return print(f"\nFields on {type_name}:\n") for f in t["fields"]: type_info = f["type"] type_name_str = type_info.get("name") or (type_info.get("ofType") or {}).get("name", "") print(f" {f['name']:<30} {type_name_str}") if __name__ == "__main__": token = get_token() access_token = token["access_token"] list_queries(access_token) describe_type("Activity", access_token) describe_type("Control", access_token) ``` ### Exporting tasks URL: https://tidalcontrol.com/docs/api/tasks Export tasks and assessments from the Tidal Control API with activities_paged and an activityTypes filter, using inline fragments for assessment-only fields. Tasks (executions) and assessments both use the `activities_paged` query with an `activityTypes` filter. Both types share the `Activity` interface, which provides all common fields. Use an inline fragment (`... on Assessment`) to access assessment-specific fields like `effectiveness`. ## Basic query: tasks (executions) ```graphql query ExportTasks($first: Int, $after: String, $filter: ActivityFilter) { activities_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name description notBefore expires closedDate reviewedDate createdDate plan { id name } controls { id sequenceId name } assets { id name } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } ``` Variables to fetch the first page of tasks: ```json { "first": 50, "after": null, "filter": { "activityTypes": ["EXECUTE"] } } ``` ## Key fields - `sequenceId`: the human-readable number shown in the UI - `closedDate`: set when the task is completed; `null` if still open - `reviewedDate`: set when the task has been reviewed by a reviewer - `plan`: the Plan that generated this task ## Complete export script (Python) This script authenticates, pages through every task record, and writes the result to a CSV file: ```python GRAPHQL_URL = "https://portal.tidalcontrol.com/graphql" QUERY = """ query ExportTasks($first: Int, $after: String, $filter: ActivityFilter) { activities_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name description notBefore expires closedDate reviewedDate createdDate plan { id name } controls { id sequenceId name } assets { id name } assignments { assignmentType user { name email } } } } pageInfo { hasNextPage endCursor } } } """ def graphql(query, variables, access_token): r = requests.post( GRAPHQL_URL, json={"query": query, "variables": variables}, headers={"Authorization": f"Bearer {access_token}"}, ) r.raise_for_status() result = r.json() if "errors" in result: raise RuntimeError(result["errors"]) return result["data"] def export_tasks(access_token, closed=None, assignee_ids=None): tasks = [] cursor = None task_filter = {"activityTypes": ["EXECUTE"]} if closed is not None: task_filter["closed"] = closed if assignee_ids: task_filter["assignees"] = assignee_ids while True: data = graphql( QUERY, {"first": 50, "after": cursor, "filter": task_filter}, access_token, ) page = data["activities_paged"] tasks.extend(edge["node"] for edge in page["edges"]) if not page["pageInfo"]["hasNextPage"]: break cursor = page["pageInfo"]["endCursor"] return tasks def to_csv(tasks, output_path): if not tasks: print("No tasks found.") return with open(output_path, "w", newline="", encoding="utf-8") as f: writer = csv.writer(f) writer.writerow([ "ID", "Sequence ID", "Name", "Description", "Not Before", "Expires", "Created Date", "Closed Date", "Reviewed Date", "Plan", "Linked Controls", "Linked Assets", "Owners", "Executors", ]) for t in tasks: owners = [ a["user"]["email"] for a in t["assignments"] if a["assignmentType"] == "OWNER" ] executors = [ a["user"]["email"] for a in t["assignments"] if a["assignmentType"] == "EXECUTOR" ] writer.writerow([ t["id"], t["sequenceId"], t["name"], t.get("description", ""), t.get("notBefore", ""), t.get("expires", ""), t.get("createdDate", ""), t.get("closedDate", "") or "", t.get("reviewedDate", "") or "", t["plan"]["name"] if t.get("plan") else "", ", ".join(c["name"] for c in t["controls"]), ", ".join(a["name"] for a in t["assets"]), ", ".join(owners), ", ".join(executors), ]) print(f"Exported {len(tasks)} tasks to {output_path}") if __name__ == "__main__": token = get_token() access_token = token["access_token"] tasks = export_tasks(access_token, closed=False) to_csv(tasks, "tasks_export.csv") ``` ## Filtering examples Pass a `filter` argument to narrow the export. These are the combinations asked for most often: **Only open tasks:** ```json { "filter": { "activityTypes": ["EXECUTE"], "closed": false } } ``` **Overdue tasks:** ```json { "filter": { "activityTypes": ["EXECUTE"], "status": ["OVERDUE"] } } ``` **Tasks due soon:** ```json { "filter": { "activityTypes": ["EXECUTE"], "status": ["DUE_SOON"] } } ``` **Tasks linked to a specific control:** ```json { "filter": { "activityTypes": ["EXECUTE"], "controls": ["control-uuid-here"] } } ``` **Tasks assigned to a specific user:** ```json { "filter": { "activityTypes": ["EXECUTE"], "assignees": ["user-uuid-here"] } } ``` ## Exporting assessments Assessments use the same `activities_paged` query with `activityTypes: [ASSESS]`. Use the `... on Assessment` inline fragment to access the `effectiveness` field, which is specific to assessments. ```graphql query ExportAssessments($first: Int, $after: String, $filter: ActivityFilter) { activities_paged(first: $first, after: $after, filter: $filter) { edges { node { id sequenceId name closedDate createdDate controls { id name } assets { id name } assignments { assignmentType user { name email } } ... on Assessment { effectiveness } } } pageInfo { hasNextPage endCursor } } } ``` Variables: ```json { "first": 50, "after": null, "filter": { "activityTypes": ["ASSESS"] } } ``` The `effectiveness` field on assessments is: `UNDETERMINED`, `INEFFECTIVE`, or `EFFECTIVE`. ## Count only To check how many tasks exist before exporting the full set: ```graphql query { tasks_open: activities_count(filter: { closed: false, activityTypes: [EXECUTE] }) tasks_closed: activities_count(filter: { closed: true, activityTypes: [EXECUTE] }) assessments_open: activities_count(filter: { closed: false, activityTypes: [ASSESS] }) assessments_closed: activities_count(filter: { closed: true, activityTypes: [ASSESS] }) } ``` --- # Core concepts ## Core concepts URL: https://tidalcontrol.com/docs/core-concepts The concepts and entities behind Tidal Control and how they fit together, from frameworks and controls to assets, risks, tasks, tests, and PDCA plans. The key concepts and entities that make up Tidal Control, and how they fit together. ### How Tidal works URL: https://tidalcontrol.com/docs/core-concepts/how-tidal-works Tidal Control works outside-in across five layers, from frameworks and controls to assets, risks, tasks, tests and plans. How each layer feeds the next. Tidal is built around a five-layer **outside-in** model: you start with external requirements (laws, frameworks) and translate them inward to the operational security & compliance measures your organisation actually implements. This page explains each layer and shows how the entities connect. ## The outside-in approach The architecture follows a top-down flow: compliance requirements from the outside world drive the controls your organisation selects, which are then applied to your specific assets and risks, monitored through tasks and tests, and kept current by plans on a recurring schedule. ## Entity relationships The diagram below shows how the core data entities in Tidal Control relate to each other. **Reading the diagram:** - **Solid arrows** show direct relationships (e.g. a Plan generates Tasks; a Control applies to Assets). - **Dashed arrows** show optional or orchestration relationships (e.g. a Task fulfils a Control; a Risk is mitigated by Controls). ## The five layers explained Each layer answers to the one outside it, from external requirements down to the schedules that generate day-to-day work. ### Layer 1: Frameworks & References Frameworks are the **external compliance requirements** your organisation must meet: ISO 27001, GDPR, NIS2, SOC 2, and more than 30 others. Each framework is structured hierarchically: 1. **Framework** (e.g. ISO 27001) 2. **Chapter / Domain** (e.g. A.5 Organisational Controls) 3. **Reference** (e.g. A.5.1 Policies for information security) Tidal maps all references from all supported frameworks to a shared control library, so activating a new framework is largely a matter of seeing which of your existing controls already cover it. ### Layer 2: Controls Controls are the **concrete operational security & compliance measures** your organisation implements to satisfy framework requirements. Tidal provides pre-built control libraries across multiple domains (security & compliance, quality, AI governance, environmental, and more), each mapped across the relevant frameworks. **Two types:** - **Policy controls**: documentation and policies (e.g. Information Security Policy, Acceptable Use Policy) - **Operational / technical controls**: processes and technical measures (e.g. access rights management, MFA, patch management) Because one control can satisfy requirements from multiple frameworks simultaneously, you implement once and comply with many. ### Layer 3: Assets & Risks Assets are the **systems, services, and organisational units** you want to protect: cloud platforms, SaaS applications, databases, physical locations, personnel groups, projects, departments, business units, or business processes. Each control is linked to the assets it applies to, giving compliance a concrete, organisation-specific context. Risks are identified threats linked to assets. Tidal provides a standard risk library based on IRAM V2. Controls are mapped to the risks they mitigate, so you can trace from any risk to the controls that reduce its likelihood or impact. ### Layer 4: Tasks & Tests This layer provides **evidence** that controls are actually implemented and working. - **Tasks** are manual work items: write a policy, run a training session, perform an internal audit. They have an owner, a due date, and can carry uploaded evidence. - **Tests** are automated checks: Tidal (or an integration) verifies a configuration and records a pass/fail result. Examples include checking whether MFA is enabled for all users in Microsoft 365, or whether all S3 buckets in AWS are private. Together, tasks and tests give auditors a continuous, traceable record of compliance activity throughout the year, not just at audit time. ### Layer 5: Plans (PDCA) Plans are **recurring schedules** that orchestrate when tasks are generated and tests run, implementing the Plan-Do-Check-Act cycle: - **Plan by Control**: one task is created covering all assets linked to that control. - **Plan by Asset**: a separate task is created per asset (useful for asset-specific reviews like quarterly access rights checks). Plans automatically regenerate tasks on the configured frequency (annually, quarterly, monthly) to collect evidence for specific control and asset combinations. This ensures evidence is gathered continuously throughout the year, not just before an audit. ## End-to-end example A risk-based trace through the architecture for "unauthorised access to customer data":
Layer Entity Example
Frameworks ISO 27001 A.9.2 User access management
Controls B03 Access rights management
Assets AWS RDS Customer database
Risks Risk-047 Unauthorised access to sensitive data
Tasks Task Quarterly access rights review
Tests AWS test Are all IAM users still active?
Plans Quarterly plan Generates review task every 3 months
When the test turns red (a stale IAM user is detected), it surfaces immediately on the control, framework, and dashboard views, giving your team a clear action item to resolve. ## Next steps - [Getting started with Frameworks](/docs/frameworks/getting-started) - [Getting started with Controls](/docs/controls/getting-started) - [Getting started with Assets](/docs/assets/getting-started) - [Getting started with Plans](/docs/plans/getting-started) ### Task types and the three lines model URL: https://tidalcontrol.com/docs/core-concepts/three-lines-model Why Tidal has Executions, Assessments and Issues, which line owns each one, and how to set up assignments and plans so every group only gets its own work. Tidal has three task types because three different groups of people do three different jobs: the first line operates the controls, the second line concludes on whether they worked, and the third line audits both independently. This article covers which type belongs to which group, and how to set up assignments and plans so each group only gets its own work. ## Choosing between Executions, Assessments and Issues Pick the type by asking who is going to do the work, not what the work is about.
Task type Who does it What it establishes How it closes
Execution The team that runs the asset That the control was carried out over a period, with evidence Closed once the work is done and the evidence is attached
Assessment Security & compliance, risk, or quality Whether the controls in scope were effective over that period Closed by recording a verdict: Effective or Ineffective
Issue Whoever found the problem That something needs fixing, and who is fixing it Closed once the finding is resolved
If you are a small team where the same person does all three jobs, Executions alone are enough. The split starts paying off once the people who operate a control are no longer the people who judge it. ## How the three lines split the work The three lines model separates doing the work from judging the work, and Tidal gives each line its own task type so the two never collapse into one. The important property is independence. When the team that configured a firewall is also the team that signs off that the firewall control is effective, the sign-off is worth very little to an auditor. By giving the second line its own task with its own verdict, Tidal records two separate statements about the same period: the first line's "we did this, here is the proof", and the second line's "we looked at that proof and we agree it worked". ## First line: Executions An Execution asks the people who operate a system to carry out a control and leave proof that they did. The first line is management in the broad sense: asset owners, engineering, IT, HR, facilities. They are accountable for the thing itself, so they are the ones who patch the servers, run the awareness training, and review the access list. Two details make an Execution more than a to-do item: - **It covers a period**, not a moment. An Execution scoped to "Year 2026" or a quarter evidences that the control operated across that whole window, which is what an auditor asks about. - **It carries the evidence**. Whatever the first line uploads or writes in the conversation stays attached to that period, so the record survives long after the people involved have moved on. When a plan generates an Execution, it fills in the people from the roles already set on the control and the asset. Everyone listed under **Executors** becomes a contributor on the task, and everyone under **Owners** becomes an owner. You set these once per control or asset instead of assigning every generated task by hand. > **tip:** **The first line does not have to work in Tidal.** If your engineers live in Jira, Azure DevOps or TOPdesk, you can raise a work item there straight from a Tidal task, and its status syncs back into the Tidal task overview. The first line stays in its own tool while the second line keeps oversight in Tidal. See [External issues](/docs/integrations/external-issues). ## Second line: Assessments An Assessment asks an independent reviewer to conclude on whether the controls in its scope were effective, based on what the first line actually did. The second line is the expertise-and-challenge function: security & compliance officers, risk management, quality management. They do not implement the controls, they judge them. Their contributors come from the **Assessors** role on the control and the asset, which is why the same plan machinery can hand first-line and second-line work to entirely different people over the same scope. ### Recording the verdict An Assessment closes by recording a conclusion rather than by being ticked off. While it is open its effectiveness reads **Undetermined**; closing it means choosing **Effective** or **Ineffective**. Reopening an Assessment resets the verdict to Undetermined, so a reopened conclusion never lingers as a stale sign-off. That verdict feeds the effectiveness Tidal computes for the control itself. A control counts as effective when it has no failing tests, no overdue tasks, and its most recent closed Assessment is not rated Ineffective. A control with no tests and no tasks at all does not count as effective either, so closing an Assessment rated Effective is one of the two ways to establish effectiveness on a control that has no automated test behind it. ### Seeing the first line's work An Assessment does not need you to gather up the underlying Executions, because it finds them itself. The **Linked tasks** tab shows every Execution that falls in the same scope, and Tidal matches them on three things at once: - They share at least one **control** with the Assessment. - Their **periods overlap**. - They share at least one **asset**. The asset rule has one exception worth knowing. If neither the Assessment nor the Execution has any assets linked, both are treated as company-wide and a shared control plus an overlapping period is enough to link them. If only one of the two has assets, they do not link at all, because an asset-scoped task and a company-wide task are not statements about the same thing. > **warning:** **Mismatched periods break the link silently.** An Assessment for Q1 will not pick up an Execution scoped to Year 2026 unless the periods genuinely overlap. If a **Linked tasks** tab looks emptier than you expect, compare the periods on both plans first. From that tab the second line can also act on what it finds, including reopening an Execution whose evidence does not hold up. ## Third line: Issues An Issue records something that needs fixing, and keeps it separate from the person who found it. The third line is internal audit: independent of both other lines and reporting to the governing body rather than to management. Its output is not implementation work and not a periodic verdict, it is findings. In Tidal those findings land as Issues, and the **Audit finding** issue type exists for exactly this. Alongside it you can classify an Issue as a Control deficiency, Control gap, Incident, Action plan, Opportunity, Opportunity for improvement, or Generic. Issues differ from the other two types in one structural way: plans do not generate them. Executions and Assessments are scheduled work that you know is coming, so a plan creates them on a frequency. An Issue exists because something happened, so you create it when it does, give it a priority and a due date, and link it to the controls and assets it concerns. This is also why the third line does not fix what it finds. Internal audit raising an Issue and then resolving it themselves would put them back inside the process they are meant to audit. The finding gets an owner from the line that has to act on it, and the audit trail shows who raised it and who closed it. > **info:** **Issues are not audit-only.** Anyone can raise one, and most Issues in practice come from incidents and control gaps found during normal work rather than from a formal audit. The third line is the reason the type exists, not the only user of it. ## Setting this up for a larger organisation The whole model runs on two things: roles assigned once on your controls and assets, and a pair of plans over the same scope. ### Assign the roles on the control and the asset On any control or asset you can fill in **Owners**, **Executors** and **Assessors**, each with the **Assign** link. Getting these right is what makes the rest automatic, because every task a plan generates draws its people from these fields. In an organisation with hundreds of asset and control combinations, this is the difference between configuring a plan once and hand-assigning tasks every quarter. Keep the two operational roles genuinely separate. If the same person appears under Executors and Assessors on the same control, the second line's independence exists on paper only. ### Run an Execution plan and an Assessment plan over the same scope Under **Ask users to**, a plan creates either **Execute the control** tasks or **Assess the control** tasks, not both. To get the full two-line cycle you configure two plans across the same controls and assets, one of each type, on periods that overlap. ### Choose a different granularity per line The **How tasks are created** setting is where asset-based organisations get the most out of this, because the two lines want opposite granularity:
Line Setting Result
First line Separate tasks One Execution per combination of a control and an asset, so each team gets only the work for the systems it runs
Second line One task per control One Assessment per control covering all its assets, so the second line concludes once instead of reviewing every asset separately
You can also group by asset instead, with **One task per asset**, which suits a review that is really about one system, vendor, or business unit across all the controls that apply to it. > **tip:** **Start with one control.** Set the roles on a single control and its assets, build the two plans over just that control, and run a full cycle end to end. Once you have seen the Executions arrive with the right people and the Assessment pick them up in its **Linked tasks** tab, widen the scope. ## Where the model comes from Tidal's task types follow the [IIA's Three Lines Model](https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf), published by the Institute of Internal Auditors in July 2020 as an update to what was previously called the three lines of defence. The 2020 update matters for how you read the model. It places the first and second line both under management rather than treating them as separate departments, keeps internal audit independent, and drops the defensive framing in favour of roles that contribute to governance. That is why the first and second line in Tidal share the same task machinery, the same plans and the same periods, and differ only in who is assigned and what closing the task records, while the third line's work has a different shape entirely. --- # Evidence ## Evidence URL: https://tidalcontrol.com/docs/evidence One list of every file uploaded to Tidal Control, whether it was attached to a task, a policy or a control, with the filters to find any of them again. ### Evidence management and overview URL: https://tidalcontrol.com/docs/evidence/managing-documents The Evidence page lists every file uploaded to Tidal Control. How to filter by document usage, search inside documents, sort the list, and add new documents. The Evidence page is the single list of every file uploaded to Tidal, whether it was attached to a task, a policy, or a control. This article covers finding files in it, uploading new ones, and why some files cannot be deleted. ## Evidence page overview The **Evidence** page gives you a central overview of all files uploaded to Tidal Control. These files are used as evidence for tasks, policy documentation for controls, and general compliance documentation. > **info:** **Where to find it:** This overview now lives under **Settings → Evidence**. It was previously a top-level "Documents" page; the functionality is unchanged, only the location and name have moved. ![Evidence overview](/images/help/documents_overview.png) ### What you see in the overview Each row shows the filename, when it was uploaded, and two icons counting how often it's actually in use. **Per document is shown:** - **Name** - Original name of uploaded file - **Created Date** - When the document was added - **Usage indication** - Two icons with numbers showing: - **Paperclip icon (Evidence)** - How often used as evidence in Tasks - **Controls icon** - How often used as documentation in Controls - **Created By** - Who added the document ## Filtering and searching documents The usage filters are the useful ones here: they separate files that are being used as evidence from files that are not attached to anything. ### Document usage filters Filter for unused files to find candidates for cleanup, since an orphaned upload can usually be deleted safely. **Filter by usage status:** - **Linked** - Documents linked to Tasks as evidence - **Unlinked** - Uploaded documents not yet used anywhere > **tip:** **Clean up orphaned documents**: Use the "Unlinked" filter regularly to identify unused files. These can often be safely deleted to keep your document library organized. ### Searching in documents Search matches filenames, and combining it with a usage filter narrows results further. **Search functionality:** 1. **Click in the search field** at the top of the page 2. **Type filename** or part of the name 3. **Results filter** automatically while typing 4. **Combine with usage filters** for specific searches **Search tips:** - Search by **date** - for example "2025" for all documents from this year - Search by **type** - for example "policy" for policy documents - Search by **subject** - for example "security" for security-related files ## Sorting documents Sort the list by name, date, or size to find a specific upload. ### Sort options Sort the list by upload date, filename, or the person who uploaded it. **Available sorting methods:** - **Newest** - Most recently uploaded documents first - **Oldest** - Oldest documents first - **Name (A-Z)** - Alphabetical by filename - **Name (Z-A)** - Reverse alphabetical - **Author (A-Z)** - Alphabetical by uploader name - **Author (Z-A)** - Reverse by uploader ## Adding new documents Files can be uploaded in bulk, which is the fastest way to populate your policies. ### Uploading documents 1. **Click "Add Document"** in top right (blue button) 2. **Select file(s)** from your computer 3. **Files are uploaded** and appear in overview 4. **Status is "Unlinked"** until you link them to tasks or controls ### Best practices for uploading - **Batch upload** - It's possible to upload multiple documents at once. This is especially applicable for setting up Policies. - **Link to tasks** - Go to the Tasks page and [Upload files there](/docs/tasks/handling-and-completing-tasks#uploading-files) - **Link to Policies** - Go to the Policies page and [Upload files there](/docs/policies/creating-and-editing-policies#uploading-existing-documents) ## Using and linking documents Files are attached from the item that needs them, not from the Evidence page itself. To use a file as evidence for a task, go to the [Tasks page and upload it there](/docs/tasks/handling-and-completing-tasks#uploading-files). To attach one to a policy, go to the [Policies page and upload it there](/docs/policies/creating-and-editing-policies#uploading-existing-documents). Either way the file then appears in this overview, with an icon showing what it is used for. ## Managing and maintaining documents Select files with the checkboxes to act on several at once. Only files that are not linked to anything can be deleted. ### Selecting documents 1. **Click checkboxes** to the left of documents you want to manage 2. **Select multiple** by checking different checkboxes ![Documenten verwijderen](/images/help/documents_multiselect.png) 3. **Bulk actions** become available at the top of the list ### Deleting documents > **info:** To maintain audit trail integrity, only orphaned documents (not linked to tasks, policies, or vendor documentation) can be deleted. **Deletion steps:** 1. **Select document(s)** with checkboxes 2. **Click "Delete" button** (red, top right) 3. **Confirm deletion** in dialog 4. **Documents are permanently** deleted **When safe to delete:** - **Unlinked** documents without links - **Old versions** of updated policy documents - **Test uploads** not intended for production - **Duplicates** of existing documents > **warning:** **Be careful with deletion**: Always check that documents are not being used as evidence or policy before deleting them. Deleted documents cannot be recovered. ## Next steps Now that you know how to manage documents in Tidal Control: - **Upload systematically** relevant policy documents and procedures - **Link directly** to tasks and policies for maximum traceability - **Maintain regularly** your document library for optimal organisation - **Monitor usage** to identify important and unused documents For problems and frequently asked questions, see [Troubleshooting & FAQ](/docs/evidence/troubleshooting-and-faq). ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/evidence/troubleshooting-and-faq Which file types you can upload, how a file gets attached to a task or policy, what the icons and counts mean, and why a document in use cannot be deleted. Evidence questions are usually about what you can upload, how a file gets attached to a task or policy, and why a file cannot be deleted. Deletion is the one real constraint: only files that are not linked to anything can be removed. ## Frequently asked questions ### Which file types can I upload? The upload function supports all file formats. ### How do I link documents to tasks or policies? - **Link to tasks** - Go to the Tasks page and [Upload files there](/docs/tasks/handling-and-completing-tasks#uploading-files) - **Link to Policies** - Go to the Policies page and [Upload files there](/docs/policies/creating-and-editing-policies#uploading-existing-documents) ### What do the icons and numbers mean for each document? **Paperclip icon** - used as evidence **Controls icon** - used as documentation in Controls **Number** - How often the same document has been used. When uploading evidence and policies, previously used documents can be selected. ## Common problems ### Cannot select or delete document To maintain audit trail integrity, only orphaned documents (not linked to tasks, policies, or vendor documentation) can be deleted. ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Personnel ## Personnel URL: https://tidalcontrol.com/docs/personnel Register your employees, track the policies they have accepted, and decide who gets a login and at which role. One register for everyone who works here. ### Getting started with Personnel URL: https://tidalcontrol.com/docs/personnel/getting-started How the Personnel module works. The compliance dashboard with its compliant and needs-attention tiles, the People table, and what the module covers overall. The Personnel module registers your employees and tracks whether they have accepted the policies that apply to them. That record is what demonstrates staff awareness of your information security policies to an auditor. ## Navigating the module Open the Personnel module from the main menu. The module is split into two tabs: - **People**: a list of all registered persons - **Groups**: a list of all groups ## The compliance dashboard At the top of the People overview you see a compliance dashboard with two tiles: ### Compliant tile Shows how many employees have completed all their required policy acknowledgements out of the total number of registered employees. ### Needs attention tile Breaks down the employees who still need action, split into four categories:
Category What it means
To assign to group Employees not yet assigned to any group
To assign policy task(s) Employees in a group, but the group has no policies assigned yet
To give access Employees with policy tasks, but no login access to Tidal Control
To accept Employees with access who still have open policy acceptance tasks
Work through these categories from top to bottom to bring your organisation to full compliance. ## The People table Each row in the People table shows: - **Name**: first and last name of the person - **Email**: email address - **Roles**: the organisational role(s) assigned to this person - **Access**: whether the person has a Tidal Control login, at which role, and how they sign in. Super Users only - **Groups**: how many groups this person is in (hover to see which groups) - **Progress**: a ring showing how many of their assigned checks they have completed ## What the Personnel module covers The Personnel module lets you register the employees in your organisation and track whether they have accepted the policies that apply to them. It is the foundation for demonstrating that your staff are aware of and have accepted your information security policies. With Personnel you can: - Register employees with their contact details and organisational roles - Organize employees into groups - Assign policies to groups so each group member must acknowledge them - Invite employees to log in to Tidal Control and complete their policy tasks - Track compliance progress per employee and across the organisation ## Next steps - [Managing people](/docs/personnel/managing-people): add, edit, and invite employees - [Portal access](/docs/personnel/portal-access): give someone a login, pick their role, and revoke it again - [Managing groups](/docs/personnel/managing-groups): create groups and assign policies - [Policy acceptance](/docs/personnel/policy-acceptance): understand how employees complete their policy tasks ### Importing people from an integration URL: https://tidalcontrol.com/docs/personnel/importing-personnel Import personnel straight from Google Workspace or Microsoft Entra ID instead of adding everyone by hand. What a Super User connects first, and how to preview. Import personnel straight from Google Workspace or Microsoft Entra ID instead of adding everyone by hand. This article covers what a Super User needs to connect first, how to run an import, and how to review its result. ## Before you start Importing personnel reads the user directory of a connected integration, so a Super User must first connect **Google Workspace** or **Microsoft Azure** under **Settings > Integrations**. See the [Google Workspace](/docs/integrations/google-workspace) and [Azure](/docs/integrations/azure) integration guides for the required credentials. The import button itself is also only visible to Super Users. ## Starting an import 1. **Go to Personnel** via the main menu and open the **People** tab. 2. **Click "Import from integration"** next to the search bar. 3. **Select the connection** you want to import from. Every connected Google Workspace or Azure connection is listed separately. 4. **Click "Fetch"** to load the directory. ![Selecting the integration to import from](/images/help/personnel_import_source.png) Tidal fetches the directory live, so what you see in the next step is the current state of your Google Workspace or Microsoft Entra ID tenant. Suspended or disabled accounts and accounts without an email address are left out automatically. ## Reviewing the preview The preview lists everyone found in the directory, with a summary of how many people are new and how many already exist in Tidal Control. ![Import preview with new and existing people](/images/help/personnel_import_preview.png) - **Pick who to import.** Use the checkboxes (or "Select all") to import a subset. First name, last name and email are editable before importing, and a last name and valid email are required. - **Rows are matched against the people already in Tidal Control by email address.** A row that matches gets the **"already exists"** badge and is locked: it always stays part of the import, but only records the directory account on that person and changes nothing else about them. - **"Also create logins & send invites"** (off by default) sends a Tidal Control invitation to everyone the import creates. People who already existed are not invited. Click **"Import"** to run the import. ## The result The final step summarises what happened, for example "4 people imported, 1 identities added". If a row could not be imported, it is listed with the email address and the reason. Importing again later is safe: people who already exist are only linked to the directory, never duplicated or overwritten. ![Import result summary](/images/help/personnel_import_result.png) > **info:** An import brings over the first name, last name and email address, and records which directory the person was found in. Group memberships and roles are not imported. One import run handles up to 1000 people; for a larger directory, run the import again to pick up the rest. ## Seeing where a person came from The people overview has a **Source** column showing the logo of every directory a person was found in: Google Workspace, Microsoft Entra ID, or Tidal Control for people who were added by hand. A person can have several identities at once, for example when they appear in both directories. ![People overview with the Source column](/images/help/personnel_overview_sources.png) The person's detail panel shows the same information in the **Identities** field on the Details tab. ![Person details with the Identities field](/images/help/personnel_detail_identities.png) ### Managing groups URL: https://tidalcontrol.com/docs/personnel/managing-groups Groups collect employees who share the same policy acceptance requirements. Assign a policy to a group and every member must accept it. Progress per group too. Groups are collections of employees who share the same policy acceptance requirements. When you assign a policy to a group, every member of that group must accept that policy. This lets you manage policy obligations by job function or department rather than employee by employee. ## Creating a group 1. **Go to Personnel** via the main menu and open the **Groups** tab. 2. **Click "Add group"** at the top right. 3. **Enter a name** for the group (for example: "Development Team" or "Management"). 4. **Click "Add"** to save the group. ## Adding people to a group You can manage group membership from the group's detail panel. 1. **Click the group name** in the Groups overview to open the detail panel. 2. **Find the "People" field** under the Details tab. 3. **Start typing a name** and select the person from the suggestions. 4. **Repeat** to add more members. To remove someone from the group, click the × next to their name in the field. > **tip:** You can also add a person to a group from the person's detail panel. Both approaches keep in sync automatically. ## Assigning policies to a group Policies are assigned to a group as "checks". Each check represents one policy version that group members must accept. 1. **Open the group's detail panel.** 2. **Find the "Policies to acknowledge" section.** 3. **Click the + button** to open the add policy form. 4. **Select a policy** from the dropdown. Only approved policy versions are shown, each indicated by a green dot. 5. **Click "Add"** to assign the policy to the group. > **info:** Once a policy is assigned to a group, all current and future group members will see it as a task to complete on their **Onboarding** page. ### Removing a policy from a group Click the × on the policy chip in the "Policies to acknowledge" field to remove it from the group. > **warning:** Removing a policy from a group does not delete existing acceptance records. Employees who already accepted the policy keep their acceptance history. ## Understanding group progress In the People overview, the **Progress** column shows a ring for each person. This ring reflects how many of the checks assigned through their groups they have completed: - **No ring / "Not started"**: the person is not in any group with assigned policies - **Orange ring**: some policies accepted, but not all - **Green ring**: all assigned policies accepted ## Deleting a group 1. **Open the group's detail panel.** 2. **Click the three-dot menu** (···) at the top right of the panel. 3. **Click "Delete"** and confirm. > **warning:** Deleting a group removes the group and its policy assignments. Employees who were members are not deleted. They simply no longer belong to this group. Their existing acceptance records are preserved. ### Managing people URL: https://tidalcontrol.com/docs/personnel/managing-people The People tab. Add employees, edit their details, assign ISMS roles and groups, and invite them so they can accept their own policies from their own account. This article covers the People tab: adding employees, editing their details, assigning ISMS roles and groups, and inviting them so they can accept their own policies. An employee only needs a login for that last part. ## Adding a person 1. **Go to Personnel** via the main menu and open the **People** tab. 2. **Click "Add person"** at the top right of the overview. A dialog opens. 3. **Fill in the required fields:** - **First name** - **Last name** - **Email**: used to match this person to a Tidal Control login account 4. **(Optional) Set "Portal access"** to a role to create their account and email an invitation straight away. It starts on **No login**, and only a Super User sees it. 5. **Click "Add"** to save the person. > **info:** Each email address can only be used once. If you try to add someone with an email that already exists, you will see an error message. ## Editing a person's details 1. **Click the person's name** in the overview to open the detail panel on the right. 2. **Select the "Details" tab.** 3. **Edit the fields** you want to update: - **First Name** - **Last Name** - **Email** 4. **Changes are saved automatically** when you move to another field. ## Assigning roles Roles indicate the person's function in the context of your information security management system. Each role can only be assigned to one person at a time. Available roles:
Role Description
ISMS Manager Responsible for the overall information security management system
IT Manager Responsible for IT infrastructure and operations
Development Lead Leads software development activities
HR Manager Responsible for human resources
Legal & Compliance Officer Handles legal and compliance matters
Operations Manager Responsible for day-to-day operations
**To assign a role:** 1. **Open the person's detail panel** and go to the **Details** tab. 2. **Find the "Roles" field** and click "Assign". 3. **Select a role** from the dropdown. Roles that are already assigned to someone else are not shown. > **tip:** Roles are used by Tidal to automatically run checks (for example, to verify that your ISMS Manager role is filled). Assign roles to the right people to keep these checks green. ## Assigning a person to groups You can assign a person to one or more groups from their detail panel. 1. **Open the person's detail panel** and go to the **Details** tab. 2. **Find the "Groups" field** and start typing a group name. 3. **Select the group** from the suggestions. 4. **Repeat** to add the person to more groups. To remove a person from a group, click the × next to the group name in the field. > **info:** You can also manage group membership from the group side. See [Managing groups](/docs/personnel/managing-groups). ## Giving a person a login A person needs a Tidal Control login to accept their policy tasks themselves. Open them, go to the **Details** tab, and set **Portal access** to a role. Tidal Control creates the account and emails an invitation. The field is Super Users only, and so is the email address on the same tab, because that address is what the account signs in with. Most employees only need to read and accept policies, which is what the **Basic User** role covers. It reaches onboarding and the incidents they submitted themselves, and nothing else. The **Access** column in the overview shows who already has a login and how they sign in. [Portal access](/docs/personnel/portal-access) covers the roles, the Access column labels, invitations, and how to revoke a login again. ## Viewing a person's policy tasks 1. **Open the person's detail panel.** 2. **Select the "Tasks" tab.** 3. You see a list of all policies this person must accept, with their status: - **Green dot**: accepted - **Grey dot**: pending (not yet accepted) - The date or "pending" in the Accepted column ## Offboarding someone Offboarding records that somebody has left. Open their detail panel, click the three-dot menu, and pick **Offboard**. Their record moves to the Offboarded tab of the People overview and the account they signed in with is disabled, so the login stops working while everything they did stays on the books. **Reactivate** in the same menu brings them back and enables the account again. Their work does not move with them. Reassign their open tasks and anything they owned yourself. ## Deleting a person Only a former colleague can be deleted. Offboard the person first, then switch to the **Offboarded** tab and open them from there. 1. **Open the person's detail panel.** 2. **Click the three-dot menu** (···) at the top right of the panel. 3. **Click "Delete"** and confirm. To delete several people in one go, select them on the Offboarded tab and click Delete in the action bar. Deleting takes the login with it. The account the person signed in with is deleted from Tidal Control along with their record, which is why deleting somebody who has a login is Super User work and the option is absent for everybody else. Deleting a person who never had a login is an ordinary personnel edit. The last Super User cannot be deleted at all, because they cannot be offboarded in the first place. > **warning:** Deleting a person removes all their data including accepted policies. This action cannot be undone from the interface. Consider whether you need to retain this information for audit purposes before deleting. Offboarding on its own keeps the record: the person stays on the Offboarded tab and their disabled account preserves the audit trail of who did what. ### Policy acceptance URL: https://tidalcontrol.com/docs/personnel/policy-acceptance Policy acceptance is how each employee confirms they have read the policies that apply to them. What has to be in place first, and how to track the progress. Policy acceptance is how each employee confirms they have read the policies that apply to them. It only works once two things are in place: the employee belongs to a group, and that group has policies assigned to it. ## How policy acceptance works Policy acceptance is the process by which each person confirms they have read and agreed to the policies that apply to them. In Tidal, this works as follows: 1. A policy version is assigned to a group as a check. 2. Every member of that group sees the policy as a task on their **Onboarding** page. 3. The person logs in to Tidal Control and accepts the policy. 4. Tidal records the acceptance with a timestamp. 5. Once a person has accepted all their assigned policies, they are marked as **compliant**. ## Setting up policy acceptance Before employees can accept policies, two things must be in place: 1. **The group must have a policy assigned.** See [Managing groups](/docs/personnel/managing-groups) for how to assign policies to a group. 2. **The person must have access to Tidal Control.** They need a login to visit their Onboarding page. See [Managing people](/docs/personnel/managing-people) for how to invite someone. > **info:** A person can only accept a policy if they are a member of a group that has that policy assigned. Assigning a policy directly to a person is not possible. Use groups. ## Completing policy acceptance (for personnel) When a person logs in to Tidal Control, they can find their open policy tasks on the **Onboarding** page: 1. **Go to Onboarding** via the menu. 2. **Review the listed policies** that require acceptance. 3. **Open each policy** and read its content. 4. **Click "Accept"** to confirm acceptance. 5. The policy is marked as accepted with the current date and time. ## Tracking acceptance progress Progress can be read three ways: per person, across the whole organisation, and at a glance from the progress ring. ### Per person 1. **Open the person's detail panel** in the People overview. 2. **Select the "Tasks" tab.** 3. Each row shows a policy name, version, and: - **Accepted**: the date the person accepted it - **pending**: not yet accepted ### Across the organisation The compliance dashboard at the top of the People overview gives an overview at a glance: - The **Compliant** tile shows how many employees have completed all their checks. - The **To accept** counter in the Needs attention tile shows how many employees have access but still have open tasks. ### Progress ring The **Progress** column in the People table shows a ring per person: - **No ring / "Not started"**: no policies assigned via groups - **Orange ring**: partially complete (e.g. 1/3 accepted) - **Green ring**: fully complete (all policies accepted) ## What counts as compliant? A person is counted as **compliant** when they have accepted all policy versions assigned through the groups they belong to. If a new policy version is assigned to a group, or if the person is added to a new group with existing policy assignments, their compliance status resets until they accept the new tasks. > **tip:** When you release a new version of a policy, assign the new version to the relevant groups. All group members will then receive a new acceptance task for the updated version. ### Portal access URL: https://tidalcontrol.com/docs/personnel/portal-access Portal access is a field on a person. Pick a role to give someone a login, change it from the same field later, and revoke it without losing their record. Everyone in your organisation belongs in Personnel, whether or not they can open Tidal Control. Portal access is a field on their record. Pick a role and they get an account, leave it on **No login** and they stay a person without one. Someone with no login still holds policy checks and still counts in your reports. Handing out access is Super User work. Everybody else uses Personnel as they always have, without the **Portal access** field and without the **Access** column, and with the email address on a record shown but locked. The address is the login, so whoever can change it can point an existing account at another mailbox. ## Giving someone access 1. **Open Personnel** from the main menu and find the person on the **People** tab. 2. **Click their name** to open the detail panel, then go to the **Details** tab. 3. **Set Portal access** to the role they need. Tidal Control creates the account and emails an invitation to the address on their record. If that person already signs in, the field moves their existing account to the role you picked rather than creating a second one. Somebody who has been offboarded cannot be given access. Reactivate them first and the account they had is enabled again. The same field sits in the **Add person** dialog, where it starts on No login. Setting it there saves a step for someone who needs access from day one. > **tip:** Add people before you decide who needs a login. Personnel is the register of your staff, and the policy checks it tracks do not depend on anyone being able to sign in. ## Roles A role is global: it decides what someone can do everywhere in Tidal Control.
Role What it grants
Basic User Onboarding and their own submitted incidents. Enough to read and accept the policies assigned to them, and nothing else.
Read Only User Views every control, asset and risk, plus dashboards and reports. Cannot change anything, execute tasks, or own an object.
Regular User Everything Read Only can see, plus the work itself: run tests, upload evidence, and own controls and assets.
Super User Everything a Regular User can do, plus administration: portal access for others, organisation settings, and integrations.
