COMPLIANCE365

Checkpoint · Help

Checkpoint help

Short guides for the things people do most, and a plain description of every screen. The same help is inside Checkpoint: press Help at the top of any screen.

How do I…?

Find your way around

Your first time in Checkpoint, or when you are not sure what to do next.

  1. Open Start here. It shows which step of the build you are on, what to do now and what comes after.
  2. The Next step bar at the top of every screen shows the one thing to do next, with a button that takes you there.
  3. My tasks lists everything assigned to you by name, with a button for each.
  4. The search box at the top (Ctrl or ⌘ K) finds any record, screen or command.
  5. The menu shows the screens most people need. Show full menu, at the bottom of it, lists every screen.

Try it in the demo: Start here

Link evidence to a control

A control or requirement is in place and you need to show the auditor the proof.

  1. Save the proof (a screenshot, an export, a signed document) in SharePoint or OneDrive.
  2. Open the Statement of Applicability and select the control to open its side panel.
  3. Choose Link evidence and paste the link to the file.
  4. For a management system requirement (Clauses 4 to 10), do the same from Management system clauses.
  5. Checkpoint checks the link opens and flags evidence that has gone out of date.

Try it in the demo: Statement of Applicability

Approve a policy or document

A policy has been drafted and needs to be signed off.

  1. Open Documents. Each policy shows its status: draft, in review or approved.
  2. Open a draft and read it. Change anything that does not match how you actually work.
  3. If a second person must check it first, choose Ask for review.
  4. Then choose Request approval to send it to top management, or Approve if you are the approver.
  5. The approved version is recorded with the approver’s name and date, and goes on the exported document.

Try it in the demo: Documents

Run the Microsoft 365 posture scan

At the start, and whenever you want fresh evidence of your security settings.

  1. Choose Run posture scan at the top right of any screen.
  2. Checkpoint reads your Microsoft 365 settings. It never changes them.
  3. Each check shows pass, review, fail or manual. Manual means Microsoft 365 cannot show it, so you confirm it yourself.
  4. Failed checks become proposed risks with actions. Approve the ones you agree with to add them to the risk register.

Try it in the demo: Posture scan

Add and treat a risk

You have found something that could go wrong and need to record what you will do about it.

  1. Open the Risk register and choose + Add risk.
  2. Describe the risk and score its likelihood and impact.
  3. Choose a treatment (reduce, avoid, share or accept) and give it an owner.
  4. A risk above your agreed risk appetite stays only if top management accepts it in writing.

Try it in the demo: Risk register

Send policies to staff to acknowledge

Policies are approved and staff need to confirm they have read them.

  1. Open Policy attestation and choose + New campaign.
  2. Choose the approved policies and who should receive them.
  3. Choose Preview recipients to check the list, then Launch campaign.
  4. Progress shows on this screen: who has acknowledged and who has not.

Try it in the demo: Policy attestation

Run the internal audit

Before the certification audit, and at least once a year after it.

  1. Open Internal audits and choose + Schedule audit, or Plan the next 12 months to spread audits across the year.
  2. When the audit is due, open its Workpack and record the result of each check.
  3. Findings become actions with an owner and a due date.
  4. The completed audit report is ready for the certification auditor.

Try it in the demo: Internal audits

Give your auditor access

Your certification audit is booked and the auditor needs to see the records.

  1. Open the Auditor guide and choose Give an auditor access.
  2. Enter the auditor’s name, email, certification body and the dates of the audit.
  3. They sign in as a guest and see Checkpoint read-only, starting on the Auditor guide.
  4. Checkpoint reminds you to remove their access when the window ends.

Try it in the demo: Auditor guide

Work through your tasks

Something has been assigned to you.

  1. Open My tasks. The first card is the next thing to do and roughly how long it takes.
  2. Each task has a button that opens exactly what needs doing.
  3. A finished task drops off the list. Checkpoint can email you a weekly summary of what is waiting.

