Command

Part ofSet up Soveryne for your organisation Build and run your compliance programme

Command is Soveryne's security-governance console. You use it to keep your register of security controls, collect evidence, write and publish policies, track your frameworks, handle incidents and keep an audit trail, all for one organisation.

This page explains who uses Command, what you need before you start, how to find your way around, and how to set up a new workspace with the set-up wizard. Each task has its own page; see Tasks.

Who uses it

Your role decides what you can change. Menus and buttons are the same for everyone. When your role does not allow an action, Command refuses it and shows a short error message.

Role	What they do in Command
Admin	Sets up the workspace: organisation profile, departments, single sign-on, people and roles, frameworks and the workspace language. Can do everything below. Admin access is set up by Soveryne or your partner, never from inside Command.
Policy editor	Writes and reviews controls, generates, approves and publishes policies, applies template packs, and sends evidence requests. Reads incidents.
Incident responder	Opens investigations, declares and handles incidents, and runs reporting clocks. Reads controls, evidence and frameworks.
Auditor	Reads controls, evidence, policies, frameworks, incidents and the audit log. Can ask the AI evidence auditor to check a piece of evidence. This is the read-mostly role your staff get by default.
Security manager	Registers and retires assets, runs the AI assists on controls, imports frameworks and edits the organisation profile.

Everyone in the workspace works on the same organisation records: an Incident responder, Auditor or Policy editor sees all of the organisation's controls, incidents, evidence and frameworks that their role may read, not only the ones they created. Notifications are personal: you see only your own.

Partners who run Command for several customers manage those customer workspaces from the Soveryne portal. Return to portal in the profile menu takes you back there.

For the full list of what each role may do, see Roles and permissions.

Before you begin

Your workspace has been created by Soveryne or by your partner, and you have an account. See the Onboarding checklist.

You sign in with your work account through single sign-on. See Single sign-on.

To publish policies and send evidence requests, your workspace is linked to a Counsel workspace and your organisation's Customer email domain is filled in. See Settings.

Your assets come from MESH, Soveryne's shared asset register. See Assets.

Getting around

After you sign in, Command opens on the Dashboard. The top navigation has eight pages:

Page	What you find there
Dashboard	Your compliance overview, the control board and the threat-intelligence feed.
Controls	Your register of security controls, with the control editor. See Controls.
Assets	The systems, locations and data your controls protect. See Assets.
Chat	Conversations with Command's AI assistants. See Chat and assistants.
Documents	Three tabs: Evidence, Policies and Frameworks. See Evidence and Policies.
Frameworks	Framework enrolment, template packs, gap analysis and comparison. See Frameworks.
Incidents	Investigations and incidents, with timelines and reporting clocks. See Incidents.
Audit log	The record of changes to controls and incidents. See Audit log.

The numbers next to Controls and Assets show how many you have. Clicking the Command logo in the top-left corner also opens the Dashboard.

Watch: getting around Command (about 1 min)

The Dashboard

The Dashboard has three tabs:

Overview shows your coverage per framework at the top, under Framework coverage, and seven cards under Operational metrics: Control posture, Framework coverage, Incident response, Asset protection, Audit-readiness, Risk posture and Governance activity. Click the footer of a card to open the page behind it.

Control board shows your controls in three columns, People, Organization and Technology. Filter by Status and Risk, click a card to open the control, or click + Add control in a column.

Threat intel shows security news from your feeds. See Threat intelligence.

Click one or more framework dials at the top of the Overview to narrow the cards to the controls of those frameworks, their evidence and the assets they protect. Incident response and Governance activity always show the whole organisation. GDPR, NIS2 and DORA are always shown first in the strip, whether or not you have enrolled them.

The Dashboard overview with framework coverage dials and seven metric cards

The control board with controls in People, Organization and Technology columns

At the top of the Dashboard, Search controls… finds controls on the control board, and New control opens the control editor with a new control.

The notification bell

The bell in the top bar shows a dot when you have something unread. Click it to see your notifications, for example Draft ready: followed by a control title when Command has finished drafting a control for you. Click a notification to open the control, incident, asset or evidence it is about. Mark all read marks everything as read, even after you reload the page. Opening a notification marks it as read too.

Click your name in the top-right corner to open the profile menu. It holds:

Item	What it does
Appearance	Theme (Auto, Light or Dark), remembered in this browser, and Language (EN or NL), which follows you to other devices. See Settings.
Set-up wizard	Opens the set-up wizard. See below.
Governance	Opens Documents › Policies.
Organisation	Your organisation profile, and Manage access for people and roles.
Departments	Your departments and the single sign-on settings.
Account settings	The language Command uses for AI-written content and chat.
Return to portal	Takes you back to the Soveryne portal, the list of your applications.
Log out	Signs you out.

