1. Introducing RSA Archer GRC 6
RSA Archer GRC 6is now available. It includes many exciting new enhancements to the RSA Archer GRC Platform and the RSA Archer Operational Risk Management solution. This deck highlights the latest features and functions available with our offerings.
Introducing RSA Archer GRC 6
November, 2015

2. RSA Archer GRC 6 is… A new user experience for all Solutions
Enhanced capabilities for Operational Risk including enhancements for self assessments (RCSAs), KRIs and Loss Events
Back and front-office improvements to the Platform including workflow and more
RSA Archer GRC 6 brings together technology and business processes to inspire everyone to own risk within an organization. This release offers:
A new user experience for all RSA Archer GRC solutions, with new features including a walk-up friendly, task-driven user interface and drag- and-drop advanced workflow capabilities. All solutions will see the updated interface that includes the new color scheme, fonts, icons, navigation and more. Advanced configuration options include task-driven landing screen integration, workflow chevrons, action-driven user interface, multi-layout workflow, and more.
New capabilities for RSA Archer Operational Risk Management includes end-to-end support for the self-assessment lifecycle; enhancements for loss event origination, routing, and approval; and metrics management. These features are designed to better engage business unit managers (the first line of defense) and risk managers (the second line of defense) in the organization’s risk management program. Operational risk use cases come with out-of-the-box workflow, reports, user personas and dashboards that align with the “three lines of defense” principle.
RSA Archer GRC 6 is currently available for new, on premise installations only, with code available beginning November 10, If you are an existing RSA Archer customer and / or hosted customer, you will be eligible for the new Archer Platform capabilities at the time of the 6.1 release (currently expected Q2 2016). RSA is implementing this staged approach to availability for this major release to enable successful migrations for the Archer customer base.
* GRC 6 is available for new, on premise installations.

3. Why GRC 6?
Use GRC to align risk to your business objectives and fuel growth
Engage the Business Lines in Risk Management – Everyone is a Risk Owner
With the Next Generation GRC Platform
Organizations recognize the value of directly involving risk management in business decision-making.
Organizations that manage risk well are better positioned to capitalize on the upside potential of risk.
EY 2015 GRC Survey
There’s No Reward without Risk
Our theme for this release is to “Inspire Everyone to Own Risk” and to help organizations fuel their enterprise. What do we mean?
First, Gartner has indicated that executive’s highest priority is growth for their organization. But risk (negative and positive) has a huge impact on growth. Our goal is to provide enabling technology that will help organizations align risk to their business objectives so that they can fuel the growth that they are expecting.
Second, given the lack of risk resources, Risk Managers are needing to bring the 1st line of defense or the business lines into the risk manager. This makes everyone a risk owner.
Third, we’re introducing Archer’s next generation of GRC solutions and the Platform to make this happen.

4. INSPIRE EVERYONE TO OWN RISK
We realize that risk management is not a challenge that can be solved simply with technology. It is a business imperative that must be addressed through a shift in focus, priority and culture within your organization, making risk management part of how everyone in your organization thinks and acts. By engaging everyone in the risk process, you can eliminate operational inefficiency and achieve your most strategic growth objectives.
That’s why our collective mission at RSA Archer is to “Inspire Everyone to Own Risk.” That is our passion. That is our commitment.

5. Bringing GRC to the Business
A New User Experience for all
Archer Solutions
Our goal for Release 6 of the Archer Platform is to make the technology friendly for all users – whether someone is a business user, a security incident responder, a risk manager, or the CEO. Our customers let us know that we needed to improve the way that users can interact with the technology. The interface must make sense to these users and allow them to quickly get to the data they’re interested in or the tasks they need to complete.
To accomplish this, we’ve improved the overall user experience with changes to the interface.

6. Streamlined Interface
The new interface really focuses on the risk and compliance content, and moves away from much of the heavy colors and “boxy-ness” of the previous layout. For instance, take a look at the new “look and feel” of a record within Archer. There is greater emphasis on the content itself, and less focus on the interface. Because the interface is simpler, users are able to focus their attention on the record content.
All pages within Archer have taken on this new interface design, including Dashboards, records [CLICK], the task driven landing screen, record pages [CLICK], and even the new layout for self-assessment records in Operational Risk Management (we’ll get to that in moment).
These changes not only improve the look and feel of the product, but also help users focus on what is important when working with their data. You’ll see these overall design improvements throughout Archer.

