6clicks Hub & Spoke expert guide

This article guides organizations through the 6clicks Hub & spoke model, providing steps on how to architect Spokes to meet their needs as well as best practices for deployment.

Topics covered in this article:

  1. What is the Hub & Spoke?

    1.1    The problem

    1.2    The model and solution

    1.3    Typical use cases

  2. Benefits of the Hub & Spoke
  3. Architecting the Hub & Spoke for your organization

    3.1    Understanding the Hub vs a Spoke

          3.1.1    Content management 

          3.1.2    Data management

          3.1.3    Reporting

    3.2    Architecture/use case examples

          3.2.1    Holding company with many subsidiaries

          3.2.2    Healthcare organization managing multiple hospitals

          3.2.3    Technology provider managing multiple ISO 27001 certifications across products 

          3.2.4    Managed service provider delivering across multiple clients and service lines

    3.3    How to define a Spoke to meet your needs

  4. Access management for the Hub & Spoke

    4.1    Access management at the Hub

          4.1.1    Hub-level Role-Based Access Controls (RBAC)

          4.1.2    Controlling access to Spokes

    4.2    Access management at the Spokes

  5. Configuration and content lockdown

    5.1    Mandating configuration across all Spokes from the Hub

    5.2    Locking content at the Hub

  6. Scaling the Hub & Spoke model

    6.1    Leveraging Spoke groups for hierarchy management

    6.2    Managing teams across geographies

  7. Digital resources for 6clicks Hub & Spoke customers
  8. FAQs

    8.1    Why would I choose the Hub & Spoke over a standalone spoke license?

    8.2    How does the Hub & Spoke work for consultants, advisors, systems integrators, and managed service providers?

    8.3    Can you configure a Hub to connect to a Hub?

    8.4    Are there limitations to using Hailey in this model?

    8.5    How can I be sure data is segregated?

    8.6    In which case is a Spoke NOT required in the Hub & Spoke model?

    8.7    As a Spoke, am I limited to the content and configurations that are pushed into my environment from the Hub?

    8.8    How long does a typical Hub & Spoke deployment take?

    8.9    How many full-time employees would you recommend I need to manage a Hub & Spoke deployment?

    8.10    In the Hub & Spoke model, how would I employ a sandbox environment for non-production testing?

    8.11    How should I prepare for a Hub & Spoke implementation?

  9. Getting started on your Hub & Spoke journey

    9.1    6clicks contacts

    9.2    6clicks success plans

  10. Appendix A: List of out-of-the-box reports

    10.1      Hub level

    10.2    Spoke level

    10.3    Power BI

1. What is the Hub & Spoke?

1.1   The problem

Michael Rasmussen, world-renowned GRC analyst and owner of GRC 20/20, published a solution briefing on the 6clicks Hub & Spoke model where he outlined the problems distributed organizations face today. According to him, businesses today are distributed, dynamic, and disrupted as relationships and processes operate independently yet interconnectedly, while risks and regulations undergo constant change.

The complexity of business – combined with the intricacy and interconnectedness of risks and objectives – necessitates the implementation of an integrated GRC management strategy, process, and architecture that can allow distributed and diversified businesses to work autonomously but provide some consistency in management and reporting.

Read the full perspective of Michael Rasmussen on the 6clicks Hub & Spoke model in this solution briefing.

1.2   The model and solution

Built for multi-entity organizations and various use cases, the Hub & Spoke model provides customers with a flexible way to run GRC programs across multiple teams, departments, or businesses. It allows organizations to centralize their risk and compliance functions while empowering and providing teams with the autonomy they need to succeed.

Think of it as multi-tenancy for the enterprise or managed clients, making it the perfect solution for large businesses, multinationals, franchises, private equity firms, government agencies, and managed service providers (MSPs). With the Hub & Spoke model, organizations can quickly and easily define the hierarchical structure that works best for them, which includes parent-child relationships between entities.