Try it in the demo: My tasks

Screen by screen

What each screen is for and what you do there, in the order they appear in the menu.

My tasks

What it is. Everything assigned to you by name, each with the one button that does it.

What you do here. Work down the list. Checkpoint emails you when something new arrives.

Open My tasks in the demo

Dashboard

What it is. The overview: how ready you are for certification, what needs attention and what to do next.

What you do here. Start with Do next.

Words used on this screen
ISMS
Information security management system: the policies, people and routines an organisation uses to manage information security. ISO 27001 certifies it.
ISO 27001
The international standard for managing information security. Certification means an independent auditor has checked the ISMS works.

Open Dashboard in the demo

Guided build

What it is. The management system built one stage at a time, in the order it is actually done, with the clauses each stage completes.

What you do here. Work through the current stage; each item has the button that does it.

Words used on this screen
ISMS
Information security management system: the policies, people and routines an organisation uses to manage information security. ISO 27001 certifies it.
Clause
One of the requirements in the main body of ISO 27001 (Clauses 4 to 10): how the management system itself is run.
Annex A
The 93 security controls listed at the back of ISO 27001, from access control to backups. You choose which apply.
Risk appetite
How much risk the business is willing to accept. Risks above it must be reduced, or accepted by top management.

Open Guided build in the demo

Who does what

What it is. Who is responsible for what in the management system.

What you do here. Check every area has an owner; reassign anything held by someone who has left.

Words used on this screen
ISMS
Information security management system: the policies, people and routines an organisation uses to manage information security. ISO 27001 certifies it.

Open Who does what in the demo

Posture scan

What it is. The automatic check of your Microsoft 365 security settings, with what passes, what fails and how to fix it.

What you do here. Fix what fails, starting at the top. Each failure becomes a risk or an action.

Words used on this screen
Posture scan
Checkpoint’s automatic check of your Microsoft 365 security settings.
Control
A safeguard that reduces a risk, such as multi-factor sign-in, backups or a supplier review.

Open Posture scan in the demo

Risk register

What it is. The risks to the organisation’s information, how serious each is and what is being done about it.

What you do here. Keep each risk owned and treated; review them when something changes.

Words used on this screen
Risk appetite
How much risk the business is willing to accept. Risks above it must be reduced, or accepted by top management.
Inherent risk
The risk before any controls are applied.
Residual risk
The risk that is left after the controls are in place.
Risk treatment
What is being done about a risk: reduce it, avoid it, share it (for example insurance) or accept it.

Open Risk register in the demo

Actions register

What it is. Every fix and improvement someone has agreed to do, with an owner and a due date.

What you do here. Update an action when it is done, with the evidence.

Words used on this screen
Nonconformity
Something that does not meet a requirement, found by an audit or a review. Major ones stop certification until fixed.
Corrective action
The fix for a nonconformity, including why it happened, so it does not happen again.

Open Actions register in the demo

Supplier risk

What it is. The suppliers that hold or can reach your information, and how they have been checked.

What you do here. Review critical and high suppliers each year and keep their certificates current.

Open Supplier risk in the demo

Asset register

What it is. The information and systems the organisation needs to protect, each with an owner.

What you do here. Add the information itself (customer data, HR records); devices and apps sync from Microsoft 365.

Open Asset register in the demo

Statement of Applicability

What it is. The 93 ISO 27001 security controls: which apply, why, and how each is met.

What you do here. For each applicable control, record how it is met and attach the evidence.

Words used on this screen
Statement of Applicability
The list of the 93 security controls in ISO 27001 Annex A, saying which apply to you, why, and how each is met. The auditor reads it first.
Annex A
The 93 security controls listed at the back of ISO 27001, from access control to backups. You choose which apply.
Control
A safeguard that reduces a risk, such as multi-factor sign-in, backups or a supplier review.
Evidence
A record that shows something is done: a report, screenshot, approved document or minutes. Auditors ask to see it.