Pick the role from what the person does day to day rather than from their seniority. Most staff who only need to accept policies are Basic Users. External auditors are the usual case for Read Only. > **warning:** Super User grants full administrative access, including the ability to change anyone else's role. Keep the number small. > **info:** At least one Super User has to keep portal access. Tidal Control blocks the change when the last one would lose it, so moving them to another role, revoking their access, and offboarding them all fail with an explanatory message until you promote somebody else. ## Changing someone's role Open the person and set **Portal access** to the new role. The change applies immediately, and they do not need a new invitation because their account already exists. If your organisation runs Strict Mode, a global role is only half the picture. See [Strict Mode and granular access control](/docs/personnel/strict-mode-and-granular-access-control) for the object-level roles that decide what a Regular User actually sees. ## Reading the Access column The **Access** column on the People tab shows how each person signs in, so you can spot the accounts that need attention without opening them one by one. Super Users see it and nobody else does. The column only reports; the role itself is set from the person's **Portal access** field.
What you see What it means
No login The person has no account. They hold policy checks but cannot open Tidal Control to complete them.
The role name They sign in with a password at that role.
Signs in through SSO Their account is managed by your identity provider.
Two-factor authentication enabled They have set up an authenticator app on top of their password.
Signs in through SSO but still has a local password Both routes work, so the password is a way around your identity provider. The label says whether that local password carries two-factor authentication.
Disabled The account exists but cannot sign in. Offboarding someone disables their account, and an administrator can also disable one directly in Keycloak.
The **Needs attention** tile at the top of the People tab counts the first case for you under **To give access**: people who have pending policy checks but no login. Whenever that count is above zero a banner above the table says the same thing, and that one everybody sees. > **tip:** When you roll out single sign-on, remove the local passwords too. An account that keeps both leaves a route into Tidal Control that your identity provider does not govern. ## Invitations An invitation carries the activation link the person uses to set their password. It is valid for 7 days, after which you have to send a new one. To send another, open the person and pick **Resend invite** from the actions menu at the top of the panel. An invitation that never arrives is almost always one of three things: it went to spam, the email address on the record has a typo, or your mail filtering blocked it. Check them in that order. Correct the address on the **Details** tab if it is wrong, then resend. ## Resetting a password Open the person and pick **Reset password** from the same actions menu. They receive an email with a reset link. Use it when someone has forgotten their password, when you suspect it has been compromised, or when an activation email never reached them. The option is absent when there is nothing to reset. An account that signs in through SSO and holds no local password has no password of its own, and a disabled account cannot sign in either way. People on SSO manage their credentials in your identity provider. ## Revoking access Setting **Portal access** back to No login deletes the account the person signs in with, after a confirmation dialog. They stay in personnel, keep their policy checks, and keep every control, task and piece of evidence they touched. Revoking is not the same as offboarding, and the difference matters when someone leaves:
Revoking access Offboarding
The account Deleted Kept, but disabled
The person Stays in personnel Marked offboarded
Use it when Someone no longer needs a login but still works here Someone has left the organisation
Offboarding is the right choice for a departure, because the disabled account preserves the audit trail of who did what. Deleting the person is the step after that, and it is offered for a former colleague alone: it ends the record and takes their account with it. Both are in [Managing people](/docs/personnel/managing-people). > **warning:** Revoking access cannot be undone. Granting access again creates a new account, and the person has to accept a fresh invitation and set a new password. ## Managing your own account Tidal Control authenticates through Keycloak, where each person manages their own credentials. To get there, click your profile icon in the top-right corner and select **My preferences**. Keycloak opens in a new tab. ![Keycloak personal information](/images/help/keycloak_personal_info.png) People can change their own email address and name. The username stays fixed, and nobody can change their own role. ### Setting up two-factor authentication 1. **Go to Account Security** in the Keycloak menu. 2. **Select "Signing in".** 3. **Click "Set up Authenticator application".** 4. **Scan the QR code** with an authenticator app. 5. **Enter the verification code** to activate it. ![Keycloak authentication settings](/images/help/keycloak_authentication.png) The same screen manages passwords, shows active sessions, and lists the applications linked to the account. Send an email to support@tidalcontrol.com and we'll set it up for you. Additional licence costs apply to using single sign-on. ## Onboarding and offboarding Two moments deserve a fixed routine. **When someone joins**, add them to Personnel, put them in the groups that carry their policies, and set Portal access to the role their job needs. Confirm the invitation arrived before you assign them any controls or assets. When someone leaves, offboard them first so the account is disabled immediately. Then reassign their open tasks and anything they owned, because offboarding does not hand that work to anyone else. Review the People tab on a schedule as well. The Access column makes the two things worth checking visible at a glance: accounts sitting at a higher role than the job now needs, and people carrying policy checks they cannot reach. ### Strict Mode and granular access control URL: https://tidalcontrol.com/docs/personnel/strict-mode-and-granular-access-control Strict Mode swaps global rights for granular access control at object level, so Regular Users only see the controls, assets and activities assigned to them. **Strict Mode** is an advanced security setting in Tidal Control that implements **granular access control** at object level. Instead of global rights, Regular Users only get access to the specific controls, assets, and risks they are explicitly assigned to. You can tell it is switched on from the green **Strict Mode** indicator at the top right of the interface, next to "Ask TidalBot". ## Understanding object-level roles In Strict Mode, users get **two layers of roles**: global user roles AND object-specific roles per control, asset or risk. ### Global user roles (unchanged) The three global roles still apply in Strict Mode exactly as they do everywhere else. **Read Only User:** - Can view assigned objects - No execution rights on any object - No object assignment possible **Regular User:** - Can be assigned to specific objects - Execution rights depending on object-level role - Only sees assigned objects **Super User:** - Full access to all objects (bypass Strict Mode) - Can assign object-level roles to other users - Manages Strict Mode configuration ### Object-level roles (Strict Mode specific) In Strict Mode the following additional rights are applied to Regular Users. These rights can be set per compliance object (control, risk, asset). **Viewer:** - **Read-only access** to the specific object - **Can view object details** and consult historical data - **No changes** possible to object or related tasks - **No contribution** to tests or evidence collection > **info:** The Viewer role is still in development and cannot yet be assigned. Use the Read Only User role for this. **Executor:** - **Everything from Viewer** plus execution rights - **Automatically gets Contributor role** on new execution tasks - **Can thus:** - **upload evidence** and update task status - **Post messages** in object discussions - **Cannot modify object** or delete **Assessor:** - **Everything from Viewer** plus assessment rights - **Automatically gets Contributor role** on new assessment tasks - **Can thus:** - **upload evidence** and update task status - **Post messages** in object discussions - **Cannot modify object** or delete **Owner:** - **Everything an Executor or Assessor can do** plus management rights - **Create, modify and delete object** - **Schedule tasks** and set deadlines - **Assign other users** to the object - **Full responsibility** for object lifecycle **Example scenario: Control A.01 "Information Security Policy"** **Alice (Viewer):** - ✅ Can view control details - ✅ Can see implementation status - ✅ Can view historical changes - ❌ Cannot execute tasks - ❌ Cannot upload evidence - ❌ Cannot modify control **Bob (Executor):** - ✅ Everything Alice can do - ✅ Can execute execution tasks - ✅ Can upload evidence and post messages - ✅ Can update implementation status - ❌ Cannot modify control configuration - ❌ Cannot assign other users **Charlie (Owner):** - ✅ Everything Bob can do - ✅ Can modify control configuration - ✅ Can schedule tasks and set deadlines - ✅ Can assign other users as Executor, Assessor or Owner - ✅ Can archive or delete control > **tip:** Use Plans to automate role assignment to tasks. ## Permissions at a glance There are two sets of roles: **master data roles** assigned on a control or asset, and **activity roles** assigned on an individual task, execution, assessment or issue. The tables below summarise exactly what each role can do. ### Master data roles (control / asset)
The rights granted through this role No roles assigned Executors Assessors Owners
Read / view access to the master data itself (fields, attributes, linked master data)yesyesyesyes
Update / delete the master data (description, attributes, relationships, assignees)nononoyes
Automatically assigned on planned Execution activitiesnoyes, as contributornoyes, as owner
Automatically assigned on planned Assessment activitiesnonoyes, as contributoryes, as owner
(inherited) read access to activities linked to the objectnoyes, allyes, allyes, all
(inherited) contribute access to activities linked to the objectnonoyes, allyes, all
(inherited) admin access to activities linked to the objectnononoyes, all
### Activity roles (task / execution / assessment / issue)
The rights granted through this role No role assigned Contributor Owner
(read) Read / view accessnoyesyes
(contribute) Work on the activity (add comment, upload evidence)noyesyes
(contribute) Assign other people and give them the contributor role (via Assignments or @mention)noyesyes
(contribute) Conclude on the activity (close task, set effective / ineffective)noyesyes
(contribute) Receive notifications in the daily digest (subscription)noyesyes
(admin) Update the activity (scope, period, due date, etc.)nonoyes
(admin) Delete the activitynonoyes
(admin) Review the activitynonoyes
> **info:** A **Super User** always keeps full access regardless of these assignments, and any user with a global read role keeps read access to the master data record itself. Strict Mode restricts *who can edit master data* (Owners) and *which activities a user sees and works on*. ## Assigning object-level roles Only a Super User can assign object-level roles, either on a single object or in bulk. ### Assigning roles as Super User Object-level roles are assigned from the object's own Details section, one user at a time. **Access to role management:** 1. **Go to the specific object** (Control, Asset, or Risk) 2. **Open the "Details" section** in the object sidebar 3. **Select users** from the organisation list 4. **Choose the object-level role** per user (Executor, Assessor, or Owner) 5. **Confirm assignment** to grant access ### Bulk role assignment Selecting several objects at once lets you assign the same owner to all of them in one action. **Efficient assignment for multiple objects:** 1. **Navigate to the overview page** of the relevant object (control, risk and/or asset) 2. **Select all relevant objects** with checkboxes on left in overview 3. **Relevant buttons appear** at top of table 4. **Choose "Assign to"** and choose a user from the list 5. **The user now has Owner role** on all selected objects ## Rights inheritance and hierarchy Access is not always assigned directly: linking an asset to a control, or a task to a control, carries rights along with it. ### Asset-Control relationships **When an Asset is linked to Controls:** - **Asset Owner** automatically gets Viewer rights on linked Controls - **Control Owner** automatically gets Viewer rights on linked Assets - **Explicit roles** override inherited rights - **Changes in links** automatically update rights ### Control-Task relationships **When a Task is linked to Controls:** - **Control Owner** automatically gets Owner rights on linked Tasks - **Control Executor** automatically gets Contributor rights on linked execution tasks - **Control Assessor** automatically gets Contributor rights on linked assessment tasks - **Explicit roles** override inherited rights - **Changes in links** automatically update rights > **info:** The same applies to Asset-Task relationships ## When to use Strict Mode Strict Mode is worth the extra administration when compliance data needs to be compartmentalised rather than merely tracked. **Difference with standard mode:** - **Standard mode** - Regular Users can see and edit all compliance objects, and can contribute to all tasks - **Strict Mode** - Regular Users can only work on objects they have explicit rights to - **Zero-trust principle** - No access unless explicitly granted - **Enhanced security** - Ideal for large organisations with sensitive compliance data **When to use Strict Mode:** - **Large organisations** with many departments and compliance objects - **Sensitive compliance data** requiring compartmentalization - **Regulatory requirements** for data access control - **Multi-tenant environments** within one organisation - **Strict audit requirements** for access to compliance information Send an email to support@tidalcontrol.com and we'll set it up for you. Additional licence costs apply to using Strict Mode. ## Next steps Now that you understand Strict Mode: - **Evaluate organisational need** for granular access control - **Design role strategy** based on business requirements - **Plan gradual implementation** with pilot groups - **Develop governance procedures** for ongoing role management - **Train team managers** on their access control responsibilities ### Troubleshooting & FAQ URL: https://tidalcontrol.com/docs/personnel/troubleshooting-and-faq Access problems are almost always roles or invitations. Which role grants what, why an invitation does not arrive, and why someone sees nothing after login. Access problems are almost always about roles or invitations: which role grants what, why an invitation does not arrive, and why someone sees nothing after logging in. Strict Mode adds a second layer of access control, which is the usual cause of the last one. ## Frequently asked questions ### What is the difference between the roles? Four global roles exist. Basic User stands on its own for staff who only accept policies. The other three are each a superset of the last: Read Only, Regular, and Super User. **Role-based access control in Tidal Control:** **Basic User:** - **Access:** Onboarding and the incidents they submitted themselves - **Limitations:** Cannot reach controls, assets, risks or reports - **Use:** Employees who only need to read and accept their policies - **Strict Mode:** Unchanged **Read Only User:** - **Access:** Can view all compliance data (controls, assets, risks) - **Limitations:** Cannot change anything, execute tasks, or upload evidence - **Use:** External auditors, management oversight, reporting specialists - **Strict Mode:** Unchanged **Regular User:** - **Access:** Everything from Read Only plus execution rights - **Capabilities:** Execute tasks, upload evidence, be assigned as owner - **Limitations:** Cannot manage other users or change global settings - **Use:** Compliance staff, control owners, daily users - **Strict Mode:** Needs object-level roles for access **Super User (Administrator):** - **Access:** Full system rights - **Capabilities:** Manage users, global settings, all functionalities - **Responsibilities:** System management, user onboarding, configuration - **Use:** IT administrators, compliance managers, implementation specialists - **Strict Mode:** Unchanged ### How can a user update their own profile? Users manage their own profile through Keycloak, reached from the profile icon in the top-right corner. **Keycloak account access for personal data:** **Access to account settings:** 1. **Log in** to Tidal Control 2. **Click profile icon** top right (user avatar) 3. **Select "My preferences"** from dropdown menu 4. **Keycloak interface opens** in new tab **Editable personal information:** - **Email** - Contact address for system notifications - **First name / Last name** - Names as displayed in Tidal interface - **Password** - Secure password change - **Two-factor authentication** - Authenticator app configuration **What users cannot change:** - **Username** - Login identifier (often email address) - **Global user role** - Only Super Users can change roles - **Object-level access** - Only Object Owners can assign object roles - **Organisation settings** - System configuration is reserved for administrators ### Can a user change their own role? **No, users cannot change their own global role** for security reasons and to ensure organisational control. **Role change process:** - **Only Super Users** can change global roles - **Role change** happens from the person's Portal access field in Personnel - **Immediate effect** - Changes are active immediately - **Audit trail** - All role changes are logged **Strict Mode object-level roles:** - **Object Owners** can assign Viewer/Contributor roles - **Users cannot** change their own object-level roles - **Escalation** via Object Owner or Super User ### What happens to someone's data when access is revoked? Revoking access removes the login, not the history. Every control, task, and piece of evidence they touched stays intact. **Data integrity preserved when deleting users:** **What remains:** - **All compliance data** - Controls, assets, risks, tasks - **Historical evidence** - Uploads and documentation - **Audit trails** - Complete activity history - **Tasks and assessments** - Completed and ongoing work **What changes:** - **The person stays in personnel** - Their record, groups and policy checks are untouched - **Assignments** - Remain, but they can no longer respond to them - **Notifications** - Stop, because there is no account to send them to - **Access** - Blocked immediately **Practical impact:** - **Ongoing tasks** - Must be manually transferred - **Ownership** - Assign new owners for continuity - **Teamwork** - Colleagues must take over tasks - **Reporting** - Historical contributions remain visible ### How does Strict Mode work versus normal mode? Normal mode gives every Regular User access to all compliance objects; Strict Mode restricts that access to objects they're explicitly assigned to. **Access control differences:** **Normal mode (default):** - **Regular Users** see all compliance objects - **Global roles** determine what users can do - **Open access** - All objects visible to all users - **Simple rights** - Three roles for entire system **Strict Mode (enhanced security):** - **Zero-trust principle** - No access unless explicitly granted - **Object-level roles** - Viewer, Executor, Assessor, Owner per object - **Granular control** - Exact access per compliance object - **Compartmentalization** - Users only see assigned objects **When to choose Strict Mode:** - **Large organisations** with many departments - **Sensitive compliance data** requiring compartmentalization - **Legal requirements** for data access control ## Common problems ### Someone cannot log in after their invitation Start by checking whether the user is active, was actually invited, and received the email at the right address. All of this needs a Super User: the Access column and the Portal access field are theirs alone. **Diagnosis and solution for login problems:** **Check account status:** 1. **Verify on the People tab** - Is the person there, and does the Access column show a role? 2. **Check Portal access** - Is it still on No login? 3. **Confirm email receipt** - Did they receive the welcome email? 4. **Validate email address** - Is the address correct on their Details tab? **Common causes:** - **No login yet** - Portal access is still on No login - **Invitation expired** - User didn't accept invitation within 7 days - **Email not received** - Spam filter or wrong email address - **Password not set** - User didn't complete Keycloak activation - **Account timing** - Invitation can take several minutes **Solution steps:** 1. **Resend the invitation** from the actions menu in the person's detail panel 2. **Check spam folder** of the person 3. **Verify email address** and correct if needed 4. **Guide password setup** via Keycloak interface 5. **Test login process** together with user ### Invitation email doesn't arrive Check spam first, then the email address on file, then your organisation's own mail filtering. **Email delivery problem solving:** **Initial diagnosis:** - **Check spam/junk folder** - Automatic filters can block email - **Verify email address** - Typos on the person's Details tab - **Check organisation firewall** - Email security can block Tidal emails - **Validate email server** - Organisation email server problems **Troubleshooting steps:** 1. **Correct email address** on the person's Details tab if needed 2. **Resend the invitation** from the actions menu in their detail panel 3. **Whitelist Tidal domains** in organisation email security 4. **Try alternative email address** for testing 5. **Contact IT support** for email server configuration **Alternative solutions:** - **Manual account setup** - Super User helps with password setup - **IT escalation** - System administrator investigates email delivery ### Someone has the wrong access rights Check their global role on the People tab and change it from the Portal access field if it is wrong. **Access rights diagnosis and correction:** **Check global role:** 1. **Go to Personnel** and open the person 2. **Verify current role** in the Access column 3. **Change the role if needed** from Portal access 4. **Test the new rights** with them **Strict Mode specific check:** - **Object-level roles** - Does user have correct Executor/Assessor/Owner role? - **Object assignment** - Is user even assigned to relevant objects? - **Active objects** - Are objects themselves active and available? - **Inheritance** - Are rights correctly inherited from related objects? **Solution per scenario:** - **Too few rights** - Upgrade global role or add object-level roles - **Too many rights** - Downgrade to appropriate role for function - **Inconsistent access** - Review all object assignments systematically - **Timing issues** - Wait several minutes after role changes ### Strict Mode access problems **User sees no objects in Strict Mode:** **Diagnosis steps:** 1. **Check global role** - Is user Regular User or higher? 2. **Verify object assignments** - Does user have object-level roles? 3. **Check object status** - Are objects themselves active? 4. **Check Strict Mode status** via green indicator **Solution:** - **Super User** assigns correct object-level roles - **Object Owner** can grant access within own scope **User cannot execute tasks:** **Possible causes:** - **Viewer role** instead of Contributor role - **Object specific restrictions** set by owner - **Task assignment** to wrong user **Solution steps:** 1. **Verify object-level role** in object page 2. **Upgrade to Contributor** if needed 3. **Check task assignment** and deadline status 4. **Contact Object Owner** for role escalation ### Keycloak account problems Most Keycloak issues are password resets gone wrong; the reset link goes out from the Keycloak login page, not from Tidal itself. **Authentication and profile management issues:** **Password reset problems:** 1. **Go to Keycloak login page** via Tidal Control 2. **Click "Forgot Password"** link 3. **Enter email address** and send reset 4. **Check email** including spam folder 5. **Follow reset instructions** in received email ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution. --- # Required documents ## Required Documents URL: https://tidalcontrol.com/docs/required-documents The evidence-style documents your frameworks demand but that are not policy. Internal audit reports, organisation charts, network diagrams, and their approvals. ### Getting started with Required Documents URL: https://tidalcontrol.com/docs/required-documents/getting-started What required documents are, how they differ from policies, and how they move in and out of scope. Audit reports, organisation charts and network diagrams. Required Documents holds the evidence-style documents your frameworks demand but that aren't policy: an internal audit report, an organisation chart, a network diagram, your information security objectives. You'll find them under **Documents** in the menu. They behave like policies in almost every respect — same overview, same statuses, same editor, same scope rule. The one difference that matters is what happens over time, and it's the reason they get their own page. ## Required documents versus policies A policy is one living document. Your access control policy this year is the same access control policy as last year, revised. Approving it produces a new version of the same thing, and the older versions become history. A required document is a recurring obligation. Your 2026 internal audit report doesn't replace the 2025 one — both have to exist, because an auditor asking for three years of audit reports wants three reports, not the newest one with a version history behind it.
Policies Required Documents
What it is One document, maintained over time A recurring obligation, met again each cycle
What builds up Versions of the same document Separate documents, one per cycle
Typical rhythm Revised when something changes Produced on a schedule, often annually
Examples Access control policy, acceptable use policy Internal audit report, management review, organisation chart
> **info:** This is a difference in how you use them, not in what the screens can do. Both pages offer the same three routes for filling a document, the same approval and review flow, and the same version history. ### What that looks like in practice For a policy, opening the document history shows the same policy at different points in its life — v1.0 approved, v1.1 draft, and so on. For a required document, it shows the separate documents you've filed against that obligation. Each one is approved in its own right, and each stays available after the next one arrives. > **tip:** Filing this year's report? Add a new document rather than editing last year's approved one. Editing creates a new version of the existing report, which is the policy pattern — it leaves you with one report that claims to cover two years. Read more about this in [Working with required documents](/docs/required-documents/working-with-required-documents). ## The overview When you open Documents you see the required documents you have started. The ones you have not are behind **Add document**, and the "Not started" count in the **Needs attention** card is how many are left. For each one you see: - **Status** (Draft, Approved, To Review) - **Name** - **Owners** (if already assigned) - **Last version** - **Last approval** (if applicable) - **Actions** (the row menu) ### Status meanings - **Draft**: Document available but not yet approved - **Approved**: Approved document within the last 12 months - **To Review**: No recent approval (older than 12 months) > **note:** "To Review" after 12 months is what makes the recurring rhythm visible. A required document that was approved more than a year ago moves to "To Review" on its own, which is your prompt that this cycle's document is due. ### Search and filter - **In scope / Out of scope tabs** - Switch between required documents that count towards compliance and those that don't - **Search bar** - Type names or Tidal IDs to find a specific document - **Status filter** - Filter on Draft, Approved, or To Review - **Framework filter** - Show only documents required by a specific framework ## In scope vs Out of scope Scope works exactly as it does for policies. Every required document has its own test in Tidal, named after the document, and that test decides the scope: **In scope required documents:** - **Test is linked** to at least one control in your ISMS - **Count towards** framework progress and compliance scoring - **Shown by default** when you open Documents **Out of scope required documents:** - **Test is linked to no control** at all - **No effect** on your scores - the document isn't required in your environment - **Only visible** under the "Out of scope" tab To bring one in scope, link its test to the control that requires it, on the control's "Tests" tab. The full steps are in [Getting started with Policies](/docs/policies/getting-started), and they apply here unchanged. > **info:** Don't see a required document you expected? Check the "Out of scope" tab before assuming it's missing. ## Next steps - **Fill your first required document** via [Working with required documents](/docs/required-documents/working-with-required-documents) - **Bring documents in scope** by linking their tests in [Editing and managing controls](/docs/controls/editing-and-managing-controls) - **Compare with policies** in [Getting started with Policies](/docs/policies/getting-started) ### Working with required documents URL: https://tidalcontrol.com/docs/required-documents/working-with-required-documents Fill a required document from a Tidal template, the editor, an upload or a link, approve it, and file each new cycle alongside the last rather than over it. Filling a required document works the same four ways a policy does: start from the Tidal template, write it in the editor, upload a file, or link to one held elsewhere. What's specific here is the recurring part: every cycle adds a document rather than replacing the one before it. ## Starting a required document Click **Add document**, pick the one you want from the list of everything not yet started, and Tidal offers four routes: **1. Create with editor** - Write the document from scratch in the built-in editor - Full word processing capabilities - Automatic version control - Integrated approval and review flow **2. Start with template** - Opens the Tidal template for this document, already written - Shown only where a template exists for that document - A few are workbooks rather than pages, so they arrive as a spreadsheet to download, fill in and upload again **3. Upload file or use already uploaded document** - Upload PDF or Word documents - Keep your existing tooling and workflow - Recognisable afterwards by the paperclip icon - Integrated approval and review flow **4. Link to an external location** - Point at a document held in another system via URL - Editing and version management stay outside Tidal - Approvals and reviews still happen in Tidal > **tip:** Uploading suits required documents more often than it suits policies. Audit reports, management reviews and network diagrams are usually produced outside Tidal and arrive as a finished PDF, whereas a policy benefits from living in the editor where it can be revised. ## Using templates Most policies and required documents come with a Tidal template: a document we wrote for you, structured and worded, with the parts only you can answer marked for you to fill in. Choosing **Start with template** copies it into a new draft. The template is then ordinary content in the editor. You can rewrite any part of it, add or remove sections, and build your own heading structure. Nothing about it is fixed once it is in your document. Every template opens with a yellow INSTRUCTIONS box telling you what to replace and what approving the document proves. Delete that whole block before you approve, or it ships into the document your auditor reads. > **info:** Templates cover both Policies and Required Documents, on every plan. A free trial can start three of them; the rest are still listed and say they need an upgrade. The full walkthrough is in [Writing and editing policies](/docs/policies/creating-and-editing-policies), and it applies here unchanged. > **note:** **A later draft starts blank, not from the template.** Once a document is approved, "Create new draft" offers the approved version, a blank template, or a file from your computer. The Tidal template is a starting point for a document you have not started yet, not a way to reset one you have already written. ## Approving a document 1. **Open the document** by clicking its name 2. **Check the content** in view mode 3. **Click "Approve"** at the top of the page 4. **Add a version number and comment** in the dialog that opens 5. **Confirm the action** - the status becomes "Approved", its test passes, and the approval date starts the 12-month review clock > **info:** Approval works identically for required documents and policies, including approving several at once from the overview and revoking an approval afterwards. Those flows are documented once, in [Approving and managing Policies](/docs/policies/managing-policies), and apply here unchanged — read "policy" as "required document" throughout. > **note:** Approved documents are read-only, which is what makes their status and history trustworthy. To change an approved document, click "Create new draft" — Tidal copies the content into a fresh draft and keeps the approved version live until you approve the new one. ## Filing the next cycle This is where required documents part ways with policies. When the next internal audit report, management review or other periodic document is ready: 1. **Open the required document** in the Documents overview 2. **Add the new document** - upload the file, or create it in the editor 3. **Approve it** when it's complete 4. **The earlier documents stay** available under the same required document The result is a stack of documents under one obligation: the 2024 report, the 2025 report, the 2026 report, each approved on its own date. > **warning:** Don't meet a new cycle by editing the previously approved document. That produces a new *version* of the old report — the policy pattern — and you lose the distinction between the report that covered last year and the one covering this year. An auditor asking for three years of reports needs three documents. ### Keeping track of what's due You don't have to remember the cycle. The test attached to the document does it for you. Every required document and policy has its own test, and that test only passes while there is an approval less than a year old. Once the last approval passes the one-year mark: 1. **The document moves** to "To Review" in the overview 2. **Its test starts failing** 3. **The control the test is linked to** loses effectiveness, and your compliance status shows it That failing test is the reminder. It's the reason every required document and policy is wired to a test in the first place, and why a document that's a year out of date can't quietly stay that way. **Where to see it:** - **The status filter** on the overview lists everything currently at "To Review" - **The Tests page** shows the failing test and which control it affects - **The document history** in the side drawer shows what you filed and when - **The side drawer** also shows the next review date, a year after the last approval > **warning:** This only bites while the document is in scope. A required document whose test is linked to no control is out of scope, so its test doesn't count towards anything and an expired approval passes unnoticed. Read more about this in [Getting started with Required Documents](/docs/required-documents/getting-started). ## Next steps - **Understand the scope rule** in [Getting started with Required Documents](/docs/required-documents/getting-started) - **Compare with the policy lifecycle** in [Creating and editing policies](/docs/policies/creating-and-editing-policies) - **Follow up on failing tests** via [Getting started with Tests](/docs/tests/getting-started) --- # Trust center ## Trust Center URL: https://tidalcontrol.com/docs/trust-center A public security page built from the frameworks, controls and vendors you already maintain in Tidal Control, answering customer questions before they ask them. ### Custom domain URL: https://tidalcontrol.com/docs/trust-center/custom-domain Serve your Trust Center on your own domain, such as trust.yourcompany.com. Adding the domain, the DNS and CAA records it needs, and ownership verification. This article walks through setting up a custom domain for your Trust Center: adding it, creating the required DNS records, and what to expect during ownership verification and HTTPS provisioning. ## Serving your Trust Center on your own domain Every Trust Center comes with a public Tidal Control URL based on your organisation name. You can also serve it on a hostname you own, such as `trust.yourcompany.com`. Visitors stay on your domain when they follow links from your website or security questionnaires. ## Adding the domain You must use a subdomain, such as `trust.yourcompany.com`. A root domain (`yourcompany.com`) cannot be used because the required record is a CNAME. {/* TODO: recapture this screenshot. It still shows the old two-step "Set up custom domain" wizard; the current UI adds the domain in one step directly in the Custom domain panel. */} ![The Share menu with the Custom domain panel](/images/help/trust_center_share_menu.png) - Go to **Trust Center** > **Editor** in the main menu. - Click the **Share** button in the toolbar. - Under **Custom domain**, type the hostname you want to use and click **Add domain**. ![The CNAME and TXT records to create](/images/help/trust_center_dns_records.png) - Go to your DNS provider's settings and create the two records shown in the **Custom domain** panel. In Azure DNS, use **Add record set** in your DNS zone. The CNAME target goes in the **Alias** field: ![Adding the CNAME record set in Azure DNS](/images/help/trust_center_azure_cname.png) ![Adding the TXT record set in Azure DNS](/images/help/trust_center_azure_txt.png) In AWS Route 53, create both records with **Quick create record** in your hosted zone: ![Creating the CNAME record in AWS Route 53](/images/help/trust_center_route53_cname.png) ![Creating the TXT record in AWS Route 53](/images/help/trust_center_route53_txt.png) Once you create both records, come back to Tidal and click **Verify ownership**. DNS changes can take up to 30 minutes to propagate. Once verified, the status moves to **Provisioning**. ## CAA records {/* TODO: confirm the certificate authority used in production before publishing this section. The issuer is environment-configured; Let's Encrypt is the only CA referenced in the platform code. */} CAA records restrict which certificate authorities can issue certificates for your domain. If your root domain has no CAA records, skip this section. If it has them, allow Let's Encrypt for your hostname. Otherwise, the certificate cannot be issued and the domain stays at **Provisioning**: ```text 0 issue "letsencrypt.org" 0 issuewild "letsencrypt.org" ``` ## Removing a custom domain An unactivated domain disappears immediately when removed. An active domain shows **Removing** while routing and HTTPS are cleaned up. Once it disappears from the panel, you can add a different domain. Remember to delete the CNAME and TXT records at your DNS provider. ### Customising content URL: https://tidalcontrol.com/docs/trust-center/customizing-content Your Trust Center editor has a section for every part of the page. Branding, compliance, resources, controls, subprocessors, FAQ and updates, edited separately. Your Trust Center editor has a section for every part of the page: branding, frameworks, resources, controls, subprocessors, FAQ, and updates, each customisable independently. This article walks through them one by one, starting with what they have in common. ## Working with items A few things work the same in every section: - **Show and hide.** Every item has a Show/Hide action. Hidden items stay in the editor, but visitors never see them. Frameworks, controls, and subprocessors start hidden, so nothing goes public by accident. - **Remove.** Only items you created yourself (resources, FAQs, and updates) can be removed. Items that mirror platform data can only be hidden. - **Categories.** Resources, controls, FAQs, and updates are grouped by category. Pick a suggestion or type your own; items without a category appear under **General**. - **Bulk actions.** Move a single item with **Move to another category**, or use the actions on a category heading to **Show all**, **Hide all**, or move every item in that category at once. On the public page, lists longer than five items collapse automatically, and visitors expand them with a show-more button. ## Trust Center details Click **Edit Trust Center details** in the header of the page: - **Logo** - a PNG, JPEG, GIF, WebP, or static SVG image of at most 2 MB. It appears in the header and doubles as the favicon of the public page. If you cannot upload a logo stored in OneDrive, iCloud Drive, Google Drive, or Dropbox, download it to your device and try again. - **Title** - defaults to your organisation name. - **Description** - the introduction text under the title. - **Header color** - the background color of the header, picked with a color picker. - **Text color** - defaults to **Automatic**, which picks a readable color for your header color. After choosing your own, click **Use automatic** to switch back. - **Privacy policy URL** - linked from the page. - **Contact email** - where visitors can reach you with questions. ![Editing Trust Center details in the Trust Center editor](/images/help/trust_center_details_edit.png) ## Compliance Every framework on your Frameworks page has a tile here, and all of them start hidden. Click a tile to reveal its actions: - **To show a framework**, click the **eye**. - **To edit a framework**, click the **pencil**. - **To hide a framework**, click the **crossed-out eye**. ![Showing, hiding, and editing framework tiles in the Trust Center editor](/images/help/trust_center_framework_actions.png) Edit a framework to set: - **Certified date** - set it once you're certified, and the tile shows a green Certified check. - **Logo** - upload the logo of your certification, such as your certification body's mark. Make sure you have the rights to display it: many logos require an active certification. Frameworks such as ISO standards, GDPR, and NIS2 come with default tile art, so a logo is optional. ![Editing a framework in the Trust Center editor](/images/help/trust_center_framework_edit.png) ## Resources Click **Add resource**. A resource is either a **Document** or a **Link**: - **Document** - a PDF of at most 25 MB. Upload a file, or use the search field under **or pick approved document** to reuse a document that is already approved in Tidal. - **Link** - a URL to something hosted elsewhere, such as a status page or a public report. ![The add button, visibility badge, and action icons in the Resources section of the Trust Center editor](/images/help/trust_center_resources_actions.png) - **To check visibility**, look at the badge next to a document's name. - **To edit a resource**, click the **pencil**. This lets you change its name, description, file or link, and visibility. - **To move a resource**, click the **tag**. - **To hide a resource**, click the **crossed-out eye**. Click the **eye** to show a hidden resource again. - **To remove a resource**, click the **trash**. - **To apply bulk actions**, use the tag and eye on a category heading. You can move every resource in a category at once (**Move all resources in this category**), or show or hide them all (**Show all**, **Hide all**). Give each resource a display name, a description, and a category. Tidal suggests categories such as Security Documentation, Policies, Audit Reports, Certifications, and Security Questionnaires. Each document also has its own visibility:
VisibilityWhat it means
PublicAnyone viewing your Trust Center can download it.
PrivateVisitors need an approved access request to download it.
> **caution:** **Changes affect access that was already granted.** Hiding a resource closes download links that were already issued, and replacing a document changes what approved requesters download from that moment on. ## Controls Controls mirror your Controls page. Per control you can edit the public **name**, **category**, and **description**, so you can describe a control for outsiders without touching your internal wording. Use the reset action to restore the name, category, and description of the catalog control. You can't create controls here; add missing ones in Controls first. The **Public display** panel applies to the whole section: - **Show effectiveness status** - adds a green check or amber warning icon next to each public control. The status syncs hourly from your controls monitoring. - **Show ineffective controls** - when off, ineffective or unchecked controls stay hidden. Under **Layout** you choose how visitors see the section: - **List** - all controls in a flat list under category headings. - **Category cards** - one card per category; visitors open a panel to see its controls. ## Subprocessors Vendors are your internal records; subprocessors are the vendors you publish because they process customer data. Every vendor on your Vendors page has a hidden entry here. Per subprocessor you can edit the public **name** and **description**, and set a **location** and a **type**. For **type**, Tidal suggests options such as Cloud Infrastructure, Data Hosting, and Payment Processing. Use the reset action to restore the catalog vendor's name and description. You can't create subprocessors here; add missing vendors in Vendors first. ## FAQ Click **Add FAQ**. The question field searches ready-made templates: pick one to fill in the question, answer, and category, or keep typing to write your own. The templates cover the questions buyers ask most, including ISO 27001 certification, penetration testing, risk management, data residency, GDPR and DPAs, breach notification, access control, business continuity, subprocessor due diligence, and AI data usage. Answers support Markdown, so you can use lists and links. > **caution:** **Templates describe a typical practice, not yours.** The penetration testing template, for example, states that independent third-party tests happen at least annually. Edit every claim to match what your organisation actually does before you publish. ## Updates Click **Add update** to announce changes: the title field searches six templates, covering a new certification, a completed penetration test, a new subprocessor notice, an upcoming security feature, a "not impacted" advisory for a published vulnerability, and a policy update. Templates contain placeholders like `[Vendor Name]` for you to fill in. Every update has a title, a body, a category, and a published date you can adjust. The body supports Markdown and is capped at 800 characters, so keep it to the point. ### Getting started with Trust Center URL: https://tidalcontrol.com/docs/trust-center/getting-started Set up a public security page that answers prospects' most common questions upfront, built from the frameworks, controls and vendors you already maintain. Set up a public security page that answers prospects' and customers' most common questions upfront, built from the frameworks, controls, and vendors you already maintain in Tidal Control. This article covers the editor, the sections your Trust Center has, and how to publish changes. ## Opening the editor Go to **Trust Center** > **Editor** in the main menu. The editor shows your actual Trust Center page. You edit it in place. Every section lets you easily pull in existing items, customise their details, or hide them. ![Trust Center editor](/images/help/trust_center_editor.png) ## The sections A Trust Center has a fixed set of sections, in a fixed order. Visitors navigate them with the tabs at the top of the page.
SectionWhat it showsSource
OverviewYour title, description, logo, contact email, and privacy policy linkTrust Center editor
ComplianceFrameworks and certifications, with a Certified badge once you set a certification date[Tidal Frameworks](/docs/frameworks)
ResourcesDocuments and links, such as certificates, reports, and policiesTrust Center editor
ControlsYour security controls, optionally with a live effectiveness status[Tidal Controls](/docs/controls)
SubprocessorsThe vendors that process data for you, with purpose and location[Tidal Vendors](/docs/vendors)
FAQQuestions and answers, with ready-made templates for common security questionsTrust Center editor
UpdatesAnnouncements, such as a new certification or an incident advisoryTrust Center editor
## Content from the rest of Tidal Control Tidal creates a Trust Center entry for every framework, control, and vendor in your organisation. Everything starts hidden: you decide per item what visitors get to see. Items added to the platform later show up automatically as new hidden entries. You can give an item a different public name, category, or description. This helps when your internal naming isn't meant for outsiders. > **info:** **Editing here never changes your internal data.** Renaming, describing, showing, or hiding items on your Trust Center only affects the public page. Your controls, frameworks, and vendors in Tidal stay exactly as they are. Controls can show a live effectiveness status on the public page. This status syncs from your controls monitoring every hour. The page stays current without manual updates. ## Drafts and publishing Every change in the editor is a draft. Visitors see the current version of your Trust Center until you publish. The toolbar counts unsaved changes. Click **Review and publish** to see pending changes grouped by section and publish them at once. Click **Discard** to throw the draft away. ## Preview Use the **Preview mode** toggle in the toolbar to see the page exactly as visitors will: hidden items are filtered out and the editing controls disappear. Switch back to keep editing. ![Trust Center in preview mode](/images/help/trust_center_preview.png) ## Custom domain Your Trust Center includes a public URL based on your organisation name. You can also serve it on a [custom domain](/docs/trust-center/custom-domain) you own, such as `trust.yourcompany.com`. This keeps visitors on your domain when they review your security posture. ## What is the Trust Center? Your Trust Center is a public web page that shows prospects and customers how you handle security: your certifications, controls, key documents, subprocessors, and answers to common questions. Share a single link. This answers most questions upfront and saves you from filling in a security questionnaire for every deal. ## Next steps Now that you know your way around the editor: - Show the frameworks and controls you want prospects to see - Upload your key documents to Resources - Answer common security questions in the FAQ, starting from the templates --- # Glossary URL: https://tidalcontrol.com/glossary ## A