The Hub makes it possible to define risk and compliance best practices and content centrally, which is 'pushed down' to Spokes (teams, departments, or businesses) that utilize the full suite of 6clicks GRC modules for day-to-day activities. Consolidated reporting and analytics are rolled up at the Hub level, giving the organization comprehensive, aggregated reporting and insights across all Spokes.

1.3    Typical use cases

The Hub & Spoke is ideal for organizations overseeing distributed teams, departments, or businesses, regardless of industry. The Hub & Spoke model has broad applications across various organizational types. Typical use cases include:

  • Organizations that are managing GRC programs across:
      • Organizational divisions or subsidiaries
      • Geographical regions and/or jurisdictions
      • Portfolio companies and related, managing the due diligence of acquisition targets
      • Franchises
      • Healthcare networks
      • University systems
      • Local, state, or federal government departments
      • Distributed entities
      • Product lines
  • GRC service delivery to clients through consultants, advisors, systems integrators, or managed service providers (MSPs)
  • Managing risk registers across multiple product lines, business units, or teams
  • Managing an enterprise risk management program
  • Managing organizational entities whose risk and compliance needs are widely varied
  • Managing compliance regulations or certifications across multiple product lines, business units, or teams
  • Reporting on GRC programs across hierarchical organizational structures
  • Managing sensitive projects and authorized personnel access across GRC programs

If you’re unsure if this model is right for you and you would like to discuss your needs and organizational structure to determine the best architecture design for your use case, contact us here.

2. Benefits of the Hub & Spoke

The Hub & Spoke's bidirectional data model allows for a truly holistic single-pane-of-glass view into a hierarchical GRC program. It helps you streamline, automate, and closely manage your GRC program while scaling with your business as it expands, providing a flexible and cost-effective platform built to optimize risk and compliance. Some of the primary benefits are:

  1. Clear segregation between entities
    • Easily manage autonomous GRC programs across subsidiaries, departments, regions, franchises, private equity portfolio companies, service clients, healthcare networks, university systems, state municipalities, etc.
    • Each entity can operate largely autonomously, adopting functionality at its own pace.
    • Each team's data can be managed individually, including the team configuration, user access, and permissions.
  2. Ease of content management across a distributed business model
    • Content within the 6clicks library can be tailored and made available for each managed entity.
    • Entities can manage custom content within their 6clicks instance in addition to the standardized content provided by the parent or Hub-level organization.
  3. Hub-level management capabilities
    • Users at the Hub level can create templated entities with assessment templates, policies, risks, projects, and incident response playbooks to enforce a standardized approach to GRC.
    • Users within the Hub team can access each entity's account as an advisor/manager.
    • The Hub can initiate risk reviews to get a quick snapshot of risks within the entities at a board or senior executive level.
  4. Cross-functional data visibility and roll-up reporting
    • Template reporting across entities to ensure real-time and holistic risk reporting
    • Reduce audit fatigue and alleviate the hassle of tracking down data across entities
    • Establish interoperability between systems and bring all GRC and Security data into one platform
    • Holistically manage your security and risk posture at the Hub, while entities mature at their own pace

In short, developing a holistic view of your organization's GRC program using 6clicks' Hub & Spoke creates immediate value and ROI for your organization.

3. Architecting the Hub & Spoke for your organization

3.1   Understanding the Hub vs a Spoke

The Hub provides a centralized 'parent' team, which oversees a number of 'child' teams called Spokes. Spokes typically represent a team, department, service line, business, or entity running a GRC program and require some level of separation and autonomy.

The Hub is where content, such as audits and assessments, control sets, and risk and issue libraries are created and global configurations are defined. These are then 'pushed' down to Spokes, where daily GRC-related activities are undertaken. Team members at the Hub can manage Spokes they have access to and support their activities. Additional team members can be added directly to Spokes, limiting their access to a single Spoke and providing flexible user access management options.

Moreover, Spoke templates can be defined at the Hub, which are 'shell' Spokes with pre-populated content. Spoke templates expedite Spoke provisioning and enablement, meaning you can spin up turnkey Spokes in seconds. You can also define Spoke hierarchies using Spoke groups, which provide a powerful and structured way to define, manage, and report on and across your organizational hierarchy.

