IT Infrastructure X-Ray

To gain a clear understanding of your organization’s IT infrastructure and key business processes, Compleye Online will support you in establishing the X-Ray Approach. This unique approach focuses on analyzing critical components affecting security, quality, and privacy within your business context by mapping the relationships between information assets, the individuals who interact with them, and the systems and suppliers that process them 

The X-Ray Approach provides valuable insight into defining a clear scope and boundaries for your framework, ensuring the effective implementation of necessary control measures. By adopting this approach, you can identify which aspects of your organization and IT infrastructure fall within the scope and determine where controls and documentation should be applied to maintain compliance. This process helps delineate what falls within your framework and what remains outside it, allowing you to focus on areas that require immediate attention. As a result, control measures are appropriately targeted, ensuring that your organization’s security, privacy, and quality responsibilities are effectively managed. 

Steps to Implement the X-Ray Approach: 

Step 1: Identify Security Domains: Define components where information is processed and determine the interactions between these domains. 

Examples components: 

• Cloud server environment  

• Company Servers on side 

• Integration/API environment 

• Mobile App 

• Web Application 

• App and Google Play Store 

• Customers 

• End-Users 

• Channel Partners 

• Online Officer environment  

• Office building/rooms 

• Development Team 

• Outsources Development Teams 

• Support Desk 

• Payment System(s) 

• Company Website 

• Compliance Team 
• ….. 

Step 2: Map Infrastructure Components: Identify and document the key components of your IT infrastructure to oversee and protect them effectively. 

Steps 3 Determine Scope of Coverage: Decide which components fall within the scope of your framework, focusing control measures where they are most needed. A concise scope statement serves as a foundational element of your information security framework. For instance, in the context of ISO certification, such a statement might read: “Development, design, and maintenance of the SaaS platform.” This statement should be documented appropriately for audit purposes, typically within the ISMS Mandatory Topic document, which can be accessed in the Compleye Online Templates Section., or any other document of your preference.  
 

In Compleye Online, the X-ray components are available in two distinct views, as detailed below: 

A. Overview of all X-ray components (below)

For each component, you have three options available in this view: view details, edit details, or delete the component. 

To add new components, simply click the yellow ‘ADD NEW‘ button in the top left corner of the screen. Please ensure that new components are essential to your business operations rather than for pilot projects or business development initiatives. Once added, a component becomes part of your framework, carrying responsibility for thorough assessment, implementation, and ongoing maintenance. 

Choose the type of component you wish to add from the dropdown list. The available options include: 

• App: Enter the name of your application. 

• Web Portal: Select this option for any web application used by your customers, end-users, or internal team members, and provide its name. 

• API/SDK Environment: Use this option only if the API or SDK represents a distinct part of your product or service that requires separate management. 

• Other: Choose this option for components that don’t fit into any of the predefined categories. (Additional component types are currently under development.) 

• Server Environment: Choose this for your cloud or on-premises server setups (e.g., AWS, Google Cloud, Azure, or local servers). Enter the supplier’s name and, if applicable, add multiple entries for different environments. Specify whether the server is outsourced or on-site, as this will determine the corresponding template. 

• Office Network: Use this option for your office network, whether it’s a physical location or a virtual setup for remote work. This category can also cover specialized environments like a blockchain network. 

If you can’t find an appropriate option, always select Other. 

Once you choose a type, a form will be generated for you to complete. Helpful context buttons are provided to guide you on how to address and document each field. 

Keep your information high-level for two main reasons: 

• External Audits and Vendor Assessments: Your documentation should clearly inform external stakeholders about the purpose of the component and the security measures you have in place. 

• Audit Preparation: External auditors may be invited to review this information in an observer role as part of their audit preparation. 

Please note that you can download a PDF version of this document for use during vendor assessments and external communications. Internally, it can also serve as a resource to inform new team members about your IT infrastructure. However, always ensure that confidential information is respected and not shared beyond authorized personnel. 

⇒ Once you add and save the X-ray component, you have successfully created and documented the first of the three tabs associated with it. 

B. Every X-ray component is divided into three distinct tabs: General Info, Interactions, and Change & Impact. Each tab provides detailed insights into the component’s purpose and functionality.

TAB 1: General Info: This section encompasses various fields that should be completed for each component. It’s important to note that not all information fields will apply to every component; therefore, apply discretion when filling them out, focusing on the most relevant details such as owner, asset controls, storage and monitoring. If any pertinent documents, such as diagrams or descriptions, are available, please attach them accordingly to provide comprehensive context. 

TAB 2: Interactions 

By linking compliance documentation and activities, such as Operational Planning and Control (OPCs) or Improvements, to specific X-ray components, you gain deeper insights into the management of your organization and the governance of individual components. This helps you understand how they interact and the potential impact of changes. 

To support this, you can link the following compliance activities and documentation to a component: 

• Operational Planning and Controls: Recurring operational tasks assigned to specific owners, including frequency of execution, detailed procedures, and evidence of performance and delivery. These tasks are directly linked to selected components. For example, conducting quarterly vulnerability scans for external threats. 

• Improvements: Findings and non-conformities identified through risk assessments, audits, or other evaluations that contribute to the enhancement of a specific component. For example, perform more regular disaster recovery testing. 

• Policies & Procedures: Governing policies and procedures that apply to the selected component, outlining the rules and measures required for compliance. For example: Back up Policy. 

• Suppliers: Relevant vendors or service providers associated with the component, such as Google Cloud Platform for infrastructure support. 

You can link existing compliance elements (OPC, Improvement, P&P, Supplier) to an X-ray component or create a new one directly from this interface. Clicking on a card will redirect you to the specific item for further details. 

TAB 3: Change & Impact

Purpose: 

Documenting changes is essential, not only to track what has been modified but also to capture the reasoning, impact, and evidence of implementation. 

When a Change Occurs: 

Changes can occur in various scenarios, such as: 

• Adjustments based on risk assessments or regulatory requirements. 

• Modifications identified during internal or external audits. 

•  Improvements to operational procedures or security measures. 

• Updates due to new supplier, tools, or infrastructure changes. 

Each identified and documented change can be linked to the relevant X-ray component that it is associated with or directly impacts. This ensures a clear connection between changes and the affected components, allowing for better tracking, impact assessment, and compliance management. 

How to Utilize this Tab: 

• Audit Preparation: Use this section to summarize changes for 2nd and 3rd-party audit visits. If auditors have observer access to Compleye Online, they can review changes in advance. 

• Compliance Meetings: Regularly check for updates and assess their impact on compliance components. 

Implementing a Change: 

Refer to the Security Policy Framework template, which can be accessed in the Compleye Online Templates Section. where the Change Management guidelines on when and how managing changes are described. It is recommended to use a structured checklist for change management, which can be created under the Checklists section: 
 

How to Add a Change: 

Click the yellow ‘CREATE NEW CHANGE’ button in the top right corner to open the form and document the change effectively. 

Steps to Follow: 

• Provide a clear and concise name for the change. 

• Use the General and Interactions tabs to evaluate how the change affects other compliance elements. 

• Include any additional relevant information if needed. 

• Link to a checklist in Compleye Online or any other relevant platform, such as your GitHub environment. 

• Finalize and store the update. 

Once saved, the owner of the X-ray component can review and approve the change at any time.