ABDO stands for Algemene Beveiligingseisen voor Defensieopdrachten, the general security requirements for defence contracts issued by the Dutch Ministry of Defence. If you supply the Dutch MoD and will handle classified information, ABDO is the baseline you are held to. ABDO 2019 still governs existing contracts, including when they are renewed. For new contracts Defence moves during 2026 to ABRO, the Algemene Beveiligingseisen voor Rijksoverheidsopdrachten, which central government has applied since 1 January 2026.

The four domains

ABDO 2019 contains more than 600 requirements, which is less daunting than it sounds because only a subset applies to you. They fall into four areas, and the breadth is the point: it is not an IT standard.

Domain Covers
Governance and organisation Accountability, a designated security officer, policy, and how you handle incidents and deviations.
Personnel Screening and vetting for anyone with access, plus awareness and the rules on leaving.
Physical security Zoning of premises, storage of classified material, access to rooms and cabinets.
Cybersecurity Systems that process classified information: separation, encryption, logging and approved equipment.

The classification list decides your scope

Which requirements apply is not for you to judge. The client completes a Rubriceringsaanduidingslijst (RAL) per contract, marking the classification involved, and the applicable requirements follow from that level.

So the first question in an ABDO project is not "what must we implement" but "what classification are we handling". Ask for the RAL early. Scoping against the highest level you can imagine wastes money, and scoping too low means rework you cannot get around.

It follows the chain

ABDO obligations pass down to your subcontractors. If you engage a hosting provider, a courier or a maintenance firm that touches classified information, they come into scope and you are the one who has to demonstrate it.

Treat that as part of supplier management rather than a separate exercise. The evidence an assessor wants is the same shape as any supplier risk assessment: who is in scope, what was agreed, and what you check.

How it relates to ISO 27001

An ISO 27001 certificate does not make you ABDO compliant. The two overlap heavily on management system and personnel requirements, so existing certification is a genuine head start, but ABDO adds classified-specific physical and handling rules that ISO 27001 never addresses.

In practice you keep one control set and map it to both, rather than running two programmes. What you cannot do is present the certificate and expect the ABDO requirements to be considered met.

} />

Access control encompasses the policies, procedures and technologies that regulate who can access specific resources within an organisation. It operates on principles such as least privilege and need-to-know, ensuring that individuals only have the minimum level of access required to perform their duties.

Effective access control is a cornerstone of any information security management system (ISMS) and is explicitly addressed in ISO 27001 Annex A. Organisations typically combine physical controls (badge readers, biometric scanners) with logical controls (role-based access, multi-factor authentication) to create a layered defence against unauthorised access.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "ACL (Access Control List)", href: "/glossary/acl-access-control-list" }, { name: "Classification Levels", href: "/glossary/classification-levels" }, { name: "Confidentiality", href: "/glossary/confidentiality" } ]} />

An Access Control List is a structured set of rules that defines permissions for users, groups or systems on specific resources such as files, network segments or applications. Each entry in an ACL specifies a subject (who), an object (what resource) and the permitted actions (read, write, execute, delete).

ACLs are fundamental to enforcing the principle of least privilege in IT environments. They are used extensively in firewalls, operating systems and cloud platforms, and form an important part of the technical evidence that auditors review during ISO 27001 or SOC 2 assessments.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Access Control", href: "/glossary/access-control" }, { name: "API Security", href: "/glossary/api-security" }, { name: "Classification Levels", href: "/glossary/classification-levels" } ]} />

AI governance is the structured approach organisations use to manage AI systems responsibly. It ensures AI development, deployment, and monitoring operate within ethical boundaries and comply with regulations like the EU AI Act.

Effective AI governance requires clear policies, systematic risk assessment, continuous monitoring, defined accountability structures, and organisational training on AI ethics.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Explainable AI (XAI)", href: "/glossary/explainable-ai-xai" }, { name: "AI Impact Assessment (AIIA)", href: "/glossary/aiia" }, { name: "Responsible AI", href: "/glossary/responsible-ai" }, { name: "Model Governance", href: "/glossary/model-governance" } ]} relatedBlogPosts={[ { title: "ISO 42001: What does this AI standard mean for your organisation?", href: "/blog/iso-42001-what-does-this-ai-standard-mean-for-your-organisation" } ]} />

AI guardrails are the safety mechanisms that prevent your AI system from producing harmful, biased or off-topic outputs. For startups deploying LLM-based products, guardrails are essential. A single viral screenshot of your chatbot saying something inappropriate can cause serious reputational damage.

How to implement this:

  • Input filtering: Validate and sanitise user prompts before they reach your model. Block known prompt injection patterns and set maximum input lengths.
  • Output filtering: Screen AI responses for harmful content, PII leakage and off-topic answers before showing them to users. Use a classifier or a second LLM call as a safety layer.
  • Rate limiting: Cap requests per user to prevent abuse and control costs. Start with conservative limits and adjust based on real usage.
  • System prompts: Define clear behavioural boundaries in your system prompt: what the AI should and should not do, and how it should handle edge cases.
  • Monitoring: Log all interactions (respecting privacy) and set up alerts for anomalous patterns such as repeated jailbreak attempts or unusual output lengths.

The OWASP LLM Top 10 is a practical checklist for the most common vulnerabilities. Tidal Control helps you document your guardrails as controls and track their effectiveness over time.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "AI Governance", href: "/glossary/ai-governance" }, { name: "Human Oversight", href: "/glossary/human-oversight" }, { name: "Responsible AI", href: "/glossary/responsible-ai" } ]} />

An AI Impact Assessment (AIIA) is a structured process for evaluating the potential risks and societal effects of artificial intelligence systems before and during their deployment. ISO 42001 requires these assessments as part of an AI management system, covering aspects such as bias, transparency, human oversight and fundamental rights. The EU AI Act sets out a separate instrument: the fundamental rights impact assessment in Article 27, required only of certain deployers of high-risk AI systems.

The AIIA serves as both a compliance instrument and a risk management tool, helping organisations identify and mitigate harms proactively. It draws parallels with the Data Protection Impact Assessment (DPIA) under GDPR and is increasingly integrated into broader governance, risk and compliance (GRC) frameworks.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Corrective Action Plan (CAP)", href: "/glossary/corrective-action-plan-cap" } ]} relatedFeatures={[ { name: "AI assistant", href: "/features/ai" } ]} />

AI system documentation is a comprehensive record that describes how your AI system works, what data it uses, and what its limitations are. Under the EU AI Act, providers of high-risk AI systems must maintain technical documentation before placing their system on the market. Even for lower-risk systems, good documentation protects you during audits, investor due diligence and customer procurement processes.

What to document:

  • Purpose and intended use: What problem does your AI solve? Who are the intended users? What decisions does it support or automate?
  • Architecture: Which models do you use (e.g. GPT-4, Claude, open-source)? How are they integrated? What is the data flow from input to output?
  • Training data: What data was used to train or fine-tune? Where did it come from? How was it cleaned and labelled?
  • Known limitations: Where does your system perform poorly? What biases have you identified? What inputs produce unreliable outputs?
  • Risk assessment: What could go wrong? What is the impact on affected people? What mitigations are in place?

Start with a simple internal document and iterate. The EU AI Act compliance checker helps you identify what applies to your system. Tidal Control provides templates and workflows to build and maintain this documentation as part of your AI management system.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "AI Governance", href: "/glossary/ai-governance" }, { name: "AI Impact Assessment (AIIA)", href: "/glossary/aiia" } ]} />

Article 50 of the EU AI Act requires that users are clearly informed when they interact with an AI system. This applies to chatbots, AI-generated content (text, images, audio, video) and emotion recognition systems. The goal is to prevent deception. People have the right to know when they are talking to a machine.

How to implement this:

  • Chatbots and virtual assistants: Add a clear label such as "You are chatting with an AI assistant" at the start of each conversation. Keep it visible, not hidden in terms of service.
  • AI-generated content: Label synthetic text, images or audio with a visible marker. For deepfakes or synthetic media, machine-readable metadata is also required.
  • In-product notices: Add an "AI-powered" badge next to features that use AI to generate recommendations, summaries or decisions.
  • Documentation: Record where in your product AI is used and how users are informed. This evidence is needed for compliance audits.

Transparency builds trust. Users who know they are interacting with AI tend to set appropriate expectations and report issues more constructively. Tidal Control helps you map all AI touchpoints in your product and track transparency measures as auditable controls.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "AI Governance", href: "/glossary/ai-governance" }, { name: "Explainable AI (XAI)", href: "/glossary/explainable-ai-xai" } ]} />

Annex A of ISO 27001:2022 contains 93 reference security controls organised into four themes: organisational, people, physical and technological. These controls provide a comprehensive catalogue from which organisations select applicable measures based on their risk assessment and Statement of Applicability (SoA).

The 2022 revision restructured controls from 14 domains into four themes and introduced 11 new controls addressing topics such as threat intelligence, cloud security and data masking. Organisations use Annex A as a checklist to ensure no critical security area is overlooked and to demonstrate due diligence to auditors and certification bodies.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Control Objectives", href: "/glossary/control-objectives" }, { name: "Control Tests", href: "/glossary/control-tests" }, { name: "Continuous Improvement", href: "/glossary/continuous-improvement" }, { name: "Asset Management", href: "/glossary/asset-management" } ]} />

API security focuses on protecting the interfaces that allow different software systems to communicate with each other. As APIs expose application logic and sensitive data, they are attractive targets for attackers who exploit vulnerabilities such as broken authentication, excessive data exposure and injection attacks.

Robust API security requires a multi-layered approach including strong authentication (OAuth 2.0, API keys), encryption in transit (TLS), input validation, rate limiting and comprehensive logging. With the rise of microservices and cloud-native architectures, API security has become a critical component of both ISO 27001 technological controls and SOC 2 trust service criteria.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Access Control", href: "/glossary/access-control" }, { name: "Cryptography", href: "/glossary/cryptography" }, { name: "Cybersecurity", href: "/glossary/cybersecurity" } ]} />

Asset management in information security involves maintaining a complete and accurate inventory of all assets that store, process or transmit information. This includes hardware (servers, laptops, mobile devices), software (applications, licences), data (databases, files) and intangible assets such as intellectual property and reputation.

A well-maintained asset register is a prerequisite for effective risk management, as risks can only be assessed and treated when the assets they affect are known. ISO 27001 requires organisations to identify information assets, assign ownership and apply appropriate classification levels to determine the security controls each asset requires.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Classification Levels", href: "/glossary/classification-levels" }, { name: "CMDB (Configuration Management Database)", href: "/glossary/cmdb-configuration-management-database" }, { name: "CIA Classification", href: "/glossary/cia-classification" } ]} />

Audit fatigue occurs when organisations face so many audits, assessments and compliance reviews that the process becomes counterproductive. Staff may become disengaged, evidence quality deteriorates and the organisation starts treating audits as a box-ticking exercise rather than a genuine opportunity for improvement.

Integrated GRC platforms combat audit fatigue by enabling evidence reuse across multiple frameworks and standards. When a single piece of evidence can satisfy requirements for ISO 27001, SOC 2 and NIS2 simultaneously, the burden on teams is significantly reduced. Continuous compliance approaches further alleviate fatigue by replacing periodic audit sprints with ongoing, automated monitoring.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Audit Trail", href: "/glossary/audit-trail" } ]} />

An audit trail is a sequential record of all activities within an information system, capturing details such as user identity, timestamp, action performed and the data affected. These logs provide an unalterable chronological history that enables organisations to reconstruct events and establish accountability.

Audit trails are essential for regulatory compliance, forensic investigations and internal governance. Under frameworks like ISO 27001 and SOC 2, organisations must demonstrate that they maintain comprehensive logging with appropriate retention periods, tamper protection and regular review procedures to detect anomalies and security incidents.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Control Tests", href: "/glossary/control-tests" }, { name: "CMDB (Configuration Management Database)", href: "/glossary/cmdb-configuration-management-database" } ]} />

Authentication is the foundation of access control. It ensures that users and systems are who they claim to be before granting access to resources. Common methods include passwords, multi-factor authentication (MFA), and biometric verification.

Strong authentication mechanisms are critical for preventing unauthorized access and protecting sensitive systems from being compromised.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Authorisation", href: "/glossary/authorisation" }, { name: "Access Control", href: "/glossary/access-control" }, { name: "IAM (Identity and Access Management)", href: "/glossary/iam-identity-and-access-management" } ]} />

Once a user is authenticated, authorization determines what resources they can access and what actions they can perform. It's based on roles, groups, or individual permissions.

Proper authorization ensures the principle of least privilege: users have only the minimum access needed to perform their job functions.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Authentication", href: "/glossary/authentication" }, { name: "Access Control", href: "/glossary/access-control" }, { name: "ACL (Access Control List)", href: "/glossary/acl-access-control-list" } ]} /> ## B

BCM ensures that an organisation can continue operating during and after disruptive events. It involves identifying critical functions, assessing risks, and developing recovery strategies.

A comprehensive BCM program includes business impact analysis (BIA), disaster recovery planning, and regular testing to ensure resilience.

} relatedFrameworks={[ { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Business Impact Analysis (BIA)", href: "/glossary/business-impact-analysis-bia" }, { name: "Disaster Recovery", href: "/glossary/disaster-recovery" }, { name: "Risk Assessment", href: "/glossary/risk-assessment" } ]} />

BIO (Baseline Informatiebeveiliging Overheid) is the Dutch government's information security baseline applicable to all government organisations. It provides a structured approach to information security management tailored to the public sector.

BIO is based on ISO 27001 and ISO 27002 but includes additional measures specific to government requirements, such as specific handling of classified information and compliance with Dutch government policies. Organisations must demonstrate compliance with BIO controls.

} />

Biometric data refers to measurable physical or behavioural characteristics that can uniquely identify an individual, such as fingerprints, iris patterns, facial geometry, voice prints or gait analysis. Unlike passwords or tokens, biometric identifiers are inherently tied to the person and cannot be easily changed if compromised.

Under the GDPR, biometric data processed for identification purposes is classified as a special category of personal data, requiring explicit consent or another Article 9 legal basis. The EU AI Act imposes additional restrictions on real-time biometric identification systems in public spaces. Organisations using biometric authentication must implement stringent security measures for storage and processing, including encryption and access controls.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Access Control", href: "/glossary/access-control" }, { name: "Consent", href: "/glossary/consent" }, { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Cross-Border Processing", href: "/glossary/cross-border-processing" } ]} />

A Business Impact Analysis systematically identifies and evaluates the potential effects of disruptions to critical business processes. It determines recovery time objectives (RTO), recovery point objectives (RPO) and the financial, operational and reputational consequences of downtime for each process.

The BIA is a foundational element of business continuity planning and is required by standards such as ISO 22301 and referenced in ISO 27001. By quantifying the impact of disruptions, organisations can prioritise their recovery efforts, allocate resources effectively and justify investments in resilience measures such as redundant systems, backup solutions and disaster recovery sites.

} relatedFrameworks={[ { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Asset Management", href: "/glossary/asset-management" }, { name: "Corrective Action Plan (CAP)", href: "/glossary/corrective-action-plan-cap" }, { name: "CIA Classification", href: "/glossary/cia-classification" } ]} /> ## C

A Change Advisory Board (CAB) is the group that reviews your proposed changes to IT systems and decides whether each one is safe to release. It weighs risk, impact, timing and rollback readiness, then approves, defers or rejects.

Formally the board advises and the designated change authority authorises. In most organisations those are the same people, so "CAB approval" is the ordinary shorthand, and this page uses it that way.

CAB roles and responsibilities

Keep a CAB cross-functional: no single person sees every consequence of a change. If you are small, run it with three or four people wearing several of these hats at once. The responsibilities matter more than the headcount.

Role Responsibility
Change manager (chair) Owns the process, sets the agenda and records the decision. Does not authorise changes alone.
Service or application owner Confirms the business can absorb the change now, and knows what the system is for and who breaks if it stops.
Infrastructure or platform engineer Assesses technical blast radius and dependencies, and checks the rollback plan is real.
Security representative Determines whether the change alters the attack surface, access model or data flows.
Operations or service desk Flags clashes with other work, freeze periods and support capacity around the release.
Business stakeholder Signs off on changes touching customer-facing services, contractual commitments or regulated processes.

Which changes need CAB approval

Not every change should reach the board. ITIL separates three types, and getting that split right is what keeps your CAB from becoming a bottleneck.

On vocabulary: the standing CAB and the ECAB below are ITIL v3 terms most organisations still use. ITIL 4 calls the practice change enablement and assigns a change authority per change type, warning that one central board for everything creates delay. The three types carry over unchanged.

Change type Route
Standard Pre-approved and low risk, following a documented procedure. No CAB review: the approval was granted once, to the procedure.
Normal Full review before deployment by the assigned change authority, in most organisations the CAB. The default for anything that changes architecture, access or data.
Emergency Handled by a reduced emergency CAB (ECAB, in ITIL v3 terms). Authorisation should still be sought before implementation wherever possible, with the documentation completed retrospectively.

How a CAB evidences ISO 27001 and SOC 2

ISO 27001:2022 requires change control under Annex A 8.32: changes to information processing facilities and systems must be subject to change management procedures. The standard does not mandate a board; it mandates that your changes are assessed, authorised and documented. A CAB is the usual way to show that.

SOC 2 covers the same ground in common criterion CC8.1, which expects the entity to authorise, design, develop or acquire, configure, document, test, approve and implement changes to infrastructure, data, software and procedures to meet its objectives. Auditors sample change records and trace them end to end.

What auditors ask to see

In practice the request is narrow and specific. For a sample of changes, expect to produce the change record with its requester and approver, the risk and impact assessment, test evidence, a rollback plan, and a traceable line from the ticket to the deployment that actually happened.

For emergency changes, show the retrospective approval too. An emergency route with no paper trail behind it is a finding.

Common mistakes

The failure is rarely the absence of a CAB. It is a CAB that rubber-stamps. If nothing is ever rejected or deferred, your board is recording decisions rather than making them, and an auditor will notice.

Close behind is having no standard-change catalogue. Routine work queues behind the board, teams route around it through the emergency path, and "emergency" becomes the most common change type on your register.

Third is approving in chat. A decision nobody can retrieve six months later did not happen, as far as an audit is concerned.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "CMDB (Configuration Management Database)", href: "/glossary/cmdb-configuration-management-database" }, { name: "Audit Trail", href: "/glossary/audit-trail" }, { name: "Corrective Measures", href: "/glossary/corrective-measures" } ]} relatedFeatures={[ { name: "Issues management", href: "/features/issues" } ]} />

Certification is an external validation of compliance with specific standards. An accredited third-party auditor verifies that an organisation has implemented required controls and processes.

Common certifications include ISO 27001 for information security, SOC 2 for service providers, and GDPR compliance verification, each demonstrating commitment to specific compliance requirements.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "ISO 27001", href: "/glossary/iso-27001" }, { name: "Audit Trail", href: "/glossary/audit-trail" }, { name: "Control Tests", href: "/glossary/control-tests" } ]} />

The Chief Information Security Officer is the senior executive responsible for establishing and maintaining an organisation's information security vision, strategy and programme. The CISO oversees risk assessments, security architecture, incident response, compliance with regulations and frameworks, and security awareness across the organisation.

Modern CISOs must balance technical expertise with business acumen, translating complex security risks into business terms for board-level reporting. They play a pivotal role in frameworks like ISO 27001, where top management commitment is a mandatory requirement, and are increasingly held accountable for regulatory compliance under GDPR, NIS2 and the EU AI Act.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" }, { name: "Continuous Improvement", href: "/glossary/continuous-improvement" }, { name: "Cybersecurity", href: "/glossary/cybersecurity" } ]} />

CIA classification rates information, or the system that holds it, on three properties: confidentiality (who may see it), integrity (how much it matters that it is correct and complete) and availability (how long you can do without it). In Dutch the same method is called BIV-classificatie, after beschikbaarheid, integriteit and vertrouwelijkheid.

CIA rating levels

Each property gets its own rating, usually on three levels such as low, medium and high, or 1 to 3. The result is a profile rather than a single score: a public price list is low on confidentiality but high on integrity, while a payroll file is high on confidentiality and medium on availability. A classification policy defines what each level means, for example that high availability means a process may be down for no more than a few hours, so that two people rating the same asset reach the same answer.

What the rating drives

The rating decides which controls an asset needs. High confidentiality leads to encryption and strict access control, high integrity to change control and logging, high availability to redundancy and tested backups. In ISO 27001 this sits in the asset inventory and the risk assessment, and control 5.12 of ISO 27002, classification of information, asks for classification based on confidentiality, integrity, availability and the requirements of relevant interested parties.

} relatedFrameworks={[ { name: "BIO - Government Information Security Baseline", href: "/frameworks/bio" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Classification Levels", href: "/glossary/classification-levels" }, { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Asset Management", href: "/glossary/asset-management" } ]} />

The CIA Triad is the cornerstone of information security. Confidentiality ensures data isn't disclosed to unauthorized parties, integrity ensures data isn't modified, and availability ensures data/systems are accessible when needed.

Most security controls align with protecting one or more elements of the CIA Triad, making it essential for designing effective security strategies.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Controls", href: "/glossary/controls" }, { name: "Encryption", href: "/glossary/encryption" } ]} />

Classification levels define the sensitivity categories applied to information assets, typically ranging from public (freely shareable) through internal (for employees only) and confidential (restricted access) to secret (highest sensitivity). Each level prescribes specific handling, storage, transmission and disposal requirements.

Establishing clear classification levels is a foundational requirement of ISO 27001 and enables organisations to apply the principle of proportionality: more sensitive data receives stronger controls, while less sensitive data avoids unnecessary overhead. Consistent classification also supports access control decisions, data loss prevention policies and regulatory compliance for frameworks such as GDPR and NIS2.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "BIO - Government Information Security Baseline", href: "/frameworks/bio" } ]} relatedTerms={[ { name: "CIA Classification", href: "/glossary/cia-classification" }, { name: "Classified Information", href: "/glossary/classified-information" }, { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Access Control", href: "/glossary/access-control" } ]} />

Classified information refers to government-designated data that requires protection in the interest of national security. In the Netherlands, classification levels include staatsgeheim (state secret) with sub-levels zeer geheim (top secret), geheim (secret) and confidentieel (confidential), as well as departementaal vertrouwelijk (departmentally confidential).

Handling classified information is governed by strict legal frameworks and requires specific security clearances, approved storage facilities and controlled distribution channels. Organisations working with government contracts or critical infrastructure must implement additional physical and technical safeguards beyond standard ISO 27001 requirements, including secure rooms, vetted personnel and dedicated communication systems.

} relatedFrameworks={[ { name: "ABDO - Defence Security Requirements", href: "/frameworks/abdo" } ]} relatedTerms={[ { name: "Classification Levels", href: "/glossary/classification-levels" }, { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Access Control", href: "/glossary/access-control" } ]} />

Confidentiality is one of the three pillars of the CIA Triad (alongside Integrity and Availability) and ensures that information is accessible only to those who are authorised to view it. It is maintained through a combination of access controls, encryption, data classification and security awareness training.

Breaches of confidentiality can result in regulatory penalties under GDPR, loss of competitive advantage and reputational damage. ISO 27001 addresses confidentiality through multiple Annex A controls covering areas such as access management, cryptography, physical security and supplier relationships. Organisations must continuously assess and strengthen their confidentiality measures as threats evolve.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "CIA Classification", href: "/glossary/cia-classification" }, { name: "Cryptography", href: "/glossary/cryptography" }, { name: "Access Control", href: "/glossary/access-control" }, { name: "Classification Levels", href: "/glossary/classification-levels" } ]} />

Integrity is one of the three pillars of the CIA Triad (alongside Confidentiality and Availability) and ensures that data remains accurate, complete and trustworthy throughout its lifecycle, protected against unauthorised or accidental modification. It is maintained through access controls, change management, hashing and checksums, digital signatures, input validation and audit logging.

A loss of integrity (whether from a malicious tamper, a faulty process or human error) undermines the reliability of every decision made on that data. ISO 27001 addresses integrity through Annex A controls covering change management, cryptography, logging and monitoring, and secure development. Organisations verify integrity by detecting and correcting unauthorised changes and by keeping a tamper-evident record of what changed, when and by whom.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Availability", href: "/glossary/availability" }, { name: "CIA Classification", href: "/glossary/cia-classification" } ]} />

Availability is one of the three pillars of the CIA Triad (alongside Confidentiality and Integrity) and ensures that information, systems and services are accessible to authorised users whenever they are needed. It is maintained through redundancy, resilient architecture, capacity planning, backups, disaster recovery and protection against disruptions such as hardware failure, outages and denial-of-service attacks.

A loss of availability (an outage, a ransomware lockout or an overloaded service) can halt operations, breach contractual SLAs and cause direct financial and reputational harm. ISO 27001 addresses availability through Annex A controls covering business continuity, redundancy, backup and capacity management. Organisations typically set measurable availability targets and track them through uptime metrics and recovery objectives (RTO/RPO).

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Integrity", href: "/glossary/integrity" }, { name: "CIA Classification", href: "/glossary/cia-classification" } ]} />

The Cloud Security Alliance is a global not-for-profit organisation dedicated to defining and raising awareness of best practices for secure cloud computing. Its most prominent contribution is the Cloud Controls Matrix (CCM), a comprehensive cybersecurity controls framework specifically designed for cloud environments, mapped to leading standards including ISO 27001, SOC 2 and NIST.

The CSA also administers the Security, Trust, Assurance and Risk (STAR) programme, which provides a publicly accessible registry where cloud providers can publish their security posture. For organisations evaluating cloud services, CSA resources offer a structured approach to assessing provider security and ensuring that cloud adoption does not introduce unacceptable risks.

} relatedFrameworks={[ { name: "ISO 27017 - Cloud Security", href: "/frameworks/iso27017" }, { name: "ISO 27018 - Cloud Privacy", href: "/frameworks/iso27018" } ]} relatedTerms={[ { name: "API Security", href: "/glossary/api-security" }, { name: "Cybersecurity", href: "/glossary/cybersecurity" }, { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" } ]} />

A Configuration Management Database is a centralised repository that stores information about all significant IT assets (configuration items) and the relationships between them. It provides a single source of truth for understanding the IT landscape, including servers, applications, network devices, databases and their dependencies.

An accurate and up-to-date CMDB is essential for effective change management, incident response and risk assessment. When a security incident occurs, the CMDB enables rapid impact analysis by revealing which systems and services are affected. For ISO 27001 compliance, the CMDB supports the asset management requirements and provides auditors with evidence of comprehensive IT asset oversight.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Asset Management", href: "/glossary/asset-management" }, { name: "CAB (Change Advisory Board)", href: "/glossary/cab-change-advisory-board" }, { name: "Audit Trail", href: "/glossary/audit-trail" } ]} />

Compliance automation refers to the use of software platforms to streamline and automate traditionally manual compliance activities. This includes automated evidence collection from cloud infrastructure, continuous control monitoring, policy management, risk assessment workflows and audit preparation with pre-mapped frameworks.

By replacing spreadsheets and manual processes with automated tooling, organisations can reduce the time and cost of achieving and maintaining certifications such as ISO 27001 and SOC 2 by up to 80%. Compliance automation also improves accuracy, provides real-time visibility into compliance posture and enables organisations to scale their compliance programmes without proportionally increasing headcount.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Control Automation", href: "/glossary/control-automation" }, { name: "Audit Fatigue", href: "/glossary/audit-fatigue" }, { name: "Control Tests", href: "/glossary/control-tests" } ]} />

A compliance framework provides a systematic approach to managing regulatory obligations. It combines standards (like ISO 27001 or GDPR), procedures, controls, and best practices into a cohesive system.

Effective compliance frameworks help organisations manage risks, demonstrate compliance to regulators and auditors, and protect stakeholders through consistent, documented processes.

} relatedFrameworks={[ { name: "All Frameworks", href: "/frameworks/all" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Control Objectives", href: "/glossary/control-objectives" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "ISO 27001", href: "/glossary/iso-27001" } ]} />

Under the GDPR, consent is one of six lawful bases for processing personal data. Valid consent must be freely given, specific, informed and unambiguous, meaning the data subject must actively opt in through a clear affirmative action. Pre-ticked boxes, silence or inactivity do not constitute valid consent.

Consent must be as easy to withdraw as it is to give, and organisations must maintain records proving that consent was obtained. For special categories of data (such as biometric or health data), explicit consent is required under Article 9. Organisations should carefully evaluate whether consent is the most appropriate legal basis, as it can be withdrawn at any time, potentially disrupting ongoing processing activities.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Biometric Data", href: "/glossary/biometric-data" }, { name: "Cross-Border Processing", href: "/glossary/cross-border-processing" }, { name: "Confidentiality", href: "/glossary/confidentiality" } ]} />

Context of the Organisation is a foundational requirement in ISO 27001 that mandates organisations to identify and analyse internal and external factors affecting their Information Security Management System (ISMS). This includes understanding the organisation's purpose, scope, stakeholders, and regulatory environment.

Organisations must document their context, including factors that could positively or negatively impact ISMS effectiveness. This understanding informs risk assessments, control selection, and the overall security strategy. Regular review ensures the ISMS remains relevant and effective.

} relatedFrameworks={[ { name: "ISO 27001", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Information Security Management System (ISMS)", href: "/glossary/isms" }, { name: "ISO 27001", href: "/glossary/iso-27001" }, { name: "Risk Assessment", href: "/glossary/risk-assessment" } ]} />

Continuous compliance is an approach that replaces traditional point-in-time audit cycles with ongoing, real-time monitoring and validation of an organisation's compliance posture. Instead of scrambling to collect evidence before annual audits, organisations maintain a perpetual state of readiness through automated checks, continuous control monitoring and live dashboards.

This approach significantly reduces audit preparation time and cost while providing greater assurance that controls are actually functioning as intended, not just at audit time but throughout the year. Continuous compliance is increasingly expected by certification bodies and is supported by modern GRC platforms that integrate with cloud infrastructure, identity providers and ticketing systems to automatically collect and validate evidence.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Control Automation", href: "/glossary/control-automation" }, { name: "Continuous Improvement", href: "/glossary/continuous-improvement" }, { name: "Audit Fatigue", href: "/glossary/audit-fatigue" } ]} />

Continuous improvement is a core principle of ISO 27001 that requires organisations to systematically enhance their information security management system (ISMS) over time. It follows the Plan-Do-Check-Act (PDCA) cycle: planning security measures, implementing them, monitoring their effectiveness and taking corrective action based on findings.

The requirement for continuous improvement ensures that an ISMS remains effective as the threat landscape, business context and regulatory environment evolve. Organisations demonstrate continuous improvement through management reviews, internal audits, corrective actions, updated risk assessments and measurable security objectives. Certification bodies evaluate the maturity of an organisation's improvement process during surveillance and recertification audits.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "ISO 9001 - Quality Management", href: "/frameworks/iso9001" } ]} relatedTerms={[ { name: "Corrective Action Plan (CAP)", href: "/glossary/corrective-action-plan-cap" }, { name: "Corrective Measures", href: "/glossary/corrective-measures" }, { name: "Control Tests", href: "/glossary/control-tests" }, { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" } ]} />

Continuous monitoring replaces periodic audits with ongoing assessment. It uses automated tools to track control effectiveness and compliance status in real-time.

This approach enables faster detection and remediation of issues, reducing the risk window and improving overall security posture.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Control Tests", href: "/glossary/control-tests" }, { name: "Audit Trail", href: "/glossary/audit-trail" } ]} />

Control automation means having software test a control and collect its evidence on a schedule, rather than someone checking it by hand in the weeks before an audit. The control itself does not change. What changes is how often you know whether it is working.

What can actually be automated

The useful split is not technical against organisational. It is whether the control has a machine-readable state somewhere. If it does, a system can check it hourly; if it lives in a judgement or a conversation, it cannot.

Well suited Not automatable
MFA enabled on every account Whether a risk assessment reached a sensible conclusion
Backups completing, and restores tested Whether a supplier's answers are credible
Encryption on at rest and in transit Whether management actually reviewed the results
Leavers deprovisioned within the agreed window Whether staff understood the training
Patch levels and endpoint protection Whether a change was genuinely an emergency

Being honest about the right-hand column matters. A programme that claims full automation usually means it automated the checkable half and quietly stopped testing the rest.

Why continuous testing changes the evidence

A manual check produces a point in time: on the day someone looked, the control passed. An automated check produces a series, and a series answers the question an auditor is actually asking, which is whether the control operated throughout the period.

That difference shows up in what a failure looks like. Manually, you find out at year end that a backup has been failing for months. On a schedule, you get told on the second day, which turns an audit finding into an operational fix.

Where automation stops

An automated test tells you the state of a system, not whether the control is well designed. Software can confirm that every account has MFA; it cannot tell you that contractors should not have had accounts at all.

So keep a person in the loop for design. Automate the evidence and the repetition, and spend the time you save reviewing whether you are testing the right things.

See how Tidal Control tests controls and collects the evidence if you want the tooling rather than the concept.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Compliance Automation", href: "/glossary/compliance-automation" }, { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Control Tests", href: "/glossary/control-tests" } ]} relatedFeatures={[ { name: "Controls management", href: "/features/controls" } ]} />

Control objectives define the specific outcomes that security controls are designed to achieve. They provide a clear, measurable target that links individual controls to broader security goals, such as "ensure that only authorised users can access production systems" or "maintain data integrity during processing and storage".

In frameworks like ISO 27001 and SOC 2, control objectives serve as the bridge between high-level policies and operational security measures. During audits, assessors evaluate whether the implemented controls effectively meet their stated objectives. Well-defined control objectives also help organisations prioritise their security investments and communicate security requirements clearly to technical teams.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" }, { name: "Control Tests", href: "/glossary/control-tests" }, { name: "CUEC (Complementary User Entity Controls)", href: "/glossary/cuec-complementary-user-entity-controls" } ]} />

Control tests are periodic evaluations that verify whether security controls are operating effectively as designed. They range from automated technical checks (such as verifying that encryption is enabled on databases) to manual assessments (such as reviewing access rights quarterly) and simulation exercises (such as phishing tests or disaster recovery drills).

Regular control testing is a requirement of ISO 27001 and SOC 2, and provides evidence that controls are not just implemented but genuinely effective. Test results feed into the continuous improvement cycle, identifying controls that need strengthening, updating or replacing. Modern GRC platforms automate many control tests, enabling organisations to shift from periodic manual testing to continuous automated validation.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Control Objectives", href: "/glossary/control-objectives" }, { name: "Continuous Compliance", href: "/glossary/continuous-compliance" }, { name: "Audit Trail", href: "/glossary/audit-trail" }, { name: "Corrective Measures", href: "/glossary/corrective-measures" } ]} />

Controls are the safeguards implemented to reduce or eliminate risks. They include technical measures (encryption, firewalls) and organisational measures (policies, training, procedures).

Controls are mapped to risk levels and compliance requirements. Regular testing ensures they remain effective and aligned with evolving threats.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Risk Management", href: "/glossary/risk-management" }, { name: "Control Objectives", href: "/glossary/control-objectives" }, { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" } ]} />

A Corrective Action Plan is a formal, documented response to non-conformities or findings identified during internal audits, external assessments or incident investigations. It specifies the root cause of each finding, the corrective actions to be taken, responsible parties, deadlines and verification criteria for confirming the issue has been resolved.

CAPs are a mandatory element of ISO 27001 compliance, as the standard requires organisations to address non-conformities and prevent their recurrence. Well-structured CAPs demonstrate to certification bodies that an organisation takes findings seriously and has a systematic approach to resolving them. Tracking CAPs in a centralised GRC platform ensures visibility, accountability and timely completion.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "ISO 9001 - Quality Management", href: "/frameworks/iso9001" } ]} relatedTerms={[ { name: "Corrective Measures", href: "/glossary/corrective-measures" }, { name: "Continuous Improvement", href: "/glossary/continuous-improvement" }, { name: "Audit Trail", href: "/glossary/audit-trail" } ]} />

A corrective measure, in ISO terms a corrective action, removes the cause of a non-conformity or incident so that it does not happen again. It is not the same as fixing the problem itself. ISO 9000 separates the two: a correction eliminates the non-conformity you found, and a corrective action eliminates its cause.

An example. An internal audit finds that three people who left last quarter still have access to the CRM. Removing their accounts is the correction. Finding that the leaver process never notifies IT, and changing it so that it does, is the corrective action. Checking three months later that everyone who left since then lost access on time is how you show it worked.

What ISO 27001 requires

Clause 10.2 requires you to react to a non-conformity and to evaluate whether action is needed to remove its cause: review it, determine the cause, and check whether similar non-conformities exist or could occur. Then implement the action, review its effectiveness, and change the management system if necessary. Corrective actions have to be appropriate to the effects of the non-conformity, and you keep documented evidence of what happened, what you did and the result.

Corrective or preventive

Older editions also had a separate requirement for preventive action, taken before anything went wrong. ISO 27001:2013 and ISO 9001:2015 dropped it, because the risk assessment now does that job: preventing a problem that has not happened yet is risk treatment, and removing the cause of one that has is corrective action.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Corrective Action Plan (CAP)", href: "/glossary/corrective-action-plan-cap" }, { name: "Continuous Improvement", href: "/glossary/continuous-improvement" }, { name: "Control Tests", href: "/glossary/control-tests" } ]} relatedFeatures={[ { name: "Issues management", href: "/features/issues" } ]} />

When your startup processes personal data of EU residents using services hosted outside the European Economic Area (such as US-based AI providers, cloud platforms or analytics tools), you are performing a cross-border data transfer. Under GDPR, this requires additional legal safeguards to ensure the data receives equivalent protection.

What you need to do:

  • Check adequacy: If the destination country has an EU adequacy decision (e.g. the EU-US Data Privacy Framework), transfers are permitted without additional measures. Verify your provider participates in the framework.
  • Standard Contractual Clauses (SCCs): For countries without adequacy, use the European Commission's standard contract templates. Most major cloud and AI providers already include SCCs in their terms. Check their DPA.
  • Transfer Impact Assessment (TIA): Evaluate whether local laws in the destination country could undermine the protection provided by SCCs. Document your assessment and any supplementary measures.
  • Map your data flows: Create an inventory of all services that process personal data and where that data is stored. This is often more complex than expected. Subprocessors may route data through multiple countries.

