The role of the implementation review of a measure is to invite you to validate the implementation of that measure before it actually appears on the relevant scope in its security baseline.
This article explains in which cases this review appears — depending on whether the action.review preference is enabled or not in your organization — how to handle it, and what happens once the measure is created.
💡 This behavior depends in part on the action.review preference, which determines who can complete an action in your organization. For its full behavior, across all action types, refer to the article Action review: the validation process by a pilot.
The general principle of reviews
The principle of reviews in Tenacy is to allow a pilot to limit the scope of activity of a contributor with respect to the actions they are responsible for. In Tenacy, thanks to the review system, you can ask a contributor to move an action to "To review" so that a pilot can check the action's compliance and validate it. This review system is not mandatory in Tenacy. It is the action.review preference that determines whether you want to put it in place.
If the action review preference is disabled
This is the default behavior. A contributor who completes an implementation action moves it directly to the "Finished" status. Once the action is done, the measure is implemented after confirmation by the contributor.
As a reminder, an implementation action is always linked to a measure: it is used to plan and track the implementation of the corresponding measure on a given scope.
If the action review preference is enabled
In this case, a contributor can no longer complete an implementation action themselves: the "Finished" button is grayed out. They move the action to the "To review" status, which signals that it is ready to be checked.
The relevant pilots are notified and find the action in the dedicated view for actions to review. Before validating, they can consult the Links tab of the action to see the measure that will be implemented. They then move the action to Finished, which applies the impact: the measure is created on the scope.
⚠️ In this scenario, it is the pilot's validation that directly applies the implementation of the measure.
How to handle an implementation review
When an implementation action is set to "to review", you receive as a pilot a notification within the platform and can click it to access the list of all actions to review:
Click on an action in the list
Check the information entered as part of the action and assess its compliance
Move the action to "Finished"
Confirm the creation of the measure
What happens once the measure is implemented
Once the review is complete:
Implemented measure: the measure now appears as implemented in the security baseline of the beneficiary scope.
Beneficiaries: the beneficiaries of the implementation action automatically become beneficiaries of the created measure.
Risk treatment: if the implementation action was linked to one or more risks via a treatment plan, the measure is converted into an implemented measure.