Feedback

1) Object completion indicator (ICT third-party providers and contracts): display the completion status (as a percentage from 0 to 100%, similar to a questionnaire) of the information on ICT third-party providers and contractual arrangements that is needed to compile the RoI. 2) Mandatory data highlighting: flag the mandatory requirements (for providers, contracts and financial entity data) that must be completed before the RoI is submitted to the competent authority.

From a user perspective, it would be very helpful to have access to a consolidated, continuously updated master record of ICT providers, from which identification data could be retrieved automatically when a new provider is added. As an initial scope, I would suggest starting with the critical ICT third-party service providers (CTPPs) designated by the ESAs. For example, for the Microsoft group it would be useful to find the legal name, registered office address, LEI code and US Employer Identification Number (EIN) already pre-loaded. In addition to reducing data-entry time, this feature would improve the quality and consistency of the data feeding into the register of information.

I'd like there to be an MCP connector so it's possible to connect LLM's to our Formalize account.

It would be helpful to have the ability to move already uploaded files from one file attachment field to another within the same record, without having to download and re-upload them.

I want to create a field in a questionnaire where I want the user to be able to select responsible user from a drop down list catching the data of existing users.

To avoid inserting elements from the main tables (security measures, threats, controls, risks,...) one by one for each resource, it would be useful to have a default set already pre-set. In this way, we would then work on the changes of the set by adding or removing those of direct interest to the resource.

Formalize should allow users to select and delete multiple tasks at once, similar to the existing multi-select functionality available in the Systems module. Currently, tasks must be deleted individually, which can be very time-consuming when managing large numbers of tasks. It would be helpful to: Multi-select: Allow users to select multiple tasks in the task overview. Bulk deletion: Provide an option to delete all selected tasks in a single action. Confirmation: Display a confirmation dialog before deleting the selected tasks to prevent accidental deletion. This enhancement would significantly improve efficiency, particularly when cleaning up outdated, duplicate, or incorrectly created tasks.

Formalize should provide enhanced functionality for monitoring risks through Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs). It would be helpful to: Define indicators: Assign one or more KPIs/KRIs to individual risks, including descriptions, measurement units, and monitoring frequency. Threshold values: Define individual warning and critical thresholds for each indicator. Automatic status calculation: Automatically determine the indicator status (green, yellow, red) based on the defined thresholds and current values. Historical data: Record indicator values over time to monitor trends and developments. Charts and dashboards: Visualize historical values, trends, and current risk indicators. Automated notifications: Notify responsible users when thresholds are exceeded or indicator updates are overdue. Risk integration: Display the current KPI/KRI status directly within the associated risk record and risk overview. This enhancement would enable continuous, indicator-based risk monitoring, support early identification of emerging risks, and improve the effectiveness of risk management.

Formalize should provide a dedicated module for managing and documenting an Internal Control System (ICS). The module should support the entire control lifecycle, from control identification and documentation to execution, testing, and monitoring. It would be helpful to: Control register: Centrally document internal controls, including descriptions, responsibilities, frequency, control type, and objectives. Process and risk integration: Link controls directly to business processes, risks, and relevant IT systems. Control classification: Distinguish between key controls and standard controls, as well as manual, automated, and IT-dependent controls. Control execution: Schedule and document control activities, including results, supporting evidence, and responsible persons. Control effectiveness testing: Assess control design and operating effectiveness, including identified deficiencies. Findings and corrective actions: Document control weaknesses, assign remediation measures, and monitor their implementation. Reporting: Provide dashboards and reports showing control status, effectiveness, overdue activities, and identified deficiencies. This enhancement would enable organizations to manage their Internal Control System within Formalize and establish stronger connections between risk management, business processes, compliance, and internal controls.

Formalize should allow users to access and use technical metadata fields, such as "Last Updated" and "Updated By", in overview tables and data reports. It would be helpful to: Display metadata: Make these fields available as selectable columns in overview tables. Sorting and filtering: Allow users to sort and filter records by the last modification date and the user who made the changes. Reporting: Include these fields in data reports and exports. This enhancement would improve transparency, traceability, and data quality monitoring, making it easier to identify recently modified records and track who made the latest changes.