Quickstart

By the end of this guide your organisation has its employee list, at least three assets, a first access audit with any anomalies already flagged, and your colleagues invited. It takes about 30 minutes and works on every plan.

Before you start

• You are the Owner of a new AutoCISO organisation (the person who signed up is its Owner).
• Have a CSV of your current employees. Most HR tools and Google Workspace or Microsoft 365 admin consoles can export one. Columns: name, email, job_title, department and, optionally, status; the first row must be a header.
• Pick one application whose user list you can export or screenshot — for example your cloud console, code hosting or CRM. A CSV export works best; a screenshot is fine.

1. Run Organization Setup

The first time an Owner signs in, AutoCISO shows Welcome to AutoCISO. Click Let’s get started → to open Organization Setup, a five-step guide. Progress is saved after each step, so Save & exit is safe; resume later with Continue Setup in the sidebar, or start over with Restart Setup Wizard in the user menu.

1. Identity — enter the Organization Name and Country, and choose the Identity Providers (sign-in methods) your team may use, such as email and password or Google. You can change this later; connecting your company’s own identity provider is covered in Single sign-on.
2. Employees — upload the employee CSV. This “golden list” is the source of truth AutoCISO compares every account against: an account that matches nobody, or matches someone who has left, is flagged. Duplicate emails are skipped; existing employees are updated.
3. Assets — add the systems you want to govern by name or URL (for example GitHub or https://aws.amazon.com) and click Analyze to let AutoCISO fill in the details. Add at least three: anomaly detection needs a minimum coverage to compare against.
4. Signal — choose a Target Asset and upload its user list. AutoCISO extracts the accounts and roles, matches each one to an employee, and shows how many users it found and how many anomalies.
5. Alerts — Slack and Jira alerting is shown as Coming Soon; click Finish.

2. Review what the first audit found

1. Open Operations → Access Audit. Your import is on the Access Import tab with its record count.
2. If AutoCISO could not tell which asset a file belongs to, the row shows Unidentified: click it and assign the asset.
3. Open the Review Queue tab. Anything AutoCISO flagged — an account of a terminated employee, an account that matches nobody, a match it was unsure of — waits there for a decision.
4. Open Access & Risk → Access Inventory to see the result: one row per employee and asset.

Repeat New Import for each asset you added. Access that cannot be exported at all, such as a shared admin login, can be recorded with Add Manually — see Evidence on manual access.

3. Invite your team

1. Open the user menu and choose User Management.
2. Click Invite User, enter one or more email addresses and pick a role.
3. Click Invite. Each person receives an email to join your organisation.

A typical small team starts with one more Manager (runs audits, lifecycle and ISO work), Contributors for people who maintain assets, employees and evidence, and an Auditor seat for your external auditor later. What each role can do is listed in Roles & permissions.

4. Make the console yours

Open the Dashboard. The first time, AutoCISO asks you to tailor it to your job — CTO, Security lead, CEO, Compliance officer and so on. Your choice only changes what is shown first; see Role focus.

Next steps

• Work through the Setup checklist over the coming weeks.
• Check which features your plan includes in Plans & features.
• Automating from CI or an AI assistant? Start at API tokens.