The Dutch Data Protection Authority provides detailed guidance on international transfers. Tidal Control helps you document data flows, track SCC compliance and maintain your TIA as part of your privacy management system.

} relatedTerms={[ { name: "Data Processing Agreement (DPA)", href: "/glossary/data-processing-agreement-dpa" }, { name: "Processing Register", href: "/glossary/processing-register" } ]} />

Cross-border processing refers to the processing of personal data that takes place across the borders of EU/EEA member states, either because the data controller or processor operates in multiple countries or because the processing substantially affects data subjects in more than one member state. The GDPR introduces specific mechanisms to handle such situations consistently.

When cross-border processing occurs, the one-stop-shop mechanism designates a lead supervisory authority based on the location of the organisation's main establishment, simplifying regulatory interaction. However, concerned supervisory authorities in other affected member states retain certain powers. Organisations engaged in cross-border processing must carefully document their data flows, establish clear legal bases for each jurisdiction and implement appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Consent", href: "/glossary/consent" }, { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "Biometric Data", href: "/glossary/biometric-data" } ]} />

Cryptography is the science and practice of securing information by transforming it into an unreadable format using mathematical algorithms. It encompasses encryption (protecting confidentiality), hashing (ensuring integrity), digital signatures (providing authentication and non-repudiation) and key management (safeguarding the cryptographic keys themselves).

ISO 27001 Annex A includes specific controls for cryptographic policy and key management, requiring organisations to define rules for the use of cryptography and to protect keys throughout their lifecycle. In practice, cryptography underpins secure communications (TLS/SSL), data-at-rest protection (AES encryption), authentication systems and regulatory compliance. Organisations must stay current with evolving standards, particularly as quantum computing threatens to render current algorithms obsolete.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Confidentiality", href: "/glossary/confidentiality" }, { name: "API Security", href: "/glossary/api-security" }, { name: "Cybersecurity", href: "/glossary/cybersecurity" } ]} />

CUECs, complementary user entity controls, are the controls a service organisation assumes its customers have in place. A SOC 1 or SOC 2 report lists them in the description of the system, because some of the provider's controls only achieve their objective if the customer does its part. The auditor's opinion depends on them: it says the controls were effective provided user entities applied the complementary controls assumed in the design.

What a CUEC looks like

They cover the part of the service the customer controls. Typical examples: the customer approves and removes its own users' access, reviews that access periodically, keeps its credentials secret and turns on multi-factor authentication where the service offers it, reports suspected incidents to the provider, and checks that the data it sends is complete and correct.

What to do with them

Read the CUEC section before relying on a supplier's SOC 2 report, and map each item to a control in your own environment. A supplier's report is evidence only for the controls it covers; when your own auditor asks how you rely on suppliers, the CUECs are the part you are expected to show you have covered.

CUECs are not the same as CSOCs, complementary subservice organisation controls. Those are expected of the provider's own subcontractors, such as the cloud platform it runs on, rather than of its customers.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Access Control", href: "/glossary/access-control" }, { name: "Control Objectives", href: "/glossary/control-objectives" }, { name: "Audit Trail", href: "/glossary/audit-trail" } ]} />

Cybersecurity is the comprehensive practice of protecting digital assets, including networks, systems, applications and data, from malicious attacks, unauthorised access and accidental damage. It encompasses technical measures (firewalls, intrusion detection, encryption), organisational measures (policies, training, incident response) and governance frameworks (ISO 27001, NIST CSF, NIS2).

As organisations increasingly depend on digital infrastructure, cybersecurity has evolved from a purely technical discipline to a strategic business concern. Effective cybersecurity requires a risk-based approach that aligns security investments with business priorities. Regulatory frameworks such as NIS2 and the EU Cyber Resilience Act are raising the bar for organisations across all sectors, making cybersecurity governance a board-level responsibility.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "CSIRT (Computer Security Incident Response Team)", href: "/glossary/csirt-computer-security-incident-response-team" }, { name: "Cryptography", href: "/glossary/cryptography" }, { name: "API Security", href: "/glossary/api-security" }, { name: "Chief Information Security Officer (CISO)", href: "/glossary/chief-information-security-officer-ciso" } ]} />

A Computer Security Incident Response Team is a dedicated group of security professionals responsible for detecting, analysing, containing and remediating cybersecurity incidents within an organisation. CSIRTs follow established incident response frameworks and maintain playbooks for common incident types such as malware infections, data breaches, denial-of-service attacks and insider threats.

Under the NIS2 directive, essential and important entities in the EU are required to have incident response capabilities and must report significant incidents to their national CSIRT within strict timeframes. Having a well-functioning CSIRT is also a key element of ISO 27001 compliance, supporting the requirements for incident management, business continuity and communication with stakeholders during security events.

} relatedFrameworks={[ { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Cybersecurity", href: "/glossary/cybersecurity" }, { name: "Audit Trail", href: "/glossary/audit-trail" }, { name: "Business Impact Analysis (BIA)", href: "/glossary/business-impact-analysis-bia" }, { name: "Chief Information Security Officer (CISO)", href: "/glossary/chief-information-security-officer-ciso" } ]} /> ## D

Under GDPR and similar regulations, organisations must notify authorities and affected individuals of significant data breaches promptly. The 72-hour clock starts when the breach is discovered.

Failure to notify can result in substantial fines. Organisations should maintain breach detection and notification procedures to meet this critical compliance requirement.

} relatedTerms={[ { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Data Protection Officer (DPO)", href: "/glossary/dpo" } ]} />

Data classification helps organisations identify which data requires the highest protection. Common categories include public, internal, confidential, and secret.

Classification drives decisions about encryption, access controls, storage location, and retention periods, ensuring resources are focused on protecting the most valuable data.

} relatedTerms={[ { name: "Classification Levels", href: "/glossary/classification-levels" }, { name: "Data Inventory", href: "/glossary/data-inventory" }, { name: "Access Control", href: "/glossary/access-control" } ]} />

Under GDPR, the data controller is the organisation that decides what personal data to collect and how to use it. The controller bears primary responsibility for GDPR compliance.

Controllers must ensure they have lawful basis for processing, implement required safeguards, and fulfill data subject rights requests.

} relatedTerms={[ { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Data Processor", href: "/glossary/data-processor" }, { name: "Data Protection Officer (DPO)", href: "/glossary/dpo" } ]} />

Data discovery involves using automated tools and techniques to scan an organisation's entire IT landscape (databases, file shares, cloud storage, email systems and applications) to find where personal and sensitive data resides. This process creates a comprehensive data map that reveals hidden or forgotten data stores, shadow IT repositories and legacy systems that may still hold regulated information.

Effective data discovery is a foundational step for GDPR compliance, as organisations cannot protect data they do not know exists. By maintaining an up-to-date picture of data locations, organisations can respond faster to data subject access requests, conduct more accurate data protection impact assessments and reduce the risk of unreported data breaches.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Data Inventory", href: "/glossary/data-inventory" }, { name: "Data Minimisation", href: "/glossary/data-minimisation" }, { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" } ]} />

A data inventory is a structured catalogue that records every data asset an organisation holds, including its physical or logical location, the designated data owner, its classification level (e.g. public, internal, confidential) and who has access to it. It typically also captures metadata such as retention periods, processing purposes and legal bases for processing under the GDPR.

Maintaining an accurate and up-to-date data inventory is essential for demonstrating accountability under frameworks like ISO 27001 and the GDPR. It enables organisations to quickly identify which systems are affected during a security incident, supports data subject rights fulfilment and provides auditors with clear evidence that data governance processes are in place.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Discovery", href: "/glossary/data-discovery" }, { name: "Document Management", href: "/glossary/document-management" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" } ]} />

DLP systems monitor, detect, and block unauthorized transmission of sensitive data. They apply to data in motion (network), at rest (storage), and in use (endpoints).

DLP is a critical control for protecting intellectual property, financial data, and personal information from accidental or malicious exfiltration.

} relatedTerms={[ { name: "Data Classification", href: "/glossary/data-classification" }, { name: "Encryption", href: "/glossary/encryption" }, { name: "Access Control", href: "/glossary/access-control" } ]} />

Data minimisation is one of the core principles of the GDPR (Article 5(1)(c)), requiring that personal data collected and processed must be adequate, relevant and limited to what is strictly necessary for the stated purpose. This means organisations must critically evaluate each data field they collect and be able to justify why it is needed, rather than gathering data speculatively or "just in case".

In practice, data minimisation reduces an organisation's attack surface and limits the potential impact of a data breach, since less data means less exposure. It also simplifies compliance with other GDPR obligations such as storage limitation and data subject access requests, and builds trust with customers who are increasingly aware of how their data is used.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" }, { name: "Data Discovery", href: "/glossary/data-discovery" }, { name: "Data Protection Authority", href: "/glossary/data-protection-authority" } ]} />

A Data Processing Agreement (DPA) is a legally binding contract required by GDPR Article 28 between a data controller (you) and a data processor (e.g. your cloud provider, AI API provider, analytics tool). It specifies what data is processed, how it is protected and what happens when things go wrong. For AI startups, DPAs are critical because you likely rely on multiple external AI and cloud services that handle your users' personal data.

What a DPA must cover:

  • Scope and purpose: What personal data is processed, for what purpose, and for how long? Be specific about AI-related processing like model inference, logging and analytics.
  • Security measures: What technical and organisational measures does the processor implement? Encryption, access controls, incident response, etc.
  • Subprocessors: Can the processor use subprocessors? You must be informed and have the right to object. Most AI providers use a chain of subprocessors. Make sure you know who they are.
  • Data subject rights: The processor must help you respond to access, rectification and deletion requests from your users.
  • Audit rights: You must have the right to verify compliance, either through audits or by receiving certifications (e.g. SOC 2 reports).
  • Data return and deletion: What happens when the contract ends? Data must be returned or deleted.

How to get started:

  • Check if your AI providers (OpenAI, Anthropic, Google) already offer a standard DPA. Most do, often linked from their privacy page.
  • Review each DPA against the requirements above. Pay attention to data location, subprocessor lists and training data usage policies.
  • For smaller vendors without a standard DPA, use the Dutch DPA guidance as a template.

Tidal Control helps you track all your processor agreements, monitor subprocessor changes and maintain an up-to-date register of all data processing relationships.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Controller", href: "/glossary/data-controller" }, { name: "Data Processor", href: "/glossary/data-processor" }, { name: "Cross-Border Data Transfer", href: "/glossary/cross-border-data-transfer" } ]} />

A Data Processor is any organisation or person (other than the controller) that processes personal data on behalf of the controller and following their instructions. This includes cloud providers, payroll companies, and other service providers handling personal data.

Data Processors have specific legal obligations under GDPR, including implementing appropriate security measures, assisting the controller with data subject rights, and only processing data as instructed. A Data Processing Agreement must be in place between the controller and processor.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Controller", href: "/glossary/data-controller" }, { name: "Data Processing Agreement (DPA)", href: "/glossary/data-processing-agreement-dpa" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" } ]} />

A Data Protection Authority (DPA) is the independent public body responsible for supervising the application of data protection law within its jurisdiction. In the Netherlands this is the Autoriteit Persoonsgegevens (AP), while other EU member states have their own supervisory authorities such as the ICO in the United Kingdom and the CNIL in France. DPAs have the power to investigate complaints, conduct audits and impose administrative fines for non-compliance.

Organisations must cooperate with their relevant DPA and, in many cases, are required to notify the authority within 72 hours of discovering a personal data breach. Understanding your DPA's guidance, enforcement priorities and reporting procedures is critical for maintaining compliance and avoiding significant penalties that can reach up to 4% of annual global turnover under the GDPR.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Minimisation", href: "/glossary/data-minimisation" }, { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} />

Data Protection by Design (also known as Privacy by Design) is a legal obligation under GDPR Article 25 requiring organisations to integrate data protection safeguards into the design and architecture of systems, processes and products from the very earliest stages of development. This includes measures such as pseudonymisation, access controls, data minimisation defaults and encryption, rather than bolting privacy features on after the fact.

Adopting this approach significantly reduces the cost and effort of achieving compliance, since retrofitting privacy controls into existing systems is typically far more expensive and error-prone. It also helps organisations build more trustworthy products, avoid regulatory action and demonstrate to auditors and supervisory authorities that privacy is embedded in the organisational culture rather than treated as an afterthought.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Data Minimisation", href: "/glossary/data-minimisation" }, { name: "Encryption at Rest", href: "/glossary/encryption-at-rest" }, { name: "DevSecOps", href: "/glossary/devsecops" } ]} />

A DPIA is a structured risk assessment you must conduct before starting any data processing that is likely to result in a high risk to individuals. Under GDPR Article 35, this is mandatory when you use new technologies, process data at large scale, systematically monitor public areas, or make automated decisions with legal effects. For AI startups, a DPIA is almost always required because AI processing typically involves profiling, automated decision-making and large-scale data analysis.

How to conduct a DPIA:

  • Describe the processing: What data do you process, where does it come from, how does it flow through your systems, and what is the output? Include your AI model's role in the processing chain.
  • Assess necessity and proportionality: Is this processing actually necessary for your purpose? Could you achieve the same goal with less data or a less invasive approach?
  • Identify risks to individuals: What could go wrong from the data subject's perspective? Consider discrimination, financial loss, reputational damage, loss of confidentiality, and loss of control over personal data.
  • Define mitigating measures: For each risk, describe what you will do to reduce it. Examples: anonymisation, access restrictions, human oversight for automated decisions, data minimisation, encryption.
  • Document and review: A DPIA is a living document. Review it when your processing changes, when you update your AI model, or at least annually.

When is a DPIA required?

  • Automated decision-making with legal or significant effects (e.g. credit scoring, hiring tools)
  • Large-scale processing of sensitive data (health, biometrics, political opinions)
  • Systematic monitoring of publicly accessible areas
  • Using new technologies (AI, machine learning, IoT) for processing personal data

The ICO DPIA guidance provides templates and examples. Tidal Control provides a DPIA workflow that guides you through each step, links findings to your risk register and generates audit-ready documentation.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "AI Impact Assessment (AIIA)", href: "/glossary/aiia" }, { name: "Data Protection Officer (DPO)", href: "/glossary/dpo" }, { name: "Processing Register", href: "/glossary/processing-register" } ]} />

DPOs are required for public authorities and organisations whose core activity involves large-scale systematic monitoring or processing of personal data. They act as the primary point of contact for GDPR compliance.

DPOs monitor compliance, provide guidance on data protection obligations, and serve as the liaison between the organisation and data protection authorities.

} relatedTerms={[ { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Data Protection Authority", href: "/glossary/data-protection-authority" }, { name: "Data Controller", href: "/glossary/data-controller" } ]} />

A data retention policy defines how long your organisation keeps different categories of data and when that data must be deleted. Under GDPR, you may not store personal data longer than necessary for its original purpose. For AI startups, this also covers training data, user interaction logs and model outputs.

How to create one:

  • Categorise your data: List all data types you store: customer data, employee data, AI training data, logs, analytics, backups. Group them by purpose and sensitivity.
  • Define retention periods: For each category, determine how long you need it. Some have legal minimums (e.g. financial records: 7 years) while most personal data should be deleted when no longer needed.
  • Automate deletion: Set up automated cleanup jobs or retention rules in your database and cloud storage. Manual deletion does not scale and is error-prone.
  • Handle exceptions: Define a process for legal holds (when data must be preserved for litigation) and data subject deletion requests (GDPR right to erasure).
  • Review annually: Retention needs change as your product and legal landscape evolve. Schedule a yearly review.

The Dutch Data Protection Authority provides guidance on the right to erasure and retention. Tidal Control helps you document retention schedules and link them to your processing register for a complete audit trail.

} relatedTerms={[ { name: "Processing Register", href: "/glossary/processing-register" }, { name: "Data Subject Rights", href: "/glossary/data-subject-rights" } ]} />

A Data Subject is any identified or identifiable natural person whose personal data is being processed. Under GDPR, data subjects are the individuals whose information is collected and processed by organisations.

Data subjects have specific rights under GDPR, including the right to be informed about processing, access their data, correct inaccurate data, request deletion, and object to processing. Organisations must respect these rights and ensure transparency in their data handling practices.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Subject Rights", href: "/glossary/data-subject-rights" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Personal Data", href: "/glossary/personal-data" } ]} />

Data Subject Rights are fundamental rights granted to individuals under GDPR (Articles 12-22) regarding their personal data. These include the right to access, rectification, erasure (right to be forgotten), restrict processing, data portability, and object to processing.

Organisations must provide mechanisms for data subjects to exercise these rights and respond to requests within 30 days. These rights empower individuals with control over their personal information and create accountability for organisations handling personal data.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Subject", href: "/glossary/data-subject" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Right to be Forgotten", href: "/glossary/right-to-be-forgotten" }, { name: "Personal Data", href: "/glossary/personal-data" } ]} />

DDoS protection encompasses the technologies, strategies and services designed to defend against Distributed Denial of Service attacks, in which malicious actors flood a target system with enormous volumes of traffic to exhaust its resources and render it unavailable to legitimate users. Modern DDoS protection typically operates at multiple layers (network, transport and application) using techniques such as traffic scrubbing, rate limiting, geo-blocking and behavioural analysis to distinguish genuine requests from attack traffic.

For organisations subject to compliance frameworks like ISO 27001 or DORA, DDoS protection is a critical component of availability management and business continuity planning. A successful DDoS attack can disrupt customer-facing services, trigger SLA breaches and even serve as a smokescreen for more targeted intrusions, making robust mitigation capabilities essential for both operational resilience and regulatory compliance.

} relatedFrameworks={[ { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Disaster Recovery", href: "/glossary/disaster-recovery" }, { name: "IDS/IPS (Intrusion Detection/Prevention System)", href: "/glossary/ids-ips-intrusion-detection-prevention-system" }, { name: "ICT Risk Management (DORA)", href: "/glossary/ict-risk-management-dora" } ]} />

DevSecOps is a methodology that integrates security practices directly into every phase of the software development lifecycle, from planning and coding through to testing, deployment and monitoring. Unlike traditional approaches where security is handled as a separate gate at the end of development, DevSecOps makes every team member responsible for security through automated vulnerability scanning, static and dynamic code analysis, dependency checking and infrastructure-as-code security reviews.

Adopting DevSecOps is increasingly important for organisations seeking compliance with standards such as ISO 27001 and SOC 2, which require demonstrable secure development practices. By catching vulnerabilities early in the pipeline (when they are cheapest to fix), organisations reduce their risk exposure, accelerate release cycles and produce audit-ready evidence of continuous security integration throughout the development process.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" }, { name: "Endpoint Detection and Response (EDR)", href: "/glossary/endpoint-detection-and-response-edr" }, { name: "IT General Controls (ITGC)", href: "/glossary/it-general-controls-itgc" } ]} />

Disaster recovery (DR) encompasses the documented plans, procedures and technical capabilities that enable an organisation to restore critical IT systems, applications and data following a disruptive event such as a natural disaster, cyberattack, hardware failure or human error. A comprehensive DR plan defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for each critical system, along with detailed runbooks, communication protocols and roles and responsibilities.

Disaster recovery is a mandatory requirement under most compliance frameworks, including ISO 27001 (Annex A.17), DORA and SOC 2. Regular testing of DR plans through tabletop exercises, failover drills and full-scale simulations is essential to ensure that recovery procedures actually work under pressure and that recovery targets can be met, providing both operational resilience and auditable evidence of preparedness.

} relatedFrameworks={[ { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "DDoS Protection", href: "/glossary/ddos-protection" }, { name: "ICT Risk Management (DORA)", href: "/glossary/ict-risk-management-dora" }, { name: "Inherent Risk", href: "/glossary/inherent-risk" } ]} />

DORA (Digital Operational Resilience Act) is an EU regulation establishing uniform requirements for digital operational resilience across the financial sector. It applies to financial entities including banks, investment firms, payment institutions, and insurance companies.

DORA requires financial entities to implement robust digital operational resilience measures, including ICT risk management, incident reporting, testing requirements, and supply chain risk management. The regulation aims to strengthen the financial sector's resilience to ICT-related incidents and cyber threats.

} />

Document change management is the structured process of proposing, reviewing, approving and tracking modifications to compliance-critical documents such as policies, procedures, contracts and risk assessments. It typically involves version control, approval workflows, change logs and audit trails that record who changed what, when and why, ensuring that documents remain accurate, current and authorised at all times.

Effective document change management is a core requirement of ISO 27001 (Clause 7.5) and other compliance frameworks that mandate controlled documentation. Without it, organisations risk operating on outdated policies, losing track of contractual obligations or failing audits due to an inability to demonstrate a clear history of document revisions and approvals.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Document Management", href: "/glossary/document-management" }, { name: "Evidence Collection", href: "/glossary/evidence-collection" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} />

Document management is the systematic approach to creating, storing, organising, retrieving and disposing of documents and records throughout their entire lifecycle. In a compliance context, this includes policies, procedures, evidence records, audit reports, risk assessments and contractual documents, all of which must be maintained in a controlled manner with appropriate access restrictions, retention schedules and disposal procedures.

A robust document management system is fundamental to demonstrating compliance with frameworks like ISO 27001, SOC 2 and the GDPR, where auditors expect to see well-organised, versioned and easily retrievable documentation. It reduces the time spent preparing for audits, ensures that staff always have access to the latest approved versions of critical documents and supports knowledge continuity when team members change roles.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "ISO 9001 - Quality Management", href: "/frameworks/iso9001" } ]} relatedTerms={[ { name: "Document Change Management", href: "/glossary/document-change-management" }, { name: "Evidence Archive", href: "/glossary/evidence-archive" }, { name: "Data Inventory", href: "/glossary/data-inventory" } ]} /> ## E

Encryption converts readable data into an encoded format using algorithms and cryptographic keys. Only those with the correct key can decrypt and read the data.

Encryption is a fundamental control protecting data from unauthorized access, whether at rest in storage or in transit across networks.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Encryption at Rest", href: "/glossary/encryption-at-rest" }, { name: "Encryption in Transit", href: "/glossary/encryption-in-transit" }, { name: "Cryptography", href: "/glossary/cryptography" } ]} />

Encryption at rest protects stored data by converting it into an unreadable format using cryptographic algorithms such as AES-256, ensuring that data on hard drives, solid-state drives, databases, backups and other storage media cannot be accessed without the proper decryption keys. This safeguard is essential for protecting data against physical theft of storage devices, unauthorised access to database files and improper disposal of hardware.

Encryption at rest is a key technical control required by ISO 27001 (Annex A.10), the GDPR (Article 32) and numerous other compliance frameworks. Organisations must also implement proper key management practices (including key rotation, secure storage and access controls for encryption keys), since the security of encrypted data is only as strong as the protection of the keys used to encrypt it.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Encryption in Transit", href: "/glossary/encryption-in-transit" }, { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" } ]} />

Encryption in transit protects data as it travels between systems, devices and networks by using cryptographic protocols such as TLS (Transport Layer Security) and its predecessor SSL. This prevents eavesdropping, man-in-the-middle attacks and data tampering during transmission, whether the data flows between a user's browser and a web server, between microservices within a data centre or between on-premises systems and cloud environments.

Implementing encryption in transit is a baseline security requirement under virtually all compliance frameworks, including ISO 27001, SOC 2, PCI DSS and the GDPR. Organisations should enforce minimum TLS versions (currently TLS 1.2 or higher), use strong cipher suites, implement certificate management and regularly test their configurations using tools like SSL Labs to ensure that data remains protected during every transmission.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Encryption at Rest", href: "/glossary/encryption-at-rest" }, { name: "FIDO2 Authentication", href: "/glossary/fido2-authentication" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" } ]} />

Endpoint Detection and Response (EDR) is an advanced security solution that continuously monitors endpoint devices (laptops, desktops, servers and mobile devices) to detect, investigate and respond to cyber threats in real time. Unlike traditional antivirus software that relies primarily on signature-based detection, EDR uses behavioural analysis, machine learning and threat intelligence to identify sophisticated attacks such as fileless malware, lateral movement and zero-day exploits.

EDR is a critical control for organisations pursuing ISO 27001 or SOC 2 certification, as it provides both proactive threat detection and the forensic data needed for incident investigation and response. The automated response capabilities (such as isolating compromised endpoints, killing malicious processes and rolling back changes) significantly reduce the time between detection and containment, minimising the potential impact of security incidents.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "IDS/IPS (Intrusion Detection/Prevention System)", href: "/glossary/ids-ips-intrusion-detection-prevention-system" }, { name: "DevSecOps", href: "/glossary/devsecops" }, { name: "IAM (Identity and Access Management)", href: "/glossary/iam-identity-and-access-management" } ]} />

Essential Entities are organisations operating in critical infrastructure sectors designated under the NIS2 Directive. These include operators of critical infrastructure in energy, transport, water, banking, and healthcare sectors that provide essential services to the economy and society.

Essential Entities face the strictest cybersecurity obligations under NIS2, including advanced security measures, incident reporting requirements, supply chain risk management, and regular security assessments. These enhanced requirements reflect the critical nature of services they provide.

} relatedFrameworks={[ { name: "NIS2", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "NIS2 Directive", href: "/glossary/nis2" }, { name: "Important Entities (NIS2)", href: "/glossary/important-entities-nis2" } ]} />

An evidence archive is a centralised, structured repository where all compliance evidence is stored, organised by control, framework and audit period. It serves as the single source of truth for demonstrating that security controls are implemented and operating effectively, containing artefacts such as screenshots, log exports, policy documents, configuration snapshots, training records and approval workflows.

A well-maintained evidence archive dramatically reduces the burden of compliance audits by making it straightforward for auditors to locate and verify evidence against specific control requirements. GRC platforms like Tidal automate evidence organisation by mapping artefacts to controls across multiple frameworks simultaneously, eliminating the need for manual folder structures and reducing the risk of missing or outdated evidence during audit season.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Evidence Collection", href: "/glossary/evidence-collection" }, { name: "Document Management", href: "/glossary/document-management" }, { name: "Framework Harmonisation", href: "/glossary/framework-harmonisation" } ]} />

Evidence collection is the systematic process of gathering, documenting and preserving artefacts that demonstrate security controls are designed, implemented and operating effectively. This includes automated evidence such as system logs, configuration exports and scan reports, as well as manual evidence like signed policy acknowledgements, meeting minutes from security reviews and photographs of physical security measures.

Continuous and automated evidence collection is a hallmark of mature compliance programmes, replacing the inefficient practice of scrambling to gather proof shortly before an audit. By integrating evidence collection into daily operations (through API-driven data pulls, automated screenshots and workflow-triggered artefact creation), organisations maintain perpetual audit readiness and can demonstrate compliance at any point in time rather than just during a narrow audit window.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Evidence Archive", href: "/glossary/evidence-archive" }, { name: "Internal Audit", href: "/glossary/internal-audit" }, { name: "GRC Platform", href: "/glossary/grc-platform" } ]} />

Explainable AI (XAI) refers to artificial intelligence systems and techniques designed to make AI decision-making processes transparent, interpretable and understandable to human users. Under ISO 42001 and the EU AI Act, organisations deploying AI systems must be able to explain how decisions are made, what data influences outcomes and why a particular result was produced, especially in high-risk applications such as credit scoring, hiring and medical diagnosis.

Implementing explainable AI is not just a regulatory requirement but also a business imperative, as organisations that cannot explain their AI decisions face reputational risk, legal liability and erosion of stakeholder trust. Techniques such as SHAP values, LIME, attention visualisation and decision trees help make complex models more interpretable, enabling organisations to satisfy audit requirements, identify and address algorithmic bias and maintain meaningful human oversight of automated decision-making.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Framework Harmonisation", href: "/glossary/framework-harmonisation" }, { name: "Gap Analysis", href: "/glossary/gap-analysis" }, { name: "Inherent Risk", href: "/glossary/inherent-risk" } ]} /> ## F

Federated identity management is an arrangement between multiple organisations or systems that allows users to use a single set of credentials to access resources across different security domains. It relies on trust relationships and standardised protocols such as SAML, OAuth 2.0 and OpenID Connect to securely share identity information between an identity provider (IdP) and service providers without transmitting passwords across organisational boundaries.

For organisations managing compliance across multiple platforms and cloud services, federated identity management simplifies access governance, reduces password fatigue and improves security by centralising authentication and enabling consistent enforcement of policies like multi-factor authentication. It is a key enabler for Zero Trust architectures and supports compliance with ISO 27001 access control requirements by providing a clear, auditable trail of who accessed what and when.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "IAM (Identity and Access Management)", href: "/glossary/iam-identity-and-access-management" }, { name: "FIDO2 Authentication", href: "/glossary/fido2-authentication" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" } ]} />

FIDO2 is an open authentication standard developed by the FIDO Alliance and the W3C that enables passwordless or strong multi-factor authentication using public-key cryptography. Users authenticate through biometric sensors (fingerprint or facial recognition), hardware security keys (such as YubiKeys) or platform authenticators built into their devices, eliminating the need for passwords that can be phished, leaked or brute-forced.

FIDO2 authentication is increasingly recommended by compliance frameworks and security authorities as a best practice for protecting against credential-based attacks, which remain one of the most common attack vectors. By implementing FIDO2, organisations significantly reduce the risk of phishing, credential stuffing and account takeover attacks while improving the user experience through seamless, passwordless login flows that meet the strong authentication requirements of ISO 27001 and NIS2.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Federated Identity Management", href: "/glossary/federated-identity-management" }, { name: "IAM (Identity and Access Management)", href: "/glossary/iam-identity-and-access-management" }, { name: "Encryption in Transit", href: "/glossary/encryption-in-transit" } ]} />

Framework harmonisation is the strategic process of integrating multiple compliance frameworks (such as ISO 27001, SOC 2, GDPR and NIS2) into a unified compliance programme that identifies and leverages overlapping requirements. Rather than managing each framework in isolation with separate controls, evidence and audit processes, harmonisation maps common requirements together so that a single control implementation can satisfy multiple frameworks simultaneously.

Organisations that successfully harmonise their frameworks can reduce compliance effort by 40-60%, as many controls (such as access management, incident response and risk assessment) are required by virtually every standard. This approach also reduces audit fatigue, ensures consistent control implementation across the organisation and makes it far easier to adopt new frameworks in the future by simply mapping them to the existing unified control set.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Framework Mapping", href: "/glossary/framework-mapping" }, { name: "GRC Platform", href: "/glossary/grc-platform" }, { name: "Gap Analysis", href: "/glossary/gap-analysis" } ]} />

Framework mapping is the analytical process of identifying and documenting the relationships between requirements from different compliance standards and regulations. By systematically comparing controls across frameworks (for example, mapping ISO 27001 Annex A controls to SOC 2 Trust Services Criteria or GDPR articles), organisations can see exactly where requirements overlap, where they diverge and where unique obligations exist for each framework.

Accurate framework mapping is the foundation of efficient multi-framework compliance, preventing the common problem of duplicating effort by implementing essentially the same control multiple times under different names. It enables compliance teams to collect evidence once and apply it to multiple frameworks, prioritise remediation work based on the number of frameworks a gap affects and provide management with a clear picture of the organisation's overall compliance posture across all applicable standards.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Framework Harmonisation", href: "/glossary/framework-harmonisation" }, { name: "Gap Analysis", href: "/glossary/gap-analysis" }, { name: "GRC Platform", href: "/glossary/grc-platform" } ]} /> ## G

A gap analysis compares where you are against what a standard requires, one requirement at a time, and produces a list of what is missing. It is normally the first thing you do in a certification project, because it converts "we should get ISO 27001" into a scope, a cost and a timeline.

Score each requirement, not the whole standard

A single overall percentage tells you nothing you can act on. Give every requirement one of four verdicts, because the work to close each is entirely different.

Verdict What it means, and what it costs to close
Met Done and evidenced. Note where the evidence lives, or you will look for it again during the audit.
Met but undocumented You do it, you cannot show it. Usually the largest group and the cheapest to fix: write it down.
Partially met In place somewhere but not everywhere, or done irregularly. Needs consistency, not new tooling.
Not met Absent. The only group that needs real project work, and usually far smaller than people fear.

Splitting "met but undocumented" from "not met" is what makes the output believable. Collapsing them makes a mature organisation look unprepared and turns a documentation exercise into an implementation budget.

What the output has to contain

A gap analysis that lists gaps is only half finished. For each one, record the owner, the effort, and what evidence will prove it closed. Without those three, the report gets read once and then sits in a folder.

Order the result by risk rather than by the standard's numbering. Annex A order tells you nothing about which gap would hurt you first, and working through it top to bottom means spending early effort on whatever happens to be listed first.

When to run one

Before a certification project, obviously. Also worth repeating when your scope changes, when a new framework lands on you, and roughly a quarter before the audit, when it stops being planning and becomes a rehearsal.

The same method works against any requirement-based framework: ISO 27001, SOC 2 or NIS2. Only the requirement list changes. Maturity models such as the Safety Culture Ladder work differently, because there you are measuring a level rather than checking requirements off.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Framework Mapping", href: "/glossary/framework-mapping" }, { name: "Inherent Risk", href: "/glossary/inherent-risk" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} relatedFeatures={[ { name: "Controls management", href: "/features/controls" } ]} />

GDPR is the primary EU regulation governing the protection of personal data. It applies to any organisation processing data of EU residents, regardless of where the organisation is located.

Key requirements include lawful basis for processing, data subject rights (access, rectification, deletion), data protection impact assessments, and breach notification within 72 hours.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Protection by Design", href: "/glossary/data-protection-by-design" }, { name: "Data Protection Impact Assessment (DPIA)", href: "/glossary/data-protection-impact-assessment-dpia" }, { name: "Data Protection Officer (DPO)", href: "/glossary/dpo" }, { name: "Data Breach Notification Obligation", href: "/glossary/data-breach-notification" } ]} relatedBlogPosts={[ { title: "From Convoluted Excels to Compliance Confidence in 3 Months", href: "/blog/from-convoluted-excels-to-compliance-confidence-in-3-months" } ]} />

A GRC (Governance, Risk and Compliance) platform is specialised software that centralises and automates the management of an organisation's governance structures, risk management processes and compliance obligations. It provides a unified workspace for managing policies, tracking controls, conducting risk assessments, collecting evidence, mapping frameworks and monitoring compliance status across the organisation in real time.

Modern GRC platforms like Tidal replace fragmented spreadsheet-based approaches with integrated workflows that connect controls to risks, risks to frameworks and frameworks to evidence. This automation dramatically reduces the manual effort required for compliance management, provides real-time visibility into the organisation's compliance posture and ensures that nothing falls through the cracks during audits, making it possible for lean teams to manage complex multi-framework compliance programmes efficiently.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" }, { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Framework Harmonisation", href: "/glossary/framework-harmonisation" }, { name: "Evidence Collection", href: "/glossary/evidence-collection" }, { name: "Gap Analysis", href: "/glossary/gap-analysis" } ]} /> ## H

Article 14 of the EU AI Act requires that high-risk AI systems are designed to allow effective human oversight. In practice, this means a qualified person must be able to understand, monitor and, when necessary, override the AI's decisions. This is especially critical when AI outputs affect people's rights, safety or opportunities (e.g. hiring, credit scoring, medical triage).

How to implement this:

  • Identify critical decision points: Map where in your product AI makes or influences decisions that affect people. These are the points where human oversight is mandatory.
  • Design review workflows: Build a "human-in-the-loop" step for critical decisions (e.g. a dashboard where a team member reviews flagged AI outputs before they take effect).
  • Provide override capability: Ensure the human reviewer can correct, reject or escalate AI decisions. The system should make it easy to override, not bury it behind multiple clicks.
  • Train your team: The person overseeing AI must understand its limitations. Provide training on when and how to intervene, and what biases to watch for.
  • Log oversight actions: Record every human review and override for audit purposes. This evidence demonstrates compliance and helps improve the AI over time.

Human oversight is not just a legal checkbox. It is your last line of defence against AI errors that could harm users and damage your reputation. Tidal Control helps you define oversight roles, document review procedures and track compliance with Article 14 requirements.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "AI Guardrails", href: "/glossary/ai-guardrails" }, { name: "AI Governance", href: "/glossary/ai-governance" }, { name: "Responsible AI", href: "/glossary/responsible-ai" } ]} /> ## I

Identity and Access Management (IAM) is the comprehensive framework of policies, processes and technologies used to manage digital identities and control access to an organisation's resources. IAM encompasses user provisioning and deprovisioning, authentication (verifying who someone is), authorisation (determining what they can access), role-based access control (RBAC), privileged access management and regular access reviews to ensure the principle of least privilege is maintained.

IAM is one of the most critical control domains in virtually every compliance framework, including ISO 27001 (Annex A.9), SOC 2, GDPR and NIS2, because improper access controls are among the leading causes of data breaches. A well-implemented IAM programme ensures that only authorised individuals can access sensitive systems and data, provides a complete audit trail of access events and enables rapid access revocation when employees leave the organisation or change roles.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Federated Identity Management", href: "/glossary/federated-identity-management" }, { name: "FIDO2 Authentication", href: "/glossary/fido2-authentication" }, { name: "IT General Controls (ITGC)", href: "/glossary/it-general-controls-itgc" } ]} />

ICT Risk Management under DORA (Digital Operational Resilience Act) refers to the specific and detailed requirements that financial entities in the EU must implement to identify, protect against, detect, respond to and recover from ICT-related risks and incidents. DORA goes beyond general risk management by mandating specific capabilities such as ICT asset management, threat-led penetration testing, third-party ICT provider oversight and detailed incident classification and reporting within strict timeframes.

DORA applies to a broad range of financial entities including banks, insurance companies, investment firms and their critical ICT service providers, with compliance required from January 2025. Organisations must establish a comprehensive ICT risk management framework approved by senior management, conduct regular digital operational resilience testing and maintain detailed registers of all ICT third-party arrangements, making it one of the most prescriptive regulatory frameworks for operational technology risk in the financial sector.

} relatedFrameworks={[ { name: "DORA - Digital Operational Resilience Act", href: "/frameworks/dora" } ]} relatedTerms={[ { name: "Disaster Recovery", href: "/glossary/disaster-recovery" }, { name: "DDoS Protection", href: "/glossary/ddos-protection" }, { name: "Inherent Risk", href: "/glossary/inherent-risk" } ]} />

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are network security technologies that monitor network traffic for suspicious activities, policy violations and known attack signatures. An IDS passively monitors and alerts security teams when potential threats are detected, while an IPS sits inline with network traffic and can automatically block or reject malicious packets in real time, providing an active defence layer beyond traditional firewalls.

IDS/IPS solutions are fundamental components of a defence-in-depth security strategy and are required or recommended by compliance frameworks including ISO 27001, PCI DSS and SOC 2. Modern systems combine signature-based detection with anomaly-based analysis and machine learning to identify both known threats and novel attack patterns, while generating the detailed logging and alerting data that compliance auditors need to verify effective network security monitoring is in place.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "Endpoint Detection and Response (EDR)", href: "/glossary/endpoint-detection-and-response-edr" }, { name: "DDoS Protection", href: "/glossary/ddos-protection" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" } ]} />

Important Entities are organisations designated under the NIS2 Directive that provide important digital services or critical infrastructure support services. These include cloud service providers, DNS service providers, and other digital service providers that support business operations across the EU.

Important Entities face less stringent requirements than Essential Entities under NIS2 but must still implement appropriate security measures, incident reporting procedures, and supply chain risk management. The differentiation recognises the varying criticality of services provided.

} relatedFrameworks={[ { name: "NIS2", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "NIS2 Directive", href: "/glossary/nis2" }, { name: "Essential Entities (NIS2)", href: "/glossary/essential-entities-nis2" } ]} />

An incident response plan is your playbook for when things go wrong: a data breach, a ransomware attack, an AI system producing harmful outputs, or a cloud provider outage. Under GDPR, you must report certain data breaches to the supervisory authority within 72 hours. Without a plan, those 72 hours disappear in chaos.

