⚠️

This template can only report on data returned by published ISMS.online API endpoints. Any screen in ISMS.online that combines data, applies business logic, or displays it in a specific visual format — rather than exposing it as a plain field — cannot be pulled into Power BI as-is. This applies across the platform, not just to one area: only the underlying documented fields come through the API, and those fields can be used to build a similar view yourself in Power BI, but the view itself is not something the API delivers ready-made. Not all platform data is exposed through the API at all, so some fields or record types visible in ISMS.online exports may not appear in Power BI either. This is a limitation of the API, not the template. For the full list of supported endpoints, refer to the ISMS.online API documentation.

Power BI Desktop

June 2026 release or later. Download free from powerbi.microsoft.com/desktop

ISMS.online account

With API access enabled. Check with your ISMS.online administrator if unsure.

Your API Key

Found in ISMS.online → User Settings → API Key. Treat this like a password — see Section 3.

Template file

ISMS_Online_PowerBI_Full_v1_10.pbit — provided by your CSM.

1

Navigate to your User Settings page in ISMS.online.

2

Scroll down to the API Key section and click Generate new API Key.

3

Enter a label for the key and select an expiry period.

4

Copy the API Key when it is presented — this is the only time it will be visible. It cannot be retrieved later. If you lose your key, generate a new one from the same page.

Keep your API Key safe. It grants full API access to your ISMS.online account. Do not share it, paste it into emails, or store it in a shared document. If you think it has been compromised, delete it and regenerate it immediately from User Settings → API Keys. For more information, see the Using the Public API help guide.

API Key

Paste your API Key from ISMS.online → User Settings → API Key.

BaseURL

Select your region from the dropdown: UK (r1) https://rest.api.r1.isms.online | APAC (r2) https://rest.api.r2.isms.online | US (r3) https://rest.api.r3.isms.online | EU (r4) https://rest.api.r4.isms.online

You can change your region at any time later via Home → Transform data → Edit parameters.

1

After entering your API Key and selecting your BaseURL, click Load.

2

A credential dialog may appear asking how to access the web content. Select Anonymous on the left panel.

3

Check that the “Select which level to apply these settings to” dropdown shows the base URL only (e.g. https://rest.api.r4.isms.online/). If it shows a specific path, open the dropdown and select the root URL.

4

Click Connect.

5

A Privacy Levels dialog appears. Set the dropdown on the right of each row to Organizational.

6

Click Save.

Setting the privacy level to Organizational tells Power BI that this data source is trusted within your organisation. This is what allows the connection to persist when you reopen the file — without it, Power BI re-prompts for credentials every time.

1

Once loaded, go to File → Save As.

2

Save the file as a .pbix file (not .pbit) — give it a name like ISMS_PowerBI_Report.pbix.

3

Save it somewhere you can find it again — your desktop or a project folder.

Always work from the saved .pbix file going forward — not the .pbit template. The .pbit is the starting point only.

1

Double-click your saved .pbix file (e.g. ISMS_PowerBI_Report.pbix).

2

Power BI Desktop opens and loads the last saved state of the report.

3

No credential prompt should appear — the connection settings are saved in the file.

1

In the Home ribbon, click Refresh.

2

A progress dialog shows each table loading.

3

Once complete, all visuals update with the latest data.

4

Save the file after refreshing to keep the latest data.

⚠️

Power BI does not refresh automatically. You need to click Refresh manually each time you want the latest data from ISMS.online.

⚠️

The columns listed below reflect what is currently available from the ISMS.online API. Some fields visible in ISMS.online data exports (such as Department, Business Unit, Control Testing Frequency, or Archived at) are not currently exposed via the API and therefore cannot be included in this template. If you need additional fields, contact ISMS.online support to request expanded API coverage.

