Onboarding checklist
Use this checklist to gather everything Soveryne needs before go-live, and to decide who in your organisation provides each item. Most items take minutes to collect. A few, such as a signed scanning mandate or a DNS change, can take days, so start those first.
How onboarding works
Your workspaces are created in one of two ways:
By your Soveryne partner. Your managed-service partner creates your Command workspace from their own Command and runs it with you. Your staff also get access to the partner's shared Counsel.
By Soveryne directly. Soveryne creates a workspace for each product you use, with the administrator and sign-in settings you provide.
Either way, the information below is the same. Items marked Required block the product until they are provided.
Who to involve
| Person | What they provide |
|---|---|
| CISO or security lead | Scope, frameworks, departments, crown jewels, the programme team for BAIT |
| Identity-provider administrator | Identity provider, email domains, sign-in confirmations |
| DNS administrator | TXT records for BAIT and ATLAS, and your own web address if you want one |
| Cloud, directory and CMDB administrators | Read-only access for MESH to Azure, Entra, AWS, Google Cloud, Google Workspace or ServiceNow |
| Legal, or an authorised signatory | The data processing agreement, the ATLAS scanning mandate, and any intrusive-testing authorisation |
| Data Protection Officer | Approval of the BAIT programme, and the decisions on identifying individuals |
| HR or works council | Agreement on the awareness programme, and a check that your directory groups match your departments |
| Mail administrator | The mail route and SPF/DKIM records for BAIT simulations, and mail-filter settings |
1. Agreements
| Item | Why | Provided by | Required? |
|---|---|---|---|
| Products you will use | Decides which workspaces are created | CISO | Required |
| Hosting model: shared, or a dedicated workspace that holds only your organisation | Decides where your workspaces run | Contract | Required |
| Data processing agreement | Covers the personal data the products process | Legal | Required |
| Works council or staff-representation agreement | Phishing simulations involve employees. Agree the programme before it starts. | HR / legal | Recommended for BAIT |
2. Sign-in
See Single sign-on and Domains for details.
| Item | Why | Provided by | Format | Required? |
|---|---|---|---|---|
| Organisation name | Names your workspaces and appears in every generated policy | CISO | Text | Required |
| Every email domain your staff sign in with, including subsidiaries and aliases | Decides who may sign in | Identity-provider admin | example.com. Public email services are not accepted. | Required |
| Your identity provider | People sign in with their existing work account | Identity-provider admin | Google Workspace, Microsoft Entra ID, Okta or GitHub. SAML is not supported. | Required |
| Confirmation that every user has a verified email address, and may sign in to a third-party application | Without them, sign-in is refused | Identity-provider admin | Yes / no | Required |
| First administrator | Administrator access is never granted through sign-in rules, so it is set up separately | CISO | Name and work email on your own domain | Required |
| The role your staff get by default | Most staff start read-only | CISO | Default: Auditor | Optional |
| People to invite by name, with a role | For example consultants from outside your domains, or your policy editors | CISO | Email address and role | Optional |
| Working language | Command, Counsel and BAIT work in English and Dutch | CISO | English or Dutch | Optional |
| Your own web address | If the products should open on your own domain | DNS admin | For example command.example.com. Soveryne gives you the DNS records. | Optional |
3. Command
| Item | Why | Provided by | Required? |
|---|---|---|---|
| Identity: organisation name, legal entity, registration number, website, address, country | Printed in your policies | Management / legal | Required where a policy uses it |
| Size and sector: sector, industry (NACE), headcount, turnover band, organisation size | Size decides which clauses your policies contain | Management | Required where a policy uses it |
| Your organisation in your own words: what the organisation does, the scope of the policy set, the systems and services in scope, and the regulatory context | Command drafts your policies from these. It will not generate policies while they are empty. | CISO | Required for policies |
| Governance: who signs policies off, the security contact, the Data Protection Officer, the validity period and the review cycle | Printed in your policies | Management / DPO | Required where a policy uses it |
| Customer email domain | Needed to publish policies to your staff in Counsel | IT | Required for publishing |
| Frameworks and baseline: for example the Dutch municipality BIO2 baseline, the ISO 27001 starter for smaller organisations, the NIS2 essential-entity baseline, or a custom pack | Command creates your controls and policies from the chosen baseline | CISO | Required for controls and policies |
| Departments and their members' email addresses | Decides who receives each policy and evidence request | HR / CISO | Recommended |
| The authorities you report incidents to, including your sector regulator | Used when you prepare incident notifications | CISO / legal | Recommended |
| For partners only: practice name, partner domain, brand colours, document font, signatory, legal footer and logo | Shown on your customers' workspaces and on the policy packs you publish. Set in the partner portal. | Partner | Optional |
Note
Command can read your public website to pre-fill parts of the organisation profile. Check what it filled in before you generate policies.