How to build your plan:

  • Detection: Define how incidents are discovered. Set up monitoring alerts, establish a reporting channel (e.g. a dedicated Slack channel or email), and make clear what qualifies as an incident vs. a normal issue.
  • Assessment and triage: Who decides the severity? Create a simple classification: critical (data breach, system compromise), high (service disruption), medium (suspicious activity), low (minor anomaly). Assign an incident lead per severity level.
  • Containment: Define immediate actions per incident type. For a data breach: isolate affected systems, revoke compromised credentials, preserve evidence. For an AI incident: disable the affected feature, switch to a fallback.
  • Notification: Know your legal obligations. GDPR: notify the Dutch DPA within 72 hours if personal data is affected. NIS2: notify CSIRT within 24 hours. Also plan customer communication. Silence erodes trust faster than the incident itself.
  • Recovery and review: Restore normal operations, then conduct a blameless post-mortem. Document what happened, what worked, what did not, and update your plan accordingly.

The NCSC incident response guidance provides a practical starting point. Tidal Control helps you create, maintain and test your incident response plan, and provides workflows for tracking incidents and generating the documentation needed for regulatory notifications.

} relatedTerms={[ { name: "Security Baseline", href: "/glossary/security-baseline" }, { name: "Audit Trail", href: "/glossary/audit-trail" }, { name: "Business Continuity Management (BCM)", href: "/glossary/bcm" } ]} />

An ISMS (information security management system) is how an organisation runs information security as a system rather than a set of separate measures: with objectives, assigned responsibilities and a repeating cycle of plan, do, check and act. ISO 27001 is the international standard that sets the requirements for an ISMS, and the standard it is certified against.

An ISMS has a few fixed parts: a defined scope, an information security policy, a risk assessment and a plan for treating those risks, a Statement of Applicability listing the chosen controls, and evidence that those controls work. Internal audits and a management review close the cycle, so the system keeps pace as the organisation changes.

An ISMS is not software but the set of agreements and processes. ISMS software, such as Tidal Control, keeps the system current by holding policies, risks, controls and evidence in one place. A well-run ISMS protects the confidentiality, integrity and availability of information, and shows customers and auditors that security is demonstrably in order.

} relatedFrameworks={[ { name: "ISO 27001", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "ISO 27001", href: "/glossary/iso-27001" }, { name: "Controls", href: "/glossary/controls" }, { name: "Risk Assessment", href: "/glossary/risk-assessment" } ]} relatedFeatures={[ { name: "Controls management", href: "/features/controls" } ]} />

An information security policy is the top-level governance document that defines an organisation's strategic approach to protecting its information assets. It establishes the security objectives, scope, principles, roles and responsibilities, and provides the framework within which all other security policies, procedures and standards are developed. This document is typically approved by senior management and communicated to all employees and relevant external parties.

Having a well-defined information security policy is a mandatory requirement under ISO 27001 (Clause 5.2), SOC 2 and virtually every other compliance framework. It serves as the foundation of the entire information security management system (ISMS), guiding decision-making, setting expectations for employee behaviour and demonstrating to auditors, customers and regulators that the organisation takes a structured, top-down approach to security governance.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Document Management", href: "/glossary/document-management" }, { name: "Internal Audit", href: "/glossary/internal-audit" }, { name: "GAP Analysis", href: "/glossary/gap-analysis" }, { name: "GRC Platform", href: "/glossary/grc-platform" } ]} />

Inherent risk is the level of risk that exists in a process, system or activity before any mitigating controls, safeguards or countermeasures are applied. It represents the raw, uncontrolled exposure an organisation faces from a given threat and is determined by factors such as the likelihood of the threat occurring and the potential impact if it materialises. Inherent risk is a fundamental concept in risk assessment methodologies used across all major compliance frameworks.

Understanding inherent risk is essential for effective risk management because it provides the baseline against which the effectiveness of controls can be measured. By comparing inherent risk (before controls) with residual risk (after controls), organisations can quantify the risk reduction achieved by their control environment, identify areas where additional controls may be needed and make informed decisions about risk acceptance, transfer or further mitigation in line with their risk appetite.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Gap Analysis", href: "/glossary/gap-analysis" }, { name: "ICT Risk Management (DORA)", href: "/glossary/ict-risk-management-dora" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} />

An internal audit is an independent and objective evaluation conducted by an organisation's own audit function (or an outsourced equivalent) to assess the effectiveness of its compliance controls, risk management processes and governance structures. Internal auditors systematically review whether controls are implemented as designed, operating effectively and producing the intended outcomes, documenting their findings, observations and recommendations in a formal audit report.

Internal audits are a mandatory requirement under ISO 27001 (Clause 9.2) and are considered essential by virtually all compliance frameworks as part of the continuous improvement cycle. They provide early warning of control deficiencies before external auditors or regulators discover them, give management assurance that the compliance programme is functioning as intended and create a documented trail of ongoing due diligence that strengthens the organisation's compliance posture over time.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Evidence Collection", href: "/glossary/evidence-collection" }, { name: "Gap Analysis", href: "/glossary/gap-analysis" }, { name: "Information Security Policy", href: "/glossary/information-security-policy" }, { name: "Document Change Management", href: "/glossary/document-change-management" } ]} />

ISO 27001 is the globally recognised standard for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). It provides a framework for managing sensitive company information.

Organisations can achieve ISO 27001 certification through an accredited auditor, demonstrating that they have implemented appropriate security controls and processes to protect information assets.

} relatedFrameworks={[ { name: "ISO 27001", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Information Security Management System (ISMS)", href: "/glossary/isms" }, { name: "Annex A Controls (ISO 27001)", href: "/glossary/annex-a-controls" }, { name: "Certification", href: "/glossary/certification" }, { name: "Continuous Monitoring", href: "/glossary/continuous-monitoring" } ]} relatedBlogPosts={[ { title: "Do You Really Need to Certify Everything? The Scoping Guide for SOC 2 and ISO 27001", href: "/blog/do-you-really-need-to-certify-everything-the-scoping-guide-for-soc-2-iso-27001" } ]} />

ISO/IEC 27017:2015 provides specific guidelines for information security controls relevant to cloud service providers and cloud customers. It supplements ISO 27001 by addressing security controls specific to cloud computing environments.

The standard covers controls for both cloud service providers and customers, addressing the unique risks associated with cloud computing such as data location, availability, and shared infrastructure security.

} />

ISO/IEC 27018:2019 establishes controls and practices for protecting personal data in public cloud services. It supplements ISO 27001 by focusing specifically on privacy protection in cloud environments and addresses the controller-processor relationship in the cloud.

The standard is particularly important for organisations using cloud providers for personal data processing, ensuring adequate privacy safeguards in cloud services. It aligns with GDPR requirements for cloud-based data processing.

} />

ISO/IEC 27701:2019 is an extension to ISO 27001 that establishes requirements for Privacy Information Management Systems (PIMS). It provides a structured approach to privacy management comparable to how ISO 27001 addresses information security.

Organisations certified to ISO 27001 can add ISO 27701 certification to demonstrate comprehensive privacy management. The standard requires organisations to implement privacy-specific controls and policies beyond basic information security measures.

} />

ISO/IEC 42001:2023 is the world's first international standard for AI Management Systems. It provides a structured framework for organisations to develop, implement, and manage responsible and trustworthy artificial intelligence systems.

ISO 42001 addresses AI risks including bias, transparency, security, and ethical concerns. Organisations implementing ISO 42001 demonstrate commitment to responsible AI development aligned with regulatory requirements like the EU AI Act and responsible AI frameworks.

} relatedFrameworks={[ { name: "ISO 42001", href: "/frameworks/iso42001" } ]} />

IT General Controls (ITGCs) are the foundational controls that ensure the reliability, integrity and security of the IT environment underpinning an organisation's automated business processes. They typically cover four domains: logical access controls (user authentication and authorisation), change management (controlled modifications to applications and systems), computer operations (job scheduling, backup and monitoring) and program development (secure software development lifecycle practices).

ITGCs are critical because they provide the assurance that application-level controls and automated processes can be trusted. If ITGCs are weak (for example, if anyone can modify production code without approval), then no application-level control can be considered reliable. They are a core audit focus area for SOC 1, SOC 2 and financial audit engagements, and are closely aligned with ISO 27001 Annex A controls, making them a fundamental building block of any comprehensive compliance programme.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "IAM (Identity and Access Management)", href: "/glossary/iam-identity-and-access-management" }, { name: "DevSecOps", href: "/glossary/devsecops" }, { name: "Document Change Management", href: "/glossary/document-change-management" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} /> ## J

A joint controller arrangement arises when two or more organisations collectively decide the purposes and means of processing personal data. Under Article 26 of the GDPR, joint controllers must enter into a transparent arrangement that defines their respective responsibilities for compliance, particularly regarding the exercise of data subject rights and the provision of information.

In practice, joint controllership is common in partnerships, shared platforms, and collaborative research projects. Organisations must clearly document which party handles data subject requests and breach notifications, as each controller remains fully liable to the data subject regardless of the internal arrangement.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Processing Activity", href: "/glossary/processing-activity" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" } ]} /> ## K

Key management encompasses the full lifecycle of cryptographic keys, including their generation, distribution, storage, rotation, and eventual destruction. Effective key management is fundamental to maintaining the confidentiality and integrity of encrypted data, as even the strongest encryption algorithm is rendered useless if its keys are poorly managed.

Organisations subject to standards such as ISO 27001 or PCI DSS must implement formal key management procedures. This includes using hardware security modules (HSMs) for key storage, enforcing key rotation schedules, and maintaining audit trails of all key-related operations to demonstrate compliance during assessments.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "MFA (Multi-Factor Authentication)", href: "/glossary/mfa-multi-factor-authentication" }, { name: "Pseudonymisation", href: "/glossary/pseudonymisation" } ]} />

Key Performance Indicators (KPIs) are quantifiable metrics that organisations use to evaluate the effectiveness of their compliance and information security programmes. In a GRC context, typical KPIs include the percentage of employees who completed security awareness training, the average time to remediate audit findings, or the number of policy exceptions granted over a reporting period.

Well-defined KPIs enable management to make data-driven decisions about resource allocation and programme improvements. They are essential for management reviews and board reporting, providing objective evidence that the organisation's control environment is functioning as intended and continuously improving.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Key Risk Indicators (KRIs)", href: "/glossary/key-risk-indicators-kris" }, { name: "Management Review", href: "/glossary/management-review" }, { name: "Maturity Model", href: "/glossary/maturity-model" }, { name: "Objective Evidence", href: "/glossary/objective-evidence" } ]} />

Key Risk Indicators (KRIs) are forward-looking metrics designed to signal increasing risk exposure before incidents occur. Unlike KPIs, which measure past performance, KRIs act as early warning systems by tracking conditions that correlate with elevated risk, such as a rising number of failed login attempts, an increase in overdue patches, or growing employee turnover in critical security roles.

Effective KRI programmes establish thresholds that trigger escalation and response procedures when breached. By integrating KRIs into risk dashboards, organisations can shift from reactive to proactive risk management, enabling timely intervention and better-informed decisions during management reviews and risk committee meetings.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Key Performance Indicators (KPIs)", href: "/glossary/key-performance-indicators-kpis" }, { name: "Likelihood and Impact Matrix", href: "/glossary/likelihood-and-impact-matrix" }, { name: "Management Review", href: "/glossary/management-review" } ]} /> ## L

Lawful Basis is the legal foundation required to process personal data under GDPR. Organisations must have at least one lawful basis before collecting or processing any personal data. GDPR Article 6 lists six possible lawful bases.

The six lawful bases are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Each basis has specific requirements and conditions. Organisations must clearly communicate which basis they rely on to data subjects.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Consent", href: "/glossary/consent" }, { name: "Legitimate Interest", href: "/glossary/legitimate-interest" }, { name: "Legal Obligation", href: "/glossary/legal-obligation" } ]} />

Leadership Commitment is a foundational requirement in ISO 27001 that mandates top management involvement in establishing, implementing, and maintaining an effective Information Security Management System (ISMS).

This commitment includes allocating necessary resources, setting security objectives, ensuring policies are communicated, and promoting a culture of information security throughout the organisation. Without genuine leadership support, ISMS implementations are unlikely to succeed.

} relatedFrameworks={[ { name: "ISO 27001", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Information Security Management System (ISMS)", href: "/glossary/isms" }, { name: "ISO 27001", href: "/glossary/iso-27001" } ]} />

The principle of least privilege dictates that users, applications, and processes should be granted only the minimum level of access necessary to perform their designated functions. This fundamental security concept reduces the attack surface by limiting what a compromised account or malicious insider can access, thereby containing the potential blast radius of a security incident.

Implementing least privilege requires regular access reviews, role-based access control (RBAC), and timely deprovisioning when roles change. It is a cornerstone requirement across frameworks such as ISO 27001, NIS2, and SOC 2, and works in conjunction with privileged access management to ensure that elevated permissions are tightly controlled and monitored.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "Privileged Access Management (PAM)", href: "/glossary/privileged-access-management-pam" }, { name: "MFA (Multi-Factor Authentication)", href: "/glossary/mfa-multi-factor-authentication" } ]} />

Legal Obligation is one of the six lawful bases under GDPR Article 6(1)(c). Organisations can process personal data when processing is necessary to comply with a legal obligation imposed by EU or member state law.

Examples include processing employee data for tax compliance, healthcare data for public health requirements, or financial data for anti-money laundering regulations. However, the processing must be necessary and proportionate to the legal obligation.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Lawful Basis", href: "/glossary/lawful-basis" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" } ]} />

Legitimate Interest is one of the six lawful bases under GDPR Article 6(1)(f). It allows organisations to process personal data when they have a legitimate business need, provided this is balanced against the rights and interests of data subjects.

When using legitimate interest as a lawful basis, organisations must conduct a Legitimate Interest Assessment (LIA) to determine whether the processing is necessary, fair, and whether data subjects' rights are proportionately protected. This is a commonly used basis for marketing, fraud prevention, and business operations.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Lawful Basis", href: "/glossary/lawful-basis" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Data Protection Impact Assessment (DPIA)", href: "/glossary/data-protection-impact-assessment-dpia" } ]} />

A likelihood and impact matrix, also called a risk matrix or a probability and impact matrix, scores a risk on two axes: how likely the event is, and how bad it would be if it happened. The two scores combine into one rating, which decides how urgently the risk is treated and who has to sign it off.

The 5×5 likelihood and impact matrix

Read the likelihood down the side and the impact across the top. Each cell shows likelihood multiplied by impact, and the band that score falls into. The scales and bands below are the ones Tidal Control uses, so a score you read here is the score you get in the product; see Conducting Risk Assessments for the workflow around it.

Likelihood / Impact 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Extreme
5 Almost certain 5 Low 10 Medium 15 Medium 20 High 25 High
4 Likely 4 Low 8 Medium 12 Medium 16 High 20 High
3 Possible 3 Low 6 Low 9 Medium 12 Medium 15 Medium
2 Unlikely 2 Low 4 Low 6 Low 8 Medium 10 Medium
1 Remote 1 Low 2 Low 3 Low 4 Low 5 Low

The bands are 1-6 Low, 7-15 Medium and 16-25 High. Those cut-offs are a choice rather than a formula: this one is deliberately forgiving at the bottom, so a rare event with a serious consequence does not automatically outrank a frequent one. Where you draw them is the risk appetite decision, and it belongs to whoever owns the risk.

Scoring the two axes

A matrix is only as good as the definitions behind its numbers. Tidal Control pins likelihood to an annual probability, which is what stops two assessors scoring the same risk differently and averaging their disagreement away.

Score Likelihood Impact
5 Almost certain: over 90% chance per year Extreme: critical threat to the organisation
4 Likely: 51-90% chance per year Major: serious impact on business operations
3 Possible: 11-50% chance per year Moderate: significant but manageable consequences
2 Unlikely: 1-10% chance per year Minor: limited impact on the organisation
1 Remote: under 1% chance per year Insignificant: negligible consequences

What each band means for treatment

The score is not the output; the decision attached to it is. In Tidal Control the score is calculated for you, and the next step is choosing one of four treatments: reduce, accept, transfer or avoid. Only reduce requires linking controls, because controls are what actually move the score.

Band Usual treatment
High (16-25) Reduce, or avoid the activity outright where an alternative exists. Needs a named owner and linked controls, not an acceptance.
Medium (7-15) Usually reduce, sometimes transfer where the exposure is financial. Accepting one is a decision someone has to record.
Low (1-6) Commonly accept, particularly where treatment costs more than the exposure. Record the reasoning either way.

Score the risk again after the controls are in place. The second score is the residual risk, and it is the one to compare against the risk appetite: anything still above it needs more than what is already there.

What ISO 27001 and ISO 27005 actually require

ISO 27001:2022 clause 6.1.2 requires a defined information security risk assessment process: criteria for accepting risk, criteria for performing assessments, and results that are consistent, valid and comparable. It says nothing about a matrix. The matrix is one way to make assessments repeatable; the requirement is the repeatability, not the grid.

ISO/IEC 27005 gives the supporting guidance on assessing information security risk, and ISO 31000 covers risk management generally. Both describe likelihood-and-consequence analysis without prescribing a size or a colour scheme. An auditor will ask to see your criteria and a sample of risks scored against them, not a particular matrix.

Common mistakes

The most consequential one is treating the numbers as arithmetic. The scores are ordinal: 4 is worse than 2, but not twice as bad. Multiplying them gives you a rank, not a quantity, and a 3×4 is not the same situation as a 4×3 even though both read as 12.

That is the substance of the long-standing academic criticism of risk matrices, most associated with Tony Cox: a matrix can rank a genuinely smaller risk above a larger one. Use it to structure the conversation, not to end it.

Two practical failures follow from that. Scores cluster in the middle, because 3 is the answer nobody has to defend, and a register that is four fifths Medium has sorted nothing.

And impact gets scored against the wrong subject: the inconvenience to your team rather than the consequence for the customer, the data subject or the obligation. Tighten the axis definitions and both usually resolve.

Last, a matrix records a judgement made on one particular day. Give each risk a review date and a trigger for re-scoring. Without them you are left with an artefact of what people feared a year ago, which is exactly what an auditor notices.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Key Risk Indicators (KRIs)", href: "/glossary/key-risk-indicators-kris" }, { name: "Operational Resilience", href: "/glossary/operational-resilience" }, { name: "Management Review", href: "/glossary/management-review" } ]} relatedFeatures={[ { name: "Risk assessment", href: "/features/risks" } ]} />

Logging and monitoring involves the systematic recording of system events, user activities, and security-relevant occurrences, combined with the real-time or near-real-time analysis of those records. This practice is essential for detecting anomalies, identifying potential security breaches, and maintaining an audit trail that supports forensic investigations and regulatory compliance.

Effective logging and monitoring programmes typically feed into a Security Information and Event Management (SIEM) system that correlates events across multiple sources. Regulatory frameworks including GDPR, NIS2, and ISO 27001 require organisations to maintain adequate logs and demonstrate they are actively reviewed, making this a critical component of any information security management system.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Managed Security Service Provider (MSSP)", href: "/glossary/managed-security-service-provider-mssp" }, { name: "Network Segmentation", href: "/glossary/network-segmentation" }, { name: "Operational Resilience", href: "/glossary/operational-resilience" }, { name: "Objective Evidence", href: "/glossary/objective-evidence" } ]} />

Logical access security, also called logical access control, is the set of technical controls that decide who can reach an information system and what they may do inside it. The word "logical" is there to distinguish it from physical access control: one governs the login, the other governs the door.

Logical and physical access

You need both, and they fail differently. An auditor will ask about each separately, because a server room with a strong lock and a shared admin password is not protected, and neither is the reverse.

Logical access Physical access
Controls Accounts, passwords, MFA, roles, permissions, network segmentation Locks, badges, visitor logs, cabinets, cameras
Protects against Remote intrusion, credential theft, over-broad permissions Theft of hardware, unsupervised access to equipment
Evidence User lists, MFA coverage, access review records, logs Badge records, visitor register, inspection reports

The four layers

Logical access is usually broken into four steps. Naming them separately is useful because you will probably be strong on the first two and weak on the last two, which is where audit findings come from.

Layer Question it answers
Identification Who are you claiming to be? One unique account per person, no shared logins.
Authentication Can you prove it? A password plus a second factor, or a certificate or passkey.
Authorisation What are you allowed to do? Least privilege, granted by role rather than per person.
Accountability What did you do? Logging that ties an action back to one identity.

Shared accounts break the first and last layer at once. If two people use one login, you cannot prove who acted, and every log line becomes an assertion rather than evidence.

What ISO 27001 asks for

Access control is spread across several Annex A controls, which is why it rarely fits in a single policy document. A.5.15 covers access control rules, A.5.16 identity management, A.5.17 authentication information, and A.5.18 the granting, review and removal of access rights.

A.8.2 then treats privileged access as its own problem, because an administrator account defeats most other controls. Expect to show that privileged accounts are separate, few, and reviewed more often than ordinary ones.

Common mistakes

Leavers keep access. Your offboarding probably removes the obvious accounts and misses the ones nobody owns centrally, so tie removal to the HR event rather than to someone remembering.

Access accumulates. People move roles and gain permissions without losing the old ones, which is why your periodic review exists. A review that confirms everything is fine every quarter is not being done.

And permissions get granted per person rather than per role. That feels faster and makes the estate impossible to reason about, because there is no longer any statement of what a given job should be able to see.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Least Privilege", href: "/glossary/least-privilege" }, { name: "MFA (Multi-Factor Authentication)", href: "/glossary/mfa-multi-factor-authentication" }, { name: "Privileged Access Management (PAM)", href: "/glossary/privileged-access-management-pam" }, { name: "OAuth 2.0", href: "/glossary/oauth-20" } ]} /> ## M

Machine Learning Operations (MLOps) is a set of practices that combines machine learning, DevOps, and data engineering to reliably deploy and maintain ML models in production environments. It addresses the unique challenges of ML systems, including data drift, model degradation, reproducibility, and the need for continuous retraining, while ensuring that models operate within ethical and regulatory boundaries.

From a compliance perspective, MLOps is increasingly important as regulations like the EU AI Act impose requirements for transparency, documentation, and human oversight of AI systems. A mature MLOps framework includes model versioning, automated testing pipelines, bias monitoring, and comprehensive audit trails that demonstrate how models were trained, validated, and deployed.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Model Governance", href: "/glossary/model-governance" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" }, { name: "Maturity Model", href: "/glossary/maturity-model" } ]} />

Under the GDPR, the main establishment of a controller or processor is the place of its central administration in the European Union, or alternatively the location where decisions about the purposes and means of processing are made and implemented. This concept is crucial for the one-stop-shop mechanism, as it determines which data protection authority serves as the lead supervisory authority for cross-border processing activities.

Correctly identifying the main establishment has significant practical implications for multinational organisations. It determines where complaints are initially handled, which authority leads investigations, and which national procedural rules apply. Organisations must be able to demonstrate where effective decision-making about data processing takes place, which may differ from their corporate headquarters.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Joint Controller", href: "/glossary/joint-controller" }, { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Processing Activity", href: "/glossary/processing-activity" } ]} />

Model governance provides a structured framework for managing AI and machine learning models throughout their entire lifecycle, from design and development through deployment, monitoring, and retirement. It encompasses policies and procedures for model validation, performance monitoring, bias detection, explainability requirements, and change management, ensuring that models remain accurate, fair, and compliant with applicable regulations.

With the introduction of the EU AI Act and growing regulatory scrutiny of automated decision-making, model governance has become a board-level concern. Organisations deploying high-risk AI systems must demonstrate robust governance practices including model inventories, risk classifications, regular performance reviews, and clear accountability structures that define who is responsible for model outcomes.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Machine Learning Operations (MLOps)", href: "/glossary/machine-learning-operations-mlops" }, { name: "Profiling", href: "/glossary/profiling" }, { name: "Management Review", href: "/glossary/management-review" } ]} />

A Managed Security Service Provider (MSSP) is a specialised third-party organisation that delivers outsourced security monitoring, threat detection, and incident response services. MSSPs typically operate a Security Operations Centre (SOC) that provides 24/7 surveillance of client environments, analysing logs, alerts, and network traffic to identify and respond to security threats in real time.

Engaging an MSSP can be an effective strategy for organisations that lack the in-house expertise or resources to maintain comprehensive security operations. However, it is important to recognise that outsourcing security services does not transfer accountability for compliance. Organisations must conduct thorough due diligence, establish clear service level agreements, and maintain oversight of their MSSP's performance.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" }, { name: "Network Segmentation", href: "/glossary/network-segmentation" }, { name: "Penetration Test", href: "/glossary/penetration-test" }, { name: "Non-Disclosure Agreement (NDA)", href: "/glossary/non-disclosure-agreement-nda" } ]} />

A management review is a formal, periodic evaluation conducted by senior leadership to assess the continuing suitability, adequacy, and effectiveness of the organisation's management system. In the context of ISO 27001 and other management system standards, it involves reviewing audit results, incident reports, risk assessment outcomes, KPIs, and feedback from stakeholders to determine whether the system is achieving its intended objectives.

Management reviews are a mandatory requirement in most ISO management system standards and serve as a critical governance mechanism. They result in documented decisions and actions regarding improvement opportunities, resource needs, and potential changes to the management system. The output of these reviews provides objective evidence of top management commitment and continuous improvement.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "ISO 9001 - Quality Management", href: "/frameworks/iso9001" } ]} relatedTerms={[ { name: "Key Performance Indicators (KPIs)", href: "/glossary/key-performance-indicators-kpis" }, { name: "Non-Conformity", href: "/glossary/non-conformity" }, { name: "Objective Evidence", href: "/glossary/objective-evidence" }, { name: "Maturity Model", href: "/glossary/maturity-model" } ]} />

A maturity model provides a structured framework for assessing and benchmarking the current state of an organisation's compliance, security, or governance processes against defined levels of capability. Models such as CMMI (Capability Maturity Model Integration) and the NIST Cybersecurity Framework typically define five levels, ranging from initial or ad hoc practices through to optimised processes with continuous improvement mechanisms in place.

Maturity assessments help organisations identify gaps, prioritise improvement initiatives, and communicate progress to stakeholders in a consistent manner. They are particularly valuable for demonstrating year-over-year improvement to boards, auditors, and regulators, and for benchmarking against industry peers to ensure the organisation's security posture keeps pace with evolving threats and regulatory expectations.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Key Performance Indicators (KPIs)", href: "/glossary/key-performance-indicators-kpis" }, { name: "Management Review", href: "/glossary/management-review" }, { name: "Policy Management", href: "/glossary/policy-management" } ]} />

Metadata is structured information that describes, explains, and contextualises other data. In an information security and compliance context, metadata includes attributes such as the creation date, author, classification level, retention period, and access permissions associated with a data asset. Proper metadata management is essential for data governance, as it enables organisations to understand what data they hold, where it resides, and how it should be protected.

From a privacy perspective, metadata can itself constitute personal data under the GDPR if it relates to an identifiable individual. Organisations must therefore include metadata in their data protection impact assessments and ensure it is subject to appropriate access controls, retention policies, and deletion procedures alongside the primary data it describes.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Personal Data", href: "/glossary/personal-data" }, { name: "PII (Personally Identifiable Information)", href: "/glossary/pii-personally-identifiable-information" }, { name: "Purpose Limitation", href: "/glossary/purpose-limitation" } ]} />

Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more independent verification factors before gaining access to a system or application. These factors typically fall into three categories: something you know (password or PIN), something you have (security token, smartphone, or smart card), and something you are (fingerprint, facial recognition, or other biometrics).

MFA is one of the most effective controls against credential-based attacks, significantly reducing the risk of unauthorised access even when passwords are compromised. It is mandated or strongly recommended by virtually every security framework and regulation, including ISO 27001, NIS2, DORA, and PCI DSS, and is considered a baseline security requirement for access to sensitive systems and data.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "Least Privilege", href: "/glossary/least-privilege" }, { name: "OAuth 2.0", href: "/glossary/oauth-20" }, { name: "Privileged Access Management (PAM)", href: "/glossary/privileged-access-management-pam" } ]} /> ## N

NEN 7510 is the Dutch standard specifically for information security in healthcare organisations. It is based on ISO 27001 and ISO 27002 but includes additional controls and requirements specific to the healthcare sector's regulatory and operational environment.

Healthcare organisations in the Netherlands must comply with NEN 7510 as it addresses specific healthcare risks including patient data protection, medical device security, and continuity requirements for healthcare services. Certification demonstrates healthcare sector security compliance.

} />

Network segmentation is the practice of dividing a computer network into smaller, isolated sub-networks or zones, each with its own security controls and access policies. This architectural approach limits lateral movement by attackers who gain access to one segment, preventing them from easily reaching other parts of the network that contain sensitive data or critical systems.

Effective network segmentation is a key requirement in frameworks such as PCI DSS, which mandates isolation of cardholder data environments, and ISO 27001, which requires network controls proportionate to the sensitivity of the information being processed. Implementing segmentation through VLANs, firewalls, and micro-segmentation technologies significantly reduces the blast radius of security incidents and simplifies compliance scoping.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "Perimeter Protection", href: "/glossary/perimeter-protection" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" }, { name: "Logical Access Security", href: "/glossary/logical-access-security" } ]} />

The NIS2 Directive expands the scope and requirements of the original NIS Directive, applying to critical infrastructure operators and digital service providers. It strengthens cybersecurity obligations across the EU.

Organisations covered by NIS2 must implement strong security measures, incident reporting requirements, and supply chain security, with significant penalties for non-compliance.

} relatedFrameworks={[ { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Cybersecurity", href: "/glossary/cybersecurity" }, { name: "Incident Response Plan", href: "/glossary/incident-response" }, { name: "Risk Assessment", href: "/glossary/risk-assessment" } ]} />

The NIST Cybersecurity Framework is a flexible, risk-based approach to managing cybersecurity risk developed by the U.S. National Institute of Standards and Technology. It provides a structured methodology organisations can use to manage and reduce cybersecurity risks.

Since CSF 2.0 the framework consists of six core functions: Govern (set and oversee the cybersecurity strategy), Identify (understand your assets and risks), Protect (implement safeguards), Detect (identify cybersecurity events), Respond (take action on incidents), and Recover (restore capabilities). Organisations map these functions to their specific context and maturity level, making it applicable across industries and organisation sizes.

} />

A non-conformity is the non-fulfilment of a requirement. That is the definition in ISO 9000, and ISO 27001, ISO 9001 and the other ISO management system standards use the term the same way. The requirement can come from the standard itself, from a law or a contract, or from the organisation's own policy: a procedure you wrote and do not follow is a non-conformity too.

Major and minor non-conformities

Certification bodies grade what they find. ISO/IEC 17021-1, the standard certification bodies themselves work to, calls a non-conformity major when it affects the capability of the management system to achieve its intended results, and minor when it does not. In practice a major is a requirement that is not addressed at all, or a failure that repeats across the organisation, such as no internal audit programme or a risk assessment that was never carried out. A minor is an isolated lapse in a system that otherwise works, such as one skipped access review. Several minors against the same requirement can together count as a major.

The grade decides what happens next. A major found in a certification audit has to be corrected, and the certification body has to verify the correction, before a certificate is issued; in a surveillance audit it puts an existing certificate at risk. For a minor, the auditor normally accepts a plan with a deadline and checks it at the next visit. An observation or opportunity for improvement is not a non-conformity and needs no formal response.

Closing a non-conformity

Clause 10.2 of ISO 27001 sets out the steps, and ISO 9001 has the same clause. React first: contain the problem and deal with its consequences. Then find the cause, check whether the same problem exists elsewhere or could occur, and take a corrective action that removes the cause. Finally review whether that action worked, and keep a record of the non-conformity, what you did and the result. Auditors read those records as evidence that the management system corrects itself.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "ISO 9001 - Quality Management", href: "/frameworks/iso9001" } ]} relatedTerms={[ { name: "Objective Evidence", href: "/glossary/objective-evidence" }, { name: "Management Review", href: "/glossary/management-review" }, { name: "Policy Management", href: "/glossary/policy-management" } ]} relatedFeatures={[ { name: "Issues management", href: "/features/issues" } ]} />

A Non-Disclosure Agreement (NDA) is a legally binding contract in which one or both parties agree to keep specified information confidential. It is also called a confidentiality agreement, and the two terms mean the same thing. A workable NDA answers four questions: what is confidential, who may see it, for how long, and what happens if it leaks.

One-way or mutual?

This is the practical decision, and it follows from who is actually sharing. Getting it wrong is the most common reason an NDA has to be renegotiated halfway through a conversation.

Type Use it when
One-way (unilateral) Only you disclose. Typical when you brief a contractor, a candidate or an agency on your systems.
Mutual (bilateral) Both sides disclose. The default for supplier evaluations, partnerships and due diligence, because you will both see things.

If you are being asked to sign a one-way NDA but expect to reveal anything of your own, ask for a mutual one. It is a routine request and refusing it tells you something.

The clauses that decide whether it is usable

Most NDAs look alike. The differences that matter in practice sit in five places, and they are worth reading before signing rather than after an incident.

Clause What to look for
Definition of confidential information Broad enough to cover what you will actually share, and not dependent on stamping every document "confidential".
Permitted recipients Whether subcontractors and group companies are included, and whether they are bound on the same terms.
Duration How long the obligation runs after the relationship ends. Perpetual for trade secrets, a fixed term for commercial detail.
Return and deletion What happens to the information at the end, including copies in backups, and whether you get confirmation.
Carve-outs The standard exceptions: already public, independently developed, or required by law. Check that a legal demand triggers notice to you where notice is allowed.

An NDA is not a technical control

This is the point worth taking away. An NDA gives you a remedy after information has already left. It deters, but it does not prevent: it cannot stop a copy being made.

Treat it as the legal layer on top of the technical one. If the data matters, pair it with access limits, a defined transfer method and a supplier assessment. Auditors look for exactly that pairing, because an NDA on its own shows intent rather than control.

Where ISO 27001 requires one

Annex A 6.6 covers confidentiality and non-disclosure agreements directly, and expects them to be identified, documented, regularly reviewed and signed by personnel and external parties. A.5.20 then covers what your supplier agreements have to say about security, which is where an NDA usually sits in a supplier file.

In practice the finding is rarely a missing NDA. It is that nobody can say which suppliers have signed one, or the version on file predates the current service. Keep them with the supplier record and review them on the same cycle.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Managed Security Service Provider (MSSP)", href: "/glossary/managed-security-service-provider-mssp" }, { name: "Physical Security", href: "/glossary/physical-security" }, { name: "Policy Management", href: "/glossary/policy-management" } ]} relatedFeatures={[ { name: "Vendor management", href: "/features/vendors" } ]} /> ## O

OAuth 2.0 is an open authorisation framework that enables applications to obtain limited access to user accounts on third-party services without exposing user credentials. It works by delegating authentication to the service hosting the user account and authorising third-party applications via access tokens with defined scopes, separating the concerns of resource ownership from resource access.

OAuth 2.0 is the industry standard for API authorisation and underpins single sign-on (SSO) implementations across enterprise environments. From a security perspective, proper implementation requires attention to token lifecycle management, scope minimisation, redirect URI validation, and the use of PKCE (Proof Key for Code Exchange) for public clients to prevent authorisation code interception attacks.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "MFA (Multi-Factor Authentication)", href: "/glossary/mfa-multi-factor-authentication" }, { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "Least Privilege", href: "/glossary/least-privilege" } ]} />

Objective evidence refers to verifiable, factual information that demonstrates whether a control, process, or requirement is being met. In audit contexts, it can take many forms including documents, records, logs, screenshots, reports, test results, and observations. The key characteristic is that it must be reproducible and not based on subjective opinion, allowing independent auditors to reach the same conclusion.

Maintaining comprehensive objective evidence is crucial for ISO certification audits, SOC 2 examinations, and regulatory inspections. Organisations should establish systematic evidence collection practices as part of their continuous compliance programme rather than scrambling to gather documentation before audits. This includes automated log collection, periodic control testing with documented results, and structured records of management decisions.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Management Review", href: "/glossary/management-review" }, { name: "Non-Conformity", href: "/glossary/non-conformity" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" } ]} />

Operational resilience is the ability of an organisation to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions in order to continue delivering critical business services. It goes beyond traditional business continuity planning by taking an end-to-end view of service delivery, including dependencies on third parties, technology, people, and processes.

Regulatory frameworks such as DORA (Digital Operational Resilience Act) for the financial sector and NIS2 for essential services have elevated operational resilience from a best practice to a legal requirement. Organisations must map their critical business services, set impact tolerances, conduct scenario testing, and demonstrate to regulators that they can remain within those tolerances even during severe but plausible disruption scenarios.

} relatedFrameworks={[ { name: "DORA - Digital Operational Resilience Act", href: "/frameworks/dora" }, { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" } ]} relatedTerms={[ { name: "Likelihood and Impact Matrix", href: "/glossary/likelihood-and-impact-matrix" }, { name: "Patch Management", href: "/glossary/patch-management" }, { name: "Managed Security Service Provider (MSSP)", href: "/glossary/managed-security-service-provider-mssp" } ]} />

The OWASP Top 10 is a regularly updated consensus document published by the Open Web Application Security Project that identifies the ten most critical security risks facing web applications. The list serves as an awareness document and a starting point for organisations to address the most common and impactful web application vulnerabilities, including injection flaws, broken authentication, sensitive data exposure, and security misconfigurations.

The OWASP Top 10 is widely referenced in compliance frameworks, procurement requirements, and secure development standards. Many organisations mandate that their development teams address all OWASP Top 10 categories during the software development lifecycle, and penetration testers use it as a baseline for their assessments. Regular training on OWASP risks is considered essential for any secure development programme.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Penetration Test", href: "/glossary/penetration-test" }, { name: "Patch Management", href: "/glossary/patch-management" }, { name: "Perimeter Protection", href: "/glossary/perimeter-protection" } ]} /> ## P

Patch management is the systematic process of identifying, acquiring, testing, and deploying software updates and security patches across an organisation's IT infrastructure. It addresses known vulnerabilities in operating systems, applications, firmware, and middleware that could be exploited by attackers if left unpatched, making it one of the most fundamental and cost-effective security controls available.

A mature patch management programme includes vulnerability scanning to identify missing patches, a risk-based prioritisation process for deployment, testing in staging environments before production rollout, and documented rollback procedures. Regulatory frameworks including NIS2, ISO 27001, and PCI DSS all require timely patching, with critical vulnerabilities typically expected to be remediated within days rather than weeks.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "OWASP Top 10", href: "/glossary/owasp-top-10" }, { name: "Penetration Test", href: "/glossary/penetration-test" }, { name: "Operational Resilience", href: "/glossary/operational-resilience" }, { name: "Key Risk Indicators (KRIs)", href: "/glossary/key-risk-indicators-kris" } ]} />

PCI DSS is a comprehensive security standard developed by the Payment Card Industry Security Standards Council that applies to all organisations that store, process, or transmit credit card data. The standard defines twelve high-level requirements covering areas such as network security, access control, encryption, vulnerability management, monitoring, and information security policies, with the goal of protecting cardholder data from theft and fraud.

Compliance with PCI DSS is mandatory for any organisation in the payment card ecosystem, with validation requirements ranging from self-assessment questionnaires for smaller merchants to on-site assessments by Qualified Security Assessors (QSAs) for large processors. Non-compliance can result in significant fines, increased transaction fees, and ultimately the revocation of the ability to process card payments.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Network Segmentation", href: "/glossary/network-segmentation" }, { name: "Key Management", href: "/glossary/key-management" }, { name: "Penetration Test", href: "/glossary/penetration-test" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" } ]} />

A penetration test is an authorised, simulated cyber attack conducted against an organisation's systems, networks, or applications to identify security weaknesses before malicious actors can exploit them. Penetration testers use the same techniques and tools as real attackers, but operate within a defined scope and rules of engagement agreed upon with the organisation, providing a realistic assessment of security posture.

