When configuring an assessment's workflow(s), administrators can choose if instances (clones) of the objects added to the assessment will be created or if they will be used only as reference data, which is considered important, secondary data that needs to be included, but not actually assessed. This is done by enabling or disabling the Assessment Data option in the Configuration tab from the Edit Assessment page.
By default, the Assessment Data option is enabled for all the object types on the Configuration tab, which is populated based on the assessment's data definition. When enabled, any objects added to the assessment through the dimension, relationship, or reference fields will have instances of that object created. When disabled, these objects can still be added to the dimensions, relationship, or reference fields, but no clones of the objects will be created. Specifically:
- If Assessment Data is enabled: Instances of objects added to the dimension, relationship, or reference fields on an assessment are created. To prevent unnecessary duplicate data, objects that were already cloned in an assessment are not cloned again if they're added to a relationship or reference field on the same assessment. For example, Assessment Data is enabled for the Control object type. The Control 1 object was added to Assessment A and the instance, Control 1.1, was created, but additional instances of Control 1 are not created when this object is added to the Risk relationship on Assessment A. However, adding Control 1 to Assessment B will create an additional instance (Control 1.2) because this object was not previously cloned in this particular assessment. This applies to library and assessment objects.
- If Assessment Data is disabled: Objects added to the dimension, relationship, or reference fields on an assessment are linked to the relationship/reference and/or assessment objects, but instances are not created. For example, Assessment Data is disabled for the Control object type. The Control 1 object was added to Risk Assessment A and the Risk relationship on Assessment A, but no clones of Control 1 are created. This applies to library and assessment objects on new and launched assessments.
Note that you cannot create or configure workflows for object types added to assessments unless the Assessment Data option is enabled. Additionally, disabling Assessment Data for a root object type will also disable the option for any leaf (relationship or reference) object types in the data definition.
In the screenshot below, only objects from Process will have instances created, while the IT Application and Risk object types, including the relationships and references saved to Risk (i.e., Control, Issue, Corrective Action, and Test), will not have any instances created should any of their objects be added to the assessment as dimensions or relationship or reference objects.
The Configuration tab of an assessment. Only the Process object type will have instances of its objects created when added to the assessment.