Console Reference
Every console page explained: what it shows, each tab, column and field. The same text as the help panel in the console.
Overview
- Dashboard OverviewThe dashboard provides security, IT, and compliance teams with a high-level summary of the organization's current access posture.
- AI Security AdvisorHello! I'm your AutoCISO AI Security Advisor, up and running.
- Notifications & AlertsThe Notifications page centralises all system-generated alerts in one place. Notifications are created automatically when the platform detects something that needs your attention, for example a domain that is about to…
Operations
- Lifecycle Command Center (JML)Lifecycle Command Center (sidebar: Operations > Lifecycle (JML)) standardizes access changes during key employment events, reducing the risk of orphaned accounts and improving onboarding speed.
- Evidence Collection AgentThe Evidence Agent automates the collection of compliance evidence such as screenshots and configuration data for frameworks like SOC 2 and ISO 27001.
- Evidence Job DetailsThis page shows the results of a single evidence collection run: what was captured, any error, and a step-by-step activity log.
- Joiner OnboardingTrack the access every new joiner needs and see whether they actually receive it. Each joiner has a To-Do list generated from your Access Profiles.
- Offboarding Case TrackerThis tab tracks all offboarding cases for departing employees. Each case represents a structured decommissioning workflow that ensures no access is left behind.
- Access ProfilesAn access profile lists the access a new hire needs, based on employee attributes such as department or job title. When you start a joiner, AutoCISO combines every matching, enabled profile into the joiner's To-Do list.
Access & Risk
- Access: Inventory, Comparison & GraphThe Access page (sidebar: Access & Risk > Access) gives a granular view of every permission link in the organization. It has three tabs.
- Access AuditAccess Audit is where you import access snapshots for AI-powered analysis and keep a complete, auditable record of every import.
- Compliance CockpitThe Compliance Cockpit (sidebar: Compliance > Compliance Cockpit) brings control status, evidence, risk and supplier compliance into one view.
- Review QueueThe Review Queue is a tab on the Access Audit page (open it from the sidebar under Access & Risk > Review Queue).
- Access Graph MapThe Graph Map is the Graph tab of the Access page (sidebar: Access & Risk > Access, then Access Graph).
CISO Reports
- Access Concentration RiskThis report identifies employees who have access to an unusually large number of assets.
- High-Risk Mover CasesThis report surfaces employees who have changed roles (Movers) but still have open lifecycle cases — meaning their access profile has not been fully updated to reflect their new responsibilities.
- Anomaly DiscoveryAnomalies are access irregularities found during your access audits by AutoCISO's AI analysis — such as accounts that don't match any known employee, terminated users who still have access, or privileges nobody has…
- Stale & Orphaned AccountsThis report identifies active accounts that are either dormant (no recent activity) or orphaned (no matching employee in your directory, or an employee who has been terminated).
- Offboarding ViolationsThis report lists terminated employees who still have active access grants — a direct compliance violation and a significant security risk.
- Identity Normalization HealthThis report shows the quality of AutoCISO's identity matching process. Normalization is the act of linking raw account names (as they appear in each system) to verified employee identities.
- User Access Review StatusThis report tracks the completion progress of your access review tasks across all assets and reviewers. Periodic access reviews are required by ISO 27001, SOC 2, and most internal access policies.
- Privileged Access ChangesThis report detects role changes across all assets — specifically flagging escalations where an account moved from a standard role to a privileged one (role names such as admin, owner, root, write, prod or global).
- Compliance Evidence LogThe Evidence Log is the consolidated audit trail of access decisions, reviews, remediation and lifecycle events recorded in AutoCISO. Use it as source evidence when preparing for a compliance audit.
- Security Debt TrendThis report visualizes how your organization's access-related security debt has changed over time.
- Department Risk ScoresThis report breaks down access hygiene by organizational department, enabling targeted remediation and holding department heads accountable for the access health of their teams.
Directory
- Asset InventoryThe central registry for every system, application, or resource whose access you monitor or certify.
- Supplier RegisterThe Supplier Register is the governance workspace for third-party organizations your company depends on.
- Employee Identity ManagementThis page organizes access by person, providing a unified view of what each individual can reach across the entire environment.
- Supplier QuestionnairesManage the questionnaires sent to suppliers: view the built-in security & privacy questionnaire, clone it, and maintain your own tenant-owned copies.
- Questionnaire EditorEdit one supplier questionnaire draft: question text in English, Russian and Hebrew, answer options, per-option risk points and findings, question weight (1–10), the required flag, whether “not applicable” is allowed,…
ISO 27001
- ISO 27001 ProjectsThis is the home screen for AutoCISO's ISO 27001 module. It lists all certification projects your organization has started, each representing a distinct ISMS scope or certification engagement.
- New Certification ProjectThis form creates a new certification engagement. The information you provide here sets the context for all subsequent ISO 27001 work: scope, gap analysis, risk treatment, policies, and audit readiness.