Regular penetration testing is required by numerous compliance frameworks including PCI DSS, ISO 27001, SOC 2, and NIS2. The results provide actionable findings ranked by severity, enabling organisations to prioritise remediation efforts. Penetration tests complement automated vulnerability scanning by identifying complex attack chains and business logic flaws that automated tools typically miss.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "OWASP Top 10", href: "/glossary/owasp-top-10" }, { name: "Patch Management", href: "/glossary/patch-management" }, { name: "Perimeter Protection", href: "/glossary/perimeter-protection" }, { name: "Network Segmentation", href: "/glossary/network-segmentation" } ]} />

Perimeter protection encompasses the security measures deployed at the boundary between an organisation's internal network and external, untrusted networks such as the internet. Traditional perimeter defences include firewalls, intrusion detection and prevention systems (IDS/IPS), demilitarised zones (DMZs), web application firewalls (WAFs), and email security gateways that filter traffic before it reaches internal systems.

While perimeter protection remains important, the shift towards cloud computing, remote work, and zero-trust architectures has fundamentally changed how organisations approach boundary security. Modern perimeter strategies combine traditional network-edge controls with identity-based access decisions, encrypted traffic inspection, and micro-segmentation to address the reality that the network perimeter is no longer a single, well-defined boundary.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Network Segmentation", href: "/glossary/network-segmentation" }, { name: "Physical Security", href: "/glossary/physical-security" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" } ]} />

Under the GDPR, personal data is defined as any information relating to an identified or identifiable natural person (the data subject). A person is considered identifiable if they can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

The broad scope of this definition means that many types of data organisations routinely process qualify as personal data, including IP addresses, cookie identifiers, device fingerprints, and pseudonymised data where re-identification remains possible. Understanding what constitutes personal data is the essential first step in GDPR compliance, as it determines which processing activities fall under the regulation's requirements for lawful basis, transparency, and data subject rights.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "PII (Personally Identifiable Information)", href: "/glossary/pii-personally-identifiable-information" }, { name: "Processing Activity", href: "/glossary/processing-activity" }, { name: "Purpose Limitation", href: "/glossary/purpose-limitation" }, { name: "Pseudonymisation", href: "/glossary/pseudonymisation" } ]} />

A Personal Data Breach is a security incident where personal data is accidentally or unlawfully destroyed, lost, altered, or disclosed to unauthorized parties. Under GDPR, organisations must report breaches to supervisory authorities and affected individuals in certain circumstances.

When a breach occurs, organisations must notify the relevant data protection authority unless the risk to data subjects is low. If there is high risk, data subjects must also be notified. The notification must be made within 72 hours of becoming aware of the breach and must include details about the breach and recommended actions.

} relatedFrameworks={[ { name: "GDPR", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Breach Notification Obligation", href: "/glossary/data-breach-notification" }, { name: "GDPR (General Data Protection Regulation)", href: "/glossary/gdpr" }, { name: "Incident Response Plan", href: "/glossary/incident-response" } ]} />

Physical security encompasses the measures designed to protect an organisation's physical assets, facilities, and personnel from unauthorised access, damage, or interference. In an information security context, this includes access control systems for buildings and data centres (badge readers, biometric scanners), surveillance cameras (CCTV), security guards, environmental controls (fire suppression, flood detection), and secure disposal procedures for physical media.

Physical security is a foundational layer that underpins all other security controls, as even the most sophisticated logical access controls are ineffective if an attacker can physically access servers or network equipment. ISO 27001, SOC 2, and data centre standards such as ISO 27017 all require comprehensive physical security measures, and auditors will verify these controls through on-site inspections during certification assessments.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "Perimeter Protection", href: "/glossary/perimeter-protection" }, { name: "Operational Resilience", href: "/glossary/operational-resilience" } ]} />

Personally Identifiable Information (PII) is any data that can be used, either on its own or in combination with other information, to identify a specific individual. This includes direct identifiers such as names, social security numbers, and email addresses, as well as quasi-identifiers like date of birth, postal code, or job title that, when combined, can uniquely identify a person.

While the term PII originates from US privacy frameworks such as NIST SP 800-122, it overlaps significantly with the GDPR concept of personal data. Organisations operating across jurisdictions must understand the nuances between these definitions, as the GDPR's scope is broader and includes online identifiers and location data. Proper PII handling requires classification, access controls, encryption at rest and in transit, and documented retention and deletion procedures.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Pseudonymisation", href: "/glossary/pseudonymisation" }, { name: "Metadata", href: "/glossary/metadata" }, { name: "Privacy by Default", href: "/glossary/privacy-by-default" } ]} />

Policy management is the systematic approach to creating, approving, distributing, reviewing, and retiring organisational policies that govern behaviour, processes, and decision-making. In a GRC context, it encompasses information security policies, privacy policies, acceptable use policies, and compliance policies, ensuring they are aligned with regulatory requirements, business objectives, and industry standards.

An effective policy management programme includes version control, defined ownership and approval workflows, regular review cycles (typically annual), mechanisms for communicating policy changes to affected stakeholders, and evidence that employees have acknowledged and understood applicable policies. Frameworks such as ISO 27001 require a documented information security policy approved by management, with supporting policies that address specific domains.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Management Review", href: "/glossary/management-review" }, { name: "Non-Conformity", href: "/glossary/non-conformity" }, { name: "Maturity Model", href: "/glossary/maturity-model" }, { name: "Objective Evidence", href: "/glossary/objective-evidence" } ]} relatedFeatures={[ { name: "Policy center", href: "/features/policies" } ]} />

Privacy by default is the principle, codified in Article 25(2) of the GDPR, that organisations must ensure the highest level of privacy protection is applied automatically without requiring any action from the individual. This means that when a system or service offers multiple privacy settings, the most restrictive option must be the default, and only the personal data strictly necessary for the specific purpose should be processed.

In practice, privacy by default affects product design decisions such as opt-in rather than opt-out consent mechanisms, minimal data collection forms, limited default data sharing with third parties, and restricted access to personal data within the organisation. It works in tandem with privacy by design and requires collaboration between legal, product, and engineering teams to ensure privacy-protective defaults are embedded throughout the data processing lifecycle.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Privacy Engineering", href: "/glossary/privacy-engineering" }, { name: "Purpose Limitation", href: "/glossary/purpose-limitation" }, { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" } ]} />

A privacy champion is a designated employee within a department or business unit who promotes privacy awareness, serves as a first point of contact for privacy-related questions, and acts as a liaison between their team and the organisation's Data Protection Officer (DPO) or privacy office. Privacy champions are typically volunteers or appointees who receive additional privacy training beyond the standard awareness programme.

Establishing a network of privacy champions is an effective strategy for scaling privacy governance across large organisations where the central privacy team cannot be involved in every operational decision. Champions help identify new processing activities early, ensure privacy impact assessments are initiated when needed, and embed a privacy-conscious culture within their teams, significantly reducing the risk of compliance gaps at the operational level.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Privacy by Default", href: "/glossary/privacy-by-default" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" }, { name: "Processing Activity", href: "/glossary/processing-activity" } ]} />

Privacy engineering is the discipline of applying engineering principles and methodologies to embed privacy protections directly into the design and architecture of systems, applications, and data processing workflows. It goes beyond policy-level compliance by implementing technical measures such as data minimisation at the database level, automated consent management, purpose-bound data access controls, and privacy-preserving computation techniques.

As regulations like the GDPR mandate privacy by design and by default, privacy engineering has become an essential capability for technology organisations. It bridges the gap between legal requirements and technical implementation, ensuring that privacy controls are not bolted on as an afterthought but are integral to the system architecture from the outset. Key techniques include differential privacy, secure multi-party computation, and automated data lifecycle management.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Privacy by Default", href: "/glossary/privacy-by-default" }, { name: "Pseudonymisation", href: "/glossary/pseudonymisation" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" } ]} />

A Privacy Impact Assessment (PIA) is a systematic evaluation of how a proposed project, system, or processing activity will affect the privacy of individuals whose personal data is involved. While the PIA predates the GDPR, its principles have been formalised in the regulation's Data Protection Impact Assessment (DPIA) requirement under Article 35, which mandates such assessments for processing likely to result in high risk to individuals' rights and freedoms.

A well-conducted PIA identifies privacy risks early in the project lifecycle, when changes are least costly to implement, and recommends mitigation measures to reduce those risks to acceptable levels. It examines data flows, retention periods, access controls, third-party sharing, and data subject rights mechanisms, producing a documented record that demonstrates the organisation's commitment to privacy compliance and informed decision-making.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" }, { name: "ISO 27701 - Privacy Management", href: "/frameworks/iso27701" } ]} relatedTerms={[ { name: "Privacy by Default", href: "/glossary/privacy-by-default" }, { name: "Privacy Engineering", href: "/glossary/privacy-engineering" }, { name: "Processing Activity", href: "/glossary/processing-activity" }, { name: "Profiling", href: "/glossary/profiling" } ]} />

A privacy notice (or privacy policy) is the document where you tell your users what personal data you collect, why you collect it, how long you keep it and what their rights are. Under GDPR, this is mandatory for any organisation that processes personal data. For AI startups, your privacy notice must also cover AI-specific data processing such as model training, profiling and automated decision-making.

What to include:

  • Identity and contact details: Who is the data controller? Include your company name, address and a contact email for privacy questions.
  • Data you collect and why: List every category of personal data (name, email, usage data, AI interaction logs) and the specific purpose for each.
  • Legal basis: State your legal ground for each processing activity: consent, legitimate interest, contractual necessity or legal obligation.
  • AI-specific disclosures: If you use data for model training or automated decisions, explain this clearly. Users have the right to know about profiling and to object to it.
  • Retention and rights: State how long you keep data and explain users' rights: access, rectification, erasure, portability and the right to lodge a complaint.
  • Third parties and transfers: List categories of recipients (cloud providers, analytics tools, AI providers) and any cross-border transfers.

Use the Dutch Data Protection Authority's guidance as a starting point. Write in plain language. Avoid legal jargon. Tidal Control helps you generate and maintain your privacy notice and link it to your processing register for consistency.

} relatedTerms={[ { name: "Processing Register", href: "/glossary/processing-register" }, { name: "Data Subject Rights", href: "/glossary/data-subject-rights" }, { name: "Cross-Border Data Transfer", href: "/glossary/cross-border-data-transfer" } ]} />

Privileged Access Management (PAM) is a set of cybersecurity strategies and technologies for controlling, monitoring, and auditing elevated access to critical systems and sensitive data. Privileged accounts, such as system administrators, database administrators, and root accounts, have the ability to make significant changes to IT infrastructure and access sensitive information, making them high-value targets for attackers.

A comprehensive PAM programme includes credential vaulting (storing privileged passwords in encrypted vaults), session recording and monitoring, just-in-time access provisioning, and automatic credential rotation. PAM is a critical control for meeting the requirements of ISO 27001, SOC 2, NIS2, and PCI DSS, and is one of the most impactful security investments an organisation can make to reduce the risk of insider threats and lateral movement during a breach.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Least Privilege", href: "/glossary/least-privilege" }, { name: "Logical Access Security", href: "/glossary/logical-access-security" }, { name: "MFA (Multi-Factor Authentication)", href: "/glossary/mfa-multi-factor-authentication" }, { name: "Logging and Monitoring", href: "/glossary/logging-and-monitoring" } ]} />

A processing activity, as defined by the GDPR, encompasses any operation or set of operations performed on personal data, whether automated or manual. This includes collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, and destruction of personal data.

Article 30 of the GDPR requires controllers and processors to maintain a Record of Processing Activities (ROPA) documenting each processing activity, including its purpose, categories of data subjects and personal data involved, recipients, international transfers, retention periods, and security measures. This register is a foundational compliance tool that supervisory authorities frequently request during investigations and serves as the basis for data protection impact assessments.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Purpose Limitation", href: "/glossary/purpose-limitation" }, { name: "Joint Controller", href: "/glossary/joint-controller" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" } ]} />

A processing register (or Record of Processing Activities) is a structured overview of every way your organisation processes personal data. Under GDPR Article 30, organisations with more than 250 employees must maintain one, but in practice, any startup processing personal data at scale or using AI should have one, as supervisory authorities expect it.

What to document per processing activity:

  • Purpose: Why are you processing this data? Be specific: "improving our service" is too vague; "training our recommendation model on anonymised usage patterns" is clear.
  • Legal basis: Which of the six GDPR grounds applies? Consent, contract, legal obligation, vital interest, public interest or legitimate interest.
  • Categories of data and data subjects: What data (e.g. names, emails, AI interaction logs) and whose (e.g. customers, employees, website visitors)?
  • Recipients: Who receives the data? Include processors (cloud providers, AI APIs), subprocessors and any third-party integrations.
  • Retention periods: How long do you keep the data for each activity? Link to your data retention policy.
  • Security measures: What technical and organisational measures protect this data? Encryption, access controls, pseudonymisation, etc.

Start with a spreadsheet if needed, but move to a structured tool as you grow. The Dutch Data Protection Authority provides a template. Tidal Control maintains your processing register as a living document linked to your controls, policies and data flows.

} relatedTerms={[ { name: "Privacy Notice", href: "/glossary/privacy-notice" }, { name: "Data Processing Agreement (DPA)", href: "/glossary/data-processing-agreement-dpa" }, { name: "Data Retention Policy", href: "/glossary/data-retention-policy" } ]} />

Profiling, as defined in Article 4(4) of the GDPR, is any form of automated processing of personal data that involves using that data to evaluate certain personal aspects of a natural person. This includes analysing or predicting aspects concerning an individual's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

The GDPR imposes specific safeguards on profiling, particularly when it produces legal effects or similarly significantly affects individuals. Article 22 gives data subjects the right not to be subject to decisions based solely on automated processing, including profiling. Organisations engaged in profiling must ensure transparency about the logic involved, implement appropriate safeguards including the right to human intervention, and conduct data protection impact assessments for high-risk profiling activities.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Model Governance", href: "/glossary/model-governance" }, { name: "Privacy Impact Assessment (PIA)", href: "/glossary/privacy-impact-assessment-pia" }, { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Purpose Limitation", href: "/glossary/purpose-limitation" } ]} />

Pseudonymisation is a data protection technique defined in Article 4(5) of the GDPR whereby personal data is processed so that it can no longer be attributed to a specific data subject without the use of additional information. This additional information must be kept separately and subject to technical and organisational measures to ensure non-attribution. Common techniques include replacing identifiers with tokens, hash values, or reference codes.

Pseudonymisation is explicitly recognised by the GDPR as an appropriate safeguard that can reduce risks to data subjects and help controllers and processors meet their data protection obligations. Importantly, pseudonymised data remains personal data under the GDPR because re-identification is possible with the additional information. It differs from anonymisation, where re-identification is no longer reasonably possible, placing the data outside the scope of the GDPR entirely.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Privacy Engineering", href: "/glossary/privacy-engineering" }, { name: "Key Management", href: "/glossary/key-management" }, { name: "PII (Personally Identifiable Information)", href: "/glossary/pii-personally-identifiable-information" } ]} />

Purpose limitation is one of the fundamental principles of data protection enshrined in Article 5(1)(b) of the GDPR. It requires that personal data must be collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those original purposes. This principle ensures that organisations are transparent about why they collect data and do not repurpose it without appropriate legal basis.

Applying purpose limitation in practice requires organisations to clearly define and document the purpose of each processing activity at the time of data collection, communicate these purposes to data subjects through privacy notices, and evaluate compatibility before using data for any new purpose. The GDPR provides criteria for assessing compatibility, including the relationship between purposes, the context of collection, the nature of the data, and the possible consequences for data subjects.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Processing Activity", href: "/glossary/processing-activity" }, { name: "Personal Data", href: "/glossary/personal-data" }, { name: "Privacy by Default", href: "/glossary/privacy-by-default" }, { name: "Profiling", href: "/glossary/profiling" } ]} /> ## Q

Quantum-safe cryptography, also known as post-quantum cryptography, refers to cryptographic algorithms designed to withstand attacks from both classical and quantum computers. As quantum computing advances, traditional encryption methods such as RSA and ECC will become vulnerable to Shor's algorithm, which can factor large numbers exponentially faster than any classical approach.

Organisations handling sensitive data should begin planning their migration to quantum-resistant algorithms now, even though large-scale quantum computers are not yet widely available. Regulatory bodies and standards organisations such as NIST are already publishing recommended post-quantum algorithms, making early adoption a prudent element of any long-term security strategy.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Security Control", href: "/glossary/security-control" }, { name: "Risk Management", href: "/glossary/risk-management" }, { name: "System Hardening", href: "/glossary/system-hardening" } ]} /> ## R

A RACI matrix is a responsibility assignment tool that clarifies who is Responsible for executing a task, who is Accountable for its completion, who should be Consulted before decisions are made, and who needs to be Informed of outcomes. It is widely used in compliance and governance frameworks to ensure that every obligation has a clear owner and that no critical activity falls through the cracks.

In practice, a well-maintained RACI matrix prevents duplication of effort and reduces the risk of tasks being overlooked during audits or regulatory changes. It is particularly valuable when multiple departments share compliance responsibilities, as it provides a single reference point for escalation paths and decision-making authority.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Segregation of Duties (SoD)", href: "/glossary/segregation-of-duties-sod" }, { name: "Regulatory Change Management", href: "/glossary/regulatory-change-management" }, { name: "Remediation", href: "/glossary/remediation" } ]} />

Ransomware protection encompasses a layered set of technical and organisational measures designed to prevent, detect and recover from ransomware attacks. These measures include endpoint detection and response, network segmentation, immutable backups, email filtering and employee awareness training. Modern ransomware variants often exfiltrate data before encrypting it, adding the threat of public disclosure to the demand for payment.

Effective ransomware protection requires more than just technical controls; it demands tested recovery procedures with clearly defined RPO and RTO targets. Organisations should regularly rehearse their incident response plans and verify that backups can be restored within acceptable timeframes to minimise business disruption.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "Recovery Point Objective (RPO)", href: "/glossary/recovery-point-objective-rpo" }, { name: "Recovery Time Objective (RTO)", href: "/glossary/recovery-time-objective-rto" }, { name: "Security Incident", href: "/glossary/security-incident" }, { name: "Security Awareness Training", href: "/glossary/security-awareness-training" } ]} />

Role-Based Access Control (RBAC) is an access management model in which permissions are assigned to roles rather than to individual users. Users are then granted one or more roles that collectively determine what resources and actions they may access. This approach simplifies administration considerably in larger organisations, as changes to permissions only need to be made at the role level.

RBAC is a cornerstone of the principle of least privilege and supports compliance with frameworks such as ISO 27001, SOC 2 and the GDPR. By aligning roles with job functions, organisations can reduce the risk of excessive access rights and streamline access reviews during internal or external audits.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST SP 800-53", href: "/frameworks/nist-sp800-53" } ]} relatedTerms={[ { name: "Segregation of Duties (SoD)", href: "/glossary/segregation-of-duties-sod" }, { name: "Single Sign-On (SSO)", href: "/glossary/single-sign-on-sso" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

Responsible AI is an approach to designing, developing and deploying artificial intelligence systems that places ethics, transparency, accountability and fairness at the centre. It covers the full lifecycle of AI (from data collection and model training through to deployment and monitoring), ensuring that systems do not perpetuate bias, infringe on privacy, or produce unexplainable decisions.

With the EU AI Act and similar regulations emerging worldwide, responsible AI is rapidly shifting from a voluntary best practice to a legal obligation. Organisations deploying AI must document their risk assessments, implement human oversight mechanisms and maintain audit trails to demonstrate compliance with evolving regulatory requirements.

} relatedFrameworks={[ { name: "ISO 42001 - AI Management Systems", href: "/frameworks/iso42001" } ]} relatedTerms={[ { name: "Risk Management", href: "/glossary/risk-management" }, { name: "Security Awareness Training", href: "/glossary/security-awareness-training" }, { name: "Sensitive Personal Data", href: "/glossary/sensitive-personal-data" } ]} />

Under the GDPR, a recipient is any natural or legal person, public authority, agency or other body to whom personal data is disclosed, whether or not they are a third party. This includes internal departments, external service providers, and regulatory authorities that receive personal data as part of their functions. Understanding who qualifies as a recipient is essential for maintaining accurate processing records.

Organisations must document all recipients in their records of processing activities and, where applicable, in their privacy notices. When personal data is transferred to recipients outside the European Economic Area, additional safeguards such as Standard Contractual Clauses or adequacy decisions must be in place.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Subprocessor", href: "/glossary/subprocessor" }, { name: "Standard Contractual Clauses (SCC)", href: "/glossary/standard-contractual-clauses-scc" }, { name: "Sensitive Personal Data", href: "/glossary/sensitive-personal-data" } ]} />

The Recovery Point Objective (RPO) defines the maximum amount of data an organisation can afford to lose, measured as a time interval. For example, an RPO of four hours means that backups must occur at least every four hours, so that no more than four hours' worth of data is ever at risk. RPO is a key parameter in business continuity and disaster recovery planning.

Setting an appropriate RPO requires balancing the cost of more frequent backups against the business impact of data loss. Critical financial systems may demand an RPO of near zero, whilst less sensitive systems can tolerate longer intervals. RPO should always be defined alongside RTO to ensure a coherent recovery strategy.

} relatedFrameworks={[ { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Recovery Time Objective (RTO)", href: "/glossary/recovery-time-objective-rto" }, { name: "Ransomware Protection", href: "/glossary/ransomware-protection" }, { name: "Risk Management", href: "/glossary/risk-management" } ]} />

The Recovery Time Objective (RTO) specifies the maximum acceptable duration within which systems, applications or business processes must be restored after a disruption. It represents the threshold beyond which downtime causes unacceptable harm to the organisation (whether financial, reputational or regulatory). RTO is a fundamental metric in disaster recovery and business continuity planning.

Defining realistic RTOs requires input from both technical teams and business stakeholders, as the cost of achieving shorter recovery times increases significantly with tighter targets. Regular disaster recovery testing is essential to validate that actual recovery capabilities align with documented RTOs and to identify bottlenecks before a real incident occurs.

} relatedFrameworks={[ { name: "ISO 22301 - Business Continuity", href: "/frameworks/iso22301" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Recovery Point Objective (RPO)", href: "/glossary/recovery-point-objective-rpo" }, { name: "Security Incident", href: "/glossary/security-incident" }, { name: "Service Level Agreement (SLA)", href: "/glossary/service-level-agreement-sla" } ]} />

Regulatory change management is the structured process of monitoring, assessing and implementing changes in laws, regulations and industry standards that affect an organisation. It involves scanning regulatory landscapes, evaluating the impact of new or amended requirements on existing policies and controls, and coordinating the necessary updates across departments.

Without a robust regulatory change management process, organisations risk non-compliance, fines and reputational damage. Effective programmes typically combine automated regulatory intelligence feeds with expert review, clear RACI assignments and documented timelines for implementation, ensuring that no legislative change is overlooked or inadequately addressed.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "RACI Matrix", href: "/glossary/raci-matrix" }, { name: "Remediation", href: "/glossary/remediation" }, { name: "Statement of Applicability (SoA)", href: "/glossary/statement-of-applicability-soa" }, { name: "Risk Treatment Plan", href: "/glossary/risk-treatment-plan" } ]} />

Remediation is the process of correcting identified compliance gaps, audit findings or security vulnerabilities to bring an organisation back into conformity with its policies, standards or regulatory obligations. It typically involves root cause analysis, defining corrective actions, assigning ownership and tracking progress until the issue is fully resolved and verified.

Timely remediation is critical because unresolved findings can compound over time, increasing both risk exposure and the cost of correction. A well-governed remediation process includes escalation procedures, defined SLAs for different severity levels, and evidence collection to demonstrate closure during subsequent audits or regulatory inspections.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Treatment Plan", href: "/glossary/risk-treatment-plan" }, { name: "Residual Risk", href: "/glossary/residual-risk" }, { name: "Risk Register", href: "/glossary/risk-register" } ]} />

Residual risk is what is left once your controls are working. You score the risk twice: once as it would be with nothing in place, and again with your controls counted. The second number is the residual risk, and it is the one you compare against your risk appetite.

Inherent and residual

Both numbers are worth keeping, because the distance between them is the only direct evidence you have that a control is doing something.

Inherent risk Residual risk
Scored Before controls After controls
Answers How bad could this be if we did nothing? How bad is it now, given what we do?
Used for Prioritising which risks deserve controls Deciding whether to accept, and proving control value

If a risk scores the same before and after, your controls are not reducing it. That is worth investigating rather than recording, because it usually means the control addresses a different risk than the one it is linked to.

Accepting one is a decision, not a default

Residual risk below your appetite can be accepted. What matters is that acceptance is explicit: a named person, a date, and a reason. An unaccepted risk sitting quietly in the register is the version auditors object to, because nobody has taken responsibility for it.

Above appetite, you have three options rather than one: add controls, transfer the exposure through insurance or contract, or stop the activity. Choosing to do nothing is also available, but it has to be recorded as a decision at the right level.

How it is scored

Most methods reuse the same scale for both passes, so the two numbers are comparable. In Tidal Control you set likelihood and impact for the inherent risk, choose a treatment, then set them again with your controls in place, and the residual score is calculated the same way.

See the likelihood and impact matrix for the grid both scores land on, and re-score after the controls change rather than at the next annual review.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Appetite", href: "/glossary/risk-appetite" }, { name: "Risk Treatment", href: "/glossary/risk-treatment" }, { name: "Risk Register", href: "/glossary/risk-register" }, { name: "Risk Score", href: "/glossary/risk-score" } ]} relatedFeatures={[ { name: "Risk assessment", href: "/features/risks" } ]} />

A retention period is the defined timeframe during which personal data or business documents may lawfully be stored. Under the GDPR, personal data must not be kept longer than necessary for the purpose for which it was collected, unless a specific legal obligation mandates extended storage. Different categories of data often have different retention requirements based on applicable legislation.

Establishing and enforcing clear retention periods is a practical necessity for data minimisation compliance. Organisations should maintain a retention schedule that maps each data category to its legal basis and disposal method, and conduct periodic reviews to ensure that expired data is deleted or anonymised in a timely manner.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Right to be Forgotten", href: "/glossary/right-to-be-forgotten" }, { name: "Sensitive Personal Data", href: "/glossary/sensitive-personal-data" }, { name: "Recipient", href: "/glossary/recipient" } ]} />

The right to be forgotten, enshrined in Article 17 of the GDPR, grants data subjects the right to request the erasure of their personal data under specific conditions. These include situations where the data is no longer necessary for its original purpose, where consent has been withdrawn, or where the data has been unlawfully processed. Controllers must act without undue delay and, where data has been made public, take reasonable steps to inform other controllers of the erasure request.

Implementing this right effectively requires organisations to maintain comprehensive data inventories and have robust deletion processes in place across all systems, including backups and third-party processors. Failure to honour erasure requests within the legally mandated timeframe can result in significant fines and reputational harm.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Retention Period", href: "/glossary/retention-period" }, { name: "Special Categories of Personal Data", href: "/glossary/special-categories-of-personal-data" }, { name: "Subprocessor", href: "/glossary/subprocessor" } ]} />

Risk appetite defines the amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives. It is set by senior leadership or the board of directors and serves as a guiding principle for all risk-related decisions. Risk appetite can be expressed qualitatively through policy statements or quantitatively through thresholds such as maximum acceptable financial loss or tolerable downtime.

A clearly articulated risk appetite ensures consistent decision-making across the organisation and prevents both excessive risk-taking and overly cautious behaviour that could hinder growth. It should be reviewed periodically and adjusted in response to changes in the business environment, threat landscape or regulatory requirements.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Residual Risk", href: "/glossary/residual-risk" }, { name: "Risk Management", href: "/glossary/risk-management" }, { name: "Risk Treatment", href: "/glossary/risk-treatment" } ]} />

Risk assessment is the foundation of risk management. It identifies potential threats, evaluates their probability and impact, and assesses the adequacy of existing controls.

Regular risk assessments ensure organisations understand their threat landscape and can prioritise resources to manage the highest-risk areas effectively.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Risk Management", href: "/glossary/risk-management" }, { name: "Controls", href: "/glossary/controls" }, { name: "Threat", href: "/glossary/threat" } ]} />

Risk management is the systematic process of identifying, analysing, evaluating and treating risks that could affect an organisation's ability to achieve its objectives. It encompasses both threats and opportunities and applies across all levels of the organisation, from strategic decision-making to day-to-day operations. Frameworks such as ISO 31000 and ISO 27005 provide structured approaches to implementing risk management.

Effective risk management is not a one-off exercise but an ongoing cycle that adapts to evolving threats, business changes and regulatory developments. Organisations that embed risk management into their culture and decision-making processes are better positioned to protect their assets, maintain stakeholder confidence and respond swiftly to incidents when they occur.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Risk Register", href: "/glossary/risk-register" }, { name: "Risk Appetite", href: "/glossary/risk-appetite" }, { name: "Risk Treatment Plan", href: "/glossary/risk-treatment-plan" }, { name: "Risk Score", href: "/glossary/risk-score" } ]} />

A risk register is a centralised document or system that records all identified risks, along with key attributes such as the risk owner, likelihood, impact, current controls, residual risk level and treatment status. It serves as the single source of truth for an organisation's risk landscape and is a mandatory artefact in frameworks like ISO 27001.

Maintaining an up-to-date risk register enables management to prioritise resources effectively and provides auditors with clear evidence of ongoing risk governance. Regular reviews (typically quarterly or after significant changes) ensure that new risks are captured promptly and that existing risk assessments reflect current conditions.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Score", href: "/glossary/risk-score" }, { name: "Residual Risk", href: "/glossary/residual-risk" }, { name: "Risk Treatment Plan", href: "/glossary/risk-treatment-plan" } ]} />

A risk score is a numerical value assigned to a risk based on a quantitative assessment of its likelihood and impact. By converting qualitative judgements into comparable numbers, risk scores enable objective prioritisation across different risk categories and business units. Common approaches include simple multiplication of likelihood and impact ratings or more sophisticated models that weight additional factors such as velocity and detectability.

Risk scores are most valuable when applied consistently using a well-defined methodology and reviewed regularly. They inform decisions on where to allocate security budgets, which risks require immediate treatment and which fall within the organisation's accepted risk appetite. Transparent scoring criteria also improve communication between technical teams and executive stakeholders.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Register", href: "/glossary/risk-register" }, { name: "Residual Risk", href: "/glossary/residual-risk" }, { name: "Risk Management", href: "/glossary/risk-management" } ]} />

Risk treatment is the ISO 27001 process of selecting and implementing one or more options to modify an identified risk. The four standard treatment options are mitigation (reducing likelihood or impact through controls), transfer (shifting the risk to a third party, e.g. through insurance), avoidance (eliminating the activity that gives rise to the risk) and acceptance (consciously retaining the risk within appetite).

Each treatment option should be evaluated for feasibility, cost-effectiveness and alignment with the organisation's risk appetite before implementation. The chosen treatment must be documented in the risk treatment plan and its effectiveness monitored over time. Regular reassessment ensures that treatments remain appropriate as the threat landscape and business context evolve.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Treatment Plan", href: "/glossary/risk-treatment-plan" }, { name: "Risk Appetite", href: "/glossary/risk-appetite" }, { name: "Residual Risk", href: "/glossary/residual-risk" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

A risk treatment plan is a formal document that outlines how each identified risk will be addressed, specifying the chosen treatment strategy, whether acceptance, mitigation, transfer or avoidance. It includes details such as the responsible owner, required resources, implementation timeline and success criteria for each treatment action.

The risk treatment plan is a mandatory deliverable in ISO 27001 and serves as the operational bridge between risk assessment outcomes and concrete security improvements. It should be reviewed regularly by management and updated as risks are resolved, new risks emerge or business priorities shift, ensuring that the organisation's risk posture remains aligned with its objectives.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Risk Treatment", href: "/glossary/risk-treatment" }, { name: "Risk Register", href: "/glossary/risk-register" }, { name: "Remediation", href: "/glossary/remediation" } ]} /> ## S

The Safety Culture Ladder (SCL) is a Dutch assessment method that measures safety awareness and conscious safe conduct, so it rates culture and behaviour rather than the existence of a management system. It was originally developed by ProRail for the rail sector and has been managed by NEN since 1 July 2016, which made it available across industries. The scheme is widely known by its former name, the Veiligheidsladder. The current version is SCL 2.0, and since 1 January 2025 certification is only issued against 2.0.

Assessment runs over five levels, called ladder rungs or treden, and certification is possible from rung 2 upwards. The rungs describe how far safety has moved from paper into practice: rung 1 is pathological, where safety barely registers; rung 2 is reactive, with attention that is ad hoc and short-lived; rung 3 is calculating, where the focus is on systems and data but not yet on implementation on the shop floor, and involvement sits mainly with managers; rung 4 is proactive, with company-wide safety awareness; and rung 5 is progressive, where safety carries the same weight as cost, time and quality in every business process. Rung 3 is therefore the rung where the paperwork is in order and the workplace has not caught up, which is exactly the gap an assessment probes.

A certificate comes from an audit by an SCL-licensed certification body and is valid for three years, on condition that a follow-up audit takes place each year. Smaller organisations can use SCL Light, a reduced-scope route that produces a statement rather than a full certificate. A self assessment is a preparation and self-declaration tool for internal use and carries no evidentiary value.

The SCL matters commercially because Dutch clients increasingly require it in procurement. Under the ViA scheme (Veiligheid in Aanbestedingen) of the Governance Code Veiligheid in de Bouw, clients that signed the code set a ladder rung as a tender condition, and the requirement cascades to contractors, suppliers and advisory firms. It applies to contracts from EUR 100,000 and to organisations with more than five employees. The required level rose from rung 2 to rung 3 on 1 July 2026, having been postponed from 1 January 2025. On that same date the Approved Self Assessment lapsed as acceptable ViA evidence, and SCL Light was added in its place, so the accepted instruments are now SCL and SCL Light, chosen according to the size of the organisation.

A gap analysis on the SCL compares current practice with the requirements of the target rung and identifies what has to change before an assessment. Note that the SCL is a separate scheme from ISO 45001: ISO 45001 certifies an occupational health and safety management system, while the SCL rates the maturity of safety culture and behaviour. An organisation can hold one without the other.

Tidal Control does not currently support the Safety Culture Ladder as a framework in the platform. This entry is here because the scheme comes up alongside the standards we do cover, including ISO 45001.

} relatedFrameworks={[ { name: "ISO 45001 - Occupational Health and Safety", href: "/frameworks/iso45001" } ]} relatedTerms={[ { name: "Gap Analysis", href: "/glossary/gap-analysis" }, { name: "Maturity Model", href: "/glossary/maturity-model" }, { name: "Internal Audit", href: "/glossary/internal-audit" } ]} />

SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorisation data between an identity provider (IdP) and a service provider (SP). It enables single sign-on by allowing the identity provider to assert a user's identity and attributes to multiple service providers without the user needing to authenticate separately with each one.

SAML remains widely deployed in enterprise environments, particularly for web-based applications and SaaS platforms. It supports compliance requirements around centralised identity management and access logging, making it easier to enforce consistent authentication policies, conduct access reviews and maintain audit trails across the application landscape.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Single Sign-On (SSO)", href: "/glossary/single-sign-on-sso" }, { name: "RBAC (Role-Based Access Control)", href: "/glossary/rbac-role-based-access-control" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

Static Application Security Testing (SAST) is an automated technique that analyses source code, bytecode or binary code to identify security vulnerabilities without executing the application. SAST tools scan for common weaknesses such as SQL injection, cross-site scripting, buffer overflows and insecure cryptographic usage, typically integrating into the development pipeline as part of a shift-left security strategy.

By catching vulnerabilities early in the development lifecycle, SAST significantly reduces the cost and effort of remediation compared to finding issues in production. For optimal coverage, organisations often combine SAST with dynamic testing methods and manual code reviews, creating a comprehensive application security programme that satisfies compliance requirements under standards like ISO 27001 and SOC 2.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Security Control", href: "/glossary/security-control" }, { name: "Remediation", href: "/glossary/remediation" }, { name: "System Hardening", href: "/glossary/system-hardening" } ]} />

Schrems II refers to the landmark 2020 ruling by the Court of Justice of the European Union (CJEU) that invalidated the EU-US Privacy Shield framework and placed stricter requirements on international data transfers. The ruling established that organisations must assess whether the laws of the recipient country provide an essentially equivalent level of data protection before relying on Standard Contractual Clauses or other transfer mechanisms.

In practice, Schrems II requires organisations to conduct Transfer Impact Assessments (TIAs) and implement supplementary measures (such as encryption or pseudonymisation) where the legal framework of the destination country is deemed inadequate. This ruling has had a profound effect on how European organisations engage with non-EU cloud providers and service providers, particularly those based in the United States.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Standard Contractual Clauses (SCC)", href: "/glossary/standard-contractual-clauses-scc" }, { name: "Recipient", href: "/glossary/recipient" }, { name: "Subprocessor", href: "/glossary/subprocessor" } ]} />

In the context of an Information Security Management System (ISMS), scope defines the boundaries and applicability of the management system, specifying which processes, locations, departments, systems and information assets are covered. Setting the scope is one of the first steps in ISO 27001 implementation and directly influences which controls from Annex A must be considered in the Statement of Applicability.

A well-defined scope ensures that the ISMS is focused and manageable, whilst still covering all areas where information security risks could affect the organisation. Scope that is too narrow may leave critical assets unprotected, whilst scope that is overly broad can make the management system impractical. The scope statement must be documented and made available to interested parties, including certification auditors.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Statement of Applicability (SoA)", href: "/glossary/statement-of-applicability-soa" }, { name: "Security Control", href: "/glossary/security-control" }, { name: "Risk Management", href: "/glossary/risk-management" } ]} />

Security awareness training is a structured programme of periodic education designed to equip employees with the knowledge and skills to recognise and respond appropriately to security threats. Topics typically include phishing recognition, password hygiene, social engineering tactics, data handling procedures and incident reporting. Effective programmes go beyond annual compliance tick-boxes and incorporate ongoing reinforcement through simulations and micro-learning modules.

Human error remains one of the leading causes of security breaches, making awareness training a critical control in any security framework. Organisations subject to ISO 27001, SOC 2 or GDPR are expected to demonstrate that employees receive regular, role-appropriate training and that the programme's effectiveness is measured and improved over time.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Security Incident", href: "/glossary/security-incident" }, { name: "Spoofing", href: "/glossary/spoofing" }, { name: "Security Posture", href: "/glossary/security-posture" } ]} />

A security baseline is the minimum set of security measures every organisation should have in place. For startups, this is your first line of defence against data breaches, ransomware and unauthorised access. Getting the basics right prevents the vast majority of common attacks. You do not need enterprise-grade security from day one, but you do need the fundamentals.

Essential measures to implement:

  • Multi-factor authentication (MFA): Enable MFA on all critical accounts: email, cloud console, code repositories, admin panels. This single measure blocks most credential-based attacks.
  • Encryption: Encrypt data at rest (database encryption, encrypted disk volumes) and in transit (TLS/HTTPS everywhere). Most cloud providers offer this by default. Verify it is enabled.
  • Access control: Follow the principle of least privilege. Only grant access that people actually need. Review permissions quarterly and revoke access for departing team members immediately.
  • Logging and monitoring: Enable audit logs on your cloud platform, application and database. Set up alerts for failed login attempts, privilege escalation and unusual data access patterns.
  • Patch management: Keep your operating systems, frameworks and dependencies up to date. Enable automated security updates where possible and use tools like Dependabot for dependency monitoring.
  • Backup and recovery: Set up automated backups with a tested restore procedure. Follow the 3-2-1 rule: 3 copies, 2 different media, 1 offsite.

