¶ What is offered to the organisations below
An organisation can offer its settings and its records to the organisations below it. This is what Diri calls inheritance. It lets a group define a risk matrix, a threat library or a common IT system once, at the top, and use it everywhere below. For the overall picture, see How access works.
Two rules apply to everything that is offered below:
- Offered below means visible in every organisation under the one that owns it, at every level, not only the one directly below.
- Let them change it decides whether the organisations below may edit it. Without it, they see it read-only, and it is edited only in the organisation that owns it.
Offering below never restricts the organisation that owns the settings or the record.
¶ Settings and type definitions
The organisation's settings (risk matrix, asset classification, risk acceptance threshold, currency, revision and review times) and its type definitions (event types, consequence, threat and vulnerability categories, tags) can be offered to the organisations below as a whole.
- Go to Users & Access > Organisation, click the settings icon on the organisation and open the Access and sharing tab.
- Under What is offered to the organisations below > Settings and type definitions:
- Offer this organisation's settings below – the organisations below receive this organisation's settings and type definitions.
- Let them change the settings – off means the organisations below see them read-only.
- Click Confirm.
Good to know before you switch it on:
- It applies to the module you are working in. Settings are kept per module, so offering them in Cyber security does not offer the Privacy or Operational risk settings. Switch module and repeat for each module that should be shared.
- It offers every type definition the organisation owns in that module, read-only, replacing any choice made on the individual items. Frameworks and the assessment templates you have chosen to offer are also passed down only when the settings are offered.
- A change made below is a change for everyone. When the organisations below may change the settings and an administrator there changes one, the change is saved on the organisation the settings come from, and applies to every organisation that receives them.
- Data still aggregates across different matrices: a 3x3 risk matrix in a sub-organisation aggregates into a 4x4 risk matrix higher up.
¶ Two common set-ups
| You want… | Offer this organisation's settings below | Let them change the settings |
|---|---|---|
| One set of settings for the whole group, managed centrally | On | Off |
| Shared settings that administrators below may also maintain | On | On (remember: their changes apply to everyone) |
| Each organisation keeps its own settings | Off | – |
¶ Records
Individual records can be offered below one by one. This works for treatments, IT systems, vendors, business processes, assets, threats, vulnerabilities, data processing activities and assessment templates, and for items in the settings such as tags and asset types.
On the record's form, use the two switches Allow child organizations to inherit this … and Allow child organizations to modify this …. A record offered below shows up in the lists of the organisations below, marked with the organisation that owns it.
To see the status in a list, click Configure on the table and add the Use Inherited and Can Modify columns.
¶ What new records start with
You can decide what records created in an organisation start with, per register. On the Access and sharing tab, under New records: offered below by default, set Offer below and Let them change it for treatments, IT systems, vendors, business processes, assets, threats, vulnerabilities and data processing activities. The Effect now line says how many registers are offered below by default.
This is only the starting point: each record can still be changed on its own form, and changing the default does not change existing records.
¶ Offering below or sharing?
Offering below makes a record available to everyone in the organisations below, as their roles allow. Sharing gives named users access to one record, wherever they are. Use offering below for common registers and libraries; use sharing to bring a specific person into a specific piece of work. See also Shared assets, threats and vulnerabilities.