Help When validating a treatment plan - Risk "Existing controls" desappeared

[danje57]

Dear all,

I juste created my risk analysis and defined treatment plan in my Monarc SaaS session.

I had such risk:

Asset: Employees
Label: Lack of awareness regarding phishing attack

Treatment plan: Implement awareness for employee and conduct exercise.

Before the treatment plan, raw risk was 40 (max 125)

Witht the treatment plan, risk will be 20.

I've validated the risk tratment plan for this risk.

Now my risk has "Not treated" in the treament column. This is normal has this is the 2nd iteration.

However, the field "Existing controls" doesn't keep previous controls described before I applied the new treatment plan...

Why, Monarc doesn't keep the old controls in place? Which are already deployed + the new control.

I don't understand this behavior.

[ruslanbaidan]

Hello,

The previous value of "Existing controls" filed is saved in the history of the validated recommendations and the value is replaced with the value of "New controls" that is set on the validation step. If the New control is not set, the "Existing controls" value will be empty after validation.

The behaviour is well described in the documentation: https://www.monarc.lu/documentation/user-guide/#managing-the-implementation-treatment-plan

[danje57]

Thanks for the answer Ruslan.

However, in my point of view it is a little bit strange to not show all applied security controls in the interface after the remediation in place.

Additional remediation doesn't cancel the existing one.

For example, I add a first control which is purely administartive control, like a policy which request to not plug on the computer usb key.

Then, I could add an addiitonal security control such as an endpoint agent which will control the usage of USB port.

So after the remediation, I'll have 2 controls: the policy and the endpoint agent, so it should be displayed in the list of risk insted of the history page....

However, I've also a strange behavior, when I apply the treatment plan, New existing controls are replace by something else....

The selected risk has these controls before the application of the treatment plan:

Then I apply My treatment plan for this risk:

Once applied; the risk is reduced as expected, however new controls are:

I don't know where these value where filled. Because as you can see in the screenshot new controls are not the same description.

Do you have this strange bahavior to?

Regards

[ruslanbaidan]

Hello,

Thank you for the descriptive explanations.

We could not reproduce the issue that you experienced.
Perhaps you could describe a bit more your step(s) before and this one:
"Then, I could add an addiitonal security control such as an endpoint agent which will control the usage of USB port."

Could you tell if you validated multiple recommendations linked to the risk, perhaps between the change of Existing controls field value ?

[danje57]

Thanks for your following,

No I don't validate multiple controls only one.

Because it is my first iteration in monarc :)

On my risk, I want to add a new control so I use the option in monarc as risk treatment:

Then I create the risk treatment show above...

Not sure it helps but this is what I made 📦
Regards

[ruslanbaidan]

Thank you for the details, but unfortunately, there is no additional context on it.

We tried to perform different scenarios:

• Set or change Existing controls, validate a single recommendation, linked to the risk.
• Validate multiple recommendations, changing value of Existing controls between the validations of them.
• Validating recommendations linked to multiple risks.
  Every time when we validated the recommendations, we set values for New controls and when the last (final) linked recommendation was validated the value of Existing controls of the risk(s) is changed with the value of New controls that was set at the validation step.

What would be beneficial in the issues determining, if you could try to perform the same actions as you did with the same risk or another one and send an email to [email protected] with a recorded screen (part of the screen). Or describe each action as you did with related screenshoots.

It's very important for us to solve any possible issues in Monarc.

Thank you for the cooperation in advance.

[danje57]

I tried many time too..

I can't reproduce the issue

However, as I need to review my risk analysis, I will take a snapshot before appliying all treament plan. SO if the issue appears I could maybe reproduce it.

Regarding the controlls, I don't understand why you make the choice to not keep initial controls in place before the application of new treament plan...

I'll apply the following workaround.
Copy the exisiting controls
Paste it in the new one in treament plane
Add the new controls for this treament plan.
So I'll be sure to have the list of all controls in place when applying my treament plan.

In my opinion, this is logic to retrieve all security controls in place, even if you are in the N iteration of the risk analysis.

This is a little bit strange for me, to need to go to history to see other controls in place...

Regards,

Jeremy

[ruslanbaidan]

Hello,

Thank you for your feedback.

We are looking forward to have new details if the issue will happen to you again.

Regarding the proposed scenario of keeping all the Controls history on place.
This is the way how it is done by the risks analytics, sometimes the Existing Controls are not kept on place after the recommendation(s) implementation and sometimes kept. So it's up to the person decide of transit or not the value to the New Controls. And if we will always keep the previous value, the filed value could be enormously big after couple of iteration.
However, the adding a popup or a help context 'i' menu with the previous history directly in the list could e useful addition.
We can see how to make it in the future.

Thank you.

[danje57]

Thanks for your replay! I will make special attention when I valid treatment plan to see if issue come back again.

Regarding Iteration, I will copy paste old security control in new existing plan ;)

Thanks again!!!