> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # How to Start with Brainframe # πŸš€ **How to Start with Brainframe** > **"Build your GRC program once β€” as a connected web of assets, risks, controls and requirements β€” and let audits, reports and the Statement of Applicability generate themselves."** > > *This guide takes you from an empty workspace to a fully connected GRC environment. It is written for GRC professionals, so it focuses on **how Brainframe models your world** and the fastest path to value β€” not on explaining GRC fundamentals you already know.* --- ## 🧠 The One Concept That Makes Everything Click Brainframe is built on a single idea: > **Everything is a document, documents live in a familiar folder tree, and documents link to each other bi-directionally.** Internalise this and the whole platform becomes intuitive: * πŸ“„ **Everything is a document** β€” assets, risks, policies, procedures, suppliers, KPIs, meeting notes, audit reports. They all share the same features (properties, versioning, approvals, reminders, tasks). See a [document view](https://docs.brainframe.com/en/article/document-view-1xqae9v/). * πŸ”— **Links are bi-directional** β€” link a risk to an asset once and it appears on both. Update the source and it updates everywhere. There is no "copy" β€” only one source of truth. * ♻️ **Reuse over duplication** β€” one control document can mitigate many risks *and* satisfy requirements across ISO 27001, GDPR, NIS2 and DORA simultaneously. You build it once. > πŸ“Œ The connected web you build in Phase 1 **is** your audit evidence in Phase 2. Nothing is ever done twice. ### πŸ—Ί How Brainframe maps to your GRC vocabulary | You already think in terms of… | In Brainframe it is a… | Lives under… | | ---- | | Asset inventory / CMDB | Primary & supporting **asset documents** | [Resources](https://docs.brainframe.com/en/article/resources-abzzvs/) | | Risk register | **Risk documents** on a matrix + inventory | [Risks](https://docs.brainframe.com/en/article/risks-li00v8/) | | Control library / policies & procedures | **Control documents** | [Controls Overview](https://docs.brainframe.com/en/article/controls-overview-1guam0z/) | | Statement of Applicability | **Auto-generated** from framework config | [Compliance](https://docs.brainframe.com/en/article/compliance-1wcl5p/) | | CAPA / findings | **Non-conformities** with corrective/preventive actions | [Compliance](https://docs.brainframe.com/en/article/compliance-1wcl5p/) | | KPIs / OKRs / metrics | **KPI readings** on any document | [Objective Tracker](https://docs.brainframe.com/en/article/objective-tracker-vk68w9/) | | Kanban / task tracking | **Workbench** checklists & boards | [Workbench](https://docs.brainframe.com/en/article/workbench-of9sr0/) | | Evidence pack for auditor | **Distribution** (tracked, password-protected) | [Distributions](https://docs.brainframe.com/en/article/document-distribution-1k2gqwz/) | --- ## 🧭 Your Setup at a Glance Work through four phases. Each builds on the previous one, and each has a clear outcome and a natural owner. | Phase | Goal | Typical owner | Outcome | | ---- | | **0 Β· Foundations** | Configure the workspace once | Admin / ISO manager | Folder tree, users, document types, risk methodology ready | | **1 Β· Connected core** | Assets β†’ Risks β†’ Controls, all linked | Risk & asset owners | A living, bi-directional GRC web | | **2 Β· Compliance** | Point frameworks at existing controls | Compliance lead | Live SoA + maturity, audit-ready | | **3 Β· Operate & improve** | Tasks, KPIs, reviews, reporting | Everyone | Continuous, evidenced improvement | > πŸ’‘ **Fastest path to a first win:** Do a lightweight Phase 0, document **one** primary asset with its risks and controls (Phase 1), then load your **ISO 27001 template** (Phase 2) to see the SoA and maturity radar populate from work you already did. ### πŸ‘₯ Where should *I* start? * πŸ›‘ **ISO / ISMS manager** β†’ Phase 0 (methodology & structure) β†’ Phase 2 (load the framework). * ⚠️ **Risk owner** β†’ Phase 1 (assets & risks) β†’ governance tab. * πŸ“‹ **Compliance / audit lead** β†’ Phase 2 (frameworks, SoA, distributions). * πŸ“Š **Management / executive** β†’ [Performance](https://docs.brainframe.com/en/article/performance-ewfk9q/) & [My Compliance](https://docs.brainframe.com/en/article/my-compliance-w4ie2c/) dashboards (Phase 3). --- # πŸ— Phase 0 β€” Foundations (configure once) > **"A few minutes of setup here saves hours of rework later."