Setup Checklist
Use this list to plan the weeks after the Quickstart. Each phase builds on the one before. The Plan column is the lowest plan that includes the step — see Plans & features.
Phase 1 — Foundation (day 1)
| Step | Where | Plan | |
|---|---|---|---|
| ☐ | Finish Organization Setup: name, sign-in methods, employee list, three or more assets, first audit | Welcome screen, or Continue Setup | Free |
| ☐ | Invite at least one other Owner or Manager, so you are never the only person who can sign in | user menu → User Management | Free |
| ☐ | Choose a role focus for your home screen | Dashboard | Free |
Phase 2 — Know your access (week 1)
| Step | Where | Plan | |
|---|---|---|---|
| ☐ | Import the user list of every important asset | Operations → Access Audit → New Import | Free |
| ☐ | Record access that cannot be exported, with proof | Access Audit → Add Manually | Free |
| ☐ | Work through the review queue and fix wrong employee matches | Access Audit → Review Queue | The Seed |
| ☐ | Read the CISO reports: stale accounts, offboarding violations, access concentration | Access & Risk → CISO Reports | The Seed |
Phase 3 — Keep it current (weeks 2–3)
| Step | Where | Plan | |
|---|---|---|---|
| ☐ | Define access profiles and start joiner cases for new hires | Lifecycle (JML) → Access Profiles | The Seed |
| ☐ | Check every leaver case until it is Clean | Lifecycle (JML) → Leaver (Offboarding) | The Seed |
| ☐ | Connect your company’s identity provider and restrict sign-in to it | user menu → Organization Settings → Sign-In Policy | The Growth |
| ☐ | Add your key suppliers and send them a security questionnaire | Directory → Suppliers | Free (assessments) |
Phase 4 — ISO 27001 programme (weeks 3–8)
| Step | Where | Plan | |
|---|---|---|---|
| ☐ | Create an ISO 27001 project, define the scope and run the gap analysis | Certifications → ISO 27001 | The Growth |
| ☐ | Review the Statement of Applicability and assign control owners | ISO project → SoA | The Growth |
| ☐ | Record risks and treatment plans | Access & Risk → Risk Management | The Growth |
| ☐ | Upload or collect evidence for every applicable control | ISO project → Evidence | The Growth |
| ☐ | Run access reviews, a backup test and an internal audit | ISO project → Access Reviews, Backup Tests, Internal Audits | The Growth |
Phase 5 — Audit readiness
| Step | Where | Plan | |
|---|---|---|---|
| ☐ | Clear stale evidence before the audit window | ISO project → Evidence | The Growth |
| ☐ | Hold the management review | ISO project → Mgmt Review | The Growth |
| ☐ | Check the readiness score | ISO project → Readiness | The Growth |
| ☐ | Invite your external auditor with the read-only Auditor role; they work in the External Auditor Portal | user menu → User Management | Free |
Last reviewed: 2026-10-15
Was this page helpful?