Onboarding a client

What the wizard does

Radius360's onboarding turns the usual first-week setup work into the first ninety seconds. Instead of staring at a blank risk register and empty framework tabs, the Risk Discovery Wizard asks five short questions and uses the answers to seed starter content across the client's tenant.

The wizard understands that the first version doesn't need to be perfect, it needs to give you something to react to. Everything it seeds is editable, attributable to you as the operator, and visible in the client's risk register, policy library, and framework assessments from the moment the wizard closes.

Running the wizard

Open Client Management → Onboard Client from the sidebar. You'll be asked five questions:

1. 1
   Industry. Healthcare, financial services, SaaS, manufacturing, biotech, and more. This drives which starter risks and policy templates are most relevant. A healthcare client gets HIPAA, HITRUST, and SOC 2 defaults; a fintech gets SOC 2, GLBA, and (where applicable) PCI DSS, NYDFS Part 500, and DORA. The wizard surfaces the likely set, but you can add or remove frameworks at any point.
2. 2
   Size. Rough employee count. Affects which controls are realistic (e.g., formal SOC is disproportionate for a 20-person company).
3. 3
   Data types handled. PHI, cardholder data, personal data under GDPR, intellectual property, etc. Drives the regulatory framing and evidence priorities.
4. 4
   Regulatory context. Any explicit framework requirements (SOC 2, ISO 27001, HIPAA, NIST CSF, PCI DSS, CMMC, FDA/GxP, etc.). You can select multiple, the wizard will seed cross-framework mapping so shared controls don't get duplicated.
5. 5
   Current maturity. A quick self-assessment of where the program is today. This tunes the severity scoring on seeded risks so your register reflects where the client actually is, not a one-size-fits-all baseline.

After the last question, the wizard spends ~30 seconds generating the starter state. Then the client tenant is ready.

What gets seeded

Starter risks

Ten risks across categories that matter for almost every security program:

• Access control: e.g., MFA on remote access, privileged account review
• Data security: encryption at rest, key management, backup testing
• Infrastructure: endpoint detection deployment, patch SLAs, configuration drift
• Operational: incident response plan, business continuity, vendor review
• Compliance: security awareness training, BAAs/DPAs, policy acknowledgment tracking
• Third-party risk: vendor inventory, tiered assessments, continuous monitoring
• AI risk: shadow AI usage, model governance, training data provenance (if applicable)

Starter policies

A foundational policy set drafted against the frameworks you selected, typically 8–12 policies covering information security, access control, data classification, incident response, business continuity, acceptable use, vendor management, and framework-specific ones (HIPAA Security Rule for healthcare, PCI-DSS SAQ policy for card-handling clients, etc.).

Policies are seeded as drafts, owned by you, and editable immediately. You decide when to move them from Draft to Active.

Framework assessments

Every framework you selected is activated with its full control library and mapped against the seeded risks and policies. Controls that are partially addressed by the starter content are marked as in progress; the rest are marked as not started so you can see exactly where to focus.

Editing after onboarding

Nothing from the wizard is locked. The seeded content is a starting point, by the end of your first week you'll have modified severity scores, re-owned risks to real people, published policies, and connected integrations that replace manual evidence with live feeds.

A good rule of thumb: if a seeded risk or policy doesn't feel right for this specific client, edit it. The wizard optimizes for coverage and reasonable defaults, not a perfectly tuned starting state.

Multi-client workflows

For vCISOs and MSSPs running multiple clients, the wizard scales. Each client gets its own tenant with row-level isolation, data never crosses between clients. From the vCISO Dashboard, you can onboard as many clients as your tier allows (3 on Starter, 10 on Professional, 25 on Business, unlimited on Enterprise) and move between them without re-authenticating.

Common starter content (your own policy templates, for example) can be promoted to an organization template and applied to every new client at onboarding time. Useful when you have a signature set of policies you want every client to start with.

Common questions

Can I re-run the wizard?

The wizard runs once per tenant. If you want to regenerate a fresh starter state, you'd create a new tenant. But in practice, editing the existing seeded content is faster than re-seeding, especially once you've connected integrations, since those risks and evidence aren't regenerated by a wizard re-run.

What if my client doesn't fit the industry options?

Pick the closest match. The wizard's industry choice is a starting bias, not a hard constraint. You can adjust frameworks, policies, and risks after the wizard runs.

What if my client has existing policies we want to import?

Run the wizard first to get the framework assessments set up. Then use Policy Library → Import to upload existing policies. Radius360 will parse them, extract controls they cover, and map them to the right framework slots automatically.