Reference: Isora GRC Comprehensive Capabilities & Permissions

In Reference: Roles and Capabilities the various types of user accounts are discussed, along with an overview of their various capabilities. In this document, we will delve into greater detail about the capabilities of different user types and roles, with respect to different functional aspects of Isora GRC.

💡

Remember: All roles are on a per-unit basis. An individual user may have roles in multiple units, or multiple roles within the same unit. A superuser may also have roles, but their capabilities won’t be limited by their assigned roles.

💡

Related API calls are also provided in the tables below; GET, POST, PATCH, PUT and DELETE are common HTTP methods used to interact with resources:

GET: Retrieves data from the server. It’s used to fetch information without making any changes.

POST: Submits new data to the server, often used to create new records or resources.

PATCH/PUT: Updates or modifies an existing resource partially (e.g., changing just one field).

DELETE: Removes an existing resource from the server.

For more information about how to interact with Isora GRC using its API, check out

Third-Party Vendor Product Capabilities

Inventory and Assessments

Vendors

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (GET)	All	All	All	All	All	All - List view but not detail	All - List view but not detail	All - List view but not detail
Create (POST)	Yes	Yes	Yes	Yes	Yes	No	No	No
Modify (PATCH)	All	All	All	All	All	No	No	No
Remove (DELETE)	All	No	No	No	No	No	No	No

Products

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (GET)	All	All	All	All	All	All- List view but not detail	All- List view but not detail	All- List view but not detail
Create (POST)	Yes	Yes	Yes	Yes	Yes	No	No	No
Modify (PATCH)	All	All^1	All^1	All^1	All^1	No	No	No
Remove (DELETE)	All	No	No	No	No	No	No	No

Product Documents

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (GET)	All	All	All	All	All	No	No	No
Create (POST to documents + PATCH product)	All	All	All	All	All	No	No	No
Remove (DELETE)	All	All	All	All	All	No	No	No

Product Deployments

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (GET)	All	My unit	My unit	My unit- only from New Assessment Intake step	My unit	All- List view but not detail	All- List view but not detail	All- List view but not detail
Modify (PATCH)	All	My unit	My unit	My unit^1	My unit	No	No	No
Remove (DELETE)	All	My unit	My unit	My unit	My unit	No	No	No

Third-Party Vendor Assessments

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View Completed (“reports”) (GET)	All	All shared^2 + My unit private	All shared^2 + My unit private	All shared^2 + My unit private	All shared^2 + My unit private	All shared^2 + My unit private	All shared^2	All shared^2
View (GET) ACTIVE	All	My unit	My unit	My unit	My unit	No	My unit	No
Create (POST)	All	My unit	My unit	My unit	No	No	No	No
Edit Active or Published (PATCH)	All active / published	My unit active / My unit published- can launch	My unit active / My unit published- can launch	My unit active / My unit published- can launch	No	No	No	No
Remove (DELETE)	All^3	My unit active	My unit active	My unit active	My unit active	No	No	No

^1Some functionality is currently broken in the GUI and is in the process of being fixed.

^2Some reports are viewable in the list but result in a File Not Found error when you attempt to view them. This is a known issue in the process of being fixed.

^3Only active or published can be removed from the Assessments page, but it is possible for superusers to remove completed assessments using the API or from the Assessments area of the Settings page.

Application Capabilities

Inventory and Assessments

Applications

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Application Delegate (named owner)	(No role)
View (GET)	All	My unit	My unit	No	My unit	No	No^2	Mine	No
Create (POST)	Yes (any unit)	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1	Yes (any unit)^1
Modify (PATCH)	All	My unit	My unit	No	My unit	No	No	Mine	My unit
Remove (DELETE)	All	My unit	My unit	No	My unit	No	No	Mine	No

Application Documents

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Application Delegate (named owner)
View (GET)	All	My unit	My unit	No	My unit	No	No^2	Mine
Create (POST to documents + PATCH application)	All	My unit	My unit	No	My unit	No	No	Mine
Remove (DELETE)	All	My unit	My unit	No	My unit	No	No	Mine

