Onboarding a client

What the wizard does

Radius360's onboarding turns the usual first-week setup work into a few minutes. Instead of staring at a blank risk register and empty framework tabs, the onboarding wizard walks you through six short steps and uses your choices to seed starter content across the client's tenant.

The wizard understands that the first version doesn't need to be perfect, it needs to give you something to react to. Everything it seeds is editable, attributable to you as the operator, and visible in the client's risk register, policy library, and framework assessments from the moment the wizard closes.

Running the wizard

Open Client Management → Onboard Client. The wizard has six steps:

1. 1
   Client info. Organization name, industry, company size, and a short description.
2. 2
   Frameworks. Pick any of the 30 frameworks in the catalog (SOC 2, ISO 27001, HIPAA, NIST CSF, PCI DSS, CMMC, DORA, and more). You can select several; cross-framework mappings mean shared controls don't get duplicated. You can add or remove frameworks at any point later.
3. 3
   Risk register. Starter risks matched to the frameworks you picked. HIPAA and CMMC pull in their domain-specific risks, and most frameworks add AI-era risks. Everything is selected by default; untick anything that doesn't apply.
4. 4
   Policies. Eight starter policies. Deselect any you don't need.
5. 5
   Review. Check what will be created. You can also choose to run Risk Discovery as soon as the client is set up.
6. 6
   Assign vCISOs. Pick which members of your practice work this client. You are selected by default, and at least one person is required.

When you finish, the client tenant is created and you are switched into it. If you chose to run Risk Discovery, you land there next. It asks nine questions (industry, size, sensitive data handled, cloud platforms, controls already in place, compliance requirements, recent incidents, vendor access, and priorities) and uses the answers to suggest risks beyond the starter set.

What gets seeded

Starter risks

Starter risks across categories that matter for almost every security program:

• Access control: e.g., MFA on remote access, privileged account review
• Data security: encryption at rest, key management, backup testing
• Infrastructure: endpoint detection deployment, patch SLAs, configuration drift
• Operational: incident response plan, business continuity, vendor review
• Compliance: security awareness training, BAAs/DPAs, policy acknowledgment tracking
• Third-party risk: vendor inventory, tiered assessments, continuous monitoring
• AI risk: shadow AI usage, model governance, training data provenance (if applicable)

Starter policies

A foundational set of eight policies: information security, acceptable use, access control, data classification and handling, incident response, business continuity, change management, and vendor management.

Policies are seeded as drafts, owned by you, and editable immediately. You decide when to move them from Draft to Published.

Framework assessments

Every framework you selected is activated with its full control library, starting at zero percent complete so you can see exactly where to focus. Completion rises as evidence lands from integrations and uploads.

Editing after onboarding

Nothing from the wizard is locked. The seeded content is a starting point, by the end of your first week you'll have modified severity scores, re-owned risks to real people, published policies, and connected integrations that replace manual evidence with live feeds.

A good rule of thumb: if a seeded risk or policy doesn't feel right for this specific client, edit it. The wizard optimizes for coverage and reasonable defaults, not a perfectly tuned starting state.

Multi-client workflows

For vCISOs and MSSPs running multiple clients, the wizard scales. Each client gets its own tenant with row-level isolation, data never crosses between clients. From Client Management, you can onboard as many clients as your plan allows and move between them without re-authenticating.

Common starter content (your own policy templates, for example) can be promoted to an organization template and applied to every new client at onboarding time. Useful when you have a signature set of policies you want every client to start with.

Common questions

Can I re-run the wizard?

The wizard runs once per tenant. If you want to regenerate a fresh starter state, you'd create a new tenant. But in practice, editing the existing seeded content is faster than re-seeding, especially once you've connected integrations, since those risks and evidence aren't regenerated by a wizard re-run.

What if my client doesn't fit the industry options?

Pick the closest match. The wizard's industry choice is a starting bias, not a hard constraint. You can adjust frameworks, policies, and risks after the wizard runs.

What if my client has existing policies we want to import?

Run the wizard first to get the framework assessments set up. Then use Upload policy on the Policies tab to bring in existing documents, or drop them into Intake, which reads and classifies each document and proposes what to create. Nothing is written until you approve it.