What AutoCISO Does
AutoCISO is an access-intelligence and ISO 27001 compliance platform for companies with roughly 5 to 150 employees. It answers one question continuously — who has access to what, and should they? — and turns the answer into the evidence, risks and reports an ISO 27001 programme needs.
What it does for you
| You want to… | AutoCISO gives you | Start with |
|---|---|---|
| Know who can reach which systems | An access inventory built from your employee list and the user lists of your applications | Quickstart |
| Catch leavers who still have access | Leaver checks that compare off-boarding tasks with the latest access data | Off-boarding & leaver checks |
| Give new hires the right access, once | Access profiles that turn into a to-do list per joiner | On-boarding & access profiles |
| Get and stay ISO 27001 certified | Gap analysis, Statement of Applicability, policies, evidence and audit preparation | Upload evidence for a control |
| Manage supplier risk | Security questionnaires sent to suppliers, scored and rated | Supplier assessments |
| Run privacy operations | Record of processing, DPIAs, DSAR readiness and a personal data dictionary | Personal data dictionary |
| Look after several client companies | The Partner Portal: one view of all clients, a combined action list and board reports | Partner Portal overview |
| Automate it | A REST API for pipelines and an MCP server for AI assistants | Developers |
Core concepts
Organisation. Your company’s workspace. All data belongs to exactly one organisation and never leaves it. A person can belong to several organisations. Someone who does opens the menu at the top of the sidebar and picks Switch Organization, then chooses the organisation to work in. AutoCISO platform staff (System Owners and System Managers) have no such item; they use All Organizations in the same menu and click Switch to on a row.
Users and roles. The people who sign in to AutoCISO. Each has one organisation role — Owner, Manager, Contributor, Member or Auditor — that decides what they can see and change. See Roles & permissions.
Employees. Your workforce roster (the “golden list”): everyone who works for the company, whether or not they sign in to AutoCISO. Employees are the people access is attributed to. Leavers stay in the list with the status Terminated, which is how AutoCISO spots access that should be gone.
Assets. The applications and systems you want to govern — SaaS apps, cloud consoles, internal tools. Access is always “an employee has a role in an asset”.
Access audit. An import of one asset’s user list — a CSV export, a spreadsheet or a screenshot. AutoCISO reads it, matches every row to an employee, and flags anything that does not fit: accounts of terminated employees, accounts nobody can be matched to, unexpected privileged roles.
Access inventory. The current picture assembled from every audit, manual record and lifecycle case: one row per employee × asset grant, with role, privilege, first and last seen dates and dormancy.
Plan. Your subscription: Free, The Seed, The Growth or The Scale. The plan decides which features exist for your organisation; the role decides what each person may do with them. See Plans & features.
Find your way around the console
The left sidebar is grouped by job. The documentation’s Product section uses the same groups.
| Sidebar group | What is in it |
|---|---|
| Overview | Dashboard (with My home, Statistics, Executive and Security Surface tabs), Notifications, AI CISO Assistant |
| Directory | Employees, Assets, Suppliers, supplier Questionnaires |
| Operations | Lifecycle (JML) (joiners, leavers, access profiles), Supply Chain (SBOMs, findings, vendors) |
| Access & Risk | Access Audit (imports and the review queue), Access (inventory, comparison and graph tabs), Compliance Cockpit, Control Reliability, CISO Reports, Risk Management, vCISO Workspace |
| Privacy | DPO Cockpit, Privacy Register, DSAR Readiness, DPIA Records, Data Processors, Data Dictionary |
| Certifications | Security Maturity, ISO 27001 |
The user menu — your name at the bottom of the sidebar — holds the organisation-wide settings: User Management, Organization Settings (identity, Sign-In Policy, export and import, integrations, partner access), Billing & Subscription, Partner Access, Audit Trail and API Tokens. Menu items for features outside your plan are shown with a lock and the plan that unlocks them.
Page help
Tip pop-ups no longer open on their own. To read help for the page you are on, click the information button in the page header. A drawer opens with the page help and a Tips section. Press Esc to close it.
Where to go next
- Follow the Quickstart to set up your organisation and run your first access audit.
- Use the Setup checklist to plan the weeks after that.
- Pick a Role focus so the console opens on what matters for your job.
Was this page helpful?