Application Assessments

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Application Delegate (named owner)
View (GET)	All	My unit	My unit	No	My unit	No	No^2	Mine active
Create (POST)	Yes	My unit	No	No	No	No	No	No
Launch (PATCH)	All	My unit^3	No	No	No	No	No	No
Enrich (PATCH)	All	My unit	My unit	No	My unit^4	No	No	Mine
Answer/Lock/Unlock Questions (PATCH)	All	My unit	My unit	No	No	No	No	Mine
Acknowledge questions / Final acknowledge (PATCH)	All	My unit	No	No	No	No	No	No
Remove (DELETE)	All	My unit^5	No	No	No	No	No	No

^1This is a known issue which will be corrected soon. Assessment Managers and IT Staff should be able to create applications that are assigned to their units only.

^2Auditors should have view-only access to applications and application assessments for their units; this is a known issue under development.

^3Assessment managers can currently only launch at creation time; they should also be able to launch published application assessments (this is a known issue under development).

^4This is probably a bug.

^5They can do it from the API but not in the GUI.

Unit-Related Capabilities

Settings

Units

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (including permissions) (GET)	All	All	All	All	All	All	All	All
Create (POST)	Yes	No	No	No	No	No	No	No
Edit Unit Details (PUT)	All	No	No	No	No	No	No	No
Add / Remove Permissions (PUT)	All	My unit	No	No	No	No	No	No
Remove (DELETE)	All	No	No	No	No	No	No	No

People-Related Capabilities

Settings

People

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (including permissions) (GET)	All	All	All	All	All	All	All	All
Create (POST)	Yes	No*	No	No	No	No	No	No
Edit (PUT)	All users all fields	All - Enable New UI field/ Add permissions to my unit; Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields	Self- Password/ Enable New UI fields
Remove (DELETE)	All	No	No	No	No	No	No	No

*Except via LDAP add user by delegation.

Locations-Related Capabilities

Settings

Locations

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	(No role)
View (including permissions) (GET)	All	All Non-confidential	All Non-confidential	All Non-confidential	All Non-confidential	All Non-confidential	All Non-confidential	All Non-confidential
Create (POST)	Yes	No	No	No	No	No	No	No
Edit (PUT)	All	No	No	No	No	No	No	No
Remove (DELETE)	All	No	No	No	No	No	No	No

Unit Assessment Capabilities

Unit Assessments

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Asset Delegate	Question Delegate	(No role)
View Active and Published (GET)	All	My unit	My unit	No	My unit	No	My unit	Delegated ACTIVE^1	Delegated ACTIVE	No
View Completed (reports) (GET)	All	My unit	My unit	No	My unit	No	My unit	No	No	No
Create (POST)	Yes - any unit(s)	No	No	No	No	No	No	No	No	No
Launch (PATCH)	All editable	My unit	No	No	No	No	No	No	No	No
Update Question Responses (PUT)	All	My unit	My unit	No	No- but can see them and comment for my unit	No	No- but can see them and comment for my unit	No	Yes- delegated to me	No
Delegate Question Category (POST)	All	My unit	No	No	No	No	No	No	No	No
Enrich (POST)	All	My unit	My unit	No	My unit^2	No	No	Yes- my assets	No	No
Ack / Unack Survey Questions (PATCH)	All	My unit	No	No	No	No	No	No	No	No
Ack / Unack Asset Enrichments (PATCH)	All	My unit	No	No	No	No	No	No	No	No
Pre-final Ack / Unack Survey (PATCH)	All	My unit	No	No	No	No	No	No	No	No
Final Ack (PATCH)	All	No	No	No	My unit	No	No	No	No	No
Update Question Snapshots (PATCH)	All if applicable	No	No	No	No	No	No	No	No	No
Remove Published / Active (DELETE)	All	No	No	No	No	No	No	No	No	No
Remove Completed (Reports) (DELETE)	All^3	No	No	No	No	No	No	No	No	No

^1There is a known issue with which surveys and which parts of the surveys asset delegates currently can see.