RisksData

All risks across all risk registers

Risk Name, Status, Position, Owner Name, Categories, Review Date

RiskManagersData

Your risk registers

id, name

TracksData

All your tracks

id, name

TrackTicketsData

All tickets across all tracks

name, status_name, responsible_user_name, category_names, created_at, due_date

TrackCategoriesData

Categories per track

track_id, name

TrackStatusesData

Statuses per track

track_id, name

TrackOutcomesData

Outcomes per track

track_id, name

UsersData

All users in your company

id, firstname, lastname, email, Full Name

AllTracksData

Combined view of tickets, outcomes and categories across all tracks

track_name, Label, RecordType, Status, ItemID, created_at, Category, due_date

TodosData

All to-dos linked to risks and tickets

Description, Due Date, Is Completed, Days Overdue, Owner Name, Parent Type, Parent Name

ℹ️

Category shows the category names exactly as your organisation has defined them in ISMS.online. These are free-text labels your team created — not a fixed list controlled by the API or by this template. If a category happens to be named something that looks like a date (for example, a category created for a specific review cycle and labelled '01/04/2026'), it will appear in this column exactly as typed. This reflects your account's own configuration and is expected behaviour, not a defect in the report.

ℹ️

AllTracksData combines three different record types from ISMS.online: Tickets, Outcomes, and Categories. Only Tickets have an individual, human-referenceable ID in the API — Outcomes and Categories are option lists attached to a Track (for example, 'Resolved', 'Won't Fix', or a category name) and do not carry their own per-row identifier. For this reason, the ItemID column will always show a value for Ticket rows and will always be blank for Outcome and Category rows. This is not missing data — it reflects how ISMS.online structures these record types.

ℹ️

Owner Name reflects the owner assigned to a risk in ISMS.online. From template v1.8 onwards, this is resolved correctly: the owner is looked up from ISMS.online's user list using the risk's owner reference. Earlier versions (v1.7 and before) contained a bug that returned this field as blank for every risk, regardless of whether an owner was assigned — this took several iterations to resolve fully, as the underlying data required a per-risk detail lookup combined with a separate user list match, and the exact structure only became clear from testing against live data. If you are using v1.8 or later and Owner Name is blank for a specific risk, this means no owner is currently assigned to that risk in ISMS.online. If you are still on an earlier template version, upgrade to v1.8 before relying on this column.

ℹ️

The colour-coded risk matrix (“heat map”) on the ISMS.online Risk Overview screen is one example of the general rule in Section 1: it's a visual built from your risk scores plus ISMS.online's own colour banding and methodology rules (see the Risk Methodology button on that screen), not a single field returned by the API. The underlying numbers are available — RisksData includes Position, Impact, and Likelihood — but the colour thresholds and matrix layout are not exposed as API data. To reproduce something similar in Power BI, build a matrix visual from these fields and apply your own conditional formatting; the colours will not match ISMS.online automatically. The same principle applies to other combined or styled views elsewhere in ISMS.online, not just this screen.

NotesData

Notes attached to risks and tickets

content, created_at, parent_type, parent_id, parent_name

DocumentsData

Documents linked to risks and tickets

name, version, filename, file_size, mime_type, parent_type, parent_id

RiskReadingsData

Historical risk score readings over time

score, impact, likelihood, confidentiality, integrity, availability, created_at, risk_id, risk_name

ProjectsData

All projects

id, name, description, created_at

ActivitiesData

Activities within projects

name, status, due_date, project_id, project_name

LinkedWorkData

Work items linked to risks and tickets

source_type, source_id, source_name, linked_id, linked_name, linked_type

1

In Power BI Desktop, go to Home → Publish.

2

Select your Power BI workspace and click Select.

3

Once published, go to app.powerbi.com and find the dataset.

4

Click the three-dot menu → Settings → Data source credentials.

5

For each ISMS.online credential entry, click Edit credentials and set Authentication method to Anonymous.

6

Go to Scheduled refresh and configure your refresh schedule.

⚠️

Power BI Service may enforce additional privacy level requirements. If the refresh fails in the service, try enabling “Skip the privacy levels check” in the dataset settings.

Version

2.8 — August 2026

Template

ISMS_Online_PowerBI_Full_v1_10.pbit

API

ISMS.online REST API v1.0.2