Launch your first program
Choose a framework, scope it to your organization, assign owners and set milestones your team can hit.
Updated 2026-10-21
A program is one compliance effort against one framework, for example "SOC 2 Type II 2026". Everything else in cSquare, controls, evidence, tasks and reports, hangs off a program.
1. Choose a framework
- Open Programs > New program.
- Browse the templates. Each is built from the official framework text and shows how many controls are actionable, so you know the size of the job before you commit. Structural entries such as functions, categories and guidance are counted separately.
- Name the program with the framework, type and year, for example ISO 27001:2022 Certification 2026. Clear names make reports and auditor sharing easier.
If you are unsure which framework applies, see Frameworks & regulations or ask Fibo:
We are a <industry> company with <headcount> people, operating in <countries>, and we handle <data types>. Which frameworks apply to us, which do customers usually ask for first, and roughly how much overlap is there between them?
2. Work through the planning wizard
The wizard has five required and three optional steps. Required steps set scope, timeline and ownership; optional steps add context that improves suggestions. You can save and leave at any point.
3. Scope the controls
The Control Applicability Wizard proposes which controls apply based on your organization profile. For each control you can:
- Keep it in scope.
- Mark it not applicable, with a justification an auditor can read.
- Mark it inherited from a provider, for example physical security from your cloud host.
Review every not-applicable decision. Auditors will ask about them.
Review the not-applicable controls in my <program name> program. Flag any whose justification is weak or that an auditor is likely to challenge, and suggest better wording.
4. Assign owners
Every in-scope control needs an owner.
- Open the program's Controls table.
- Filter by domain or department.
- Select controls and choose Assign owner to bulk assign.
- Let owners refine and reassign within their teams.
Suggest an owner role for each unassigned control in my <program name> program, grouped by department, so I can bulk assign them.
5. Set milestones
Add milestones such as Readiness review, Evidence freeze and Audit fieldwork. The program dashboard tracks progress against each and flags what is blocking the next one.
A typical first-year plan:
| Milestone | Typical timing |
|---|---|
| Scoping complete | Week 2 |
| Policies approved | Week 6 |
| Connectors live, evidence flowing | Week 8 |
| Readiness review | Week 12 |
| Audit fieldwork | After your observation period (Type II) or readiness review (Type I) |
6. Check readiness
The audit readiness score updates as controls are implemented and evidence arrives. Use it to decide when you are ready to book the audit.
How ready is my <program name> program for audit? List the ten gaps that would move the readiness score the most, with an owner and a suggested due date for each.