3.1.1   Content management

From the Hub, you can create and manage content such as assessments, control sets, authorities, playbooks, and more and distribute them to Spokes. You can also use content from the 6clicks Content Library.

Learn more about pushing content to one or more Spokes.

In addition to the Hub team managing and publishing content, Spokes are empowered to create and manage their own content and templates as required. This ensures full flexibility for teams to manage their risk and compliance content needs.

3.1.2   Data management

In 6clicks nomenclature, content refers to templates used throughout the platform, such as standards, laws, regulations, compliance frameworks, assessment templates, control sets, issue and risk libraries, and projects or playbooks, while data represents the tasks or actions created in a workflow using a template or piece of content, such as assessment tasks, issue actions, or control responsibilities.

While content can be managed and distributed from a Hub or within a Spoke, data is only managed within each Spoke. The Hub can access Spoke data at the Hub level for reporting purposes but cannot manage Spoke data – data and task management activities are conducted within a specific Spoke.

3.1.3   Reporting

Organizations can aggregate reporting at the Hub level and gain comprehensive insights across all Spokes. For more flexible reporting, use hierarchical Spoke groups to define an organizational structure for your Spokes.

You can also template dashboards at the Hub level and share them down to Spokes using Spoke templates. This ensures that Hub-level users see the information and reports they require for their respective Spokes in a standardized manner. Spokes can also create their own dashboards that are separate from the Hub-shared template.

Aside from dashboard reports, 6licks offers various reporting formats such as PDF, Excel, and Word for external delivery as well as options to build real-time PowerPoint presentations and Word document reports within the platform. Additionally, organizations can present their GRC data in a format that meets their specific needs using our self-service reporting options.

Below are a few examples of board and executive-level reporting using the Hub & Spoke model:

Compare assessment results across Spokes for benchmarking:

Identify trends in your data using progress and trending charts:

Show control effectiveness and control testing results:

Track overall program tasks across one or more entities:

3.2   Architecture/use case examples

In each of the diagrams and use case examples below, the following color key can be used:

  • Navy blue - Represents the Hub tenant
  • Yellow - Represents a Spoke group or categorization of Spokes
  • Orange - Represents a separate Spoke/autonomous GRC program

3.2.1   Holding company with many subsidiaries

The 6clicks Hub & Spoke model enables a holding company that owns or operates hundreds of offices or subsidiaries across many countries or jurisdictions to manage each subsidiary autonomously and handle the growth of multiple subsidiaries per year.

In the below architecture example, the parent company is the Hub and the subsidiaries are grouped Spokes under their respective regions. The parent company can publish US-specific policies, for example, to all subsidiaries in the US region.

3.2.2   Healthcare organization managing multiple hospitals

With Hub & Spoke, a healthcare provider with multiple entities or divisions, either in various locations or all in one, can allocate a 'Super Administrator' with full view and access management.

In this example, the Healthcare Headquarters operates as the Hub and has categorized its Spokes by General Care, Emergency/Urgent Care, and Specialist Care with different locations and units each operating as its own Spoke. This empowers each location to manage its assets, risks, and HIPAA compliance, for example, separately from one another while maintaining visibility at headquarters.

3.2.3   Technology provider managing multiple ISO 27001 certifications across product lines

The Hub & Spoke can standardize tools and techniques for documenting and managing an ISMS. Using the Hub & Spoke, an organization can enforce compliance requirements while business units autonomously manage their respective risk and compliance obligations, providing the organization with a bird's-eye view of each business line’s compliance levels.

In the depiction below, the Corporate Org is the Hub managing multiple products or Spokes, each with its own ISO 27001 certification and ISMS needs. In this example, the Corporate Org at the Hub level has visibility into the required overall compliance levels while leaving the management of each ISMS to the respective product line teams.

3.3.4   Managed service provider delivering across multiple clients and service lines

In this example, the MSP offers three service lines: ISO 27001 Readiness, Vendor Management as a Service, and vCISO services. The MSP can create content such as a proprietary vendor assessment template, for example, and share it with clients or Spokes who require vendor management services.

