How can I create new roles?

Creating a role that grants basic view access (including the ability to create new forms in a tool):

• Navigate to System Admin → Roles → Add New Role.
• Enter a clear name and description for the role.
• Under Basic View Permissions, click Add Permission.
• Configure the permission: Select the module (tool) to which the role applies. In Organization / Asset, select the asset for which you want to grant access. In Instance, select either:
• • A specific instance, or
  • All Existing Instances.

This determines whether the role grants access to only one Instance or to all current and future Instances under the selected asset.

• Save the role. You can now assign it to users through the Roles tab in Admin view.

Creating a role that grants access to assessment-type tool forms (for example, in the Information Security Incidents tool):

• Navigate to System Admin → Roles → Add New Role.
• Enter a clear name and description for the role.
• Under Permissions, click Add Permission.
• Configure the permission: In Action, select "Assessment: Read and Edit Access to Forms (Asset)". Select the asset to which the role should apply. In Restrictions, select the module (tool) if you want to limit the role to a specific assessment-type tool and prevent access to forms in other assessment tools.
• Save the role. You can now assign it to users through the Roles tab in Admin view.

Creating a role that grants access to reporting-type tool forms (for example, in the ERM Enterprise Risk Management tool):

• Navigate to System Admin → Roles → Add New Role.
• Enter a clear name and description for the role.
• Under Permissions, click Add Permission.
• Configure the permission: In Action, select "Report: Read and Edit Access to Forms (Asset)". Select the asset to which the role should apply. In Restriction, select the module (tool) if you want to limit the role to a specific reporting-type tool and prevent access to forms in other reporting tools.
• Save the role. You can now assign it to users through the Roles tab in Admin view.

Additional notes and limitations

• Some roles cannot be edited or deleted, such as certain default system roles or training-related roles.
• If role visibility or permission inheritance does not work as expected, verify the role’s asset scope, organizational restrictions (parent vs. child level) and any module-specific settings that may affect permissions.

Best practices

• Use consistent naming conventions for roles, for example: ERM – Finance Department – Read and ERM – Finance Department – Edit
• Test role changes with a limited group of users before rolling them out to a larger audience.

Updated on: 20/10/2026