The example below shows a fully documented system, following the tabs of the system details panel.
1. System Name
CRM Platform
2. Context
- Description: a customer relationship management platform used by the sales and marketing teams to manage client interactions and data.
- Country / Region: Spain, Europe
- Functional Domain: Sales and Marketing
- Business Unit: Sales Department
- Environment Stage: Production
- Operational Status: Operational
- Criticality: Critical
3. Architecture
- Internet Facing: Yes
- Architectural Domain: Applications
- System Domain: IT
- System Type: Application
- System Accessibility: External
- System Management: External
- System Hosting: External Shared
- Cloud Type: SaaS
- Cloud Stack Components: Application, Data
4. Data Information
- CIA Levels of Processed Data: one row for "Customer personal data", with the confidentiality, integrity and availability levels selected from the workspace scale. The table derives the security objectives and the overall categorisation automatically.
- Data Classification: Confidential
- PII: Yes
- PHI: No
5. Recovery
- Recovery Time Objective (RTO): 4 hours
- Recovery Point Objective (RPO): 15 minutes
6. Finishing the Record
To complete the record, assign the accountable people through Owners & Contacts, link the major risk assessments from the assessment badge in the header, and describe the system boundaries in Complementary Information (what is in scope and out of scope, and the interfaces with external systems).