Each client operates in their own Spoke with the MSP delivering the required services. Clients can also be grouped into one or more service lines based on their agreement with the MSP.

Read our customer success stories for more Hub & Spoke use cases.

3.3   How to define a Spoke to meet your needs

The Hub & Spoke model allows for a lot of flexibility in its architecture. Here are a few questions to guide how you should define a Spoke for your organization:

  • Do we currently have autonomous entities or subsidiaries? These constitute a Spoke, where each subsidiary can operate its respective GRC program in its own Spoke environment.
  • How do we manage risks presently? Do we need to segregate our risk register between multiple teams, divisions, or products and ensure no cross-functional data visibility?
  • Are we managing multiple ISMS programs across various business units or subsidiaries?
  • How do we segregate data in our GRC program? By team, product, use case, or something else?
  • Do we have teams with varying use cases or tools that we want to integrate into one platform? Generally, in this case, it is ideal for each team to have its own Spoke.

4. Access management for the Hub & Spoke

In the Hub & Spoke model, access control is multilayered to support granular requirements at both the Hub and Spoke levels. Organizations can control: 1) who has access to the Hub and what level of access, 2) who has access to multiple Spokes and what level of access in each, and 3) which team members have access to only one Spoke.

4.1   Access management at the Hub

4.1.1   Hub-level Role-Based Access Controls (RBAC)

There are several roles in 6clicks for managing access at the Hub level. These are:

  • Administrator – All permissions are granted to this user by default. This user can see all data and perform all functional actions across all modules within the Spoke.
  • Advisor – Nearly synonymous with Administrator-level permissions with the exception of Spoke group management functions that are used for managing multiple Spokes.
  • Contributor – This user role only has access to the risk review functionality at the Hub.
  • Owner – Owners have access to view and manage risk reviews at the Hub but no other functionality.
  • User – This is the default role at the Hub level. The user has access to create, edit, update, and push all content types to Spokes and manage Content Library items. Effectively, this role has permissions to all Hub-level data and functionality except the Administration panel (i.e. managing users, permissions, integrations, etc.)

In addition to the out-of-band (OOB) roles, organizations can also create their own Hub-level roles or modify the roles provided. There are varying levels of permissions or Hub-level access control functions to enable proper segregation of duties and privileges.

4.1.2   Controlling access to Spokes

Core risk and compliance members interacting and engaging with entities across the organization have RBAC permissions. This means they can only see and access the teams they are working with directly. All this can be managed by the centralized Hub team.

A user having access to the Hub doesn’t mean they have been granted access to Spokes. This is purposefully maintained separately to ensure granular and flexible access controls.

If your organization would benefit from all Hub-level users automatically gaining access to all Spokes, this can be enabled on a role-by-role basis at the Hub. To give a certain Hub role access to all Spokes, from the Hub, navigate to Administration > Roles > click on a role > Edit > check the “Access All Spokes” option under General:

If turned on for a role, any user with that role assigned at the Hub level will automatically gain access to all Spokes in the environment with the role of ‘Advisor.’

You can also enable this Spoke access option on a user-by-user basis from the Hub by navigating to Administration > Users > choose a user > Edit > check the “Access All Spokes” option under General in the Permissions tab.

4.2   Access management at the Spokes

OOB roles for managing access at the Spoke level are also available in 6clicks. These are:

  • Administrator – All permissions are granted to this user by default. This user can see all data and perform all functional actions across all modules within the Spoke.
  • Advisor – This is a Hub-level user who has been granted permission to the Spoke. By default, this user adopts the same access levels as the Administrator role.
  • Contributor - This user role only has permission to view the risk review functionality, complete risk reviews, and see risks in the register they’ve explicitly been granted access to via the Access Members list.
  • Owner – This role can manage, create, and view risk reviews and risks in the system. However, this permission does not grant access to all data. Owners can only access risks they have explicitly been granted permission to on the Access Members list.
  • User - This is the default role at the Spoke level which is automatically given to users who are added to the environment without a role specified. Similar to the Hub, this role has all available permissions and data visibility at the Spoke except for Administration panel functions and risk workflow staging management.

