Every control, risk, policy, vendor, incident and audit carries a Comments tab, so the argument about a decision sits on the thing it was about instead of in someone’s inbox. Mention a colleague and they get a notification and an email, replies go one level deep so a conversation still reads in order months later, and the item’s history shows who joined it and when.
A comment sits on the item it is about, replies go one level deep, and every change to a comment is written to that item’s history.
Controls, risks, treatment actions, policies, vendors, evidence, incidents, audits, records and your collections all carry a Comments tab on their detail view, 28 kinds of item in all. Frameworks are the deliberate exception, because a centralized framework is shared across every tenant.
Reply to a comment and the answer nests under it. You cannot reply to a reply, so a conversation stays two levels and reads top to bottom. Comments carry bold, italic, underline and lists, and you can edit or delete your own. An edited comment is marked as edited, and deleting one that has replies leaves a placeholder so the answers underneath keep their context.
Type @ and pick a colleague, up to ten in one comment. They get an in-app notification and an email, as does the author of a comment you reply to. Each person sets the cadence per category in their notification settings: as it happens, one weekly digest, or off.
Comments follow the visibility of the item they sit on, and writing one needs read permission rather than update permission. So the person who can see a risk but not change it can still ask what a treatment decision was based on, and the answer stays on the risk.
Four choices behind how comments work here — each one something you can check, not an adjective.
Controls, risks, treatment actions, threat and vulnerability classes, reviews of every kind, assets, policies, vendors, questionnaires, evidence, actions, tasks, incidents, audits, records and the six collections each carry a Comments tab. Frameworks are deliberately left out, because a centralized framework is shared across every tenant.
You reply to a comment, and that is as far as it goes. Nesting stops at one level so a conversation reads top to bottom, and deleting a comment that has replies leaves a placeholder rather than orphaning the answers under it.
Visibility follows the item, and commenting needs read permission rather than update permission. Someone who can only read a risk can still ask about it, which is how the question reaches the owner instead of going into a side channel.
Creating, editing and deleting a comment each write an entry against the item, so the history shows who joined the discussion and when. The comment body itself stays out of that entry, so the audit trail never becomes a second copy of the conversation.
Hosted in Switzerland by default, in German and English, with on-premise possible. Your data and evidence are yours and exportable in full at any time, with no lock-in.
A Comments tab rides along with the items you already work in, from controls and risks to policies and the audits that review them.
Ask about a control on the control itself.
The reasoning behind a treatment decision, on the risk.
Question a clause where the clause actually lives.
Findings and the back-and-forth about them, together.
28 kinds, from controls, risks and treatment actions to policies, vendors, evidence, incidents, audits, records, questionnaires and the six collections. Frameworks are the deliberate exception: a centralized framework is shared across every tenant, so a discussion on it would not belong to one organization. Trainings, people and business roles have no Comments tab today.
Anyone who can read the item. Visibility follows it, and writing a comment needs read permission rather than update permission on purpose, so a person who can only read a risk can still ask a question about it. The mention picker offers only colleagues who can open that same item, and portal-only employees have no access to it, so they cannot be mentioned.
Comments stay out of global search. You look for the risk or the vendor, then read what was said about it, because a half-sentence surfaced away from the item it belongs to is worse than no result at all.
Placement and permission. A chat message lives in a channel and an email lives in the inboxes of whoever was copied, so neither is reachable from the risk or the policy it was about. Here the discussion sits on that item, everyone who can read the item can read the discussion, and the item’s history records who joined it and when.
Swiss-hosted by default, in German and English, with on-premise possible. Your comments are part of your data, yours and exportable in full at any time, with no lock-in.
Give every control, risk, policy and vendor a Comments tab of its own, mention the person who has the answer, and keep the reasoning next to the item instead of in an inbox nobody can open at audit time.