# What AutoCISO Does
URL: https://docs.autociso.io/getting-started/overview/
Description: The problems AutoCISO solves, the handful of concepts every other page builds on, and where each part of the product lives in the console.

AutoCISO is an access-intelligence and ISO 27001 compliance platform for companies with roughly 5 to 150 employees.
It answers one question continuously — **who has access to what, and should they?** — and turns the answer into the
evidence, risks and reports an ISO 27001 programme needs.

## What it does for you

| You want to… | AutoCISO gives you | Start with |
|---|---|---|
| Know who can reach which systems | An access inventory built from your employee list and the user lists of your applications | [Quickstart](https://docs.autociso.io/getting-started/quickstart/) |
| Catch leavers who still have access | Leaver checks that compare off-boarding tasks with the latest access data | [Off-boarding & leaver checks](https://docs.autociso.io/product/lifecycle/offboarding/) |
| Give new hires the right access, once | Access profiles that turn into a to-do list per joiner | [On-boarding & access profiles](https://docs.autociso.io/product/lifecycle/onboarding/) |
| Get and stay ISO 27001 certified | Gap analysis, Statement of Applicability, policies, evidence and audit preparation | [Upload evidence for a control](https://docs.autociso.io/product/iso/upload-evidence/) |
| Manage supplier risk | Security questionnaires sent to suppliers, scored and rated | [Supplier assessments](https://docs.autociso.io/product/suppliers/assessments/) |
| Run privacy operations | Record of processing, DPIAs, DSAR readiness and a personal data dictionary | [Personal data dictionary](https://docs.autociso.io/product/privacy/data-dictionary/) |
| Look after several client companies | The Partner Portal: one view of all clients, a combined action list and board reports | [Partner Portal overview](https://docs.autociso.io/product/partner/overview/) |
| Automate it | A REST API for pipelines and an MCP server for AI assistants | [Developers](https://docs.autociso.io/developers/) |

## Core concepts

**Organisation.** Your company's workspace. All data belongs to exactly one organisation and never leaves it. A
person can belong to several organisations. Someone who does opens the menu at the top of the sidebar and
picks **Switch Organization**, then chooses the organisation to work in. AutoCISO platform staff (System Owners and
System Managers) have no such item; they use **All Organizations** in the same menu and click **Switch to** on a row.

**Users and roles.** The people who sign in to AutoCISO. Each has one organisation role — Owner, Manager,
Contributor, Member or Auditor — that decides what they can see and change. See
[Roles & permissions](https://docs.autociso.io/getting-started/roles-and-permissions/).

**Employees.** Your workforce roster (the "golden list"): everyone who works for the company, whether or not they
sign in to AutoCISO. Employees are the people access is attributed to. Leavers stay in the list with the status
**Terminated**, which is how AutoCISO spots access that should be gone.

**Assets.** The applications and systems you want to govern — SaaS apps, cloud consoles, internal tools. Access is
always "an employee has a role in an asset".

**Access audit.** An import of one asset's user list — a CSV export, a spreadsheet or a screenshot. AutoCISO reads it,
matches every row to an employee, and flags anything that does not fit: accounts of terminated employees, accounts
nobody can be matched to, unexpected privileged roles.

**Access inventory.** The current picture assembled from every audit, manual record and lifecycle case: one row per
employee × asset grant, with role, privilege, first and last seen dates and dormancy.

**Plan.** Your subscription: Free, The Seed, The Growth or The Scale. The plan decides which features exist for your
organisation; the role decides what each person may do with them. See
[Plans & features](https://docs.autociso.io/getting-started/plans-and-features/).

**Note — Plan and role are separate gates**

An Owner on the Free plan cannot open ISO 27001 (a plan limit), and a Member on The Scale cannot change
organisation settings (a role limit). When a page says "Requires The Growth plan, Owner or Manager", both apply.