In addition to these roles, organizations can create their own Spoke-level roles or modify the roles provided. There are varying levels of permissions available at the Spoke level to enable proper segregation of duties and privileges.

View the full list of access control functions at the Spoke level.

5. Configuration and content lockdown

5.1   Mandating configuration across all Spokes from the Hub

Understanding the importance of process standardization, we enable organizations to define workflows and custom fields at the Hub level and enforce them down at the Spoke level. This ensures that all Spokes are following the same risk methodology and other best practices.

For mandating risk framework or methodology across all Spokes, learn more about managing Risk Fields and defining risk workflows at the Hub.

5.2   Locking content at the Hub

A Hub-level administrator or partner (MSP) may utilize our content-locking option on templates created at the Hub to prevent editing by a Spoke and ensure standardization. This is an optional feature and can be used on a template-by-template basis across assessment templates, control sets, project plans, and playbooks.

For example, Hub-level administrators can configure a proprietary assessment template and lock it for editing to ensure Spokes are using a standardized and mandated assessment approach. This is possible for various content template types at the Hub level. This means that if a locked template is downloaded in a Spoke environment, it cannot be modified by the entity before use. A locked piece of content can be identified by the lock icon at the Hub and Spoke levels, as in this example:

 

Learn how to lock different types of content such as an assessment template.

6. Scaling the Hub & Spoke model

By design, the Hub & Spoke model is scalable both horizontally and vertically. This enables organizations to continue to adapt their 6clicks solution to a growing and changing organization.

6.1   Leveraging Spoke groups for hierarchy management

Spoke groups allow you to organize Spokes into groups for categorization, better management, and organization. Groups can be set up to have parent-child relationships, giving you the flexibility to create your organizational structure or better organize clients. A Spoke can belong to one or more groups in this hierarchical model.

Using Spoke groups, organizations can filter Hub-level reporting based on groups, share content based on groups, and more.

In the below example, the Spoke groups are represented by regions. The parent company can publish US-specific policies, for example, to all subsidiaries in the US Region Spoke group.

 

Learn how to manage your organization’s hierarchy needs with Spoke groups.

6.2   Managing teams across geographies

For organizations with teams or entities in multiple geographies, we have a few options:

  • Create your Hub environment in the geography with the highest concentration of entities or the strictest data sovereignty rules and use Spoke groups to organize Spokes into their respective region(s); or
  • Create multiple Hub environments – one in each geography (Learn more about establishing a Hub-to-Hub connection)

Either of these options provides a viable solution for organizations operating globally. Learn more about our current data center locations for hosting your 6clicks Hub & Spoke environment. You may also contact us for your preferred hosting location.

7. Digital resources for 6clicks Hub & Spoke customers

For organizations getting started in a Hub & Spoke deployment, we recommend the following expert guides in addition to the various Knowledge Base articles linked throughout this guide:

8. FAQs

8.1   Why would I choose the Hub & Spoke over a standalone spoke license?

The 6clicks standalone spoke license is perfect for small to medium-sized organizations managing a single GRC program. The Hub & Spoke license is the best option for organizations managing GRC programs across multiple teams.

8.2   How does the Hub & Spoke work for consultants, advisors, systems integrators, and managed service providers?

While there is functionally no difference in the application of Hub & Spoke for enterprise vs advisors, 6clicks offers a white-labeled Hub & Spoke environment that allows our partners to provision and manage all GRC-related client engagements and services centrally from a custom branded Hub, promoting their service offerings and intellectual property (IP).

Client teams (Spokes) can be created from templated teams designed for specific offerings, minimizing setup time. Advisors can then easily be granted access to client teams, and client users can be invited into their teams at the right time, depending on the engagement. Build customer stickiness and revenue share with us through the 6clicks Partnership Program.

8.3   Can you configure a Hub to connect to a Hub?

For organizations with complex organizational hierarchies, we recommend our Spoke group functionality. In most instances, this solves the Hub-to-Hub requirement.

