Configure the PurpleWASP platform

1. Configure the organisation and security baseline

Set organisation profile information such as name, permitted domain, country, sector, currency, locations and sensitivity labels. Review account-security options and confirm whether organisation AI features should be available.

Use Setup & Readiness to maintain the wider GRC context used by downstream work where available, including business objectives, business processes and process-to-Asset dependencies. These records give framework scope and governance decisions a reusable organisation context instead of repeating the same description in each module.

2. Manage roles, users and permissions

Create organisation roles, map them to PurpleWASP system permissions and assign users. Use least privilege and separate ownership, approval, exception and administrative responsibilities where appropriate.

• Test the actual permissions of each principal role.
• Remove stale or conflicting assignments.
• Use named ownership rather than shared administrator responsibility for operational records.

3. Configure Policies, documents, quizzes and reminders

• Review active document types and the capabilities each type supports.
• Set review periods and reminder intervals.
• Configure templates and quiz settings such as passing score and due periods where used.
• Review recall behaviour and workflow notifications.
• Confirm organisation AI availability before relying on AI document summaries or quiz generation.

4. Configure Assets

Review the CIA scale, Asset value bands, reassessment periods, taxonomy, criticality labels, locations, tags and related Asset settings used by your deployment.

5. Configure Risk

• Set assessment and reassessment expectations.
• Set exception review periods and decision authority.
• Define qualitative Risk categories and acceptance criteria.
• Configure FAIR appetite, tolerance, currency and supporting baselines where FAIR is used.

6. Confirm module access and ownership

Review who can view and manage Control Management, Compliance and Third-Party Risk Management. Confirm that each workspace has accountable owners before enabling wider access.

• Control owners should understand applicability, implementation and assurance responsibilities.
• Compliance roles should own the relevant framework workspace—for example ISO 27001 ISMS/SoA work or SOC 2 readiness and audit-preparation activity.
• TPRM should have clear relationship, business, procurement and review ownership.
• PurpAI should be treated as an assistant over authorised data and workflows, not as a replacement for module permissions, review or confirmation controls.

Verify the configuration

• Sign in as a test user for each principal role and verify access.
• Create a sample governed document and confirm approval, publication and quiz behaviour.
• Create a sample Asset and confirm classification and CIA calculation.
• Send the Asset to Risk and validate appetite/tolerance behaviour.
• Adopt a sample Control and confirm the expected scope/implementation workflow.
• Confirm a Compliance/SoA user can access the intended records without unintended administrative rights.
• Run TPRM discovery on controlled sample data and confirm candidates require an explicit decision.
• Where AI is enabled, confirm PurpAI only exposes authorised records and that workflow actions remain constrained by the test role's view/write permissions and confirmation requirements.

Common problems

A role can see too much or too little

Review both the organisation role and the mapped system/module permissions. Test with a fresh non-administrator login.

Risk recommendations changed unexpectedly

Review qualitative acceptance criteria, appetite, tolerance and any recent CIA/matrix changes.

PurpAI is unavailable

Confirm that organisation AI features are enabled and that the user has access to the module/context being queried.

Related guidance