The NCSC basic measures provide a concrete checklist tailored to the Dutch context. Tidal Control helps you implement these measures as trackable controls and monitors their status as part of your information security management system.

} relatedTerms={[ { name: "ISMS (Information Security Management System)", href: "/glossary/isms" }, { name: "Incident Response Plan", href: "/glossary/incident-response" }, { name: "Penetration Test", href: "/glossary/penetration-test" } ]} />

A security control is a safeguard or countermeasure (technical, administrative or physical) designed to manage and reduce security risks to an acceptable level. Technical controls include firewalls, encryption and access management systems; administrative controls encompass policies, procedures and training programmes; physical controls cover locks, CCTV and environmental protections. Controls are selected based on risk assessment outcomes and framework requirements.

The effectiveness of security controls must be regularly tested and monitored to ensure they continue to mitigate the risks they were designed to address. In ISO 27001, controls are mapped to Annex A and documented in the Statement of Applicability, providing a clear audit trail of which measures are in place and why. A defence-in-depth approach layering multiple controls is considered best practice.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Statement of Applicability (SoA)", href: "/glossary/statement-of-applicability-soa" }, { name: "Risk Treatment", href: "/glossary/risk-treatment" }, { name: "System Hardening", href: "/glossary/system-hardening" }, { name: "Security Posture", href: "/glossary/security-posture" } ]} />

A security incident is any event that compromises or threatens the confidentiality, integrity or availability of information or information systems. Incidents range from malware infections and unauthorised access attempts to data breaches and denial-of-service attacks. Timely identification and classification of incidents is essential for triggering an appropriate response and meeting regulatory notification obligations.

Organisations should maintain a documented incident response plan that defines roles, communication channels, escalation procedures and evidence preservation requirements. Under the GDPR, certain incidents involving personal data must be reported to the supervisory authority within 72 hours and, where there is a high risk to individuals, to the affected data subjects without undue delay.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Security Operations Centre (SOC)", href: "/glossary/security-operations-centre-soc" }, { name: "Security Orchestration (SOAR)", href: "/glossary/security-orchestration-soar" }, { name: "Ransomware Protection", href: "/glossary/ransomware-protection" }, { name: "SIEM (Security Information and Event Management)", href: "/glossary/siem-security-information-and-event-management" } ]} />

A Security Operations Centre (SOC) is a centralised unit (either in-house or outsourced) staffed by security analysts who monitor, detect, investigate and respond to cyber threats around the clock. The SOC leverages tools such as SIEM platforms, endpoint detection and response systems, and threat intelligence feeds to maintain continuous visibility over the organisation's security posture.

For many organisations, a SOC is essential for meeting the monitoring and incident response requirements of frameworks like ISO 27001 and SOC 2. Whether operated internally or provided as a managed service, the SOC must have clearly defined playbooks, escalation procedures and performance metrics to ensure that threats are identified and contained before they cause significant damage.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "SIEM (Security Information and Event Management)", href: "/glossary/siem-security-information-and-event-management" }, { name: "Security Orchestration (SOAR)", href: "/glossary/security-orchestration-soar" }, { name: "Security Incident", href: "/glossary/security-incident" } ]} />

Security Orchestration, Automation and Response (SOAR) platforms automate and streamline security operations by integrating disparate security tools, orchestrating workflows and enabling automated response actions. SOAR reduces the manual workload on security teams by automatically triaging alerts, enriching them with contextual data and executing predefined response playbooks for common incident types.

By dramatically reducing mean time to detect and respond, SOAR platforms help organisations manage the growing volume of security alerts without proportionally increasing headcount. They also improve consistency in incident handling and provide detailed audit logs, which support compliance requirements and post-incident reviews for continuous improvement.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Security Operations Centre (SOC)", href: "/glossary/security-operations-centre-soc" }, { name: "SIEM (Security Information and Event Management)", href: "/glossary/siem-security-information-and-event-management" }, { name: "Security Incident", href: "/glossary/security-incident" } ]} />

Security posture refers to the overall status and strength of an organisation's security measures, policies, procedures and capabilities in relation to its threat environment. It encompasses the effectiveness of technical controls, the maturity of governance processes, the awareness level of staff and the ability to detect and respond to incidents. A strong security posture indicates comprehensive, well-maintained defences.

Assessing security posture is an ongoing activity that involves vulnerability scanning, penetration testing, compliance audits and risk assessments. Organisations use security posture evaluations to identify gaps, prioritise investments and demonstrate due diligence to regulators, customers and partners. Continuous improvement of security posture is a core objective of any ISMS.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Security Control", href: "/glossary/security-control" }, { name: "Security Awareness Training", href: "/glossary/security-awareness-training" }, { name: "Risk Management", href: "/glossary/risk-management" } ]} />

Segregation of Duties (SoD) is an internal control principle that distributes critical tasks and privileges across multiple individuals to reduce the risk of fraud, error and abuse of authority. By ensuring that no single person can initiate, approve and execute a sensitive transaction end-to-end, SoD creates natural checkpoints that increase accountability and transparency.

SoD is a fundamental requirement in compliance frameworks such as ISO 27001, SOC 2 and financial regulations. In practice, it is implemented through role-based access control systems that enforce separation at the technical level. Organisations should regularly review role assignments and access rights to detect SoD conflicts, particularly after organisational restructuring or personnel changes.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "RBAC (Role-Based Access Control)", href: "/glossary/rbac-role-based-access-control" }, { name: "RACI Matrix", href: "/glossary/raci-matrix" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

Sensitive personal data encompasses special categories of personal data that reveal particularly private aspects of an individual's life, such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership and sexual orientation. Under the GDPR, processing these categories is prohibited unless a specific legal exception applies, such as explicit consent or a vital interest of the data subject.

Organisations that process sensitive personal data must implement heightened security measures and conduct Data Protection Impact Assessments where the processing is likely to result in high risk. Proper handling of sensitive data is frequently scrutinised during audits and regulatory inspections, making it essential to maintain detailed records of processing activities and lawful bases.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Special Categories of Personal Data", href: "/glossary/special-categories-of-personal-data" }, { name: "Right to be Forgotten", href: "/glossary/right-to-be-forgotten" }, { name: "Retention Period", href: "/glossary/retention-period" } ]} />

SLA stands for Service Level Agreement: a contract between a service provider and a customer that sets out the service level owed, how it is measured, and what happens when it is missed. Unlike a general statement of intent, an SLA has numbers in it, and those numbers carry a consequence.

SLA, SLO and SLI

These three get used interchangeably and mean different things. Getting them straight matters when you negotiate, because a provider can hit every SLA while the service still feels unreliable to you.

Term What it is Example
SLI (indicator) The raw measurement. Successful requests as a share of all requests
SLO (objective) The internal target for that measurement. No contractual force. 99.95% of requests succeed each month
SLA (agreement) The contractual promise, usually set below the SLO, plus the remedy. 99.9% or you receive service credits

The gap between the SLO and the SLA is deliberate. A provider that promises exactly what it targets has left itself no margin, so treat an SLA identical to the advertised SLO as a warning rather than a selling point.

What an SLA needs to say about security

Availability is the clause everyone reads. The clauses that matter for your own compliance are usually further down, and they are the ones an auditor asks to see when your supplier handles personal or business-critical data.

Clause What to require
Breach notification A fixed window in hours, not "without undue delay". Your own 72-hour clock starts once you know, so the later your supplier tells you, the less of it you have left.
Audit and evidence rights The right to request an ISO 27001 certificate or SOC 2 report, and what happens if it lapses.
Subprocessors Notice before a new one is added, and a right to object.
Recovery targets RTO and RPO as numbers, so continuity claims are testable.
Exit Data return format, deletion deadline, and assistance during migration.

Where SLAs meet ISO 27001

Supplier agreements are covered by Annex A 5.20, addressing information security within supplier agreements, sitting under A.5.19 for supplier relationships generally. A.5.22 then expects you to monitor and review what the supplier actually delivers.

That last one is where most organisations fall short. Signing a strong SLA is evidence of a control being designed; showing that you read the reports and acted on a breach of it is evidence of the control operating, which is what an auditor tests.

Common mistakes

The most common is treating service credits as a remedy. A credit worth a few percent of one month's fee does not cover a day of downtime, so it prices the provider's risk rather than protecting yours. Read it as a signal of confidence, not compensation.

Next is measuring nothing. If nobody compares the monthly report against the agreed target, the SLA is a filing-cabinet document, and you will discover it during an incident rather than before one.

Last is the uptime definition itself. Check whether planned maintenance is excluded, how a partial outage is counted, and who does the measuring. A 99.9% promise that excludes maintenance windows and only counts total failures can coexist with a service you cannot rely on.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Shared Responsibility Model", href: "/glossary/shared-responsibility-model" }, { name: "Supplier Risk Assessment", href: "/glossary/supplier-risk-assessment" }, { name: "Recovery Time Objective (RTO)", href: "/glossary/recovery-time-objective-rto" } ]} relatedFeatures={[ { name: "Vendor management", href: "/features/vendors" } ]} />

The shared responsibility model is a framework that delineates the division of security obligations between a cloud service provider and its customer. The provider is typically responsible for securing the underlying infrastructure (physical data centres, networking and hypervisor layers), whilst the customer is responsible for securing their data, identities, applications and configurations within the cloud environment. The exact boundary varies by service model (IaaS, PaaS, SaaS).

Misunderstanding the shared responsibility model is one of the most common causes of cloud security incidents. Organisations must clearly map which controls fall under their responsibility and implement appropriate measures accordingly. This includes identity management, encryption, access controls and monitoring (areas that remain the customer's obligation regardless of the cloud deployment model).

} relatedFrameworks={[ { name: "ISO 27017 - Cloud Security", href: "/frameworks/iso27017" }, { name: "ISO 27018 - Cloud Privacy", href: "/frameworks/iso27018" } ]} relatedTerms={[ { name: "Service Level Agreement (SLA)", href: "/glossary/service-level-agreement-sla" }, { name: "Supplier Risk Assessment", href: "/glossary/supplier-risk-assessment" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

SIEM (Security Information and Event Management) is a platform that aggregates, normalises and correlates log data and security events from across an organisation's IT environment to enable real-time threat detection and forensic investigation. By centralising data from firewalls, servers, endpoints, applications and cloud services, SIEM provides a holistic view of security activity and identifies patterns that individual systems cannot detect in isolation.

A well-tuned SIEM is essential for meeting the logging and monitoring requirements of compliance frameworks such as ISO 27001 and SOC 2. However, the value of a SIEM depends heavily on the quality of its detection rules, the completeness of its data sources and the capacity of the security team to investigate and respond to the alerts it generates. Organisations should invest in ongoing rule tuning to minimise false positives and ensure genuine threats are surfaced promptly.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Security Operations Centre (SOC)", href: "/glossary/security-operations-centre-soc" }, { name: "Security Orchestration (SOAR)", href: "/glossary/security-orchestration-soar" }, { name: "Security Incident", href: "/glossary/security-incident" } ]} />

Single Sign-On (SSO) is an authentication mechanism that allows users to access multiple applications and services with a single set of credentials and one login event. SSO is typically implemented using protocols such as SAML, OAuth 2.0 or OpenID Connect, with an identity provider managing the authentication process and issuing tokens or assertions to participating service providers.

SSO improves both user experience and security by reducing password fatigue and the likelihood of credential reuse across services. From a compliance perspective, SSO centralises authentication logging and simplifies access reviews, making it easier to enforce consistent policies such as multi-factor authentication across the entire application estate.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "SAML (Security Assertion Markup Language)", href: "/glossary/saml-security-assertion-markup-language" }, { name: "RBAC (Role-Based Access Control)", href: "/glossary/rbac-role-based-access-control" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

SOC 2 is a widely recognised compliance framework for service providers (cloud, SaaS, hosting). It evaluates controls in five trust service categories: security, availability, processing integrity, confidentiality, and privacy.

SOC 2 reports (Type I and Type II) provide customers with assurance that their data is properly protected and managed by service providers.

} relatedTerms={[ { name: "AICPA SOC 2", href: "/glossary/soc2" }, { name: "Certification", href: "/glossary/certification" }, { name: "Control Tests", href: "/glossary/control-tests" } ]} />

SOC 2 Type I is an audit report issued under the AICPA's Trust Services Criteria that evaluates the design and implementation of an organisation's controls at a specific point in time. It assesses whether the controls are suitably designed to meet the relevant Trust Services Categories (security, availability, processing integrity, confidentiality and privacy) but does not test their operational effectiveness over a period.

A SOC 2 Type I report is often used as a stepping stone towards a Type II report, demonstrating to customers and partners that appropriate controls have been established. It is particularly useful for organisations that have recently implemented their control environment and want to provide assurance before a full period of operational testing has elapsed.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "SOC 2 Type II", href: "/glossary/soc-2-type-ii" }, { name: "Security Control", href: "/glossary/security-control" }, { name: "Statement of Applicability (SoA)", href: "/glossary/statement-of-applicability-soa" } ]} />

SOC 2 Type II is an audit report that evaluates both the design and the operational effectiveness of an organisation's controls over a defined review period, typically between three and twelve months. Unlike the Type I report, which only assesses control design at a point in time, the Type II report provides evidence that controls have been consistently operating as intended throughout the examination period.

SOC 2 Type II reports are increasingly demanded by enterprise customers as a condition for doing business, particularly in the SaaS and cloud services sectors. Achieving and maintaining a clean Type II report requires sustained discipline in control execution, evidence collection and exception management, making it a strong indicator of an organisation's security maturity.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "SOC 2 Type I", href: "/glossary/soc-2-type-i" }, { name: "Security Control", href: "/glossary/security-control" }, { name: "Supplier Risk Assessment", href: "/glossary/supplier-risk-assessment" } ]} />

An SBOM is a complete inventory of all software components, libraries and dependencies your product uses. For AI startups, this includes not just your application dependencies but also ML frameworks, model libraries and data pipeline tools. Knowing exactly what is in your software stack is essential for identifying vulnerabilities, managing licence compliance and responding quickly to supply chain incidents.

How to get started:

  • Enable Dependabot or Renovate: These tools automatically scan your repositories, flag known vulnerabilities and create pull requests for updates. Start with GitHub Dependabot. It takes minutes to enable.
  • Check licence compliance: Pay special attention to copyleft licences (GPL, AGPL) that may require you to open-source your own code. Use a licence scanning tool to flag these automatically.
  • Generate a formal SBOM: Use standard formats like SPDX or CycloneDX. Many build tools (npm, pip, Maven) can export dependency lists that can be converted to these formats.
  • Monitor continuously: New vulnerabilities are discovered daily. Set up automated alerts so you are notified when a dependency in your stack is affected by a CVE.
  • Include AI-specific components: Document which model providers, frameworks (PyTorch, TensorFlow, LangChain) and inference runtimes you use. These have their own vulnerability surfaces.

An SBOM is increasingly expected by enterprise customers and required by regulations like the EU Cyber Resilience Act. Tidal Control helps you maintain your software inventory as part of your asset management and link it to your security controls.

} relatedTerms={[ { name: "Security Baseline", href: "/glossary/security-baseline" }, { name: "Asset Management", href: "/glossary/asset-management" } ]} />

Special categories of personal data, as defined in Article 9 of the GDPR, include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, health data, and data concerning sexual life or orientation. Processing these categories is prohibited by default, with limited exceptions such as explicit consent, employment law obligations or substantial public interest.

The heightened sensitivity of these data categories demands proportionally stronger protective measures, including encryption at rest and in transit, strict access controls and comprehensive Data Protection Impact Assessments. Organisations must be able to demonstrate a valid legal basis for each processing activity involving special categories and maintain thorough documentation for regulatory scrutiny.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Sensitive Personal Data", href: "/glossary/sensitive-personal-data" }, { name: "Right to be Forgotten", href: "/glossary/right-to-be-forgotten" }, { name: "Retention Period", href: "/glossary/retention-period" } ]} />

Spoofing is a class of attack in which a malicious actor disguises their identity or the origin of a communication to gain unauthorised access, steal data or spread malware. Common forms include email spoofing (forging sender addresses), IP spoofing (falsifying source IP addresses), DNS spoofing (redirecting domain name lookups) and caller ID spoofing. These techniques are frequently used as a precursor to more targeted attacks such as phishing or man-in-the-middle interception.

Defending against spoofing requires a combination of technical controls and user awareness. Email authentication protocols such as SPF, DKIM and DMARC help verify sender legitimacy, whilst network-level controls like ingress filtering can detect forged IP packets. Regular security awareness training ensures that employees remain vigilant against social engineering attempts that leverage spoofed identities.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Security Awareness Training", href: "/glossary/security-awareness-training" }, { name: "Security Incident", href: "/glossary/security-incident" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

Standard Contractual Clauses (SCCs) are pre-approved model contract terms issued by the European Commission that provide a legal mechanism for transferring personal data from the EEA to third countries that lack an adequacy decision. The current SCCs, adopted in June 2021, include modular clauses covering four transfer scenarios: controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller.

Following the Schrems II ruling, simply signing SCCs is no longer sufficient; organisations must also conduct a Transfer Impact Assessment to evaluate whether the legal framework of the recipient country undermines the protections provided by the clauses. Where gaps are identified, supplementary measures such as encryption or pseudonymisation must be implemented to ensure an essentially equivalent level of protection.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Schrems II", href: "/glossary/schrems-ii" }, { name: "Recipient", href: "/glossary/recipient" }, { name: "Subprocessor", href: "/glossary/subprocessor" } ]} />

The Statement of Applicability (SoA) is a mandatory ISO 27001 document that lists all controls from Annex A and states whether each is applicable or not, together with a justification for the inclusion or exclusion. It also references the implementation status and links each applicable control to the relevant risk treatment decisions, creating a comprehensive map between identified risks and the measures in place to address them.

The SoA is one of the most scrutinised documents during ISO 27001 certification audits, as it demonstrates that the organisation has systematically considered all relevant controls and made informed decisions. Keeping the SoA current requires updating it whenever the scope changes, new risks emerge or controls are modified, ensuring it remains an accurate reflection of the organisation's control environment.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Scope", href: "/glossary/scope" }, { name: "Security Control", href: "/glossary/security-control" }, { name: "Risk Treatment", href: "/glossary/risk-treatment" } ]} />

A subprocessor is a third party engaged by a data processor to carry out specific processing activities on behalf of the data controller. Under the GDPR, processors may only engage subprocessors with the prior specific or general written authorisation of the controller. When general authorisation is used, the processor must inform the controller of any intended changes, giving the controller the opportunity to object.

Managing subprocessors is a critical aspect of third-party risk management. Organisations must ensure that subprocessor agreements include the same data protection obligations as the primary processing agreement. Maintaining an up-to-date register of all subprocessors, along with their locations and processing activities, is essential for transparency and for responding to data subject enquiries or supervisory authority requests.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Recipient", href: "/glossary/recipient" }, { name: "Standard Contractual Clauses (SCC)", href: "/glossary/standard-contractual-clauses-scc" }, { name: "Supplier Risk Assessment", href: "/glossary/supplier-risk-assessment" } ]} />

A supplier risk assessment is the process of evaluating the security, compliance and operational risks associated with engaging a third-party supplier before and during the business relationship. It typically involves reviewing the supplier's security certifications, policies, incident history, financial stability and data processing practices, often supported by questionnaires, audits or independent assessment reports such as SOC 2.

The supplier risk assessment process:

  • Build a supplier inventory: Record every third party that processes your data, connects to your systems or supports a critical process. You cannot assess what you have not written down, and an incomplete register is the most common audit finding here.
  • Tier by criticality: Rank suppliers by the sensitivity of the data they touch and the impact of them failing. Tiering decides how deep each assessment goes: a payroll processor warrants far more scrutiny than an office supplier.
  • Send a proportionate questionnaire: Ask about security controls, subprocessors, data location, breach notification and continuity. Match the depth to the tier; a 200-question form sent to every supplier gets rushed answers and tells you little.
  • Review independent evidence: Certifications such as ISO 27001, audit reports such as SOC 2 Type II, and penetration test summaries carry more weight than self-declaration, because someone external has tested the claim.
  • Decide and record: Accept, accept with conditions, or reject. Document the residual risk and who approved it. This decision trail is what an auditor asks for, not the questionnaire itself.
  • Monitor and reassess: Set a review cadence per tier, and re-run the assessment on contract renewal, after an incident, or when the service materially changes.

ISO 27001:2022 covers this in Annex A controls A.5.19 to A.5.23, spanning supplier relationships, security within supplier agreements, the ICT supply chain, monitoring of supplier services, and cloud services. NIS2 makes supply chain security an explicit obligation under Article 21(2)(d), and DORA sets detailed third-party ICT risk requirements for financial entities. In practice most auditors look for three things: a maintained supplier register, evidence that assessments happened before onboarding rather than retrospectively, and a review cycle you can demonstrate.

Looking for a tool rather than a definition? See how Tidal Control automates supplier risk assessment: a supplier database that pre-fills certifications and policies, then scores and re-checks the risk for you.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Supply Chain Security", href: "/glossary/supply-chain-security" }, { name: "Service Level Agreement (SLA)", href: "/glossary/service-level-agreement-sla" }, { name: "Subprocessor", href: "/glossary/subprocessor" }, { name: "SOC 2 Type II", href: "/glossary/soc-2-type-ii" } ]} relatedFeatures={[ { name: "Vendor management", href: "/features/vendors" } ]} />

Supply chain security encompasses the measures, processes and technologies used to identify, assess and mitigate risks arising from an organisation's network of suppliers, partners and service providers. It recognises that an organisation's security is only as strong as the weakest link in its supply chain. Threats range from compromised software updates and counterfeit components to data breaches at third-party service providers.

High-profile incidents such as the SolarWinds and Kaseya attacks have demonstrated the devastating impact that supply chain compromises can have. Organisations should implement a structured approach that includes supplier risk assessments, contractual security requirements, continuous monitoring and incident response coordination with key suppliers. Regulatory frameworks including NIS2 and DORA are increasingly mandating supply chain security measures.

} relatedFrameworks={[ { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Supplier Risk Assessment", href: "/glossary/supplier-risk-assessment" }, { name: "Shared Responsibility Model", href: "/glossary/shared-responsibility-model" }, { name: "Security Control", href: "/glossary/security-control" } ]} />

System hardening is the process of reducing the attack surface of a system by removing unnecessary software, services, accounts and configurations, and applying security best practices to the remaining components. This includes disabling default accounts, closing unused ports, applying the principle of least privilege, enabling audit logging and keeping systems patched with the latest security updates.

Hardening is a foundational security control required by virtually every compliance framework, including ISO 27001, CIS Benchmarks and SOC 2. Organisations should establish standardised hardening baselines for each technology in their environment and use automated configuration management tools to enforce and verify compliance with these baselines across all systems on an ongoing basis.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "Security Control", href: "/glossary/security-control" }, { name: "Security Posture", href: "/glossary/security-posture" }, { name: "RBAC (Role-Based Access Control)", href: "/glossary/rbac-role-based-access-control" } ]} /> ## T

Technical and Organisational Measures (TOMs) are the safeguards that organisations must implement under GDPR Article 32 to ensure appropriate security for personal data processing. Technical measures include encryption, access controls and pseudonymisation, whilst organisational measures cover policies, staff training and incident response procedures. The specific measures required depend on the nature, scope, context and purposes of processing, as well as the risk to individuals' rights and freedoms.

Implementing robust TOMs is not merely a legal obligation but a cornerstone of trustworthy data handling. Organisations must regularly review and update these measures to keep pace with evolving threats and technological developments. Documenting your TOMs thoroughly also provides essential evidence of compliance during audits and regulatory inquiries.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Data Protection Impact Assessment (DPIA)", href: "/glossary/data-protection-impact-assessment-dpia" }, { name: "Vulnerability Management", href: "/glossary/vulnerability-management" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" } ]} />

In data protection law, a third party is any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor, and those authorised to process personal data under the direct authority of the controller or processor. This distinction is crucial for determining responsibilities and obligations when personal data is shared or disclosed. Understanding who qualifies as a third party helps organisations manage data flows and apply appropriate safeguards.

Correctly identifying third parties is essential when conducting data protection impact assessments and drafting privacy notices. Whenever personal data is disclosed to a third party, the legal basis for that disclosure must be established and documented. Organisations should maintain a register of third-party disclosures to ensure transparency and accountability in their data processing activities.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Third Party Risk Management (TPRM)", href: "/glossary/third-party-risk-management-tprm" }, { name: "Data Protection Impact Assessment (DPIA)", href: "/glossary/data-protection-impact-assessment-dpia" }, { name: "Data Processor", href: "/glossary/data-processor" } ]} />

Third Party Risk Management (TPRM) is the structured process of identifying, assessing and mitigating the compliance and security risks that arise from engaging suppliers, vendors and partners. It encompasses due diligence before onboarding, ongoing monitoring of third-party security posture, and contractual requirements for data protection and regulatory compliance. A mature TPRM programme ensures that external relationships do not introduce unacceptable risk to the organisation.

With supply chain attacks and regulatory expectations both increasing, effective TPRM has become a business-critical capability. Organisations should classify third parties by risk level and apply proportionate assessment measures, from self-assessment questionnaires to on-site audits. Regular reviews and clearly defined escalation paths ensure that emerging risks are identified and addressed before they materialise into incidents.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Third Party", href: "/glossary/third-party" }, { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" }, { name: "Threat Intelligence", href: "/glossary/threat-intelligence" }, { name: "Trust Service Principles (TSP)", href: "/glossary/trust-service-principles-tsp" } ]} />

A threat is any potential danger or harmful event that could exploit one or more vulnerabilities to negatively impact the confidentiality, integrity or availability of information assets or systems. Threats can be intentional, such as cyberattacks and insider sabotage, or unintentional, including natural disasters, hardware failures and human error. Identifying and categorising threats is a foundational step in any risk management framework.

Understanding the threat landscape relevant to your organisation enables more effective allocation of security resources. Threats should be assessed in combination with existing vulnerabilities and the potential business impact of exploitation. Regular threat assessments, informed by up-to-date threat intelligence, help organisations stay ahead of adversaries and maintain a robust security posture.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Threat Intelligence", href: "/glossary/threat-intelligence" }, { name: "Threat Modelling", href: "/glossary/threat-modelling" }, { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" } ]} />

Threat intelligence is the collection, analysis and dissemination of information about current and emerging cyber threats, adversary tactics, techniques and procedures (TTPs), and indicators of compromise (IoCs). It transforms raw data from multiple sources into actionable insights that enable security teams to anticipate attacks, prioritise defences and respond more effectively to incidents. Threat intelligence can be strategic, tactical or operational depending on the audience and use case.

Integrating threat intelligence into security operations significantly improves an organisation's ability to detect and prevent attacks before they cause damage. It informs decisions on patch prioritisation, firewall rule updates and incident response playbooks. Organisations that consume and share threat intelligence within trusted communities benefit from collective defence and a broader understanding of the evolving threat landscape.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Threat", href: "/glossary/threat" }, { name: "Threat Modelling", href: "/glossary/threat-modelling" }, { name: "Vulnerability Management", href: "/glossary/vulnerability-management" } ]} />

Threat modelling is a systematic approach to identifying, documenting and evaluating potential threats and vulnerabilities in a system, application or process. Methodologies such as STRIDE, PASTA and attack trees help teams think like adversaries to uncover weaknesses before they can be exploited. It is most effective when applied early in the design phase and revisited throughout the development lifecycle as the system evolves.

By proactively identifying where an attacker is most likely to strike, threat modelling enables teams to implement targeted security controls and make informed design decisions. It fosters a security-first mindset across development and operations teams. The outputs of threat modelling exercises also serve as valuable documentation for auditors, regulators and security assessments.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Threat", href: "/glossary/threat" }, { name: "Threat Intelligence", href: "/glossary/threat-intelligence" }, { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" } ]} />

The Trust Service Principles (TSP) are the five criteria established by the American Institute of Certified Public Accountants (AICPA) that form the foundation of SOC 2 reports: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security (also known as the Common Criteria) is mandatory for every SOC 2 engagement, whilst the remaining four principles are selected based on the nature of the services provided. Each principle defines specific control objectives that organisations must meet to demonstrate trustworthy operations.

For organisations seeking SOC 2 certification, understanding which Trust Service Principles apply to their services is a critical first step. The principles provide a clear and auditable framework for demonstrating to customers and stakeholders that appropriate controls are in place. Aligning internal controls with the TSP criteria also streamlines audit preparation and can reduce the time and cost of achieving certification.

} relatedFrameworks={[ { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" }, { name: "Third Party Risk Management (TPRM)", href: "/glossary/third-party-risk-management-tprm" }, { name: "User Access Review", href: "/glossary/user-access-review" } ]} />

Two-Factor Authentication (2FA) is a security mechanism that requires users to provide two distinct forms of verification before gaining access to a system or account. These factors typically combine something you know (such as a password) with something you have (such as a mobile device generating a time-based code) or something you are (such as a fingerprint). By requiring two independent factors, 2FA significantly reduces the risk of unauthorised access even if one factor is compromised.

Implementing 2FA is one of the most effective and accessible security measures an organisation can adopt to protect against credential theft and phishing attacks. Modern implementations favour authenticator apps or hardware tokens over SMS codes, as SMS is vulnerable to SIM-swapping attacks. Enforcing 2FA across all user accounts, particularly for privileged and administrative access, is a baseline expectation in most security frameworks and compliance standards.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "User Access Rights", href: "/glossary/user-access-rights" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" }, { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" } ]} /> ## U

A user access review is a periodic evaluation process to verify that user permissions and access rights remain appropriate for each individual's current role and responsibilities. It typically involves comparing assigned permissions against job requirements, identifying excessive or orphaned accounts, and revoking access that is no longer justified. Access reviews are a key control in frameworks such as ISO 27001, SOC 2 and GDPR, and are often required on a quarterly or annual basis.

Regular access reviews are essential for maintaining the principle of least privilege and preventing privilege creep as employees change roles or leave the organisation. Automating the review process where possible reduces administrative burden and improves accuracy. Documenting review outcomes and remediation actions provides an audit trail that demonstrates ongoing compliance with access control policies.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "SOC 2", href: "/frameworks/soc2" } ]} relatedTerms={[ { name: "User Access Rights", href: "/glossary/user-access-rights" }, { name: "Two-Factor Authentication (2FA)", href: "/glossary/two-factor-authentication-2fa" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" } ]} />

User access rights are the specific authorisations and permissions granted to individual users that determine what systems, data and functionalities they can access and what actions they can perform. These rights are typically managed through role-based access control (RBAC) or attribute-based access control (ABAC) models, and should follow the principle of least privilege, granting only the minimum access necessary for a user to perform their duties. Proper management of access rights is fundamental to information security and regulatory compliance.

Effective management of user access rights requires a clear process for granting, modifying and revoking permissions aligned with organisational roles. When employees join, move between departments or leave, their access rights must be promptly adjusted to reflect their current responsibilities. Combining well-defined access policies with regular user access reviews ensures that permissions remain appropriate and that the organisation maintains a strong security posture.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "User Access Review", href: "/glossary/user-access-review" }, { name: "Two-Factor Authentication (2FA)", href: "/glossary/two-factor-authentication-2fa" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" } ]} /> ## V

Version control is the systematic management of changes to documents, source code, configurations and other digital assets, maintaining a complete history of all modifications with full traceability. Modern version control systems such as Git enable teams to track who changed what, when and why, whilst supporting parallel development through branching and merging. Beyond software development, version control is increasingly applied to policy documents, infrastructure configurations and compliance artefacts.

In a compliance and security context, version control provides an essential audit trail that demonstrates when changes were made and by whom. It supports change management processes by enabling reviews, approvals and rollbacks of modifications. Organisations that apply version control to their policies, procedures and security configurations can respond more quickly to incidents and demonstrate accountability to auditors and regulators.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Vulnerability Management", href: "/glossary/vulnerability-management" }, { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" }, { name: "Waterfall Method", href: "/glossary/waterfall-method" } ]} />

Vital interests is one of the six legal bases for processing personal data under the GDPR (Article 6(1)(d)), applicable when processing is necessary to protect the life or critical health interests of the data subject or another natural person. This basis is intended for emergency situations where the individual is unable to give consent, such as medical emergencies or natural disasters. It is narrowly interpreted and cannot be used as a general justification for health-related data processing.

In practice, reliance on vital interests as a legal basis is rare and typically limited to life-threatening scenarios. Organisations in the healthcare and emergency services sectors should understand when this basis applies but should not treat it as a substitute for obtaining proper consent or establishing another more appropriate legal basis. Documenting the circumstances under which vital interests are invoked is essential for demonstrating compliance.

} relatedFrameworks={[ { name: "GDPR - General Data Protection Regulation", href: "/frameworks/gdpr" } ]} relatedTerms={[ { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" }, { name: "Third Party", href: "/glossary/third-party" } ]} />

A vulnerability assessment is a systematic examination of systems, applications, networks and processes to identify security weaknesses that could be exploited by threats. Unlike penetration testing, which actively attempts to exploit vulnerabilities, a vulnerability assessment focuses on discovery and classification, typically using a combination of automated scanning tools and manual analysis. Findings are prioritised based on severity, exploitability and potential business impact.

Regular vulnerability assessments are a fundamental component of any information security programme and are required by standards such as ISO 27001, PCI DSS and SOC 2. They provide a clear picture of an organisation's attack surface and feed directly into vulnerability management and remediation workflows. Combining assessments with threat intelligence ensures that the most relevant and dangerous weaknesses are addressed first.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Vulnerability Management", href: "/glossary/vulnerability-management" }, { name: "Vulnerability Scan", href: "/glossary/vulnerability-scan" }, { name: "Threat Modelling", href: "/glossary/threat-modelling" } ]} relatedFeatures={[ { name: "Issues management", href: "/features/issues" } ]} />

Vulnerability management is the continuous, cyclical process of identifying, evaluating, prioritising and remediating security vulnerabilities across an organisation's systems, applications and infrastructure. It goes beyond one-off assessments by establishing an ongoing programme that includes regular scanning, risk-based prioritisation, remediation tracking and verification. A mature vulnerability management programme integrates with change management, patch management and incident response processes.

Effective vulnerability management requires clear ownership, defined SLAs for remediation based on severity, and regular reporting to stakeholders. Organisations should leverage automated tools for continuous scanning whilst applying contextual risk analysis to prioritise remediation efforts. By maintaining a current view of their vulnerability landscape, organisations can reduce their attack surface systematically and demonstrate due diligence to auditors and regulators.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "CIS Controls", href: "/frameworks/cis-controls" } ]} relatedTerms={[ { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" }, { name: "Vulnerability Scan", href: "/glossary/vulnerability-scan" }, { name: "Threat Intelligence", href: "/glossary/threat-intelligence" }, { name: "Version Control", href: "/glossary/version-control" } ]} />

A vulnerability scan is an automated process that uses specialised tools to detect known security weaknesses in systems, networks, applications and configurations. Scanners compare the target environment against databases of known vulnerabilities (such as CVE entries) and misconfigurations, producing reports that detail discovered issues along with severity ratings. Scans can be authenticated (using credentials for deeper inspection) or unauthenticated (simulating an external attacker's view).

Vulnerability scanning is a cost-effective way to maintain continuous visibility into an organisation's security posture and is a required control in many compliance frameworks. Scans should be run on a regular schedule and after significant changes to the environment, with results feeding into the broader vulnerability management process. Interpreting scan results in context is important, as false positives can waste remediation effort whilst false negatives may leave critical weaknesses unaddressed.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" }, { name: "Vulnerability Management", href: "/glossary/vulnerability-management" }, { name: "WAF (Web Application Firewall)", href: "/glossary/waf-web-application-firewall" } ]} relatedFeatures={[ { name: "Issues management", href: "/features/issues" } ]} /> ## W

A Web Application Firewall (WAF) is a security solution that monitors, filters and blocks HTTP/HTTPS traffic between the internet and a web application to protect against common web-based attacks. It operates at the application layer (Layer 7 of the OSI model) and can defend against threats such as SQL injection, cross-site scripting (XSS), file inclusion and other OWASP Top 10 vulnerabilities. WAFs can be deployed as hardware appliances, software solutions or cloud-based services.

Deploying a WAF provides an important layer of defence for web applications, particularly when rapid patching of application vulnerabilities is not feasible. Modern WAFs offer adaptive rule sets, bot detection and API protection capabilities that go beyond traditional signature-based filtering. However, a WAF should complement, not replace, secure coding practices and regular vulnerability assessments as part of a defence-in-depth strategy.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Vulnerability Scan", href: "/glossary/vulnerability-scan" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" }, { name: "Zone-Based Security", href: "/glossary/zone-based-security" } ]} />

The Waterfall method is a traditional, sequential software development and project management approach in which each phase must be completed before the next begins. The typical phases include requirements gathering, design, implementation, testing, deployment and maintenance, flowing downwards like a waterfall. Unlike iterative approaches such as Agile or DevSecOps, Waterfall assumes that requirements can be fully defined upfront and that changes during development are minimal and costly.

Whilst the Waterfall method provides clear structure, well-defined milestones and straightforward documentation, it can be inflexible when requirements evolve or when early feedback is needed. In compliance and security contexts, some organisations favour Waterfall for its predictability and thorough documentation, which can simplify audit trails. However, many modern compliance programmes are adopting iterative approaches to integrate security testing and compliance checks throughout the development lifecycle rather than only at the end.

} relatedTerms={[ { name: "Version Control", href: "/glossary/version-control" }, { name: "Threat Modelling", href: "/glossary/threat-modelling" }, { name: "Vulnerability Assessment", href: "/glossary/vulnerability-assessment" } ]} />

Whistleblower protection comprises the legal safeguards and organisational measures designed to protect employees and other individuals who report misconduct, fraud, corruption or violations of law within an organisation. The EU Whistleblower Directive (2019/1937) requires organisations with 50 or more employees to establish secure, confidential reporting channels and prohibits retaliation against reporters. Protection extends to employees, contractors, shareholders, volunteers and others who report breaches in a work-related context.

Implementing effective whistleblower protection is both a legal obligation and a powerful tool for early detection of compliance violations and unethical behaviour. Organisations should establish clear reporting procedures, ensure confidentiality, provide feedback to reporters within defined timeframes, and train staff on their rights and protections. A strong whistleblower programme fosters a culture of transparency and accountability, reducing the risk of issues escalating into major incidents or regulatory sanctions.

} relatedFrameworks={[ { name: "NIS2 - Network and Information Security", href: "/frameworks/nis2" } ]} relatedTerms={[ { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" }, { name: "Third Party Risk Management (TPRM)", href: "/glossary/third-party-risk-management-tprm" }, { name: "User Access Rights", href: "/glossary/user-access-rights" } ]} /> ## Z

A zero-knowledge proof is a cryptographic protocol that allows one party (the prover) to demonstrate to another party (the verifier) that a statement is true without revealing any information beyond the validity of the statement itself. This is achieved through mathematical constructions that enable verification without disclosure of the underlying data. Zero-knowledge proofs come in interactive and non-interactive variants, with applications ranging from authentication to blockchain privacy.

In the context of data protection and compliance, zero-knowledge proofs offer the potential to verify identity, credentials or compliance status without exposing sensitive personal data. This aligns strongly with data minimisation principles under the GDPR. As the technology matures, it is finding practical applications in privacy-preserving authentication, confidential transactions and secure multi-party computation, making it an increasingly relevant tool for organisations balancing security with privacy.