For organizations that are operating across geographies with data sovereignty requirements driving the need for multiple Hubs, we recommend looking into reporting options via an external BI tool, like Power BI or Tableau. Often, the Hub-to-Hub need mostly relates to a desire to report across multiple environments. Pulling data from 6clicks APIs to a single BI tool satisfies this multi-Hub reporting requirement.

8.4   Are there limitations to using Hailey in this model?

For enterprise deployments of the Hub & Spoke, Hailey AI can be utilized to:

For Advisors leveraging the Hub & Spoke for service delivery, please contact your 6clicks representative to explore which license options include the Hailey AI feature set for your clients.

To learn more about Haily AI and its capabilities please refer to this KB here and this article here for a general overview of Hailey AI.

8.5   How can I be sure data is segregated?

There are several access control layers in the Hub & Spoke model to prevent unwanted cross-pollination of data and configuration across Spokes. Each Spoke is treated as a separate tenant in the environment where access must be explicitly granted (at the Hub or Spoke level) and data must be created within a Spoke. There is no cross-sharing of data between Spokes.

Learn more about how we ensure security in the 6clicks platform.

8.6   In which case is a Spoke NOT required in the Hub & Spoke model?

We do not recommend creating individual Spokes for entities that do not require GRC functionality. If you have entities who only respond to a routine corporate assessment, we recommend creating a dedicated Spoke in your Hub & Spoke model for this assessment cadence. Then, each entity can be treated as a “third party” within that Spoke and assessed on your required cadence. The value of this approach is the cost savings from mitigating the need for Spokes for a single use case and also the ease with which you can create, send, and manage multiple assessments.

The general rule of thumb is, if the entity doesn’t need to manage its risks, issues, incidents, policies, third parties, or another GRC use case distinct from the rest of the entities, we do not recommend a separate Spoke for that entity.

8.7   As a Spoke, am I limited to the content and configurations that are pushed into my environment from the Hub?

While Hubs can push down content and configuration to the Spokes, Spokes also have the autonomy to build, create, and use their own content when required. Content and configuration do not have to originate from the Hub and Spokes are not limited to only the content provided by the Hub.

However, there may be times when a Hub mandates certain configuration or locks content for editing – in which case the Spoke must follow the configuration or content requirements as mandated by the Hub organization.

8.8   How long does a typical Hub & Spoke deployment take?

While this depends on the number of Spokes, stakeholders, and use cases, our clients enjoy a speedy deployment and implementation with 6clicks. As a reference point, we have a client who deployed 165 Spokes across three use cases and was able to go into production in just six weeks. This included training exercises for administrators and advisor-level users. As a rule of thumb, Hub & Spoke deployments take weeks, not months.

Once you purchase your 6cilcks Hub & Spoke license, we’ll get your environment stood up in no more than 5 business days. Once you have access to your environment, our Customer Success team will set up a kick-off meeting to establish your 30/60/90-day implementation plan. Depending on your preferred success plan, we will make sure you have the right level of expert guidance and support to suit your needs and meet your goals.

8.9   How many full-time employees would you recommend I need to manage a Hub & Spoke deployment?

The number of employees required to manage a Hub & Spoke deployment depends on several program-related factors. These could include number and complexity of Hub mandated use cases, volume and frequency of assessments, cadence around policy reviews, the scope of third-party assessments and management, the number of Spokes being managed, the presence of Spoke administrators separate from Hub-level users, and so on.

In the example cited above (8.8), this organization started with 165 Spokes and has grown to 195 Spokes. Day-to-day management of the 6clicks platform involves the delivery of Spoke user training, administering a semi-annual risk assessment to each business unit (Spoke), conducting the corresponding review of responses and evidence (including back/forth Q & A), managing findings and risks based on assessment results, ensuring that dashboards are built, populated, and maintained with the relevant KRI’s for board reporting, liaising with 6clicks technical resources, and staying up-to-date with newly released 6clicks functionality.

