Recent development in Cyberday

You can now select multiple "owners" for the Security incidents documentation list. If you have allowed employees to report security incidents through the Guidebook, every user listed in this section will be automatically notified about each incident.

‍

We made improvements on the print view of reports so that they could be better utilized as pdf versions also.

We recommend using reports mainly by sharing them directly in Teams, but supporting this way of use is also important to us. We are happy to receive any wishes for further improvement of the print view. 👍

‍

‍

A new login solution using Teams SSO has been developed for Cyberday's Teams application, which saves clicks from the new user and corrects some challenges associated with the previous login model.

After this update is published, you may be asked to re-allow the Cyberday app in the Teams environment. There has been no changes to the data required by the application. As an admin you can also allow the app on behalf of other users at once, and allowing the app applies to all end devices (desktop, browser, mobile).

‍

You can now receive admin notifications and end user reminders directly in Slack (instead of Microsoft Teams or email).

1. Follow the card on the Dashboard to add the Slack app to your account.

2. Grant permissions on your Slack account

3. (Optional) Enable user syncing if you wish to get everyone in Slack as a Cyberday user

4. Start receiving notifications from the Cyberday bot in Slack!

‍

Now all items on Taskbook, that jump to the "Needs attention" -section, will clearly communicate to you why they're there.

‍

We are building a readiness assessment view that would serve e.g. the following uses:

• At the beginning of Cyberday use, the core team can assess organization's readiness by themselves or together with an expert - e.g. what's our current compliance in relation to ISO 27001 standard?
• When the use is to be expanded to other frameworks, the organization can start with a readiness assessment, so that the required time, investment or know-how can be assessed more precisely.

As a result of the assessment, the organization gets a summary of current compliance, the strongest and weakest digital security themes, and an understanding of the most urgent improvements.

We are currently developing Cyberday's Slack app to act as an alternative channel for notifications and other messages, if the organization does not use the Microsoft Teams environment.

We will tell you more about the Slack app soon! 👍

Our content AI automatically links some tasks to risks. This is done e.g. to automatically evaluate, which risks you already have in better control than some others.

Now you can also see recommendation on the risk treatment step. When you're planning new risk treatment tasks, you can see if there are suggested tasks, that are popular choices in decreasing this risk. These tasks are highlighted in the selector.

We are constantly improving the content intelligence, so the recommended tasks are gradually being supplemented for more risks.

When you assign a theme to an owner on Cyberday dashboard, the user will now always be reminded of the ownership of this theme also on his Taskbook.

This is important, because the theme owner is expected to also go through the Untreated tasks connected to your frameworks, not only proceed the tasks already assigned for them.

We tuned the UI for the Frameworks-page slightly.

This allows us to keep building our framework library and present all its contents for you better in the future too!

In addition, you can now see on the Frameworks-page a preview of what compliance looks like towards frameworks you don't have yet activated.

You can now divide tasks more precisely based on the work done for them.

With this addition it's also possible to activate the task and then set it to "Not Done", if you want to set a deadline for the task, for example, but the actual work has not yet started.

From the user management of Cyberday, you can set some users as so-called as "external users". This means that they do not participate in e.g. to the Guidebook process, but may otherwise be able to see contents based on the user level you choose.

Now you can divide external users more precisely into different groups:

• Partner is intended for e.g. to a consultant or other expert who actively helps you at work. He can be set as the owner, e.g. tasks or other targets.
• Auditor enables you to flag someone clearly as the person who is auditing your operations from different perspectives. The auditor cannot own the objects and is not involved in the Guidebook process.
• Other / external selection enables you to mark e.g. the management of your own organization or other persons who are not supposed to own the objects or be involved in the instructions, but who want the content to be visible.
  

You can now easily generate a report for a list of items (e.g. data systems) or a bigger, individual item (e.g. a DPIA).

From Reporting-page, you can create reports in different formats. Choose "Create new report" and select the type of report you'd like to create this time - either pick from our ready-made report templates in library or create a report of your content.

We did some improvements on the Reporting-page at the same time when we launched some new reporting types.

Our report library has nowadays so many different templates, that the old page UI didn't support these too well anymore.

Now you can search for reports easier and categorize them to e.g. Active, Inactive and Shared reports. Also marking the owners and reviews for reports is now easier.

You can now add own entries in the event logs of different objects in a more versatile way.

If you have worked on an improvement (e.g. implementation of MFA in a data system, review of a contract with a partner, edits to the content of the task or guideline), you can record the matter in the object's log as an improvement.

If there has been an incident with an object and measures have been taken to resolve the incident and to recover from it, these should be recorded in the log as incident response type entries.