GRC User Manual

Application: https://grc.legale.io Audience: compliance administrators, contributors, and employees Last updated: August 20, 2026 This manual explains how to use the GRC platform step by step: signing in, managing frameworks and controls, uploading evidence, handling tasks and policies, connecting external systems, and reviewing the audit trail. Getting started Signing in Open https://grc.legale.io in a modern browser (Chrome, Edge, Firefox). Enter your username and password and select Log in. Tick Remember me to stay signed in on that device. If configured by your administrator, you can also sign in with Google or Microsoft using the buttons under the login form. Forgot your password On the login page, select Forgot your password? Enter your account email and submit. If the address exists, you will receive an email with a reset link. Follow the link, set a new password, and sign in again. Language and theme Use the language selector in the top bar to switch between English, Español, and Português. The choice is remembered on your device. Use the moon/sun icon in the top bar to switch between light and dark theme. Signing out Open the account menu (your initial, top-right corner) and select Sign out. Finding your way around The left sidebar groups modules: Compliance, Risk, Governance, Trust, and Connections. You only see the modules your role allows. Every module has a search box in the top bar (“Search this module…”) that filters the current list. The Run monitoring button in the top bar re-evaluates monitors and alerts. Roles and permissions Access is controlled per module by your administrator. In general: Role type What you can do Administrator / writer Full create, edit, and delete rights in the modules granted to you Read-only (auditor) View permitted modules; all action buttons are hidden and blocked Employee Limited view; mainly tasks assigned to you and policies to acknowledge Customer (portal) Only the external Customer Portal, not the internal application If a section described in this manual is not visible to you, your role does not include it — contact your administrator (see Users and access management). Dashboard The dashboard is your compliance overview. Stat cards — controls in scope, operational controls, controls with gaps, and controls declared automated. Control lattice — one square per control in your catalog. Colors: Green — Operational Orange — Gap (needs remediation) Red — Overdue: the control is in scope but has not been verified in more than 90 days (even if it was operational). Re-verify it to clear the red state. Grey — Out of scope Hover a square to see the control code and name; click it to open the control. Progress by framework — readiness bar per framework with its target date. Upcoming tasks — the next open tasks by due date. Frameworks Where: Compliance → Frameworks (/marcos/) A framework is a compliance standard you work against (for example ISO/IEC 27001:2022). Each framework shows its requirements and how your controls cover them. Add a framework Go to Frameworks and select Add framework. Choose an option from the catalog — for example ISO/IEC 27001:2022, ISO/IEC 27701, SOC 2, or HIPAA — or choose Custom to define your own (name, short name, description). Optionally set a target date (your certification or readiness deadline). Save. Catalog frameworks are created with their full requirements list — ISO 27001 arrives with all 123 requirements: 30 management-clause requirements (Clauses 4–10, the ISMS) and 93 Annex A controls. Note: Frameworks already added disappear from the catalog list, so they cannot be added twice. Custom frameworks start with no requirements. Work with a framework Open a framework to see: Stat cards — total requirements, in scope, ready, and readiness percentage. Section navigator (left side) — jump between ISMS clauses (Context, Leadership, Planning, Support, Operation, Performance evaluation, Improvement) and Annex A themes (Organizational, People, Physical, Technological). You can also filter by readiness (Ready / Not ready). Scope tabs — All requirements / In scope / Out of scope. Search — find requirements by code or title. Requirements table — each row shows the requirement code and title, the mapped controls (colored pills linking to each control), a scope toggle (mark a requirement out of scope if it does not apply — this is your Statement of Applicability decision), and its readiness (Ready when at least one mapped, in-scope control is operational). Export the Statement of Applicability (SoA) On the framework page, use the SoA export to download a CSV of all requirements with scope, mapped controls, and readiness — the document your auditor will ask for. Controls Where: Compliance → Controls (/controles/) Controls are the safeguards your organization operates (for example “Least-Privileged Policy for Sensitive Data Access”). Each control is mapped to framework requirements and backed by evidence. Browse controls Filter by status, domain, owner, or test type; search by code or name. Export CSV downloads the current list. Mark verified (administrators) stamps today’s date as the verification date on all operational controls — use it after a periodic review. Controls not verified for more than 90 days show as Overdue (red) on the dashboard. Create a control Select Create control. A catalog picker opens with standard controls that are not yet in your organization. Search by code or name (for example “DCF-10” or “encryption”). Either: Pick a catalog control — the form opens pre-filled with its code, name, domain, and description. The code cannot be changed (catalog codes are fixed). Choose Other — add a custom control from scratch — a blank form opens; you define the code and all fields yourself. Complete the form: Control code / name / description — what the control is. Domain — internal category used for filtering (e.g. “Access and Identity”). Frameworks — tick the frameworks this control belongs to. Requirements — after ticking a framework, its requirements appear grouped below; tick every requirement this control addresses (a control can map to many, e.g. A.5.15, A.5.16, A.8.2). Owner, Status, Scope, Test type — who runs it, whether it is Operational or a Gap, whether it counts for...