Using Keen

Context, objectives and ISMS records

Chapter 8 of 17

Context and objectives

The ISMS screens hold the records a management system runs on: the context you operate in, the objectives you set, and the assets, people, documents and meetings that carry the work. This chapter introduces them one at a time, starting with context. ISMS read and manage permissions apply, and risk permissions include them.

PESTLE(E) and interested parties

PESTLE(E) records the external and organisational issues that shape your scope: political, economic, social, technological, legal, environmental and ethical. For each issue, say what it is, why it matters, which business processes it touches and which framework clauses it relates to.

Interested parties records the people and organisations whose needs affect the management system: what their interest is, which controls relate to it, and how and how often you plan to communicate with them. A party is recorded once for the whole organisation; the controls that address it are linked per framework, so the same regulator can relate to different controls in each framework you assess against.

Organisational context: PESTLE(E) and interested parties

To record a PESTLE(E) issue, choose Risks → Add a risk and the PESTLE(E) factor kind, or add it in the PESTLE(E) workspace: describe it and its rationale, choose its type and lens, and link the relevant business processes and framework clauses with a relevance level. The PESTLE(E) tab of the Risks dashboard lists every factor beside the other kinds of risk. A change in law, dependence on a key supplier or a new technology each give context for risks and objectives.

To record an interested party, note who has the need or expectation and the nature of their interest, add the planned communications (method, relevant events or frequency), and link the applicable controls in the framework you are viewing. A risk names the interested parties, people and vendors it affects, and the risk wizard adds a new interested party by name and nature when none matches. Both lists are worth a look at management review, and both can be sampled into audits.

Define objectives you can evaluate

Open ISMS → Objectives. An objective pairs a requirement with a goal, an owner, a metric and planned start and target dates. Describe the completion method and the evaluation method separately: doing the work and checking that it achieved the goal are different activities.

Use the resource fields to say who and what are needed, link the relevant controls and clauses, save, and check the detail page and changelog. At review time, compare the intended metric and evaluation method with the actual effectiveness observations and meeting decisions.

Use the Objectives views to review statuses and dates together, and link objectives to the SWOT items that explain the intended response.

Manage the ISMS

Each ISMS record type answers one question. This section introduces them briefly; documents, people, assets and measures each have a chapter of their own.

Maintain the ISMS

Objectives

Intended outcomes, linked to controls, owners and effectiveness measures.

Effectiveness measures and metrics

A measure says how effectiveness is assessed; a metric is one dated observation or score for it.

Documents

Policies and processes, with folders, types, tags, rich text, version history and comments.

Assets

The resources you manage, with ownership, organisation relationships and related risks.

Organisation chart

Roles and reporting relationships. Roles can own risks.

Access Matrix

Who, or which role, should have access to an asset and at what level. It records intended access; grants and revocations happen in the external system.

Application Configuration

Relevant application settings, documented.

Minutes of meetings

Decisions, discussion and attendance, including people without Keen accounts.

Before you add a metric, review the measure's method, target and source. Some metrics arrive through configured webhooks. Where a measure records automatic zero values, read them as part of its method and check source coverage separately.

Save substantive document changes as a new content version, so the history shows which wording was in force at any time. If someone else edits at the same time, a reload reconciles their changes.

People and vendors

People & vendors holds personnel and supplier assurance. A person does not need a Keen account: record their optional account, organisation role and assets, then add assurance records such as training, screening or policy acknowledgement. Each record can carry a category, requirement, status, completion and expiry dates, an authoritative source and an evidence link.

A vendor record holds supplier details and the assets it supplies. An asset has one supplying vendor, so assigning it to another vendor moves that relationship; review the effect before saving.

Meetings and decisions

Minutes turn a meeting into a record you can link to the objectives, risks and controls it affected.

Record decisions in meeting minutes

1. In ISMS → Minutes of meetings, set the title, date and optional start and end times.
2. Select the people attending and apologising. If someone is missing, enter their name and optional e-mail and use the offered action to create a Person for next time.
3. Select supporting ISMS documents and add external links with meaningful titles.
4. Write the agenda, minutes and decisions in the editor, naming the responsible people and follow-up dates.
5. Link the relevant controls and clauses, save, and check the detail page and changelog.

For a management review, useful inputs are the current risks and treatments, measure trends, audit findings, objectives, changes in interested parties and overdue work. Record the actual decisions, then update the affected records themselves: the risk owner, the treatment status or the objective each live in their own record.