Quickstart
Go from a new workspace to your first compliance program, with evidence collecting itself, in about fifteen minutes.
Updated 2026-10-21
This guide gets a new workspace to a working compliance program: a framework selected, controls scoped, one system connected and the first evidence collecting itself. Every step has a prompt you can hand to Fibo if you would rather have them do the legwork.
Before you start
You need:
- A work email address for the workspace owner.
- A rough idea of the framework you are working toward. Not sure? Step 3 helps.
- Admin access to at least one system you want to connect, usually your identity provider (Okta, Microsoft Entra ID, Google Workspace) or cloud account (AWS, Azure, GCP).
1. Create your workspace
- Sign up at app.csquaregrc.com.
- Confirm your email address from the message we send you.
- Name your workspace after your organization. The first person to sign up becomes the workspace owner.
2. Complete your organization profile
Open Settings > Organization and fill in:
| Field | Why it matters |
|---|---|
| Industry | Drives framework suggestions and sector-specific controls. |
| Locations | Determines which regional laws apply, for example GDPR. |
| Data types | PHI, cardholder data and personal data pull in HIPAA, PCI DSS and privacy controls. |
| Headcount and hosting | Tailors which controls are inherited from your cloud provider. |
A complete profile is what makes the Control Applicability Wizard accurate later, so it is worth the five minutes.
Review my organization profile in cSquare GRC and tell me which fields are missing or too vague to tailor control applicability. Suggest what to fill in for each.
3. Start your first program
- Go to Programs and choose New program.
- Pick a framework template, for example SOC 2 or ISO 27001.
- Walk through the planning wizard. Five steps are required and three are optional; you can come back to the optional ones.
- Review the control list. The Control Applicability Wizard marks controls that do not apply to you, with a reason you can edit.
Based on my organization profile, which compliance frameworks should we prioritize and in what order? Explain the reason for each in one sentence.
See Launch your first program for the detailed walkthrough.
4. Connect one tool
Evidence that collects itself is the fastest way to raise your readiness score. Pick the system most of your controls depend on and follow its connector guide. Good first choices:
- Identity provider for access reviews, MFA and onboarding/offboarding controls.
- Cloud account for logging, encryption and configuration controls.
- Code host (GitHub, GitLab) for change management controls.
Which single connector would cover the most controls in my current program? Rank the top three and tell me how many controls each would provide evidence for.
5. Invite your team
Bring in control owners, reviewers and, later, auditors. See Invite your team.
Check your work
After fifteen minutes you should see:
- A program on the Programs page with a control count.
- At least one connector showing Connected in Settings > Integrations.
- Evidence items appearing under Evidence with that connector as the source.
- A readiness score on the program dashboard above zero.
Next steps
- Follow the 30-day setup checklist to reach audit-ready.
- Keep the AI prompt library handy for everyday work.
- Learn how programs and controls fit together.