Exporting your data

Audience: ISMS Admin preparing to cancel a Certaria subscription, or any admin needing a full snapshot of ISMS data for auditor review or migration.

Where: the Certaria app for the records, and your SharePoint site for the documents themselves. Mechanism: Native Dataverse Advanced Find + Export to Excel. No custom Certaria infrastructure.

Why this exists

If you cancel your Certaria subscription, you retain full access to your ISMS data for auditor review or import into a replacement tool. The export uses Microsoft’s native Dataverse export capabilities. Nothing Certaria-specific has to keep running for you to read your data after the subscription ends.

The same procedure also works as a periodic backup snapshot, for example before a major change or as part of a tabletop continuity exercise.

What gets exported

Every Certaria ISMS table is exportable. Run the procedure once per table. The full table list (in recommended export order, PII first then evidence registers):

1. Person Identity (PII, the master person record with full name, email, phone, job title)
2. People (reference table)
3. Person Emails
4. User Accounts
5. ISO Controls (your Statement of Applicability)
6. Risks
7. Assets
8. Incidents
9. Audit Findings
10. Corrective Actions
11. Management Reviews (filter the Documents view by Category = Report and Clause = 9)
12. Documents (Document Register)
13. Policy Templates (reference data shipped with Certaria; usually not needed for offboarding)
14. Policy Acknowledgements
15. Policy Exceptions
16. Training Records
17. Suppliers
18. Interested Parties
19. ISMS Tasks
20. Access Reviews
21. Security Checks
22. Secrets Register
23. Changelog
24. Shared Mailboxes
25. Certifications and Insurance
26. Engagements
27. Scan Snapshots (M365 evidence history)
28. Departments
29. Configuration (singleton, one row)
30. Tier Configuration (singleton, one row)
31. Compliance Templates (reference data; usually not needed)
32. Health Checks
33. CE Overlap Mapping (reference data)

Procedure

Per-table export

1. Open the ISMS Management Hub model-driven app.
2. Navigate to the table you want to export, for example Risks.
3. Pick the All Active view from the view selector (top-left of the grid). This gives you the unfiltered active record set. For a full export including deactivated records, switch to All if available.
4. Click Export to Excel in the command bar -> choose Static worksheet (not dynamic) -> click Download.
5. Open the downloaded .xlsx file in Excel.
6. Save under a consistent name: <YYYY-MM-DD>-Certaria-<TableName>.xlsx, for example 2026-05-25-Certaria-Risks.xlsx.
7. Repeat for every table in the list above.

Column headers in the exported files use display names, not logical schema names, so the files are immediately auditor-readable.

Using Advanced Find for filtered exports

If you need a subset, for example only incidents from a specific year, use Advanced Find:

1. Click the Advanced Find icon (the funnel) top-right of any view.
2. Choose the target table from Look for.
3. Add filter clauses as needed (date ranges, status, owner).
4. Click Results to preview.
5. Click Export
-> Static worksheet -> Download.

Recommended folder structure

Save all exported files into a single timestamped folder so the snapshot is self-contained:

2026-05-25-Certaria-Offboarding-Export/
  01-PersonIdentity.xlsx
  02-People.xlsx
  03-PersonEmails.xlsx
  04-UserAccounts.xlsx
  05-ISOControls.xlsx
  06-Risks.xlsx
  ...
  33-CEOverlapMapping.xlsx
  README.txt   <- write the date, scope and any notes here

What this export does NOT contain

The export is the structured data held in Dataverse. Three other categories of evidence live elsewhere; back them up separately:

1. Policy documents and evidence files in SharePoint: the Policies / Evidence / ComplianceTemplates libraries in your Certaria SharePoint site. Use SharePoint’s own download or OneDrive sync to export these. The Dataverse Documents table holds the metadata and a URL pointing to each SharePoint file, but not the file bytes.
2. Audit trail / change history, Dataverse maintains a built-in audit log for every row. To export the audit log itself, use the Power Platform admin centre’s audit history export. The Excel exports above show current state, not change history.
3. Power Platform flow run history, if you need the historical runs of the Recurring Task Generator, Incident Notification, etc, export from the Power Automate portal under each flow’s Run history tab.

After offboarding

Once you have the full snapshot:

• The Excel files are yours to keep indefinitely and to import into any ISMS replacement tool.
• The SharePoint documents are yours to keep indefinitely (the SharePoint site is in your M365 tenant, not Certaria’s).
• Cancellation of the Certaria subscription removes the Certaria managed solution from your Power Platform environment. The oda_* tables and their data are deleted as part of that uninstall. Your exported Excel files are unaffected.
• If you later import the Excel files into a different ISMS tool, the Person Identity export is the authoritative starting point for re-identifying every other record (every other table joins on the same person reference).

Audit defensibility

This procedure is itself an ISO 27001 Clause 8.3 (information transfer) and Clause 7.5 (documented information) evidence event. Recommended practice when used for offboarding:

1. Record the export as an ISMS Task (Tasktype = Other; title = “Certaria offboarding data export”) with the date and snapshot folder location.
2. Compute and record the SHA-256 hash of each exported .xlsx file in a manifest file (MANIFEST.txt in the snapshot folder), which gives you tamper-evidence if the snapshot is ever produced in evidence later.
3. Store the snapshot in a controlled location: the same SharePoint site, an Azure Storage account with retention lock, or an offline encrypted archive, per your organisation’s retention policy.

Troubleshooting

Symptom	Cause	Fix
”Export to Excel” button greyed out	Your Dataverse role lacks Read on the table	Ask your ISMS Admin or System Customizer to grant Read
Excel file has logical names (oda_riskname) instead of display names	You chose Worksheet (dynamic) instead of Static worksheet	Re-export, picking Static
Some rows missing	The view used was filtered	Switch to the All Active view, or use Advanced Find with no clauses Lookup columns show GUIDs not names This is the Dataverse default for static exports Open in Excel; the lookup columns include both the GUID and the formatted (name) value in adjacent columns. Use the formatted name. Related Subject access requests are a separate, person-scoped export rather than this bulk one. Ask your Certaria contact for the current procedure.