# Setup Checklist
URL: https://docs.autociso.io/getting-started/setup-checklist/
Description: A phased checklist from first sign-in to audit readiness, with the console location and plan for each step.

Use this list to plan the weeks after the [Quickstart](https://docs.autociso.io/getting-started/quickstart/). Each phase builds on the one
before. The **Plan** column is the lowest plan that includes the step — see
[Plans & features](https://docs.autociso.io/getting-started/plans-and-features/).

## Phase 1 — Foundation (day 1)

| | Step | Where | Plan |
|---|---|---|---|
| ☐ | Finish Organization Setup: name, sign-in methods, employee list, three or more assets, first audit | Welcome screen, or **Continue Setup** | Free |
| ☐ | Invite at least one other [Owner or Manager](https://docs.autociso.io/getting-started/roles-and-permissions/), so you are never the only person who can sign in | user menu → [**User Management**](https://docs.autociso.io/console/settings/members/) | Free |
| ☐ | Choose a [role focus](https://docs.autociso.io/getting-started/role-focus/) for your home screen | [**Dashboard**](https://docs.autociso.io/console/overview/dashboard/) | Free |

## Phase 2 — Know your access (week 1)

| | Step | Where | Plan |
|---|---|---|---|
| ☐ | Import the user list of every important asset | **Operations → [Access Audit](https://docs.autociso.io/console/access/access-audit/) → New Import** | Free |
| ☐ | Record access that cannot be exported, [with proof](https://docs.autociso.io/product/access/manual-access-evidence/) | **Access Audit → Add Manually** | Free |
| ☐ | Work through the review queue and [fix wrong employee matches](https://docs.autociso.io/product/access/correct-employee-match/) | **Access Audit → [Review Queue](https://docs.autociso.io/console/access/review-queue/)** | The Seed |
| ☐ | Read the CISO reports: [stale accounts](https://docs.autociso.io/console/ciso-reports/stale-accounts/), [offboarding violations](https://docs.autociso.io/console/ciso-reports/offboarding-violations/), [access concentration](https://docs.autociso.io/console/ciso-reports/access-concentration/) | **Access & Risk → CISO Reports** | The Seed |

## Phase 3 — Keep it current (weeks 2–3)

| | Step | Where | Plan |
|---|---|---|---|
| ☐ | [Define access profiles and start joiner cases](https://docs.autociso.io/product/lifecycle/onboarding/) for new hires | **Lifecycle (JML) → [Access Profiles](https://docs.autociso.io/console/operations/access-profiles/)** | The Seed |
| ☐ | [Check every leaver case](https://docs.autociso.io/product/lifecycle/offboarding/) until it is **Clean** | **Lifecycle (JML) → [Leaver (Offboarding)](https://docs.autociso.io/console/operations/offboarding/)** | The Seed |
| ☐ | [Connect your company's identity provider](https://docs.autociso.io/product/sso/overview/) and restrict sign-in to it | user menu → **Organization Settings → Sign-In Policy** | The Growth |
| ☐ | Add your key suppliers and send them a [security questionnaire](https://docs.autociso.io/product/suppliers/assessments/) | **Directory → [Suppliers](https://docs.autociso.io/console/directory/suppliers/)** | Free (assessments) |

## Phase 4 — ISO 27001 programme (weeks 3–8)

| | Step | Where | Plan |
|---|---|---|---|
| ☐ | [Create an ISO 27001 project](https://docs.autociso.io/console/iso/new-project/), define the [scope](https://docs.autociso.io/console/iso/scope/) and run the [gap analysis](https://docs.autociso.io/console/iso/gap-analysis/) | **Certifications → [ISO 27001](https://docs.autociso.io/console/iso/projects/)** | The Growth |
| ☐ | Review the Statement of Applicability and assign control owners | ISO project → [**SoA**](https://docs.autociso.io/console/iso/soa/) | The Growth |
| ☐ | Record risks and treatment plans | **Access & Risk → [Risk Management](https://docs.autociso.io/console/risk/workspace/)** | The Growth |
| ☐ | [Upload or collect evidence](https://docs.autociso.io/product/iso/upload-evidence/) for every applicable control | ISO project → [**Evidence**](https://docs.autociso.io/console/iso/evidence/) | The Growth |
| ☐ | Run access reviews, a backup test and an internal audit | ISO project → [**Access Reviews**](https://docs.autociso.io/console/iso/access-reviews/), [**Backup Tests**](https://docs.autociso.io/console/iso/backup-tests/), [**Internal Audits**](https://docs.autociso.io/console/iso/internal-audits/) | The Growth |

## Phase 5 — Audit readiness

| | Step | Where | Plan |
|---|---|---|---|
| ☐ | Clear stale evidence before the audit window | ISO project → **Evidence** | The Growth |
| ☐ | Hold the management review | ISO project → [**Mgmt Review**](https://docs.autociso.io/console/iso/management-review/) | The Growth |
| ☐ | Check the readiness score | ISO project → [**Readiness**](https://docs.autociso.io/console/iso/readiness/) | The Growth |
| ☐ | Invite your external auditor with the read-only **Auditor** role; they work in the [External Auditor Portal](https://docs.autociso.io/console/iso/auditor-portal/) | user menu → **User Management** | Free |