Workflows and statuses

Purpose

Every issue type runs through a fixed workflow — a sequence of statuses. Statuses are marked with symbols: ⚪️/🔵 in progress · 🟢/✅ done · 🔴/🔥 critical · 🔄 under review. The app installs 10 workflows with 32 statuses in total. This page shows the lifecycles per issue type; the matching day-to-day procedures are on the domain pages.

Risk Scenario

🔍 Threat analysis → 👍 Applicable → 📊 Risk assessment → 📄 Risk treatment → ✅ Accepted

First it is checked whether the scenario is applicable at all (otherwise it ends as 👎 Not applicable). Then the current risk is assessed, treated and finally accepted. From 🔄 Under review it goes back into re-assessment — that keeps the loop alive.

Action & Corrective action

⚪️ Draft → ⚪️ Ready for implementation → 🔵 In implementation → 🔵 In effectiveness review → 🟢 Implemented

Special states: 🔵 In escalation (overdue), 🔄 Under review (periodic check) and 🟢 Not relevant / applicable.

Nonconformity (major/minor, opportunity for improvement)

✏️ In recording → 🔵 In progress → 🔄 Under review → ✅ Resolved

If a deviation leads to a risk of its own, it moves via 🔥 In risk assessment to ❌ Risk recorded.

Audit

📝 Draft → ✏️ In preparation → 🔍 Under audit → 📄 Report in progress → ✅ Completed

The audit’s findings (major/minor nonconformities, opportunities for improvement) are connected to the audit file via the “found in” link (Handling audits and nonconformities).

Asset (Process, Supplier, ICT Asset, Infrastructure)

✏️ In recording → 🟢 Active → 🔄 Under review → 🔘 Inactive

Additionally, 🔘 Not applicable / not relevant is available — for example for imported BSI modules that do not apply to your scope. Only active assets and information feed the inheritance logic.

Information

✏️ In recording → 🟢 Active → 🔄 Under review → 🔘 Inactive

Information objects are recorded, are active in operation, are reviewed periodically and are set inactive at the end of their lifecycle. Only active information feeds the protection-need inheritance.

Requirement & Partial Requirement

⚪️ In planning → 🔵 In progress → 🟢 Done

Controls that do not apply are set to 🔘 Not applicable / not relevant — this is the basis of the Statement of Applicability (SoA).

Epic (chapter container)

⚪️ In planning → 🔵 In progress → 🟢 Done

Epics represent the chapters of the requirement structure and run on the simple standard workflow.

Document (document control)

📝 Draft → ⏳ In approval → ✅ Approved → 🔄 Under review

The collector issue per controlled document mirrors the control state of the Confluence page. The document-control values are always the authoritative ones (Using document control); the issues are maintained automatically by the app.

Control Round (document control)

⚪️ In planning → 🔵 In progress → ✅ Completed

Special states: ⛔ Rejected (approval refused) and 🔘 Not applicable / not relevant. Control rounds are created as subtasks under the Document issue and are not edited by hand in day-to-day work.

Related pages

• Domains and issue types
• Managing automations
• Setting up notifications (RACI)