Define Business Entity
Once you complete the first step- Set up Enterprise Profile,the second step in evaluating the overall risk of critical business applications involves defining a business entity and its associated asset tags. This section offers guidelines on how to create a business entity.
You can create up to 50 Business Entities. To add a new one after reaching the limit, delete an existing entity.
Review and Organize Business Entities
Before you create business entities, review how your organization is structured and decide how to organize the entities. A well-planned structure helps ETM associate assets with the correct business areas, so that each business entity reflects the risk of the assets that support it.
Review Existing Business Entities
Before you define a new business entity, review the entities that already exist:
- Navigate to Inventory > Business Entities to view the business entities that are already defined. This review helps you avoid creating a duplicate of an entity that a colleague has already defined.
- Check the number of existing business entities. You can create up to 50 business entities, so reserve them for the business areas that you want to monitor.
- If your organization already uses Qualys asset tags, review the existing tags. You can reuse them to identify the assets of each business entity.
Choose an Organizing Approach
Choose the approach that matches how your organization assigns ownership and remediation responsibilities. The following table lists common approaches:
| Approach | Examples | Use This Approach When |
|---|---|---|
| Business application or service | Checkout Application, Online Banking, Order Management | You want to measure the risk of the applications and services that the business depends on. |
| Business unit or department | Finance, Customer Support, Marketing and Sales | Each department owns its assets and is responsible for remediation. |
| Region or location | North America Operations, EMEA Data Center | Regional teams own the assets and remediation in their locations. |
| Subsidiary | A company that your organization acquired | Subsidiaries operate separately and report risk independently. |
Use one primary approach so that the structure stays consistent and easy to maintain. Start with the business areas that are most critical to your organization, and add other entities over time.
Prepare the Details for Each Business Entity
Collect the following details for each business entity before you start the onboarding step:
| Detail | Guidance |
|---|---|
| Name, title, and description | Use a clear naming convention so that users can identify each entity easily. Use the description to explain the purpose and scope of the entity. |
| Location | Identify the country, state, and city where the business entity operates. |
| Asset tags | Identify the tags that mark the assets of the entity. A business entity can include one or more tags. If the required tags do not exist, create them before or during the onboarding step. |
| Owner | Identify the team that is responsible for the risk and remediation of the entity. |
| Risk quantification (optional) | Estimate the business value of the entity, the currency, and the minimum and maximum financial impact of each loss type. |
| Risk appetite (optional) | Decide the TruRisk score threshold that the entity accepts. Consider a lower threshold for entities that support critical operations. |
Example: An organization creates an Online Banking business entity. The organization assigns the Digital Banking team as the owner and applies an Online-Banking tag to the servers and databases that support the application. ETM then calculates the risk of Online Banking from the assets that carry the tag.
Keep Business Entities Current
Your organization changes over time, so review your business entities regularly:
- Update business entities when your organization adds applications, reorganizes teams, or acquires companies.
- Make sure that new assets receive the correct tags, so that ETM includes them in the risk of the business entity.
- Review the business value, loss estimates, and risk appetite of each entity as your risk program matures.
- Delete business entities that you no longer need. Deleting an entity also frees capacity within the limit of 50 business entities.
Create Business Entity
After you complete the Set up Enterprise Profile step, perform the following steps to create a business entity:
- Click Create Business Entity.
- Provide the Business Entity's Name, Title, and Description.
The Title and Description fields ensure you provide an easily understandable Business Entity name. - Select your location from the Country, State, and City drop-down.
- Click
to select tags. The Select Tags dialog displays the tags available in your account. Select and add the desired tag(s).
To create a new tag, click Create New Tag.The following screenshot displays the Basic Information, Location, and Select Tags field of the Business Entity onboarding page:
To learn about Create New Tag, refer to the instructions from step 2 of the Configure Tags in CSAM section.
-
(Optional) Enable the Risk Quantification toggle and provide your organization's monetary Business Value along with the Currency in which it should be calculated. Then, select or add your potential Loss Type and adjust the slider to estimate the Minimum and Maximum monetary impact caused by the Loss Type.
Currency dropdown is available if a subscription has Business Entities with multiple currencies.
- (Optional) Enable the Risk Appetite toggle to define the TruRisk™ Score threshold for the Business Entity.
- Click Save to create the business entity successfully.
-
Click Next. The page to configure connectors appears.
After you complete all three onboarding steps, you can view the business entities from the Inventory > Business Entities tab. For more information, refer to the View All Defined Business Entities.