Getting started
Key concepts
A short glossary of the terms you will see across Radius360. Reading this once saves you from guessing later.
Radius360 uses a small, consistent vocabulary. Every screen in the product refers back to these terms. If you are comfortable with this page you are comfortable with the product.
Tenant
A tenant is the container for one client's data. Every risk, policy, integration, framework assessment, and piece of evidence lives inside exactly one tenant. Tenants are isolated from each other at the database level. Data cannot leak across tenants, even by accident.
If you are a single company using Radius360 for your own program, you have one tenant. If you are a vCISO or MSSP managing multiple clients, each client has its own tenant and you switch between them from the dashboard.
Client
"Client" is the label for a tenant when you are running Radius360 as a vCISO, MSSP, or consultancy. A client is the end company whose security program you are managing. Every client has exactly one tenant and vice versa.
Risk
A risk is something that could go wrong in the security program, scored by how much it would hurt if it did (impact) and how likely it is to happen (likelihood). Risks can be manually entered, generated by the onboarding wizard, or created automatically by deep integrations when they detect something worth flagging.
Every risk has an owner, a severity, a status (open, in progress, mitigated), a category, linked framework controls, and a set of associated mitigation tasks.
Policy
A policy is a written document that defines how the organization handles a security topic. Policies map to framework controls: a password policy satisfies the access control requirements of SOC 2, ISO 27001, and NIST CSF simultaneously.
Radius360 stores policies with version history, acknowledgment tracking, and a draft, review, and published workflow. Policies can be imported, drafted by AI, or written from scratch.
Framework
A framework is a compliance standard the organization is held accountable to. SOC 2, ISO 27001, NIST CSF, HIPAA, PCI DSS, CMMC, GDPR, DORA, and others are among the 30 frameworks Radius360 supports out of the box.
When you activate a framework for a tenant, Radius360 loads its full control library and lets you track your progress against each control.
Control
A control is a specific requirement inside a framework. For example, SOC 2 CC6.1 is the control for logical access. ISO 27001:2022 A.5.16 covers identity management, and ISO 27001:2022 A.8.5 covers secure authentication. Controls are the unit at which evidence is collected and compliance is judged.
The same evidence often satisfies multiple controls
Cross-framework mapping is automatic. Evidence you attach to SOC 2 CC6.1 will also count toward ISO 27001:2022 A.5.16 and NIST CSF 2.0 PR.AA-01 if those frameworks are activated in the tenant, because they all require proof of the same underlying practice.Evidence
Evidence is the proof that a control is satisfied. It can be a configuration screenshot, an exported report, a policy document, a log excerpt, or a signed attestation. Evidence is stored in the Evidence Vault, tagged with the source, the controls it satisfies, and a collection timestamp.
Evidence from integrations is collected automatically. Evidence from manual uploads is attached explicitly by a user.
Integration
An integration is a connection to an external system that feeds data into Radius360. There are 46 supported integrations: 23 "deep", 18 "standard", and 5 discovery and vendor-risk feeds. See the deep vs standard page for the distinction.
Incident
An incident is a security event that requires a tracked response. Incidents can be created manually, generated automatically from a high-severity integration alert, or escalated from an open risk whose severity crosses a threshold.
Every incident has a timeline, an assigned responder, linked evidence, and a status (investigating, contained, resolved, post-mortem complete).