8.10   In the Hub & Spoke model, how would I employ a sandbox environment for non-production testing?

Generally, organizations deploy a Spokes dedicated to sandbox testing in their production Hub environment. If your organization requires a full Hub & Spoke sandbox environment, please reach out to your 6clicks Account Executive regarding options for this deployment type.

8.11   How should I prepare for a Hub & Spoke implementation?

Ahead of your kick-off meeting, it’s most beneficial to identify and prepare the following information:

  • Key stakeholders and their roles in the implementation
  • Key use cases, content requirements, and data migration needs
  • Any existing process documentation you wish to implement in 6clicks

You will also need to establish your desired production go-live dates and reverse engineer your goals based on that date. In your kick-off call, we will help you establish your 30/60/90-day plan but having your desired go-live date helps us determine the critical path to ensure you achieve your goals.

Coming to your kick-off call with the above information and a few key business decisions made ensures a more expedited onboarding and implementation process. You can also read through the Success Launchpad and Knowledge Base to begin familiarizing yourself with our digital resources and the 6clicks product.

9. Getting started on your Hub & Spoke journey

9.1   6clicks contacts

Have questions about the Hub & Spoke model that weren’t covered in this expert guide or want more information on licensing and pricing? Don’t hesitate to reach out to us today and we’ll be happy to assist.

If you have product functionality specific questions or feedback, please reach out to our Customer Support team.

9.2   6clicks success plans

Our goal is to ensure that our customers achieve the value in 6clicks they have come to expect, which is why we provide the 6clicks Premier plan. 

  • Premier Success – Reach your goals faster with access to expert guidance tailored to your risk and compliance outcomes.

If you have questions regarding the 6clciks Premier plan,  please reach out to us or learn more about the 6clicks Premier plan. We look forward to working with you on your 6clicks journey!

10 . Appendix A: List of out-of-the-box reports

Below is a list of available out-of-the-box reports at both the Hub and Spoke levels as of  August 2024. We are always improving our OOB reporting options, so you can count on these lists actively growing.

10.1   Hub level

Report Name Description
Assessment Results (QBA) - by Results (Hub) View the actual results of any question-based assessment
Assessment Results (QBA) - by Risk (Hub) View the risk ratings of question based assessments that have risk ratings
Assessment Results (QBA) - by Risk (Table - Hub) View the risk ratings of question-based assessments that have risk ratings displayed in a table
Assessment Results (QBA) - by Weighting (Hub)     View the weighted score of question based assessments that have a weighted score
Assessment Results (QBA) - by Weighting (Table - Hub)     View the weighted scores of question-based assessments that have risk ratings displayed in a table
Issue Actions (Hub)     Issue Action Report
Issue Register (Hub)     View a summary of all your issues in your issue register
Issue Summary (Hub)     View a high-level summary of issues in your spoke / client issue registers
Progress Report (QBA) - Assessment - Overall Progress (Hub)      View the overall progress status of any question based assessment
Progress Report (QBA) - Assessment Template - Responding Team Status (Hub)     View the progress status of any question based assessment created from an assessment template by responding team
Risk Matrix (Hub)    

View all your risks and related risk assessments in the risk matrix

Risk Register (Hub)    

View a summary of all your risks in your risk register

Risk Review (Hub)    

View the spoke / client risk review results of hub created risk reviews.

Risk Treatment Plan Report (Hub)

