Significance of Entity Type

[Prashant64]

Hi Everyone,

What is the significance of creating Entity Type? I can create Entity directly and can complete the entire process. Trying to understand the need for creating Entity type?

[jing3]

Entity Type provides you a method to group Entities together and automate the creation of Entity and Assign the Control Objectives. The significance is Automation.  One could start without Entity Type, and mature the program later by introducing the Entity Type. 

[priyajames1 · Accepted solution]

Hi Prashant,

Yes, In New York release we definitely can create stand alone entities and complete the process. 

But one of the important use of Entity Types comes into picture when you want to generate multiple controls or risks for one type of service/department/locations etc. 

For example, if you want to generate a risk of earthquake to all the data centers listed in your table then might just want to associate an entity type called "Data Center" and all the entities will automatically be assigned a risk based on the risk statement your assigning that entity type to. 

Risk Statement + Entity Type = Risks (auto generated)

Control Objectives + Entity Type = Controls (auto generated if checkbox "create controls automatically" is checked")

Hope this helps!

Thanks,

PJ

[sisrivastava]

Hi,

I am trying to understand the significance of the option 'Generate Target' which is available while creating a new Entity Type.

What is this functionality and why is it used.

Regards,

Siddharth

[jing3]

"Target" is introduced because of Use Case Accelerator (NIST CSF or NIST RMF). If you are not any of them, you can ignore this setting. NIST CSF and NIST RMF rely on Target along with Entities to create Metrics.