} relatedTerms={[ { name: "Two-Factor Authentication (2FA)", href: "/glossary/two-factor-authentication-2fa" }, { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" }, { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" } ]} />

Zero-Trust Architecture is a security model founded on the principle of "never trust, always verify," where no user, device or network segment is inherently trusted regardless of its location inside or outside the corporate perimeter. Every access request is continuously authenticated, authorised and encrypted based on multiple signals including identity, device health, location and behavioural patterns. This approach replaces the traditional perimeter-based security model that assumed internal network traffic was safe.

Adopting a Zero-Trust Architecture requires organisations to implement micro-segmentation, strong identity verification, least-privilege access controls and continuous monitoring across all systems. Whilst the transition can be complex, it significantly reduces the blast radius of breaches and limits lateral movement by attackers. Zero Trust is increasingly endorsed by regulatory bodies and security frameworks, making it a strategic investment for organisations seeking to strengthen their security posture against modern threats.

} relatedFrameworks={[ { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" }, { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" } ]} relatedTerms={[ { name: "Two-Factor Authentication (2FA)", href: "/glossary/two-factor-authentication-2fa" }, { name: "Zone-Based Security", href: "/glossary/zone-based-security" }, { name: "User Access Rights", href: "/glossary/user-access-rights" }, { name: "WAF (Web Application Firewall)", href: "/glossary/waf-web-application-firewall" } ]} />

Zone-based security is a network architecture approach that divides the network into distinct zones or segments based on trust levels, data sensitivity and functional requirements. Each zone has its own security policies and access controls, with traffic between zones strictly regulated by firewalls, access control lists and other enforcement points. Common zones include the public-facing DMZ, internal corporate networks, sensitive data enclaves and management networks.

Implementing zone-based security limits the potential impact of a breach by containing threats within a single zone and preventing lateral movement across the network. It provides a structured approach to applying the principle of defence in depth, where multiple layers of controls protect the most sensitive assets. Whilst Zero-Trust Architecture is increasingly favoured for modern environments, zone-based security remains a practical and widely deployed strategy, particularly in organisations with legacy infrastructure or strict regulatory requirements for network segregation.

} relatedFrameworks={[ { name: "ISO 27001 - Information Security", href: "/frameworks/iso27001" }, { name: "NIST Cybersecurity Framework", href: "/frameworks/nist-csf" } ]} relatedTerms={[ { name: "Zero-Trust Architecture", href: "/glossary/zero-trust-architecture" }, { name: "WAF (Web Application Firewall)", href: "/glossary/waf-web-application-firewall" }, { name: "Technical and Organisational Measures (TOMs)", href: "/glossary/technical-and-organisational-measures-toms" } ]} /> --- # Blog URL: https://tidalcontrol.com/blog Summaries of published articles. Each entry states the article's conclusion; follow the URL for the full text. ## What's New | July 2026 URL: https://tidalcontrol.com/blog/what-s-new-july-2026 Published: 2026-08-21 Tidal Control's July 2026 release launches the Trust Center, a public page where organisations can transparently display their security and compliance posture with customisable visibility, custom domain support, and branded styling. Seven new integrations are added, covering Cloudflare, STACKIT, Hetzner Cloud, TOPdesk, Anthropic, OpenAI, and Claude Enterprise. Azure automated checks expand by 15 tests to near-complete Microsoft Cloud Security Benchmark coverage. The in-app AI assistant TidalBot now runs on Anthropic's Claude models. ## Performing a risk assessment: methods, models and tools URL: https://tidalcontrol.com/blog/performing-a-risk-assessment-methods-models-tools Published: 2026-07-24 A risk assessment maps what can go wrong, how likely that is, and how serious the consequences would be, then determines how to respond. Risk is calculated as likelihood multiplied by impact, producing a score that guides treatment: mitigate, accept, transfer or avoid. ISO 27001 makes this process explicitly mandatory, while NIS2 and DORA impose comparable requirements. The assessment must be reviewed at least annually and after significant organisational changes, not treated as a one-off document. ## Controls: what are they and how do you use them? URL: https://tidalcontrol.com/blog/controls-what-are-they-how-do-you-use-them Published: 2026-07-24 A control is a concrete action, configuration, procedure or agreement an organisation puts in place to manage a risk or meet a framework requirement. Controls fall into three types (technical, organisational, physical) and three functions (preventive, detective, corrective). Under ISO 27001, you select controls based on a risk assessment and document your choices in a Statement of Applicability. Common failures include controls that exist only on paper, missing ownership and implementing controls without first identifying the underlying risks. ## What's new |June 2026 URL: https://tidalcontrol.com/blog/what-s-new-june-2026 Published: 2026-07-09 The June 2026 Tidal Control release adds five new integrations (Aikido Security, OVHcloud, Neon, and DigitalOcean) alongside significantly expanded Azure tests covering networking, app services, and SQL. The application now fully supports Dutch as well as English, selectable per user in settings. Bulk actions with shift-click selection, read-only API credentials, customisable roles, an Opportunity issue type for ISO 9001 and ISO 27001 clause 6.1 tracking, and live external issue status for Jira and Azure DevOps tasks are also included. ## What is GRC and why do modern businesses need a GRC platform? URL: https://tidalcontrol.com/blog/what-is-grc-why-do-modern-businesses-need-a-grc-platform Published: 2026-07-16 GRC stands for Governance, Risk and Compliance: three domains that most organisations already handle separately but that work better as one connected system. When you manage more than one framework at the same time, or enterprise customers regularly ask for compliance evidence, separate tools create duplication, unclear ownership and last-minute audit stress. A GRC platform links controls, evidence and tasks across frameworks so each control is documented once and compliance status is visible at any time. Complexity is the trigger for a structured GRC approach, not organisational size. ## ISO 9001 certification costs: what does it really cost? URL: https://tidalcontrol.com/blog/iso-9001-certification-costs-what-does-it-really-cost Published: 2026-07-14 For an SME with up to 25 employees, ISO 9001 certification costs between €3,000 and €30,000 in year one, with internal time being the most underestimated component. Over the full three-year cycle, including surveillance audits and recertification, total costs range from €6,000 to €35,000. Limiting scope, building internal audit capacity, and combining with ISO 27001 where needed are the most effective ways to land at the lower end of those ranges. ## What is ISO 9001 and when should you start certification? URL: https://tidalcontrol.com/blog/what-is-iso-9001-when-should-you-start-certification Published: 2026-07-07 ISO 9001 is the international standard for quality management systems, requiring organisations to document and prove their processes consistently deliver what customers expect. Certification is not legally required but is effectively mandatory for public tenders, enterprise supplier lists, and sectors such as construction, manufacturing, and IT services. For an SME with up to 25 employees, first-year costs run between 9,000 and 30,000 euros. ISO 9001:2026 was published on 16 September 2026; the changes are evolutionary and existing 2015 certificates remain valid during a transition period. ## From compliance roadbumps to ISO 27001 with confidence: The story of Fledger.ai URL: https://tidalcontrol.com/blog/from-compliance-roadbumps-to-iso-27001-with-confidence-the-story-of-fledger-ai Published: 2026-07-23 Fledger, the Hague-based legal tech company behind AI assistant LISA, got stuck for more than 6 months in its ISO 27001 project with a well-known American platform: progress bars moved, but the support stayed generic. Through the Breaking Barriers programme run by AIC4NL they switched to Tidal Control with guidance from implementation partner Riskwork, who carried over the existing work instead of starting again. Fledger achieved certification thanks to people and technology coming together and successfully taking them to their goals. ## What's New | May 2026 URL: https://tidalcontrol.com/blog/what-s-new-may-2026 Published: 2026-05-29 The May 2026 Tidal Control release adds eight new integrations, including Azure DevOps, Azure Defender and Vercel. Three new frameworks are now available: BIO2 v1.3 for Dutch government organisations, ABRO 2026 for companies carrying out government contracts involving national security risks, and BSI C5:2026 for cloud security in Germany, which takes effect from June 2027. The release also introduces a DORA Register of Information export in XBRL-CSV format accepted by the EBA and the AFM, plus a new Critical priority level for issues. ## DORA explained: what does the regulation mean for your organisation? URL: https://tidalcontrol.com/blog/dora-explained-what-does-the-regulation-mean-for-your-organisation Published: 2026-06-15 DORA (EU 2022/2554) became fully applicable on 17 January 2025 and requires financial entities and critical ICT service providers in the EU to manage ICT risk across five pillars: ICT risk management, incident reporting, resilience testing, third-party risk management, and information sharing. Around twenty categories of financial entity are in scope, including payment institutions holding AISP or PISP licences under PSD2. No DORA certification exists; compliance is assessed by the competent national supervisor through policies, procedures, test results, and register data. ## NIS2 for SaaS: what do you need to arrange now? URL: https://tidalcontrol.com/blog/nis2-for-saas-what-do-you-need-to-arrange-now Published: 2026-06-11 NIS2 applies directly to SaaS companies above 50 employees or €10 million in revenue, and indirectly to smaller suppliers whose enterprise customers fall in scope. The regulation requires a documented risk management system, a 24-hour incident reporting procedure, supply chain assessments, and a business continuity plan. ISO 27001 is explicitly recognised by NIS2 as a compliance path. Fines reach up to €10 million or 2% of global annual turnover for essential entities. ## Comparing compliance tools: why a false timeline is costly URL: https://tidalcontrol.com/blog/comparing-compliance-tools-why-a-false-timeline-is-costly Published: 2026-06-09 Promises of ISO 27001 or SOC 2 certification in thirty days are a red flag because both standards require a demonstrably working management system, not just documentation. A SOC 2 Type 2 report cannot comply with the standard without an observation period of at least three months, and a small organisation pursuing ISO 27001 needs a minimum of three months working in a focused way. Tidal Control works exclusively with independent, accredited certification bodies and includes implementation support, automated evidence collection, and EU hosting in its platform. ## What's New | April 2026 URL: https://tidalcontrol.com/blog/what-s-new-april-2026 Published: 2026-04-30 The April 2026 Tidal Control release adds an MCP AI integration that lets assistants like Claude, ChatGPT, Codex, and VS Code query and update GRC data directly in your tenant. A Datadog integration automatically runs 11 compliance tests, vendors can now be linked to assets, and dedicated DORA Register of Information fields support Digital Operational Resilience Act reporting for financial institutions. The release also includes a markdown policy editor and risk approval visibility. ## What's New | March 2026 URL: https://tidalcontrol.com/blog/what-s-new-march-2026 Published: 2026-03-27 The March 2026 Tidal release adds automated compliance tests for Google Workspace and Google Cloud Platform, covering areas such as MFA enforcement, IAM policies, and device management. A structured risk approval workflow now tracks the full history of assessments per risk, and existing assessments must be reviewed and approved within the new workflow. The release also introduces asset categories, an interactive evidence viewer, and incident reporting for basic users. ## What's New | February 2026 URL: https://tidalcontrol.com/blog/what-s-new-february-2026 Published: 2026-03-05 Tidal's February 2026 release adds a guided onboarding module that walks users through ISO 27001 compliance step by step, a Web Security Scanner that validates SSL/TLS certificate configuration, and the BSI C5 2020 cloud security framework. The update also brings improvements to the Jira two-way integration, a new Azure Entra Admin Portal access test, automatic saving of policies and required documents, and several bug fixes. ## When customers ask for SOC 2 and what they really mean URL: https://tidalcontrol.com/blog/when-customers-ask-for-soc-2-what-they-really-mean Published: 2026-03-04 When customers ask for a SOC 2 report, they are usually asking for evidence they can share internally to prove due diligence, not for the report itself. ISO 27001 certification or a detailed security questionnaire is often an acceptable substitute. Waiting until a customer asks is the most common mistake: setting up controls that map to both SOC 2 and ISO 27001 from the start means a report can be reached in three to six months once the request arrives, rather than nine to fifteen months from scratch. ## Why manual SOC 2 slows your team down and what it costs URL: https://tidalcontrol.com/blog/why-manual-soc-2-slows-your-team-down-what-it-costs Published: 2026-03-03 An estimated twenty to thirty percent of first SOC 2 audits fail, and manual programmes are the common factor. Three predictable failure points explain why: evidence collection does not scale, compliance knowledge concentrates in one or two people, and last-minute corrections produce lower-quality results. A manual SOC 2 Type II programme typically requires 500 or more internal hours and 35,000 to 80,000 euros in internal costs before external audit fees. Automation reduces internal hours by 40 to 60 percent and builds evidence continuously across the observation period. ## SOC 2 for startups: becoming compliant without losing speed URL: https://tidalcontrol.com/blog/soc-2-for-startups-becoming-compliant-without-losing-speed Published: 2026-03-02 SOC 2 does not require a Change Advisory Board or approval committees. The standard asks that changes are reviewed and tested before they go live, which means a pull request with mandatory peer review and automated testing already qualifies as a valid change management process. Founders who experience SOC 2 as a brake almost always caused it themselves by copying enterprise processes that do not fit their scale. Integrating controls into existing development workflows, rather than running compliance as a parallel project, is what preserves deployment speed. ## NIS2 checklist: what you need to have in order to be compliant URL: https://tidalcontrol.com/blog/nis2-checklist-what-you-need-to-have-in-order-to-be-compliant Published: 2026-03-01 The Dutch Cybersecurity Act, implementing NIS2, has applied since 15 August 2026, and supervision is active. Essential entities face fines of up to ten million euros or two percent of global turnover, and directors are personally liable. Compliance requires action across six areas: governance and management accountability, risk management, technical controls, incident detection and reporting, supply chain security, and continuous evaluation. Organisations that wait until the law is in force risk missing a thorough implementation, which takes six to twelve months. ## Is your startup too small for ISO 27001? Three triggers to start now URL: https://tidalcontrol.com/blog/is-your-startup-too-small-for-iso-27001-three-triggers-to-start-now Published: 2026-02-28 ISO 27001 has no minimum size requirement, but timing matters: a traditional project takes six to twelve months, so waiting until a customer demands it often means losing the deal. Three triggers justify starting now: a customer has listed it in a questionnaire or RFP, you have enterprise or international ambitions within 12 months, or you process sensitive data in a regulated sector. Waiting makes sense if you lack product-market fit, process little sensitive data in a market that does not ask for it, or your team is fewer than four people with no spare capacity. ## Individual security measures are not yet NIS2 compliance URL: https://tidalcontrol.com/blog/individual-security-measures-are-not-yet-nis2-compliance Published: 2026-02-27 Implementing individual security measures like two-factor authentication or an incident response plan does not add up to NIS2 compliance. Without a risk-driven foundation, assigned ownership, and continuous visibility, organisations end up with a checkbox mentality that leaves real gaps undetected. The shift to structural compliance requires linking every measure to a concrete risk, giving each measure a responsible owner, and replacing annual snapshots with ongoing monitoring. An honest inventory of what you already have is the right starting point, not adding more measures. ## How to choose the right ISO 27001 software for your company URL: https://tidalcontrol.com/blog/how-to-choose-the-right-iso-27001-software-for-your-company Published: 2026-02-26 ISO 27001 software centralises policy documents, risk analyses, controls and evidence into one platform, replacing scattered spreadsheets and manual processes. It becomes necessary once team growth, IT complexity or customer demands make manual management impractical. The right platform supports continuous compliance, integrates with existing tools, handles multiple frameworks without duplicate work and keeps audit evidence current so certification does not collapse into an annual panic. ## Cybersecurity for startups: where to begin without making it complex URL: https://tidalcontrol.com/blog/cybersecurity-for-startups-where-to-begin-without-making-it-complex Published: 2026-02-25 Cybersecurity becomes relevant for startups before regulation forces it, because customers, investors and partners ask about it early. Most complexity comes not from the standards themselves but from a lack of internal overview, priorities and clear responsibilities. Five basic measures, including two-factor authentication, a password manager and least-privilege access, reduce risk immediately and with little effort. From there, a framework like ISO 27001 and automation through a platform like Tidal Control can turn loose measures into a coherent, auditable system. ## What is NIS2 and when does the directive apply to you URL: https://tidalcontrol.com/blog/what-is-nis2-when-does-the-directive-apply-to-you Published: 2026-02-24 NIS2 is a European cybersecurity directive that applies to medium-sized and large organisations active in one of eighteen designated sectors. It requires those organisations to implement ten categories of security measures under Article 21, place board-level responsibility for cybersecurity, and report significant incidents within 24 hours. Small and micro businesses are generally outside scope, but may face NIS2 requirements indirectly as suppliers. In the Netherlands the national Cybersecurity Act has applied since 15 August 2026, adding registration in the entity register to those duties. ## ISO 27001 vs ISO 27002: what's the difference and what do you need URL: https://tidalcontrol.com/blog/iso-27001-vs-iso-27002-what-s-the-difference-what-do-you-need Published: 2026-02-23 ISO 27001 is the certifiable standard containing the requirements for an information security management system, and it is the one in the ISO 27000 family an organisation certifies its ISMS against. ISO 27002 is a non-certifiable guideline that provides detailed implementation guidance for the same 93 controls listed in Annex A of ISO 27001. An auditor assesses your ISMS against ISO 27001, not against ISO 27002. Using ISO 27002 is a choice, not an obligation. ## ISO 27001 costs: What does certification really cost your organisation? URL: https://tidalcontrol.com/blog/iso-27001-costs-what-does-certification-really-cost-your-organisation Published: 2026-02-22 ISO 27001 certification costs fall into three categories: internal time investment, the external audit, and ongoing maintenance. For most organisations the internal time investment is the largest item, not the audit fee. A small organisation with 10 to 25 employees can expect a total year-one investment of 8,000 to 20,000 euros. Scope, maturity and complexity drive costs more than headcount does. ## NIS2 for suppliers to NIS2-obligated organizations: what do you need to arrange now? URL: https://tidalcontrol.com/blog/nis2-for-suppliers-to-nis2-obligated-organizations-what-do-you-need-to-arrange-now Published: 2026-02-21 NIS2-obligated organizations must contractually manage their supplier risk under Article 21, so suppliers who are too small to fall under NIS2 themselves still receive the requirements through questionnaires, contract clauses, and requests for evidence. The four measures clients ask about most are multi-factor authentication, timely updates, tested backups, and least-privilege access rights. Demonstrability is what counts, and three common routes exist: NIS2 Supply Chain (SC10, SC20, or SC30), CyberFundamentals, or ISO 27001, with the right choice depending on your role and the market your clients operate in. ## The fastest way to get ISO 27001 certified as a startup URL: https://tidalcontrol.com/blog/the-fastest-way-to-get-iso-27001-certified-as-a-startup Published: 2026-02-20 Startups facing ISO 27001 certification deadlines are often drawn to four-week promises or cheap auditors, but certificates from non-accredited bodies are increasingly rejected by enterprise procurement teams. A responsible timeline is around three months, achieved by combining a platform that automates evidence collection, personal security officer guidance, and an RvA-accredited auditor. Tidal Control used this approach to help Aivory achieve both ISO 27001 and NEN 7510 certification simultaneously within three months. ## What's New | January 2026 URL: https://tidalcontrol.com/blog/what-s-new-january-2026 Published: 2026-02-09 The January 2026 Tidal Control release adds 6 new ISO frameworks covering healthcare, cloud security, cloud privacy, and occupational health and safety, along with 61 new AWS EC2 security tests aligned with AWS Security Hub controls. The update also introduces a risk heatmap, bulk risk appetite updates, custom personnel roles, and KPI tiles across the Risk, Vendor, Asset, Policies, Documents, and Personnel overview pages. Navigation has been streamlined by removing the top bar and consolidating menu items under a revised profile menu. ## From trust to demonstrability: How CBYTE uses digital compliance as foundation for scalable growth URL: https://tidalcontrol.com/blog/from-trust-to-demonstrability-how-cbyte-uses-digital-compliance-as-foundation-for-scalable-growth Published: 2026-01-19 CBYTE, a custom software company, found that client trust alone was no longer sufficient as larger organisations and healthcare clients began requiring objective compliance assurance. Rather than pursuing certification as a one-time project, CBYTE used Tidal Control to embed information security structurally into daily operations. Automated controls, such as testing dozens of disks for encryption with a single action, keep compliance scalable as each new client brings new security risks. With NIS2 approaching, CBYTE can demonstrate that information security is already firmly anchored in the organisation. ## What's New | December 2025 URL: https://tidalcontrol.com/blog/what-s-new-december-2025 Published: 2025-12-24 Tidal's December 2025 release adds 47 new AWS security tests covering IAM, KMS, Secrets Manager, and CloudWatch, following AWS Security Hub controls. Users can now link existing Jira tickets directly to Tidal Tasks and Issues to avoid duplicate work. A new Required Documents feature supports versioning and lifecycle management for recurring compliance evidence such as DPIA forms and ISO 27001 management review minutes. The release also includes Controls page performance improvements and fixes for GitHub, Azure app integration redirects, and Azure tests. ## From standstill to sales: How Dembrane turned compliance into their competitive advantage URL: https://tidalcontrol.com/blog/from-standstill-to-sales-how-dembrane-turned-compliance-into-their-competitive-advantage Published: 2025-11-28 Dembrane was losing sales because prospects required ISO 27001 certification and the company had none. Working with Tidal Control, they achieved certification and reduced new employee onboarding from two weeks to 45 minutes. Bram Delisse, CEO, estimates a repeat of the process would now take 70% less effort. The certification removed the sales blocker and revenue started moving again. ## What's New | November 2025 URL: https://tidalcontrol.com/blog/what-s-new-november-2025 Published: 2025-11-15 Tidal Control's November 2025 update introduces the Personnel module, which lets teams assign and track policy acknowledgements by employee group with automatic onboarding tasks. A full two-way Jira sync now links Tidal Tasks and Issues directly to Jira. 58 new AWS security tests covering ECS, RDS, and S3 services have been added, aligned with AWS Security Hub controls. Editor improvements include bookmarks, anchor links, and cross-document references to Tidal objects. ## What's New | October 2025 URL: https://tidalcontrol.com/blog/what-s-new-october-2025 Published: 2025-10-15 The October 2025 Tidal Control update adds ISO 22301 and ISO 26000 to the framework library and redesigns the Frameworks overview page for clearer compliance progress tracking. Vendor management now supports multiple documents per vendor and risk rating comments. Sorting has been added to the Controls, Assets, and Risks pages, and Strict Mode now applies to the Evidence page to restrict document visibility to permitted users. ## ISO 27001 reference guide: complete overview of requirements and implementation URL: https://tidalcontrol.com/blog/iso-27001-reference-guide-complete-overview-of-requirements-implementation Published: 2025-09-30 ISO 27001 requires organisations to meet clauses 4-10 covering context, leadership, planning, support, operation, evaluation, and improvement, plus implement between 60 and 93 controls from Annex A. Certification involves a two-phase audit: a one-day document review in Phase 1 and a two-day implementation assessment in Phase 2. Common failures include procedures that do not match reality and employees unaware of their responsibilities. The resulting certificate is valid for three years, with annual surveillance audits of approximately one day each. ## What's New | September 2025 URL: https://tidalcontrol.com/blog/what-s-new-september-2025 Published: 2025-09-15 Tidal's September 2025 update adds an in-browser Evidence Viewer for documents, images, and test evidence without requiring downloads, and a redesigned Getting Started page to help new users set up Tidal faster. The Risk Management module has a cleaner interface, detail panels can now expand to full screen, and Strict Mode gains more granular field options across plans, assets, controls, vendors, issues, risks, and execution details. The help center now contains over 60 articles covering every page in Tidal Control. ## The 7 Biggest ISO 27001 pitfalls (and how to avoid them) URL: https://tidalcontrol.com/blog/the-7-biggest-iso-27001-pitfalls-how-to-avoid-them Published: 2025-08-30 ISO 27001 certification fails most often because of seven recurring mistakes: treating the standard as a technical IT test rather than a management system, copying controls without a risk assessment, defining scope too broadly, writing documentation nobody uses or reads, treating compliance as an annual ritual rather than a continuous process, and making one person a single point of failure. Avoiding these pitfalls requires active management involvement, a scope limited to business-critical systems, short practical procedures, and shared ownership of responsibilities across the organisation. ## What's New | August 2025 URL: https://tidalcontrol.com/blog/what-s-new-august-2025 Published: 2025-08-15 Tidal Control's August 2025 update adds task grouping options in Plans, two new frameworks (ISO 14001 and ISO 42001), Jira Cloud and Atlassian Admin integrations with 10 corresponding tests, and passkey authentication via WebAuthn, biometrics, and security keys. Additional fixes include archived controls now receiving an Undetermined status instead of compliant, and support for mixed-case organisation names. ## What's New | Q2 2025 URL: https://tidalcontrol.com/blog/what-s-new-q2-2025 Published: 2025-07-29 Tidal's Q2 2025 release adds a Vendor Management module for tracking third-party compliance and risk assessments, including a library of preset vendors with pre-filled descriptions. The Controls overview page is out of beta, with inline editing and a new chip component for managing object connections. Six new GitHub security tests, redesigned Tasks and Issues interfaces, test history tracking, and automated policy version control are also included. ## Managing risk in a fast-growing fintech: how Floryn made compliance scalable URL: https://tidalcontrol.com/blog/managing-risk-in-a-fast-growing-fintech-how-floryn-made-compliance-scalable Published: 2025-06-25 Floryn, a fintech lender under De Nederlandsche Bank supervision, moved its compliance and risk processes from fragmented spreadsheets to Tidal Control after finding that recording risks and policies was not enough without systematically executing and demonstrating controls. Starting from around 120 risks built with KPMG, Floryn spread its workload across the year, linked controls directly to legislation such as the EBA guidelines, and embedded risk ownership across the whole organisation. Compliance awareness and consistent execution of internal processes have increased significantly as a result. ## Planning your ISO 27001 journey: from start to certificate URL: https://tidalcontrol.com/blog/planning-your-iso-27001-journey-from-start-to-certificate Published: 2025-06-01 Most ISO 27001 projects stall not from lack of knowledge or budget but from lack of planning: absent milestones, unclear time commitments, and no dedicated owner. A realistic journey runs five phases over twelve to eighteen weeks. Small organisations of ten to fifty people can reach certification in twelve to fourteen weeks; medium-sized organisations of fifty to two hundred fifty people should plan for sixteen to twenty-two weeks. A dedicated project leader available six to eight hours per week and management that makes decisions promptly are the two factors most likely to keep the project on schedule. ## What's New | Q1 2025 URL: https://tidalcontrol.com/blog/what-s-new-q1-2025 Published: 2025-05-06 Tidal's Q1 2025 release adds a beta Controls overview page that combines controls and tasks in one screen, a redesigned test page with over 40 new tests that reduce manual tasks by an average of 30-35%, and a personal dashboard called My Overview. New frameworks include DORA (NOREA version), NIS2 Cyber Fundamentals, NIS2 Quality Mark, and ABDO. Tidal AI can now assist with business impact analysis directly in the platform, recommending a CIA classification based on your input. ## ISO 27001 Scoping: How to define smart boundaries for faster results URL: https://tidalcontrol.com/blog/iso-27001-scoping-how-to-define-smart-boundaries-for-faster-results Published: 2025-04-16 Defining a tight ISO 27001 scope around your most critical information assets and only the Annex A controls that genuinely apply can cut implementation time from 6-9 months to around 3 months. Excluding departments, locations, and controls that do not touch critical data is legitimate after a risk assessment, provided the rationale is documented. A focused scope also reduces ongoing maintenance effort and produces cleaner audits. Revisit the scope whenever significant organisational or technology changes occur, and at least annually during management review. ## ISO 42001: What does this AI standard mean for your organisation? URL: https://tidalcontrol.com/blog/iso-42001-what-does-this-ai-standard-mean-for-your-organisation Published: 2025-03-18 ISO 42001 is the first international standard specifically for AI governance, built around an AI Management System with 38 normative controls covering policy, data governance, impact assessment and the full AI lifecycle. The post concludes that startups benefit from early implementation for three reasons: staying ahead of accelerating regulation such as the EU AI Act, meeting responsible AI criteria that enterprise clients use in vendor selection, and preventing costly problems from bias or unexpected AI behaviour before they materialise. ## From convoluted Excels to compliance confidence in 3 months URL: https://tidalcontrol.com/blog/from-convoluted-excels-to-compliance-confidence-in-3-months Published: 2025-03-12 Odido moved its Telecommunications Law compliance testing off Excel sheets and SharePoint into Tidal Control, and resolved in three months what had been a year-and-a-half struggle. Thousands of control tests across multiple applications now run in one platform, with a clear audit trail that makes every test traceable and reportable. Odido showed the tool directly to its regulator as evidence of how it works. The same visibility problem hits a startup running 10 controls in a spreadsheet. ## Improving IoT security with ISO 27001 URL: https://tidalcontrol.com/blog/improving-iot-security-with-iso-27001 Published: 2025-03-07 IoT devices introduce security risks that traditional measures like firewalls and antivirus software cannot fully address, because the devices have limited computing power, run on proprietary systems, and are deployed for years without patches. ISO 27001 provides a systematic framework that maps these risks and integrates controls across the complete device lifecycle. Beyond security, certification shortens enterprise sales cycles, satisfies investor due diligence, and is increasingly a hard procurement requirement from large organisations. Companies that certify early gain a competitive advantage while competitors are still catching up. ## ISO 27001 practical tips: Direct steps for a secure organisation URL: https://tidalcontrol.com/blog/iso-27001-practical-tips-direct-steps-for-a-secure-organisation Published: 2025-02-28 Most ISO 27001 implementations stall because responsibilities are fragmented, policies go unread, and evidence is never tracked systematically. This post works through a practical sequence: identify the information assets that matter most, map threats and weaknesses against them, assign a single named owner per ISMS component, and build a regular rhythm to keep controls active. Short policies, automated reminders, and structured evidence collection prevent last-minute audit panic. Limiting admin accounts and enabling multi-factor authentication is recommended as the first concrete control to implement. ## A race against time: How Nedscaper achieved ISO 27001 and ISO 9001 in 12 weeks URL: https://tidalcontrol.com/blog/a-race-against-time-how-nedscaper-achieved-iso-27001-iso-9001-in-12-weeks Published: 2025-02-25 Nedscaper had to rebuild a lapsed ISO 27001 implementation from scratch while simultaneously preparing for ISO 9001, with only 12 weeks available and a summer holiday period in between. Using Tidal alongside consulting partner Fendix, they achieved both certifications within that window. The audit was rigorous, requiring all physical controls to be included in the ISO 27001 scope. Nedscaper also replaced a single-person compliance dependency with a decentralised management system they describe as a foundation for future certifications. ## Introducing our partnership with Fendix URL: https://tidalcontrol.com/blog/introducing-our-partnership-with-fendix Published: 2025-02-20 Tidal Control has partnered with Fendix to combine automated compliance management with hands-on consultancy for scaling businesses. The platform handles control tracking, reporting, and deadline monitoring, while Fendix consultants provide strategic guidance and implementation support. Together, the partnership aims to help companies achieve ISO 27001, SOC 2, or GDPR certification within three to six months, compared to a year or longer for traditional approaches. ## What is ISO 27001? The standard, the controls and certification URL: https://tidalcontrol.com/blog/iso-27001-what-is-it-when-to-start Published: 2025-02-10 ISO 27001 is the international standard for information security, built around a management system (ISMS) that protects confidentiality, integrity and availability. The requirements sit in clauses 4 to 10, and Annex A adds 93 controls across four themes, each of which you justify as applicable or excluded in a Statement of Applicability. An accredited certification body audits in two stages, documentation first and practice second, and the certificate is valid for three years with annual surveillance audits. ## What's new | Q4 2024 URL: https://tidalcontrol.com/blog/what-s-new-q4-2024 Published: 2025-01-29 Tidal Control's Q4 2024 release introduces TidalAI, an AI assistant trained to think as a risk manager that learns from company information in the portal to help assess IT risks. Automated testing for Azure and AWS has been expanded, including new AWS password policy and MFA validation tests. The Controls sidebar has been enhanced to surface tasks and tests more easily, and the policy center now supports a new editor and linking to externally hosted policies while retaining automated review reminders and approvals. ## Challenges for European startups: How it actually works URL: https://tidalcontrol.com/blog/challenges-for-european-startups-how-it-actually-works Published: 2024-12-12 European startups face real disadvantages compared to US counterparts: smaller funding rounds, a fragmented 27-country market, and mandatory compliance obligations like ISO 27001 and GDPR from day one. Yet those same pressures build resilience, deepen client relationships, and produce software with compliance baked into the architecture rather than bolted on later. AI narrows the capital gap by multiplying small-team productivity. Starting ISO 27001 certification early, while the team is still small, takes roughly three months and avoids the technical debt that makes later remediation far more expensive. ## What's new | Q3 2024 URL: https://tidalcontrol.com/blog/what-s-new-q3-2024 Published: 2024-10-22 Tidal Control's Q3 2024 release introduces the Policy Center for creating, editing, approving and exporting policies directly in Tidal with automated review tracking. Automated testing (beta) shifts compliance work from collecting evidence to scoring it, giving real-time insights into how changes affect controls. Two new frameworks were added: ISO 9001 for quality management, and NEN 7510, which extends ISO 27001 with 33 healthcare-specific requirements mandatory for organizations processing healthcare data of Dutch citizens. ## Tidal Control goes to battle with the control towers URL: https://tidalcontrol.com/blog/tidal-control-goes-to-battle-with-the-control-towers Published: 2024-10-07 TidalControl is a Dutch startup building automated compliance controls into business processes rather than treating them as a separate activity, aiming to create what it calls an open assurance market with modular, reusable controls. The company uses system data to demonstrate that required activities have taken place, reducing reliance on people reporting on controls. Reviewer Nart Wielaard rates TidalControl 3.5 out of 5 on Elliott's Scale, citing a strong vision but a small customer base and limited market traction so far. ## What's new | Q2 2024 URL: https://tidalcontrol.com/blog/what-s-new-q2-2024 Published: 2024-07-19 Tidal Control shipped six major features in Q2 2024: a Frameworks page with KPIs, a new help portal, Business Impact Analysis directly in the platform, Excel export and Cloud PowerBI support, navigation improvements, and expanded user-configurable automations for Microsoft Azure, Atlassian Jira, and Amazon Web Services. Four new frameworks were also added, including NIST CSF 2.0 and ISO 9001:2015, all mapped to the Tidal Control library under a test-once-use-many approach. ## What's new | Q4 2023 URL: https://tidalcontrol.com/blog/what-s-new-q4-2023 Published: 2024-02-19 Tidal Control's February 2024 release introduces issue management, a Microsoft Power BI integration, and a policy management module in Alpha featuring a library of 32 policy documents tailored to Startups and Scaleups. The release also adds strict mode for separating Contributor and Owner access rights, new configurable activity types, enhanced framework references including GDPR improvements, and new Microsoft Azure automations. ## Tidal Control raises €500.000 in pre-seed funding URL: https://tidalcontrol.com/blog/tidal-control-raises-500-000-in-pre-seed-funding Published: 2024-01-21 Tidal Control has raised €500,000 in pre-seed funding to develop and scale its compliance automation platform, which guides startups and scaleups through achieving and maintaining certifications such as ISO 27001 and SOC 2. The round is led by the Brabantse Ontwikkelings Maatschappij and Rabobank, with additional participation from Starterslift and the Bossche Investerings Maatschappij. The platform automates continuous monitoring of information security controls, and its use is stated to be guaranteed to lead to certification. ## What's new | Q3 2023 URL: https://tidalcontrol.com/blog/what-s-new-q3-2023 Published: 2023-11-15 Tidal Control's Q3 2023 update reorganises activity and control tracking across a reworked dashboard, controls page, and new Activities page. Controls can now be mapped to eight industry frameworks including ISO 27001:2022, SOC 2, GDPR, and NIST CSF, each with detailed requirements and test instructions. Risk management gains a new rating tab for assessing inherent risk, choosing a risk treatment, and determining residual risk. Issue management launches in alpha, allowing issues to be created manually and tracked via the Activities page. ## What's new | Q2 2023 URL: https://tidalcontrol.com/blog/what-s-new-q2-2023 Published: 2023-08-23 Tidal Control's Q2 2023 release includes a beta Automation Library V2 with integrations for Microsoft Azure, AWS, Google Cloud, Google Workspace, Github and Kandji. Plans now support creation by Asset and show a progress bar. Other additions are activity Review workflows, a daily digest e-mail replacing assignment notifications, dashboard filters by control, asset and assignee, and a User Admin page for managing users, passwords and Multi-factor Authentication. ## Do You Really Need to Certify Everything? The Scoping Guide for SOC 2 and ISO 27001 URL: https://tidalcontrol.com/blog/do-you-really-need-to-certify-everything-the-scoping-guide-for-soc-2-iso-27001 Published: 2023-05-09 Neither SOC 2 nor ISO 27001 requires you to certify your entire business. SOC 2 scoping starts from your client service commitments and works outward to the systems that fulfil them, while ISO 27001 starts from the information assets that carry real business risk. A well-justified, limited scope is accepted by auditors and can cut implementation time roughly in half. The main pitfalls are scoping too broadly out of fear, forgetting critical components like CI/CD pipelines, and failing to document why systems were excluded. ## What's new | Q1 2023 URL: https://tidalcontrol.com/blog/what-s-new-q1-2023 Published: 2023-04-20 Tidal Control's Q1 2023 update introduces three changes. The Automation Library V1 lets users select out-of-the-box automations through the Tidal UI, with automations running automatically upon activity creation. User roles — Viewer, Administrator, and Super User — have been added to control access levels within Tidal Control. The Activity screen has also been redesigned with tabs to separate Linked Executions, Feed, and Conversation without reducing visible information. ## Cyber security: when and where to start? URL: https://tidalcontrol.com/blog/cyber-security-when-where-to-start Published: 2023-03-24 SMEs typically move through three cyber security stages: informal measures, a formal information security management system (ISMS), and continuous monitoring integrated into daily operations. Cyber insurance and ISO 27001 certification both become more accessible once a solid ISMS is in place, and ISO 27001 does not require a flawless system to certify. Implementing an ISMS early tends to unlock better insurance terms and build trust with customers and other stakeholders. Platforms like Tidal Control can reduce the time and resources needed to reach certification. ## What's new - Kickstart edition URL: https://tidalcontrol.com/blog/what-s-new---kickstart-edition Published: 2023-02-08 Tidal Control has released a double edition of its Quarterly Product Update series covering the past six months. New additions include a Risk Management module with pre-loaded risk registers, a Command Line Interface and SDK for custom data integrations, enhanced dashboard filters and control effectiveness tracking, secure file upload and storage for evidence, and a Feed tab that logs all changes to every entity for audit trail purposes. ## Welcome to the world of Open Assurance URL: https://tidalcontrol.com/blog/welcome-to-the-world-of-open-assurance Published: 2022-12-19 Open Assurance is an approach where audits are broken into modular sub-area reports that can be digitally combined into a complete picture, with different auditors contributing specialist work that others can reuse. The post argues this is technically feasible, supported by EU legislation such as the Data Governance Act, and already has a market among data-heavy businesses seeking cheaper, automated assurance. Reuse of audit work across organisations would also reduce duplication at a time when the accountancy profession faces a serious talent shortage. ## The 5 First Principles of compliance automation URL: https://tidalcontrol.com/blog/the-5-first-principles-of-compliance-automation Published: 2022-11-30 Tidal Control's five first principles of compliance automation start from the view that compliance is a broken process where manual evidence collection wastes time and blocks growth. The status quo, not competing platforms, is the biggest obstacle to change. Incremental fixes like better spreadsheets do not solve the core problem, so the goal is 10x improvement by pulling evidence directly from systems rather than from people. Automation handles repetitive tasks while human judgement remains essential for risk decisions and context.