- Certification Body DirectoryThis directory lists certification bodies (CBs) — the organizations that will audit your ISMS and issue your certificate. Choosing the right CB affects audit cost, timeline, industry credibility, and geographic coverage.
- Certification Body ProfileThis page shows detailed information about a specific certification body, helping you evaluate whether it is the right fit for your organization's ISO 27001 engagement.
- ISMS Scope DefinitionThe scope defines the boundary of your Information Security Management System — what systems, processes, people, and locations are covered by your ISO 27001 certificate.
- ISO 27001 Gap AnalysisThe Gap Analysis evaluates your organization's current controls against all 93 controls in ISO 27001:2022 Annex A. It tells you where you are compliant, partially compliant, or missing controls entirely.
- Asset Risk RegisterThe Risk Register tracks information security threats and their risk scores across the assets in your ISMS. It implements the ISO 27001 clause 6.1.2 risk assessment process.
- Risk ScoringThis page is the detailed risk assessment workspace for a single asset. For each identified threat, you set likelihood and impact to calculate a risk score, then choose a treatment approach.
- Statement of ApplicabilityThe Statement of Applicability is a mandatory ISO 27001 document that records your organization's decision on each of the 93 Annex A controls — whether each control is applicable to your ISMS and why.
- Implementation RoadmapThe Implementation Roadmap translates your gap analysis findings into a prioritized action plan. Each task represents a remediation step, usually mapped to an ISO 27001 control.
- ISO 27001 Policy DocumentsThis page manages the eight core information security policies required by ISO 27001. Policies are the documented commitments of your ISMS and are reviewed during both Stage 1 and Stage 2 audits.
- Policy EditorThe Policy Editor is where you refine a single ISO 27001 policy document. The policy text sits in a plain text box on the left; a sidebar on the right shows related information.
- Policy Open DecisionsWhen AutoCISO's AI generates a policy document, it may identify specific questions that need a human decision before the policy can be finalized.
- Evidence VaultThe Evidence Vault is the central repository for the evidence that supports your ISO 27001 controls. It links collected artifacts to specific Annex A controls, making audit evidence retrieval fast and traceable.
- ISO Access Review CampaignsThis page manages periodic access review campaigns that support ISO 27001 A.5.18 (Access Rights) and A.8.2 (Privileged Access Rights).
- Access Review Campaign DetailThis page shows the full status of a single access review campaign, including per-manager progress and the access decisions made.
- Backup & Recovery TestsISO 27001 A.8.13 requires that backups are tested periodically to verify that data can be restored. This page manages scheduling, running and documenting those tests (an annual live test is the usual target).
- Backup Test Live SessionThis is where you run a backup and recovery test. Click Start Live Session to begin, then work through each scenario step by step, recording outcomes as you go.
- Internal AuditsISO 27001 clause 9.2 requires periodic internal audits to verify that the ISMS conforms to the standard and to your own policies. This page lists all your internal audits.
- Internal Audit ExecutionThis is the working page for a single internal audit. Review each ISO 27001:2022 control, record findings and document nonconformities.
- Management ReviewISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. This page produces and documents that review, giving you a signed record of leadership engagement.
- Audit Readiness ScoreThe Readiness Score is a 0–100 estimate of how prepared your ISMS is for a Stage 1 or Stage 2 ISO 27001 audit. Click Refresh Score to recalculate it from your current data.
- External Auditor PortalThe Auditor Portal gives your certification body a time-limited, read-only view of your ISMS during the audit, without a full AutoCISO account.
- ISO 27001 CertificateThis page manages your organization's ISO 27001 certificate, from upload through public verification and surveillance schedule tracking.
Risk Management
- Risk ManagementThe Risk Management workspace is where you add new risks and see where you stand. It is part of The Growth plan or higher.
- Risk RegisterThe Risk Register lists every risk in your organization with its score, strategy, status, estimated loss, owner and next review date.
- Risk Record DetailThe Risk Record page shows one risk in full: what it is, how it was scored and what you decided to do about it.
- Risk BudgetRisk Budget helps you compare how much money you plan to spend on risk treatment with how much your active risks could cost.
- Expert Risk EditorThe Expert Risk Editor gives Owners and Managers full control over every field of a risk. Your work is kept as a draft until you finalize it.
- Quick Risk FormThe Quick Risk Form is a short, structured way to add a risk. You describe the risk and score it, and AI recommends a treatment strategy.
- AI-Guided Risk InterviewThe AI-Guided Risk Interview finds risks through plain-language questions. It is ideal for non-security staff or anyone new to risk management.
vCISO Workspace
- vCISO RoadmapThe roadmap turns your current compliance state into a phased plan of security work.
- Current Security StateA snapshot of where your security programme stands today: open risks, overdue items, evidence gaps, open management decisions and compliance by domain.
- Target Security StateSet the score you want to reach in each domain, and the year you want to reach it by. The page compares each target with the current score and shows the delta, so you can see where the biggest gaps are.