^2This might be a bug.

^3Superusers can do this through the API only, not through the GUI.

Asset Inventory Capabilities

💡

Every sheet has exactly one owning unit. It is also possible for individual people to be named as a sheet owner. Additionally, both people and units can be asset delegates. An asset delegate is a person or unit named as an Owner, IT Contact or User of a specific asset. In general, assets should reside on the sheets belonging to the units that are responsible for those assets. Keep in mind that for the purposes of assessment, it is the SHEET that determines where an asset gets assessed. When a unit is assessed with asset enrichment included, all assets on sheets belonging to that unit will be included in the assessment for that unit, regardless of whether other units may be named as an asset delegate.

Assets

Assuming the unit or individual owns the sheet.

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Sheet Owner (no role)
View (GET)	All assets on all sheets belonging to all units	My unit	My unit	No	My unit	No	My unit	My sheet
Create (POST)	Yes	My unit	My unit	No	My unit	No	No	My sheet
Edit Asset (PATCH)	All	My unit	My unit	No	My unit	No	No	My sheet
Remove (DEL)	All	My unit1^11	My unit1^11	No	My unit1^11	No	No	My sheet

Assets

Assuming the unit or individual is a delegate for the asset but not the sheet.

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Asset Owner/User/IT Contact (no role)
View (GET)	All	Yes - my unit (they won’t see other assets on the sheet)	Yes - my unit (they won’t see other assets on the sheet)	No	Yes - my unit (they won’t see other assets on the sheet)	No	No^2	My assets (they won’t see other assets on the sheet)
Create (POST)	Yes	No	No	No	No	No	No	No
Edit (PATCH)	All	No	No	No	No	No	No	No
Remove (DEL)	All	No	No	No	No	No	No	No

Sheets

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Sheet Owner (no role)
View Sheets (GET)	All	My unit owns the sheet or it has an asset on it belonging to my unit.	My unit owns the sheet or it has an asset on it belonging to my unit.	No	My unit owns the sheet or it has an asset on it belonging to my unit.	No	No	My sheets
Create Sheet (POST)	Yes- for all units	Yes- for all units	Yes- for all units	Yes- for all units	Yes- for all units	Yes- for all units	Yes- for all units	Yes- for all units
Modify Sheet (PUT)	All	My unit	My unit	No	My unit	My unit	My unit	My sheet
Remove Sheet (DEL)	All	My unit	My unit	No	My unit	My unit	My unit	My sheet

NOTE: Asset capabilities are under review and changes are likely coming soon.

^1They can remove individual assets from the sheet or delete all assets on the sheet by removing the sheet itself.

^2There is a known issue where Auditors can see the sheet but not the asset(s).

Compliance-Related Capabilities

Non-superusers can only link exception requests to assets on sheets belonging to their unit or applications belonging to their unit.

Exception Requests

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Risk Assessor	Risk Auditor
View (GET)	All	My unit	My unit	No1^11	My unit	No1^11	No	No	No
Create (POST)	Yes - all units	My unit	My unit	No	My unit	No	No	No	No
Update Request (if editable) (PUT)	All	My unit	My unit	No	My unit	No	No	No	No
Edit Status (PUT)	All	No	No	No	No	No	No	No	No
Remove (DEL)	All	My unit2^22	My unit2^22	No	My unit2^22	No	No	No	No

Risk Scores

	Superuser	Assessment Manager	IT Staff	Vendor Requester	Unit Head	User	Auditor	Risk Assessor	Risk Auditor
View (GET)	All	No	No	No	My unit	No	No	My unit	My unit
Create (POST)	Yes- all units	No	No	No	My unit	No	No	My unit	No
Edit (PATCH)	All	No	No	No	My unit	No	No	My unit	No
Remove (DEL)	All	No	No	No	My unit	No	No	My unit	No

^1Currently they can see it but they shouldn’t be able to; this is a known issue and will be fixed soon.

^2Probably should not be able to delete them once they are outside of the Requested status.