7. Task Driven Landing Screen
Prior to Platform 6, users were sometimes perplexed by what they should do after they after they logged in. While the dashboards were full of good information, the data shown might not have applied to the user’s specific tasks. In addition, infrequent users of the system were overwhelmed by the wealth of information available on the dashboards and weren’t sure where to drill down.
With Platform 6, the landing screen is specific to that particular user. The user’s tasks and the activities related to their responsibilities are shown in the left and middle columns on this task-driven landing screen. Tasks shown have been assigned to the user either through Task Management or within a defined workflow process, such as a Loss Event review in the Operational Risk Management solution. The activities shown provide a timeline of the user’s work so they can quickly go back to those records. And on the right pane, users can add a chart and action buttons to their person landing screen. These charts and actions are specific to this user, which means others won’t see this chart on their own task-driven landing screen.
[CLICK] The user can choose what they want their Home page to be. The Home page is what the user sees when they log in or when they click the Home button. It can be a dashboard or it can reflect the user’s personal task-driven landing screen.

8. Ease of Navigation
Another big area for improvement with Platform 6 is Archer navigation. The navigation is now much more compact. It’s also no longer dependent on an “all-or-nothing” display scenario. The navigation gets users where they want to go and then gets out of the way, allowing users to focus fully on the data.
We took the depth of navigation, labeled it, and used funneling to hide some of the complexity unless it’s needed. So, if users are looking for a specific dashboard, they can find it. A quick link? They’re always available. In addition, a variety of actions, such as search, reports or new records, are available directly from the navigation.
Users can now get very deep into Archer in a shorter amount of time because they don’t have to wait for a multitude of screens to load. These navigation changes make Archer less intimidating to infrequent users and put more emphasis on the content.

9. New Ways to View and Work with Content
In addition to improvements to the navigation, Platform 6 introduces improvements to records themselves. The objective is to emphasize record content. When users review this same content in Platform 6, they see their content. We’ve removed many of the lines on record pages to help users more clearly focus on the content.
[CLICK] In addition to the record view, Platform 6 introduces a new way to display data and their relationships on a record. Within the new capabilities of RSA Archer Operational Risk Management, we’ve enabled a purpose-built user interface that helps the business units (the first line of defense) to assess processes, risks and controls. These new capabilities are the beginning of a path toward having more purpose-built user interfaces within Archer solutions.

10. Searching Content is Key
Search is a huge aspect of how people browse for and get to their risk and compliance content.
Platform 6 introduces global search and new record browser capabilities. The global search feature allows users to search for a keyword or phrase throughout all of Archer records.
The search results allow users to narrow the search based on the applications where the results were found. Or users can transfer the search over to the Advanced Search interface. The search results show different fields depending on which application the record applies to.
[CLICK] Record browser functionality is available to users through the mega menu by clicking on the name of the application. It replaces the “Display All” capability available in Platform 5.5. The user can change which columns are visible. Or the user can apply and change filters for the application records. This uses the existing filtering options, but presents the data to users in a friendlier way. Advanced Search still exists in Platform 6, with the functionality remaining the same as what users saw with Platform 5.5.

11. Simplifying the Appearance
We’ve also changed the approach to customer branding – “theming” or “white labeling”—of the Archer interface. In the previous Platform release, Archer admins had more than 201 different settings to choose from to change the appearance of the Archer interface. The reality is that this level of interface configuration is just too complex.
In Platform 6, there are four settings Archer admins can use to customize the Archer interface: a primary and a secondary color, a logo, and an optional secondary graphic. So if an admin changes the colors here, different tints and shades of these colors are automatically computed and applied throughout the Archer interface. It’s a much simpler and cleaner approach to the appearance of the Archer product.

12. Operational Risk Management
Own Risk
Operational Risk Management
As more organizations decentralize risk management and place it as close as possible to where risk is most visible, RSA Archer is focused on making it easy and effective to engage business unit managers in the risk management process.
New capabilities for RSA Archer Operational Risk Management support this goal, including end-to-end support for the self-assessment lifecycle; enhancements for loss event origination, root cause analysis, routing, and approval; and metrics management.

13. Initiating Self Assessment Campaigns
Assessment Campaigns allow Risk Managers (the 2nd line of defense) to deploy, execute and monitor the status of several Self-Assessments at once. Here we see the Campaign view which provides Risk Managers with a quick overview of the progress status of each self assessment, along with the people responsible for each of these activities. This can be used to monitor progress and, if need be, send a reminder to those contributors that may be lagging behind the planned assessment schedule. The key contributors for each assessment appear clearly here for quick escalation, if needed.