## Find your way around the console

The left sidebar is grouped by job. The documentation's [Product](https://docs.autociso.io/product/) section uses the same groups.

| Sidebar group | What is in it |
|---|---|
| **Overview** | [**Dashboard**](https://docs.autociso.io/console/overview/dashboard/) (with **My home**, **Statistics**, **Executive** and [**Security Surface**](https://docs.autociso.io/product/posture/security-surface/) tabs), [**Notifications**](https://docs.autociso.io/console/overview/notifications/), [**AI CISO Assistant**](https://docs.autociso.io/console/overview/ai-assistant/) |
| **Directory** | [**Employees**](https://docs.autociso.io/console/directory/employees/), [**Assets**](https://docs.autociso.io/console/directory/assets/), [**Suppliers**](https://docs.autociso.io/console/directory/suppliers/), supplier [**Questionnaires**](https://docs.autociso.io/console/directory/supplier-questionnaires/) |
| **Operations** | [**Lifecycle (JML)**](https://docs.autociso.io/console/operations/lifecycle/) (joiners, leavers, access profiles), **Supply Chain** ([SBOMs](https://docs.autociso.io/console/supply-chain/sboms/), [findings](https://docs.autociso.io/console/supply-chain/findings/), [vendors](https://docs.autociso.io/console/supply-chain/vendors/)) |
| **Access & Risk** | [**Access Audit**](https://docs.autociso.io/console/access/access-audit/) (imports and the [review queue](https://docs.autociso.io/console/access/review-queue/)), [**Access**](https://docs.autociso.io/console/access/inventory/) (inventory, comparison and [graph](https://docs.autociso.io/console/access/graph/) tabs), [**Compliance Cockpit**](https://docs.autociso.io/console/access/compliance/), **Control Reliability**, **CISO Reports**, [**Risk Management**](https://docs.autociso.io/console/risk/workspace/), [**vCISO Workspace**](https://docs.autociso.io/product/posture/vciso-workspace/) |
| **Privacy** | [**DPO Cockpit**](https://docs.autociso.io/console/privacy/cockpit/), [**Privacy Register**](https://docs.autociso.io/console/privacy/register/), [**DSAR Readiness**](https://docs.autociso.io/console/privacy/dsar-readiness/), [**DPIA Records**](https://docs.autociso.io/console/privacy/dpia/), [**Data Processors**](https://docs.autociso.io/console/privacy/data-processors/), [**Data Dictionary**](https://docs.autociso.io/console/privacy/data-dictionary/) |
| **Certifications** | **Security Maturity**, [**ISO 27001**](https://docs.autociso.io/console/iso/projects/) |

The **user menu** — your name at the bottom of the sidebar — holds the organisation-wide settings: [**User
Management**](https://docs.autociso.io/console/settings/members/), [**Organization Settings**](https://docs.autociso.io/console/settings/organization/) (identity, [**Sign-In Policy**](https://docs.autociso.io/product/sso/overview/), export and import, [integrations](https://docs.autociso.io/console/settings/integrations/), partner access),
[**Billing & Subscription**](https://docs.autociso.io/console/settings/billing/), **Partner Access**, [**Audit Trail**](https://docs.autociso.io/console/settings/audit-trail/) and [**API Tokens**](https://docs.autociso.io/console/settings/api-tokens/). Menu items for features outside your
plan are shown with a lock and the plan that unlocks them.

### Page help

Tip pop-ups no longer open on their own. To read help for the page you are on, click the information button in the page header. A drawer opens with the page help and a **Tips** section. Press Esc to close it.

## Where to go next

1. Follow the [Quickstart](https://docs.autociso.io/getting-started/quickstart/) to set up your organisation and run your first access audit.
2. Use the [Setup checklist](https://docs.autociso.io/getting-started/setup-checklist/) to plan the weeks after that.
3. Pick a [Role focus](https://docs.autociso.io/getting-started/role-focus/) so the console opens on what matters for your job.