Information security
The isms preset installs security controls and policies, a risk register, internal audits, security incidents as cases, acknowledgements and a drive for documented information.
The isms preset is for an information security management system in the
style of ISMS.online or Hyperproof, for ISO 27001. A company maps the Annex A
controls, assesses its information security risks and links each to the
controls that treat it, audits the controls, handles security incidents as
cases and has every employee acknowledge the security policies.
Config
import { defineConfig } from "better-supabase/config";
export default defineConfig({ preset: "isms" });npx better-supabase init --preset isms starts a new project from it, and
npx better-supabase add --preset isms adds it to one you have
(CLI).
Blocks
The preset is saas plus these blocks, and
whatever they require:
| Block | Role in the app |
|---|---|
| compliance | Controls with evidence, recurring evidence tasks and policies |
| risks | The risk register and its treatment plan |
| inspections | Internal audits of the controls, with findings |
| cases | Security incidents, nonconformities and audit findings |
| acknowledgements | Read and understood records for the security policies |
| drive | Documented information: the scope, the statement of applicability |
The blocks require versions, pipelines, forms, attachments and enrollments, which the preset installs with them.
How the blocks connect
A risk links to the controls that treat it through mitigated_by, and the
heatmap shows the residual risk after them. An inspection assesses the
controls it audits, each finding names its control, and a nonconformity
raises a finding case. A security incident is an incident case, and when
it shows a risk came true it links to that risk through materialized_as.
Each published policy version asks the members to acknowledge it.
The preset leaves out the drive's document control. Add numbering,
approvals and state-machine and set blocks.drive.options.control to
release documents through an approval
(controlled documents), or start from
qms, which has both.
With ReUI
- Control posture per framework.
- Risk register and risk heatmap.
- Case board for incidents.
- Acknowledgement inbox.
Last updated on
Environment, health and safety
The ehs preset installs incidents and near misses as cases, safety inspections, a risk register, training and licences as qualifications, equipment in assets and acknowledged procedures.
Construction
The construction preset installs punch lists and RFIs as work items, sites in assets, daily logs as forms, drawings with revisions, comments and submittal approvals.