14. Completing Top-Down Self Assessments
CSA (Control)
RCSA (Risk & Control)
pRCSA (Process, Risk & Control)
Once a self-assessment campaign has been initiated, the assessment is passed on to the business unit manager and his business Unit coordinators  (the 1st line of defense) for completion. Several different assessment types are available: CSA (Control Self Assessments), RCSA (Risk & Control Self Assessments) or pRCSA (Process, Risk & Control Self Assessments).
This is the main screen of a RCSA (a Risk and Control Self Assessment) and is what the first line of defense will complete. For this assessment, the business unit manager will review and assess risks and controls. It has a streamlined interface that allows you to assess your entire scope in a single screen. The chevron at the top shows which stage you are in for the assessment process. As you advance within the process, the chevrons move to the next step.
The left column shows you the processes currently in scope for the assessment. You can set processes as out of scope and/or add new processes using the two buttons at the bottom.
Clicking on a process will display the risks tied to this process in the middle column. Much like the processes column, you can set some risks out of scope or add new risk.
Finally, the bigger column on the right is the assessment screen that shows you relevant information regarding the risk you are assessing, including past assessment values, cross references to findings and events tied to the risk. This section allows you to update assessment values as you see fit.
Once your assessment is complete, the business user can send it for review to the Risk Manager.

15. Summarizing the Self Assessment
The solution also provides a summary view which is accessible at any point during the assessment process. The risk manager can review assessment statistics as well as a progress tracker to give an early warning of outstanding issues such as the number of evaluated processes, risks and controls, the number of high risks, or deficient controls. This screen provides an overview of the assessment before the user accesses individual records.
The self-assessment process uses the advanced workflow features to define the flow of the self-assessment review and approval process.

16. Metrics
Additional enhancements to the Operational Risk solution will also address KRIs. Risk managers will be able to define risk indicators and gather values for those throughout the organization with both manual and automated inputs. KRIs are then consolidated to provide reports and trends that can drive decision making and provide an accurate picture of the risk profile. Metrics leverages the workflow process for activation.

17. Loss Events
In addition, we have implemented new, advanced workflow capabilities around loss events to allow risk managers to tailor the process to better fit their organization. Based on the nature of the risk involved or the amount of total loss, the validation and analysis process of the event can take different forms and involve different people. As an example, an IT event will require the intervention of a Sec Ops specialist and any event with losses above a certain threshold will require sign-off by the Controller.
At different stages of the workflow, various people will be called on to provide loss information, including actual and potential losses, near-misses, root-cause analysis, remediation plans, and stakeholder sign-off to address the issues revealed by the loss event. The loss event process also uses the advanced workflow features to define the flow of the loss event review and approval process.

18. Simplifying the Management of GRC
Advanced Workflow +
RSA Archer has differentiated our capabilities by making the back office administration of business processes easy for an Archer Administrators or a business user. In GRC 6, we continue to improve these capabilities with the introduction of an advanced workflow designer.
The Advanced Workflow capability is available for all applications in Platform 6 and it will be integrated into various business processes out of the box for the RSA Archer Operational Risk Management solution. In addition, the existing basic workflow engine will continue to be available in the Platform, and customers can continue to use Data Driven Events as needed.

19. Advanced Workflow
The ability to model ongoing business processes within Archer is key to enabling successful GRC programs. For users, managing a business process may include more actions than just changing field values and saving a record. They may need to escalate, approve, or reject content and more. In the past, we’ve asked Archer admins to model these business processes using complex data-driven events, or DDEs. But creating and maintaining a complex series of DDEs is difficult work to create, document and maintain. Having a more visual illustration of the business process would be very helpful in understanding the overall flow.
With Platform 6, we are introducing an advanced workflow engine to help users visually describe business processes in a flowchart-like interface. This new tool is called the Advanced Workflow Designer and it makes it easier to visually understand what the business process is supposed to accomplish and through this visualization, becomes easier to maintain over time.
The Advanced Workflow Designer can accommodate simply or very advanced business processes. You’ll notice that this example for Loss Events is a fairly extensive and sophisticated workflow process.

20. Save or Print Business Process Flows
Users also have the ability to save or print an image of the workflow process. This image becomes useful for sharing the process via or sharing with others as the process is built. Process owners can also use this image for documentation of the business process.

21. Workflow Process Troubleshooting
The Platform also provides a workflow process troubleshooting tool to help administrators graphically see what stage a record is at in an active workflow process. The Job troubleshooting tool shows you a list of all active records in the workflow for any Archer application. When you click into the specific process job, you can see what stage the workflow is at. Access for troubleshooting tool is controlled by permissions.

22. Advanced Help System
Platform 6 also introduces a new help system, updated for delivery in HTML5 using an industry standard look and feel. The new help search provides a preview of the content, allowing users to quickly select the correct topic. A set of support links is available from every page to keep that important resource at users’ fingertips.
Users can search across the entire documentation set for Archer. All of the information previously available in the RSA Archer Administrator's Guide and RSA Archer Risk Management Practitioner Guide is now available in the online documentation in the help system. Users can quickly search for the information they need, and no longer need to download separate documentation from the Archer Exchange or Community. With Platform 6, all documentation is available within the online help system.

23. Thanks for taking the time to learn about the exciting changes we’re introducing with RSA Archer GRC 6. Be sure to check out the Archer Community / RSA Link for more information.