- Monthly SummaryA month-by-month report of your security programme: an executive summary, key indicators (total items, items closed this month, overdue items, open decisions, open risks, critical risks and evidence gaps) and the top…
- Management DecisionsTrack the decisions management needs to take on security topics, with an owner, status (Open, In Progress or Closed) and due date. Overdue decisions are highlighted. Click a decision to see its details.
Supply Chain
- Software Vendor RegistryThe Vendor Registry lists the software vendors you depend on, with a risk tier and the status of your security assessment of each. It supports your third-party risk management.
- SBOM InventoryA Software Bill of Materials (SBOM) is a list of the open-source and third-party components your software depends on.
- Vulnerability FindingsVulnerability Findings is your triage queue for known vulnerabilities (CVEs) found in the components of your uploaded SBOMs. It lists findings from all your SBOMs in one table.
Privacy
- DPO CockpitYour privacy operations dashboard: a posture score and action cards for the gaps that need attention. Privacy is available on The Scale plan. Owners, Managers and Members can open it.
- Privacy RegisterRecords of Processing Activities (RoPA) per GDPR Article 30. Each record documents one processing activity and its lawful basis.
- DPIA RecordsData Protection Impact Assessments (DPIAs) for high-risk processing activities. The Scale plan with Risk Management is required to run one.
- DSAR Readiness CheckCheck which systems and suppliers could hold data about a given subject. The identifier is never stored; only a hash is recorded for audit purposes. Available to Owners and Managers on The Scale plan.
- Personal Data DictionaryAn inventory of the personal data types your organization processes. Each entry is one type of personal data (for example email addresses, health records or salary information) and links it to the assets, suppliers and…
- Data Dictionary EntryDetails of one personal data type. The tabs show its Overview (sensitivity, DPIA status, last reviewed), and the linked Assets, Suppliers and Activities, plus its History.
- Data ProcessorsThe DPO view of suppliers that handle personal data on your behalf. A supplier appears here when it is tagged as handling PII or PHI. Available on The Scale plan.
- Data CategoriesThe list of data categories used to tag personal data. Only Tenant Owners can manage it. Available on The Scale plan. This page has no sidebar entry; open it at /settings/privacy/categories.
Partner Portal
- Partner DashboardThe Partner Dashboard is the first screen of the Partner Portal. It gives you a one-page summary of your client portfolio so you can see where to spend your time today.
- PortfolioThe Portfolio lists every client organization your firm manages, with a status card for each one. Use it to see which clients need attention and to jump into the details.
- Action QueueThe Action Queue collects open tasks and recommendations from all your client organizations in one list, so you do not have to open each client in turn.
- Health TimelineThe Health Timeline shows what has changed for one client organization over time: score changes, alerts, offboarding, expiring items, new evidence and audits.
- Board PackThe Board Pack is a ready-to-send report on one client's security and compliance posture. Open it from the client's card in the Portfolio.
- Referral ProgramThe Referral Program page is where you share your link with prospects and follow what they earn you. Every partner can open it. It is also the landing page until your firm has enough clients for the Portfolio.
- Invite CenterThe Invite Center lists the access invitations client organizations have sent to your firm. It is available to Partner Owners; see Roles & Permissions.
- Partner SettingsPartner Settings controls how your firm looks to clients and where client reports go. It is available to Partner Owners; see Roles & Permissions.
- Partner CompliancePartner Compliance shows the compliance posture of your clients side by side. It is only available on plans that include the partner compliance overview; otherwise the page says "This feature is not available on your…
- Billing & SubscriptionBilling & Subscription is where a Partner Owner manages the firm's partner program subscription and sees its invoices. See Roles & Permissions.
- User ManagementUser Management is where a Partner Owner invites and removes the people in the partner firm. These are your colleagues, not your clients' employees.
- Advisory TemplatesAdvisory Templates are reusable workflows (for example a quarterly access review) that you define once and apply to many clients. They are listed under Library in the sidebar.
- Become a PartnerBecome a Partner is a routing screen, not a form. It sends you where you belong.
Settings & Administration
- User ManagementThis page manages access to the AutoCISO platform itself. These are the administrators and reviewers who log in and manage the system — not the workforce identities being monitored in the access inventory.
- Organization SettingsConfigure your organization's profile, sign-in policy, and data management. Changes here affect your entire organization.
- Billing & SubscriptionManage your organization's subscription plan, usage limits, and feature access. Owners open it from the user menu (your name at the bottom of the sidebar) → Billing & Subscription. Changes take effect immediately.
- All OrganizationsThis page lists every organization on this AutoCISO installation. It is for AutoCISO platform staff (System Owners and System Managers) and is reached from the user menu → All Organizations.
- Audit TrailThe Audit Trail is a chronological, hash-chained log of every security-relevant event that occurs in your organization.
- API TokensAPI Tokens provide a secure way for external systems — such as CI/CD pipelines, automated scripts, and AI clients — to interact with the AutoCISO API.
- IntegrationsThe Integrations tab lets you connect AutoCISO to external tools so compliance tasks, risk treatments, and offboarding actions flow into the systems your team already uses.