View a summary of all risk treatment plans linked to risks in your risk register

10.2   Spoke level

Report Name Description
Assessment Results (QBA) - by Results (Bar Chart)     View the actual results of any question based assessments
Assessment Results (QBA) - by Risk (Bar Chart)     View the risk ratings of question based assessments that have risk ratings
Assessment Results (QBA) - by Risk (Radar)     View the min, medium and max values of your risk-rated assessment domains displayed on a radar chart
Assessment Results (QBA) - by Risk (Table)     View the risk ratings of question-based assessments that have risk ratings displayed in a table
Assessment Results (QBA) - by Weighting (Bar Chart)     View the weighted score of question based assessments that have a weighted score
Assessment Results (QBA) - by Weighting (Radar)     View the min, medium and max values of your weighted assessment domains displayed on a radar chart
Assessment Results (QBA) - by Weighting (Table)     View the weighted scores of question-based assessments that have risk ratings displayed in a table
Assessment Results (RBA) (Authorities/Provisions)     View the results of question based assessments created from authorities
Assessment Results (RBA) (Control Sets/Controls)     View the results of question based assessments created from control sets
Assessment Results (RBA) Authorities/Provisions (Chart)     View the results of requirement based assessments created from authorities in a chart
Assessment Results (RBA) Control Sets/Controls (Chart)     View the results of requirement based assessments created from control sets in a chart
Asset Register Report     View asset items in a table
Asset Register Report (Chart)     View asset items in a chart
Authority Requirements Based Assessment View the authority of a required based assessment
Authority Requirements Based Assessment     View responses from authority requirements based assessments and to mapped authorities.
Authority Summary Report     View the count of provisions in an authority by field
Authority to Assessment     View authority responses linked to assessment responses
Authority to Control Set Mapping     View how provisions in an authority link to controls in control sets / policies
Control Performance     View the performance of your controls based on the status (Open/Closed) of linked responsibilities and related responsibility tasks
Control Set Requirement Based Assessment     View responses from control requirements based assessments and to mapped authorities.
Control Set to Authority Mapping     View how controls in a control set link to provisions in authorities
Control test frequency and performance     A bar chart showing the number of tests conducted per month, with Pass/Fail results.
Control testing trends    A line chart showing the number of Pass and Fail results over a selected time period.
Controls Register Report     View all controls and linked responsibility tasks in a table
Custom Register Report     View custom register items in a table
Custom Register Report (Chart)     View custom register items in a chart
Issue Actions     Issue Action Report
Issue Register     View a summary of all your issues in your issue register
Issue Register Story     Issue Register Story
Issue Summary     View a high-level summary of your issues in your issue register
Issues & Incidents Dashboard     A summary of the issues and incidents module in one dashboard
Performance distribution (control tests)     A stacked bar chart that categorizes controls and shows the distribution of Pass and Fail results within each category.
Progress Report (QBA) - Assessment - Overall Progress     View the overall progress status of any question based assessment
Progress Report (QBA) - Assessment - Response Progress by As...     View the progress status of individual questions of any question based assessment by question assignee
Progress Report (QBA) - Assessment Template - Responding Team Status   View the progress status of any question based assessment created from an assessment template by responding team
Progress Report (QBA) - Summary     An overview of the number of assessments published, completed and closed by month
Risk Dashboard     A summary of the risk module in one dashboard
Risk Matrix     View all your risks and related risk assessments in the risk matrix
Risk Matrix (Risk ID)     View all your risks and related risk assessments in the risk matrix with risk IDs displayed in cells
Risk Register     View a summary of all your risks in your risk register
Risk Treatment Plan Report          View a summary of all risk treatment plans linked to risks in vour risk register
Task Register Report     A summary of risk treatment plan, issue action and control responsibility tasks
Task Summary Report (Pie Chart)    A summary of risk treatment plan, issue action and control responsibility tasks depicted in pie charts
Template Overview (QBA) - by Risk     View the risk ratings of all assessments created from assessment templates that have risk ratings
Template Overview (QBA) - by Weighting     View the weighted score of all assessments created from assessment templates that have a weighted score
Third-Party Register Report     View third-parties in stable
Third-Party Register Report (Chart)    View third-parties by risk and criticality in a chart
User, Group and Role Audit Logs     Track changes to users, groups and roles. Date/time is UTC +0
Vulnerabilities - by Priority (Bar Chart)     A breakdown of vulnerabilities by priority across your assets
Vulnerabilities - by Severity (Bar Chart)     A breakdown of vulnerabilities by severity across your assets

 

10.3 Power BI 

6clicks offers Power BI integration for users who wish to leverage its advanced capabilities, enabling them to create detailed visual reports and in-depth analyses from their data.

To learn more about the Power BI functionality please see this article here.