Set up your workspace with the set-up wizard

The set-up wizard takes you through the first configuration of a workspace in six steps. Every step can be skipped, and you can come back to any step later.

Who can do thisAdmin. Some steps are also open to other roles: Assets to a Security manager, Template bundle and Generate to a Policy editor.

Note

The wizard does not open by itself in a new workspace. Open it from the profile menu.

Click your name in the top-right corner and choose Set-up wizard. The wizard fills the screen. The steps are listed on the left; click a step to jump to it.

Move through the steps with Next. Back returns to the previous step and Skip moves on without changes. Next saves the step first; if something is wrong, you stay on the step and see why.

When you have finished step 6, click Next, and then Go to the dashboard.

To stop and continue later, click Finish later at the bottom of the step list, or the close button in the top-right corner. When you open the wizard again, it opens on Generate; click any step on the left to go back to it.

Step 1: Organisation

Under Tell us about your organisation, fill in Organization name, Website, Sector and Customer email domain, and click Next.

When you enter a website, Command reads your public website in the background and fills in more of your organisation profile while you carry on. The note under Website shows Reading the website… and then Profile filled in from this site. If you type in a field while it reads, what you typed wins. You can check and complete the full profile later on the Organisation page. See Settings.

Step 2: Departments

Under Who is in the organisation?, type a Department name and, optionally, one member's Email address, and click Add department. Repeat for each department. Departments decide who receives each policy and evidence request. See People and departments.

Step 3: Single sign-on

Under How do people sign in?:

Click each identity provider you want to switch on. Only the providers set up for your platform are shown.

Under Allowed email domains, enter the email domains whose people may sign in. Your customer email domain is already filled in.

Optionally, under Invited people, enter an exact email address, choose a role and click Invite.

Click Next. Command shows Single sign-on settings saved.

Command will not switch a provider on until you add an allowed domain or at least one invited person. See Single sign-on.

Step 4: Assets

Under What are you protecting?:

Click Suggest assets. Command reads your organisation profile and proposes the assets a security programme should track.

Optionally, click Refine with Q&A and answer three short questions about where your systems run, what you operate and the most sensitive data you hold. Command updates the list.

Untick anything you do not want, and click Add selected. Command adds the assets to your asset register and shows Assets added with the number.

To import assets from ServiceNow, Microsoft Azure, AWS or Google Cloud, click Connect CMDB & clouds. When you close the wizard, Command opens Assets › Connected sources. See Connecting sources.

Step 5: Choose your baseline

In the step Template bundle, under Choose your baseline, click one or more template packs. Packs stack: overlapping frameworks and controls are merged. Below the packs, Command shows which frameworks it Will enrol and how many controls it will create at most.

If none of the packs fits, click Compose a custom pack, answer the two questions, and Command composes a pack for you. See Template packs.

Step 6: Generate

Click Generate controls and policies. Command enrols the frameworks of the packs you picked and drafts their controls. When it shows Done!, it lists how many frameworks and controls it created. The policy documents are written in the background; you can carry on working. You get a notification when they are ready.

The button is disabled until you pick a pack in step 5.

Threat intelligence

Dashboard › Threat intel gathers security news from your feeds and checks it against your assets.

Click a feed name to show only its articles, or All feeds to show everything. A story reported by several feeds is shown once.

Click Summarize & assess risk on an article. Command matches the article against the names and Technologies of your assets. If no asset is affected, the card says so. If assets match, a risk assessment opens with What happened, Why it matters here, Which assets and controls and Advice, and for each affected asset whether it is Covered, Insufficient or has No control.

From the risk assessment, click Draft control to draft a control for an unprotected asset, Take into chat to discuss the threat in Chat, or Update {n} impacted controls to move the controls that protect the affected assets back to draft for review. When more than five controls are affected, Command asks you to confirm first.

Click Read original to open the article on its own site.

An Admin can add a feed with Add RSS feed (a Feed name and an RSS feed URL) and remove one under Manage feeds.

Note

The AI brief in What happened is written for an Admin or Security manager. Other roles see the assessment and advice without it.

Tasks

Controls: write controls, comment, review and approve, use the AI assists.

Policies: generate, review and publish policies to Counsel.

Evidence: upload evidence, ask people for evidence, and check it.

Assets: register and maintain the assets your controls protect.

Frameworks: enrol frameworks, apply template packs, find and close gaps.

Incidents: investigate, declare and handle incidents.

Chat and assistants: ask Command's assistants for help.

Audit log: review and export the audit trail.

Settings: organisation profile, departments, single sign-on, people and roles, appearance and language.

← PreviousDomains Next →Controls