** These are the admin-level decisions that shape everything downstream. Do them before mass-creating documents. ## 0.1 Β· Bring in your structure * πŸ—‚ Start from the **best-practice folder structure** provided during onboarding, **or** import your existing Word/Excel/PDF/PowerPoint files to recreate your hierarchy. See [bulk document import](https://docs.brainframe.com/en/article/bulk-document-import-12vfyj6/). * Each user also has a **private inbox** (recent activity, personal & flagged documents); folder **colour indicators** give at-a-glance status. ## 0.2 Β· Set up people & access early * πŸ‘€ Create your **users and groups** now so you can apply least-privilege from day one. See [workspace users](https://docs.brainframe.com/en/article/workspace-users-ftkgjk/). * πŸ” Control visibility with [folder permissions](https://docs.brainframe.com/en/article/folder-permissions-htlsk6/) β€” checklists and documents are only visible to users with read access to their folder. * 🧩 **Own via roles, not people.** Point ownership properties at a *Role / Responsibility* document rather than a named employee, so ownership survives staff turnover. ## 0.3 Β· Tune document types, properties & templates * πŸ“‘ Brainframe ships **100+ document types** with unique identifiers, properties and templates. Adjust which properties are mandatory/optional and where each type is created by default. See [document types & templates](https://docs.brainframe.com/en/article/document-types-templates-lssmkc/). * 🏷 [Document properties](https://docs.brainframe.com/en/article/document-properties-1jern28/) (owner, classification, review date, risk type…) are what make inventories filterable and reports consistent. Define your key ones now. ## 0.4 Β· Define your risk methodology Configure this **before creating any risk**. Go to **Workspace Settings β†’ Risk Types** ([custom risk types](https://docs.brainframe.com/en/article/custom-risk-types-x8x0pe/)): * πŸ“ **Matrix scale** β€” 3Γ—3, 4Γ—4, 5Γ—5, 10Γ—10 (others on request). * 🎯 **Risk appetite** β€” thresholds where appetite colours apply. * ⏰ **Review frequency** β€” how often each risk type is revisited. * πŸ“‹ **Mandatory/optional properties** per risk type. > 🎨 You can override matrix colours purely for visualisation (to match your house conventions) without changing the underlying values. ## 0.5 Β· (Optional) Define KPI types If you track metrics, set up **KPI types** now β€” default *Unit / Financial / Percentage*, or build [custom KPI types](https://docs.brainframe.com/en/article/custom-kpi-types-1vafrb3/) with your own measures and formulas. **βœ… Phase 0 done when:** structure imported Β· users & permissions set Β· key properties defined Β· risk methodology configured. --- # πŸ•Έ Phase 1 β€” Build the Connected Core > **"Know what you have, know what threatens it, know how you protect it."** This is the operational heart of your program. Get this web right and compliance in Phase 2 flows almost for free. ## 1.1 Β· Map & create your assets Sketch **what matters most** before you touch the platform (short workshops with department and technical leads: *Who owns this? What does it depend on? What breaks if it's gone for an hour? A day?*). * πŸ₯‡ **Primary assets** β€” core services, processes or data whose disruption causes real financial/operational/reputational damage. * 🧩 **Supporting assets** β€” the systems and resources those depend on (servers, networks, SaaS, repositories, identity, suppliers). In **Resources β†’ Core Business Assets** ([asset management](https://docs.brainframe.com/en/article/asset-management-16ofn81/)): * βž• **Create** a primary asset, **or** πŸ”— **link an existing document** β€” Brainframe then auto-collects its supporting assets and related risks. * Capture **business requirements**: ⏱ RTO Β· πŸ’Ύ RPO Β· πŸ”₯ criticality / max impact (all configurable properties). * Assign **ownership** (to a role). > πŸ“Œ The primary β†’ supporting distinction is what builds your **risk hierarchy** and makes dependency chains visible and recursive. ## 1.2 Β· Attach supporting assets & visualise dependencies * βš™οΈ Link technologies, suppliers, tools and data as supporting assets (each has its own document type). * 🌐 The result is a **recursive dependency chain** you can explore in an **expandable table view** and in the **graph view** per document. ## 1.3 Β· Document your controls & continuity artefacts * πŸ›‘ **Controls** β€” policies, procedures and technical safeguards. Each is one document, linkable from *many* risks, assets and (later) requirements. * πŸ“‰ **BIA** β€” do this **first**; it informs the RTO/RPO you set on assets. * πŸ”„ **BCP / DRP** β€” continuity and recovery plans. * βš”οΈ **Threats & Vulnerabilities** β€” the raw ingredients your risks are built from. > πŸ’‘ **Recommended sequence:** BIA β†’ RTO/RPO on assets β†’ which controls & continuity strategies you actually need. ## 1.4 Β· Create & link your risks Create a risk from its document type (e.g. **"Confidentiality, Integrity or Availability Risk (CIA)"**). Each risk captures: * πŸ†” Auto-incrementing identifier (default `R-00x`, customisable). * πŸ“ Scenario, likelihood, impact, resulting level. * πŸ”§ Existing controls & mitigations. * 🎲 **Risk action** β€” Treat / Terminate / Tolerate / Transfer (or a mix). * πŸ‘€ **Risk owner** β€” a role document wherever possible. Then **link** β€” this is where the value compounds: * πŸ”— In **Linked Documents**, connect the risk to every affected asset, system or supplier (bi-directional β€” it appears on the asset too). * πŸ›‘ Link **existing controls** to show what already mitigates it. * βœ… Add remediation **tasks** via the [Workbench](https://docs.brainframe.com/en/article/workbench-of9sr0/). > πŸ“Œ **Gap detector:** any risk with no linked control and no explicit "tolerated" decision is a blind spot. ## 1.5 Β· Go deeper with the Governance tab On an asset's **Governance tab** you can rate, per asset, **how maturely each control is implemented** and **how critical each risk is** β€” moving beyond simple links to quantified posture. See [asset risks & controls governance](https://docs.brainframe.com/en/article/asset-risks-and-controls-governance-1y7i7hu/). ## 1.6 Β· Validate the web * πŸ•Έ Use **dependency graphs** to sanity-check the whole picture. * πŸ“Š Each document's **Risks tab** shows risk evolution over time. **βœ… Phase 1 done when:** primary vs. supporting assets identified Β· owners (roles) assigned Β· RTO/RPO/criticality captured Β· every primary asset has β‰₯1 linked risk Β· every meaningful risk has a linked control *or* a documented "tolerated" decision. --- # πŸ“‹ Phase 2 β€” Compliance Frameworks & the SoA > **"Map any standard to controls you already built β€” and let Brainframe generate the paperwork."** Because your controls exist from Phase 1, compliance is mostly *pointing requirements at them*. ## 2.1 Β· Add your framework **Compliance β†’ Frameworks β†’ Add Compliance Framework** ([compliance frameworks](https://docs.brainframe.com/en/article/compliance-frameworks-1mq2uoa/)). Provide πŸ“› name (e.g. `ISO/IEC 27001:2022`), and optionally πŸ“„ description, πŸ”— public URL, πŸ“Ž supporting documents. > πŸ“Œ The framework/SoA module is **admin-only** and is **not** folder-hierarchy aware. ## 2.2 Β· Choose a setup method * 🧱 **Template** β€” pre-loaded requirement set. **Fastest for ISO 27001** (80+ frameworks supported out of the box). * ✍️ **Self-configured** β€” build categories & requirements manually (custom/niche frameworks). * πŸ“Š **Excel import** β€” bulk-load categories & requirements. > ⚠️ Excel import brings in **requirements only** β€” linked controls, evidence, risks and notes are added afterward. ## 2.3 Β· Understand & link requirements Each requirement carries an πŸ†” identifier (e.g. `A.5.1`), 🏷 title and πŸ“– guidance. On each requirement: * πŸ›‘ **Link control** β€” **reuse the controls from Phase 1**. * πŸ“ **Link evidence** β€” records, logs, screenshots. * ⚠️ **Add risk** β€” justify applicability