In the security base, every measure linked to a policy or to a risk treatment plan displays a status. A measure with the status "to be handled" has not yet been the subject of any decision on the relevant perimeter. This article explains how to move it forward, whether it is already in place in your organization or still needs to be built.
🔎 New to the concept of security measure? Start with Understanding the "security measure" concept in Tenacy.
Finding measures to be handled
Go to the Security base module, then select the perimeter and the scope (a policy, all policies, or risks) you want to handle.
Filter on the To be handled status to get the list of measures that have not yet received any decision on this perimeter, then click a measure to open its detail.
Deciding the status of the measure
For each measure you open, ask yourself the following question: is this measure already in place, even partially, in your organization?
Yes, the measure already exists: mark it as Implemented. You can then create an improvement action if its efficiency still needs to progress.
No, the measure does not exist yet: mark it as Not implemented, then create an implementation action to plan its rollout (see next step).
💡 Reserve the Not implemented status for measures you are genuinely starting from scratch on. If a measure already exists, even imperfectly, declare it Implemented: you can always improve it afterwards.
Creating an implementation action
From a measure with the Not implemented status, click Add an implementation action. You can then fill in:
Name: defaults to the name of the measure.
Action plan: the register to file the action under.
Owner: the person responsible for carrying it out.
Once this action is marked as Completed, the measure automatically switches to the Implemented status, and your compliance score (or risk treatment score) is updated accordingly.
⚠️ As long as the implementation action is not completed, the measure remains at Not implemented status, even if the action is already underway.
Expected result
The measure leaves the list of measures to be handled in your security base and now shows the Implemented status. It then contributes to your compliance score or risk treatment score, depending on the scope chosen.
To keep the measure effective over time, remember to attach recurring controls to it afterwards (recurring tasks or indicators).
Frequently asked questions
What is the difference between "to be handled" and "not implemented"?
"To be handled" means no decision has been made on the measure yet. "Not implemented" means you have already made a decision: the measure does not yet exist in your organization, and an implementation action is needed to put it in place.
Can I mark a measure as implemented without creating an implementation action?
Yes. If the measure already exists in your organization, even partially, you can mark it directly as Implemented, without going through an action.
What happens once my implementation action is completed?
The measure automatically switches to the Implemented status, and your compliance score or risk treatment score is recalculated to reflect this change.
🔎 To go further, see: Setting up your compliance in Tenacy, Instantiating an indicator, and Reviewing the implementation of a measure.