Open Statement of Applicability in the demo

ASD Essentials

What it is. ASD Essentials for enterprise IT: 58 actions under 28 principles, rated in each domain they apply to. ASD scores each principle by its weakest action.

What you do here. Rate the next action, starting with the capability domains and phase 1. Tick the indicators of good practice you see, then record your reasoning and evidence.

Open ASD Essentials in the demo

Management system clauses

What it is. The requirements for running the management system itself (ISO 27001 Clauses 4 to 10).

What you do here. Open a clause and use Finish this clause to close what is left.

Words used on this screen
Clause
One of the requirements in the main body of ISO 27001 (Clauses 4 to 10): how the management system itself is run.
Evidence
A record that shows something is done: a report, screenshot, approved document or minutes. Auditors ask to see it.

Open Management system clauses in the demo

Documents

What it is. The organisation’s policies and procedures, with their version, owner, approval and review date.

What you do here. Generate, edit and approve documents; review each by its date.

Open Documents in the demo

Policy attestation

What it is. Who has read and accepted each policy.

What you do here. Send each new policy version to staff; Checkpoint chases anyone outstanding.

Words used on this screen
Attestation
A person’s confirmation that they have read and accepted a policy.

Open Policy attestation in the demo

Training

What it is. Security awareness training and who has completed it.

What you do here. Assign the courses each year; Checkpoint chases anyone outstanding.

Open Training in the demo

Certification

What it is. The certification audits: what each stage needs, the bookings and, once certified, the three-year cycle.

What you do here. Work through the gate checklist, then book Stage 1 and Stage 2.

Words used on this screen
Stage 1
The certification body’s first visit: they check the ISMS is documented and ready.
Stage 2
The certification audit itself: they check the ISMS is working, by sampling records and talking to people.

Open Certification in the demo

Internal audits

What it is. Your internal audits: the plan, the checklists and the findings.

What you do here. Run each planned audit and record its findings.

Words used on this screen
Internal audit
Your own check that the ISMS works, done before the certification auditor does theirs.
Nonconformity
Something that does not meet a requirement, found by an audit or a review. Major ones stop certification until fixed.

Open Internal audits in the demo

Management review

What it is. The leadership security meeting, and the management reviews it records: what was decided, the Clause 9.3 coverage over the year, and the conclusion on the ISMS.

What you do here. Set up the meeting once. Each month take the minutes in the agenda: close, extend or reassign actions and accept or treat risks as you go. Yearly topics join the agenda when due; at the management review meeting the chair records the conclusion.

Words used on this screen
Management review
A meeting where top management reviews how the ISMS is going and records decisions. Required at least once a year.

Open Management review in the demo

Objectives register

What it is. This year’s measurable security goals, who owns each and how they are going.

What you do here. Keep each objective measured and updated.

Words used on this screen
Objective
A measurable security goal for the year, with an owner and a due date.

Open Objectives register in the demo

Compliance calendar

What it is. Every recurring security activity and when it is next due.

What you do here. Complete each when due and attach the record.

Open Compliance calendar in the demo

Incidents

What it is. Security incidents: what happened, how it was handled and what was learned.

What you do here. Log every incident, however small, and record the lessons.

Open Incidents in the demo

Audit reports

What it is. Reports and packs to share with top management, auditors and customers.

What you do here. Generate what you need; most can be filed as evidence in one click.

Open Audit reports in the demo

Integrations

What it is. Where Checkpoint gets its evidence from, and whether each source is reporting.

What you do here. Set up the sources you use; each card has the steps.

Open Integrations in the demo

Settings

What it is. How Checkpoint is set up for this organisation.

What you do here. Fix anything the setup health check flags; most settings are set once.

Open Settings in the demo

Still stuck?

Inside Checkpoint, Help has a "Tell Compliance365" button that sends us what you were trying to do and the screen you were on. Or contact us directly. Setting Checkpoint up for the first time? How Checkpoint works walks through sign-in, set-up and the first scan.

Microsoft Teams