Organization

The organization layer answers two questions for every object in CyberGuard: where does it live? and who can see it? All other entities are linked to or contained within these objects.

A folder tree

For access-control purposes, CyberGuard data is organized as a tree of folders. It starts from a root folder called Global, which divides into sub-folders called domains. The shape of the tree is not hard-coded — it is entirely determined by how you configure it. Every object in CyberGuard is attached to a folder, either directly or through a parent object that is.

The Global root is reserved for cross-organization material such as imported catalog content; your own work always lives inside domains.

Domains

A domain delimits a work area. Inside a company, that is typically one domain per department; a consultancy may create one domain per customer. A domain is the first thing you create in CyberGuard, and it brings together all the objects a set of related projects needs.

The technical role of a domain is access control: every role a user holds on a domain applies to all objects and actions across that domain. Domains are also the natural reporting boundary — dashboards and roll-ups aggregate per domain.

Perimeters

A perimeter is an optional refinement inside a domain: it names exactly what an assessment covers — a product, a system, a process, a contract. Audits and risk assessments can be attached to a perimeter to keep several distinct scopes cleanly separated inside the same domain. Perimeters carry an internal reference and a lifecycle status (Design, Development, Production, End of life, Dropped) so analytics can be broken down per assessed scope.

The rule of thumb: if two scopes need different people seeing them, they belong in different domains; if they need separate assessments but the same audience, they are perimeters. Everyone with access to a domain sees every perimeter inside it — there is no per-perimeter access control.

Users, groups and roles

CyberGuard follows a straightforward RBAC model built from three pieces:

• Users are individual accounts, created locally or provisioned through your identity provider.
• Roles are bundles of permissions — reader, analyst, domain manager, approver, and so on.
• User groups bind the two to a scope: a group associates a role with a domain, and every member of the group receives that role on everything in the domain.

When you create a domain, CyberGuard automatically creates one user group per built-in role for that domain. Granting access is then just a matter of adding users to the right group — no per-object permissions to manage. Role assignments give you a consolidated view of who holds what, where.

Note

One role matters beyond day-to-day permissions: the Approver role is required to formally approve risk acceptances.

Related

For the how-to side — creating and managing each object — see the feature pages: Domains, Perimeters, Users and User groups.