and scope. * βœ… **Add tasks** β€” for anything not yet in place (they appear in your task list). * πŸ“ **Notes** β€” auditor comments / improvements. > πŸ”— A single requirement/control can belong to **multiple frameworks at once** β€” one control can satisfy ISO 27001, GDPR and DORA together. Removing it from one leaves the others intact. ## 2.4 Β· Manage coverage from the Controls Overview The [Controls Overview](https://docs.brainframe.com/en/article/controls-overview-1guam0z/) dashboard (**Compliance β†’ Frameworks β†’ Control overview**) gives an organisation-wide view: total vs. actively-mitigating controls, **control maturity**, **document maturity**, and **overdue reviews**. Its **Framework Mapping matrix** is the power view for multi-framework shops β€” rows are controls, columns are frameworks, cells show mapped requirements. Spot reuse, find gaps, and add mappings directly from the grid. ## 2.5 Β· Set applicability β†’ auto-generate the SoA * β˜‘οΈ Every requirement has an **Applicable** checkbox (on by default). Unchecking marks it **N/A** and excludes it from maturity tracking. * πŸ“Œ **Nothing is deleted** β€” linked controls, risks, evidence and notes are hidden and fully restored when you re-enable. * πŸ€– Brainframe **auto-generates the Statement of Applicability** from this configuration β€” click **"Show Statement of Applicability"** for the audit-ready table. There is **no separate SoA to maintain by hand**. ## 2.6 Β· Track maturity As you link controls, evidence and risks, **maturity builds automatically** and is shown as a **radar chart per category** β€” weak categories become obvious *before* an auditor finds them. ## 2.7 Β· Handle findings: Non-conformities & Audits * ❌ Log **Non-conformities** and assign **corrective & preventive actions (CAPA)**; track them to closure. * πŸ” Keep a centralised **Audit** workspace, generate audit reports, and store auditable proofs. See the [Compliance module](https://docs.brainframe.com/en/article/compliance-1wcl5p/). ## 2.8 Β· Prepare for the audit * πŸ–¨ **Print simple** β€” categories, requirements, applicability, IDs, linked control & evidence names. * πŸ“Š **Print detailed** β€” the above **plus** maturity radars and related risks per requirement. * πŸ“€ **Export to Excel** β€” requirement details, status, linked controls, evidence, risks (re-importable). * πŸ“¦ **Distribution** for external auditors β€” group evidence into categories, add πŸ” password protection, and enable πŸ‘ read/approval tracking. See [distributions](https://docs.brainframe.com/en/article/document-distribution-1k2gqwz/). > πŸ’‘ Schedule a periodic (e.g. quarterly) export as an offline backup of your compliance evidence. **βœ… Phase 2 done when:** framework added Β· controls linked to each applicable requirement Β· evidence attached Β· related risks linked Β· N/A items unchecked with justification Β· maturity radar reviewed Β· SoA generated Β· audit export/distribution prepared. --- # πŸ”„ Phase 3 β€” Operate & Continuously Improve > **"GRC is not a one-off project β€” it's a living program."** These modules turn your web into daily practice and keep it audit-ready between certifications. * πŸ›  **Workbench & tasks** β€” run remediation, onboarding, incidents and supplier lifecycles on **Kanban boards** (custom stages, dependencies, reminders, progress %). Folder-aware, with table view and workspace-wide charts. See [process management](https://docs.brainframe.com/en/article/process-management-br4e74/). * 🎯 **Objective Tracker (KPIs/OKRs)** β€” record readings on any document, watch trendlines against targets, and consolidate them in the KPI menu. See [objective tracker](https://docs.brainframe.com/en/article/objective-tracker-vk68w9/). * πŸ“Š **Performance dashboards** β€” business, security and quality performance in one place for management reviews. See [performance](https://docs.brainframe.com/en/article/performance-ewfk9q/). * βœ… **Approvals & versioning** β€” formal [document approvals](https://docs.brainframe.com/en/article/document-approvals-dmgns6/) and full [version history](https://docs.brainframe.com/en/article/document-versioning-5ikgy4/) keep