Whether you're discovering Tenacy for the first time or you're already a customer, this guide introduces our platform and its modules to help you get started quickly.
Tenacy is the cyber GRC platform designed for complex organizations: multiple subsidiaries, multiple regulatory frameworks, many stakeholders to coordinate. Rather than manually consolidating spreadsheets before each audit or board meeting, you centralize your entire compliance, risk management, and action plan approach in a single environment.
Tenacy relies on a unified measure library, which covers more than 60 regulatory frameworks (ISO 27001, NIS2, DORA, PCI-DSS, TISAX, among others): a single evaluation automatically feeds all relevant frameworks, with no redundant work.
Your business teams, your subsidiaries, and your vendors contribute directly through a guided interface, without requiring cyber expertise. Everything accomplished in Tenacy automatically feeds your dashboards in real-time, with no manual consolidation before each board meeting or audit.
Tenacy is hosted in France, ISO 27001 certified, with a SecNumCloud option available.
The Core of Tenacy: security measures
To stay compliant and protect your organization, you must implement security measures.
These measures enable you to:
meet the requirements of different policies, and
cover risks that could threaten your organization.
They can take different forms :
Software or tool
Process
Person or team
Security Measure Statuses
According to our experts, these measures are necessary to meet a policy requirement or to address a risk identified within your organization.
Measures already in place in your organization.
Even if these measures are not yet fully effective, it is important to start from what you already have and then improve them progressively.
Measures you want to implement, but that are not yet in place.
💡 A measure on which an implementation action is underway may appear as not implemented in certain views, pending the completion of that action.
Making a measure fully effective
Even if a measure is already implemented, it may not be at its full potential. In Tenacy, you can add an improvement action to indicate that the existing measure can be optimized.
⚠️ The efficiency gain selected when creating the action immediately reduces the measure's current efficiency. For example, a measure at 80% with a 30-point gain drops to 50% upon action creation. Efficiency then increases progressively, reaching 100% once the action is completed.
💡 There can be multiple improvement actions in parallel on the same measure. The sum of their gains should logically allow you to bring efficiency back to 100%.
Tracking performance over time: recurring tasks and indicators
To ensure that measures remain effective over time, Tenacy offers two types of tracking:
Recurring tasks: periodic verifications of measure performance (e.g.: verify that all devices have the latest antivirus version).
Performance indicators: quantified measures of measure performance (e.g.: percentage of devices with up-to-date antivirus).
A measure's performance can be evaluated by one or more recurring tasks and/or performance indicators.
Implementing Non-Implemented Measures
For measures not implemented, you start from scratch.
You must create an implementation action in Tenacy to begin deploying the measure.
It is also possible to add sub-tasks, so you can plan and track each step of the implementation.
The Different Modules of Tenacy
Tenacy is made up of several interconnected modules that allow you to manage all aspects of your cybersecurity and compliance program.
🌍 Organization
Your organization brings together subsidiaries, departments, applications, and vendors, each with its own concerns. The Organization module allows you to model this structure faithfully: it then determines the granularity of your security objectives, compliance tracking, and dashboards.
Organize your perimeters into groupings and sub-groupings, with as many levels as necessary
Create an identity card for each perimeter, thanks to contacts and customizable properties.
Associate the right security objectives with each perimeter.
🔎 To learn more, see:
🛡️Security Base
The Security Base module is the heart of Tenacy.
It allows you to:
manage your security measures,
as well as the actions and controls linked to them, and thus have a global vision of the state of your measures for the different policies and perimeters of your organization.
🔎 To learn more, see:
📌 Action plans
The Action Plan module allows you to manage and organize:
your improvement actions (to make your measures more effective),
your implementation actions (to deploy new measures),
as well as simple actions, not linked to measures, to organize your teams' work.
Each type of action can be assigned to a responsible person or team, making it easy to track and coordinate.
🔎 To learn more, see:
📆 Recurring tasks
The Recurring Tasks module allows you to manage all your periodic control tasks:
define their frequency,
indicate whether the control has been performed or not,
and delegate these tasks to the relevant teams in your organization.
🔎 To learn more, see:
📚 Policies
The Policies module allows you to track your organization's compliance with different security policies, whether they are public or private, and to analyze your scores to identify gaps to close.
🔎 To learn more, see:
📝 Evaluations
The Evaluations module allows you to create and manage your evaluation campaigns (compliance declarations):
from a questionnaire,
and/or linked to a security policy.
These campaigns allow you to collect information directly from relevant teams (internal or third-party), so you can assess their compliance level declaratively and in a centralized manner in Tenacy.
🔎 To learn more, see:
⚖️ Gaps and Exemptions
Following your audits, you can use the Gaps module to manage your gaps or non-conformities:
link them directly to policy requirements,
and create corrective actions to address them.
The Exemptions module allows you to manage your non-compliance requests:
they can also be linked directly to your policy requirements,
to ensure clear and justified tracking.
🔎 To learn more about gaps, see:
To learn more about exemptions, see:
🚨 Incidents
With the Incidents module, Tenacy allows you to log, analyze, and manage security incidents that have occurred in your organization.
🔎 To learn more, see:
⚠️ Risks
The Risks module allows you to manage and track identified and qualified risks in your organization (possibly selected from the public risk catalog).
You can also access the risk analysis module (add-on) to enrich your process.
🔎 To learn more, see:
📈 Dashboards
In the Dashboards module, you can:
create your custom dashboards to track your indicators and metrics,
manage your indicators and the metrics used for their evaluation.
🔎 To view potential dashboards, see:
💻 Project Security (add-on)
The Project Security module allows you to track the integration of security into your IT or business projects, to ensure that security requirements are considered from the design phase onwards.
🔎 To learn more, see:
🧩 Connectors and API
Your team already uses security tools daily: vulnerability scanners, EDR, ITSM, IAM. Rather than manually re-entering this data into Tenacy, connectors bring it up automatically.
About twenty native connectors are now available (Qualys, CrowdStrike, Cortex, CyberWatch, Jira, EasyVista, Citalid, ALL4TEC, among others). They feed your indicators, surface gaps from your external audits, and synchronize your actions with your ITSM tools.
The API lets you go further by connecting your own internal tools or solutions not covered by native connectors, to build the governance that matches your security stack exactly.