Configuring IT Risk Management Template Rules

You can use template rules to automatically trigger a specific action based on configurable criteria. Rules can be added, copied, and edited as needed to a draft template in order to meet the specific needs of your organization. For help editing the risk scoring options available when creating a rule, see Setting Up Risk Scoring.

To add a template rule

  1. On the IT & Security Risk Management menu, select Templates.

    The Templates screen appears.

  2. Click the View button on the template type you would like to configure.
  3. Hover over the card of the draft template you want to add a rule to until the Edit Draft button appears.
  4. Click the Edit Draft button.
    The Template Details screen appears.
    Note:

    The Template Builder also appears when you create a new template.

  5. Select the Rules tab.
  6. Click the Add Rule button.
  7. Complete the Condition section fields. For more information, see Condition Section Screen Reference.
  8. Complete the Action section fields based on the type of action you would like to trigger. For more information, see Template Rule Action Section Screen Reference.
  9. Click the Save button.

Condition Section Screen Reference

The template rule conditions are a required configuration used to initiate certain actions if any or all of the conditions are met. You can create individual conditions or combine conditions using the Add Condition Block button to create complex automation logic.

When combining multiple conditions, you can choose whether any of the conditions can be met to initiate the rule action or if all conditions must be met to initiate the action. This section explains how to configure single or multiple conditions to initiate template rule actions.



Section

Field

Description

General

Rule Name

Enter a name for the template rule.

Conditions

Any

If you select Any, the template rule will be initiated if any one of the conditions are met.

All

If you select All, the template rule will only be initiated if all of the conditions are met.

Condition Block

Conditions

Select the condition(s) that must be met before initiating the template rule action.

Note:

Not every trigger is available for each template action type.

The following condition are available to configure:

Question - This condition will trigger the rule when the respondent selects a specific value in response to the selected question.

Organization - This condition will trigger the rule when the assessment is launched under a specific organizational group.

Risk Score - This condition will trigger the rule when the assessment risk score is greater than or less than the specified value.

Response Count - This condition will trigger the rule when the response count is greater than or less than the specified value.

No Risks - This condition will trigger the rule when no risks are flagged on the assessment.

Assessment Score - This condition will trigger the rule when the assessment score is greater than or less than the specified value.

Question

Select the question within the template that will trigger the rule.

Note:

This option only appears if the Question condition is selected.

Operator

Select the relationship that must be met between the field and value. The following operators are available condition type:

Numerical Single Select:

  • Contains Any

  • Contains All

  • Does Not Contain

Numerical Text:

  • Equal To

  • Greater Than

  • Greater Than Or Equal To

  • Less Than

  • Less Than Or Equal To

Value

Select the value that applies to your condition(s).

Response - Select the question response that is required to trigger the rule.

Note:

This option only appears if the Question condition is selected.

Organization - Select the organization that must be selected in order to trigger the rule.

Note:

This option only appears if the Organization condition is selected.

Risk Score: - Enter the risk score required in order to trigger the rule.

Note:

This option only appears if the Risk Score condition is selected.

Enter Response Count - Enter the number of responses required to a specific question in order to trigger the rule.

Note:

This option only appears if the Response Count condition is selected.

Assessment Profile Score - Enter the profile score of the profile associated with the assessment that is required to trigger the rule. The score is calculated based on responses to questions

Note:

This option only appears if the Assessment Score condition is selected.

Add Condition Block

N/A

Click the Add Condition Block button to add more conditions to the template rule.

Template Rule Action Section Screen Reference

Rule actions determine what happens when the conditions you define are met. Each action gives you control over how triggered conditions are handled, so you can standardize outcomes, reduce manual updates, and make sure the correct next step is applied consistently.

Add Approvers Upon Creation



Field
Description
Approver

Select the individuals that will be added as approvers once the template is created.

Add Approvers Upon Stage Change



Field
Description
Workflows

Select the workflow in which the approvers should be added once the workflow and stage selected is reached.

Stage

Select the stage in which the approvers should be added once the stage and workflow selected is reached.

Approvers

Select the approvers that will be added to the stage once the stage and workflow selected is reached.

Add Approvers Upon Submission



Field
Description
Approver

Select the individual responsible for approving the assessment.

Auto-Complete Assessment Upon Submission



Field
Description
Result

Select Approved or Rejected.

Result Comments

Enter comments for the result.

Create Issue

Currently, issues can only be created on ITRM and Control template rules with Question, Response Count, or Risk Score conditions configured. If the conditions are met, the issue will be created upon submission of the assessment. The issue will appear in the Issue Register immediately to help you manage the record, and will be automatically related to the assessment with the Is Created From issue type. In order to edit details of an issue after it has been created via template rules, you must edit the metadata on the Issue Details screen.

The issue record will have primary record and inventory inheritance. For example, if an issue is flagged on Vendor A Attribute, when the issue is created, it will be related to the Vendor A Attribute and the assessment in which it was created.



Note:

When reviewing an assessment, users can select View Issues on the Context menu to view all issues that have been created on the assessment via template rules.

Field
Description
Name of Issue

Enter the name of the issue record.

Note:

Duplicatate issue names are supported.

Approvers

Select the individual(s) required to approve ths issue.

Deadline

Enter the deadline by which the issue should be addressed after it is created.

Description

Enter a brief description that describes the issue.

Owners

Select the user responsible for managing the issue.

Priority

Select the priority level of the issue.