policies controlled and auditable. * ⏰ **Reminders & reviews** β€” one-time or recurring [reminders](https://docs.brainframe.com/en/article/document-reminders-1dz7kr2/) (with optional auto-created tasks) for policy reviews, supplier re-assessments and control reviews. * 🀝 **Suppliers & GDPR** β€” manage third-party risk with [supplier management](https://docs.brainframe.com/en/article/supplier-management-9yrcxi/) and run privacy programs (RoPA, DPAs, DPIAs) with [GDPR management](https://docs.brainframe.com/en/article/gdpr-management-8sjur4/). * πŸ“Œ **My Compliance dashboard** β€” each user's personal command centre: risk reviews, personal & process tasks, overdue items. See [my compliance](https://docs.brainframe.com/en/article/my-compliance-w4ie2c/). --- # πŸ”— How It All Connects > **"Build once, comply many times."** ``` β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ Governance tab: maturity β”‚ β”‚ & criticality ratings β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ Assets ──depend on──► Assets β”‚ β”‚ β–Ό └──threatened by──► Risks ──mitigated by──► Controls β”‚ β”‚ β”‚ β”‚ linked to β–Ό β–Ό Non-conformities Framework Requirements (CAPA/tasks) (auto-generates the SoA + maturity radar) ``` * 🏷 You document **assets** and dependencies. * ⚠️ You identify **risks** against them. * πŸ›‘ You link **controls** that mitigate the risks. * πŸ“‹ You point **framework requirements** at those same controls. * πŸ€– Brainframe generates your **SoA, maturity view, and reports** automatically. The controls you build for operational risk management **are** your compliance evidence. Nothing is done twice. --- ## πŸ“Œ Common Use Cases * πŸ… Achieve **ISO 27001 certification** quickly from a template. * 🏦 Run a financial entity's **ISMS under DORA**. * πŸ”Œ Govern **IoT / connected-device** risks mapped to controls. * 🀝 Track **third-party / supplier** risk and evidence. * πŸ—Ί Run **multiple overlapping frameworks** (ISO 27001, GDPR, NIS2, SOC 2…) from one control set. --- ## 🌟 Best Practices * πŸ“ **Link, don't duplicate** β€” one source of truth, updated everywhere. * πŸ‘€ **Own via roles, not people** β€” ownership survives turnover. * πŸ“‰ **BIA first** β€” it drives RTO/RPO and continuity strategy. * 🎯 **Rate maturity honestly** β€” accuracy beats optimism in audits. * πŸ” **Reassess risks quarterly** or after major change. * ♻️ **Reuse controls across frameworks** β€” the biggest long-term saving. * πŸ—‚ **Keep evidence attached** to controls & requirements. * πŸ“Š **Watch the maturity radar** β€” fix weak categories before auditors flag them. * ⏰ **Automate reviews with reminders** β€” never let a policy or supplier review lapse. --- ## 🎯 Master Checklist **Phase 0 β€” Foundations** * [ ] Folder structure imported / created * [ ] Users, groups & folder permissions configured * [ ] Key document properties & types tuned * [ ] Risk methodology (matrix, appetite, review frequency) set * [ ] KPI types defined *(optional)* **Phase 1 β€” Connected core** * [ ] Primary vs. supporting assets identified * [ ] Owners (roles) assigned; RTO/RPO/criticality captured * [ ] Supporting assets linked; dependencies visualised * [ ] Core controls, BIA, BCP/DRP documented * [ ] Every primary asset has β‰₯1 linked risk * [ ] Every meaningful risk has a control **or** a "tolerated" decision * [ ] Governance tab ratings reviewed **Phase 2 β€” Compliance** * [ ] Framework added (template / self-configured / Excel) * [ ] Controls linked to each applicable requirement * [ ] Evidence attached; related risks linked * [ ] Applicability set (N/A justified) * [ ] Maturity radar reviewed; SoA generated * [ ] Non-conformities/CAPA & audits tracked * [ ] Audit export / distribution prepared **Phase 3 β€” Operate & improve** * [ ] Workbench boards running for key processes * [ ] KPIs & performance dashboards in management reviews * [ ] Approvals & versioning enforced on controls * [ ] Recurring reminders set for reviews * [ ] My Compliance dashboard adopted by owners --- > πŸ’¬ **Need help?** Every module referenced above has a dedicated article in the documentation. If something is still unclear, contact us at support@brainframe.com.