Show More Details

Click the arrow next to Show More Details to view custom attributes that can be configured when creating a new issue. Any required attributes will appear above this field.

Create risk

Template rules can be configured to flag risks based on assessment responses and assessment scores. If the conditions are met, a risk will be created upon submission of the assessment. The risk record will immediately appear in the Risk Register to help manage the record.

Note:

Risks flagged on an assessment are only tied to the inventory if the assessment is approved.



Field
Description
Select a Risk From the Library/Create New Risk

Select an existing risk from the library or create a new risk.

Risk Template

This is the name of the risk template used for the risk.

Note:

This field only appears if you select a risk from the library.

Risk Category

Enter or select the categories into which the risk falls.

Inherent Risk Level

Select the level of risk you want created.

Target Risk Level

Select the target risk level you want to reach.

Risk Name

Enter a name for the risk.

Threat

Select the type of threat(s) the risk poses.

Vulnerability

Select the vulnerability of the company to the risk.

Deadline

Select the days after the launch in which the risk should be remediated.

Reminder

Select the days before the deadline in which users should be reminded to review and remediate the risk.

Risk Owners

Select the name of the person responsible for remedying the risk.

Risk Approvers

Select the name of the person responsible for approving the risk.

Description

Enter a brief description of the risk.

Treatment Plan

Enter a treatment plan to mitigate the risk.

Add Risk Control

Select the control(s) that you want to implement as part of the mitigation process.

Show More Details

Configure any custom attributes that have been created so that they can be populated.

Create Task Upon Submission



Field
Description
Task Name

Enter a name for the task.

Assignee

Select the individual responsible for completing the task. The options include:

  • Assessment Respondent

  • Assessment Approver

  • Unassigned

Deadline

The number of days after a task is created that it must be completed.

Collaborators

Select the collaborators responsible for helping the assignee complete the task.

Description

Enter a brief description of the task.

Require Justification



Field
Description
Select Question

Choose the questions from the current assessment that will require a justification to be supplied if the conditions configured in this template rule are met.

Send Assessment Upon Approval



Field
Description
Template Name

Enter a name for the template.

Deadline

The number of days after the assessment is launched that it must be completed.

Reminder

The number of days before the deadline that an assessment reminder is sent to the respondents.

Approver

Select the individual responsible for approving the assessment.

Respondent

Select the individual responsible for responding to the assessment.

Require Confirmation upon Approval

Enable this setting to require the approver to confirm if the triggered assessment should be sent upon approval.

Send Assessment Upon Submission



Field
Description
Template Name

Enter a name for the template.

Deadline

The number of days after the assessment is launched that it must be completed.

Reminder

The number of days before the deadline that an assessment reminder is sent to the respondents.

Approver

Select the individual responsible for approving the assessment.

Respondent

Select the individual responsible for responding to the assessment.

Automatically Approve Assessment

Enable this setting to automatically set the assessment to complete if an additional assessment is triggered.

Skip to Stage



Field
Description
Workflows

Select the workflow in which this assessment will be moved once the conditions trigger the rule.

Stage

Select the workflow stage in which this assessment will be moved once the conditions trigger the rule.

To manage template rules

To edit a rule

  1. On the Rules tab, click the Context Menu icon for the rule you want to edit.
  2. On the Context menu, select Edit.
  3. Make changes as necessary.
  4. Click the Save button.

To copy a rule

  1. On the Rules tab, click the Context Menu icon for the rule you want to copy.
  2. On the Context menu, select Copy.
    The Copy Rule modal appears.

  3. Enter a name for the rule.
  4. Click the Copy button.

To move a rule

  1. On the Rules tab, click the Context Menu icon for the rule you want to move.
  2. On the Context menu, select Move Rule.
    The Move Rule modal appears.

  3. Complete the fields.
  4. Click the Confirm button.

To delete a rule

  1. On the Rules tab, click the Context Menu icon for the rule you want to delete.
  2. On the Context menu, select Delete.
    The Delete Rule modal appears.

  3. Click the Delete button.

How risk rules create risks: Risk library vs. Create new risk

Use the Risk library when you want to create standardized risks that can be tracked consistently across assessments and inventories, making it easier to support reporting, aggregation, and reuse. Choose to create a new risk when you need to capture specific findings as individual risks, which provides greater granularity and broader coverage for distinct outcomes.

Creating risk from the Risk library

Risks should be created from the Risk library when:

  • Representing a single, domain-level risk. For example, "Access management weakness" or "Data protection gaps".

  • Supporting reporting and aggregation. In this case, standardized definitions reduce duplication.

  • Maintaining one risk per context (e.g. vendor or asset). The system will enforce one risk per template, per context.

Behavior

  • If a matching risk already exists for the same inventory and template, the assessment links to the existing risk instead of creating a new one.

  • Duplicate risks are prevented.

  • A snapshot is created on the assessment when a rule is created. The system will capture a snapshot of the Risk library template.

    • Updates to the Risk library do not automatically apply to existing assessment rules or risks.

    • To apply Risk library updates, you must remove and re-add the library risk in the rule. For example, if the library risk name changes from Risk ABC to Risk XYZ, the existing rules will continue to reference Risk ABC unless updated.

Creating a new risk

New risks should be created when:

  • Tracking per-question or per-finding outcomes. For example, each failed control will generate a separate risk.

  • You need multiple risks from similar conditions.

Behavior

  • Each rule execution will create a new risk record.

  • No-deduplication is applied.