4. MESH (automatic asset import)
MESH keeps one asset register for all your Soveryne products. It imports from the sources you connect every hour, starting as soon as a connection is verified. Each source is optional. An administrator connects them in MESH by signing in to each provider and approving read-only access. See Connecting sources for the exact steps.
| Source | What it brings in | What you need | Provided by |
|---|---|---|---|
| Microsoft Azure | Cloud resources and access | An administrator who can sign in to Microsoft and consent to Soveryne's application, and the Reader role for that application on the subscriptions to import | Azure admin |
| Microsoft Entra | People, groups and workload identities | An administrator who can sign in to Microsoft and approve read access to users, groups, applications and directory roles | Entra admin |
| Amazon Web Services | Resources, IAM and Identity Center | Permission to deploy a CloudFormation stack that creates a read-only role, and Resource Explorer with an aggregator index | AWS admin |
| Google Cloud | Resources, service accounts and access | An administrator who can sign in to Google and approve read access | Google Cloud admin |
| Google Workspace | Users, groups and memberships | An administrator who can sign in to Google and approve read-only directory access | Google Workspace admin |
| ServiceNow | CMDB assets and relationships | Your instance name (<name>.service-now.com), which Soveryne sets up for your workspace, and an account that can sign in and read the CMDB | ServiceNow admin |
| Someone to answer import questions | Answers, not data: MESH asks a person instead of guessing, for example "are these two records one machine?" | A person with the Admin role in Command | CISO |
You never give Soveryne a cloud password or key. You sign in to the provider yourself and approve read-only access, and you can withdraw it at any time. MESH only reads from your sources; it never writes back.
5. ATLAS (attack-surface management)
| Item | Why | Provided by | Required? |
|---|---|---|---|
| Organisation name and type | Shapes the threat model | CISO | Required |
| The domains, IP addresses and ranges in scope | ATLAS looks only at what is in scope. A range can hold at most 256 addresses. | CISO / IT | Required |
| A signed scanning mandate, and the name and role of the signatory | Without it, ATLAS refuses every active scan. ATLAS records who signed and when. Keep the signed document yourself. | Authorised signatory | Required for active scans |
| DNS access to publish a TXT record for each domain, or another proof of ownership | Nothing under a domain is scanned until ownership is proved | DNS admin | Required for active scans |
| Your crown jewels, and the kind of data each one holds | Ranks the attack paths that lead to what matters most | CISO / asset owners | Recommended |
| A separate, time-limited authorisation for intrusive tests, naming the hosts it covers | Tests that go beyond observation are never covered by the scanning mandate | Authorised signatory | Optional |
| Internal ranges, if you want an internal engagement | Private addresses are refused unless they are explicitly allowed | CISO, with Soveryne | Optional |
6. BAIT (phishing awareness)
| Item | Why | Provided by | Required? |
|---|---|---|---|
| Organisation details: country, default email language and timezone | Used for reports and for when simulations are sent | CISO | Required |
| Every domain your staff receive email on, and DNS access for a TXT record on each | BAIT sends only to domains you have proved you own | DNS admin | Required |
| Mail route details: the relay that sends the simulations, the sender address, and SPF and DKIM on the sender domain | Simulations are delivered through a route agreed with you | Mail admin, with Soveryne | Required |
| Your staff directory connected in MESH, and a BAIT administrator to bring the groups into BAIT with Sync now on People | Campaigns are sent to groups from your directory | IT | Required |
| A named Data Protection Officer who uses BAIT | Identifying an individual is refused until one is named | DPO | Required to handle identification requests |
| At least two people on the programme team | Nobody approves their own campaign | CISO | Required to send a campaign |
| Mail-filter settings for simulations | Some organisations let simulation mail through their filters. Your Soveryne contact will advise. | Mail admin | Recommended |
7. Counsel
Counsel needs nothing extra. Your staff get access through your email domains, receive published policies by department, and answer evidence requests there. To give outside consultants access, invite them by exact email address.
Recommended order
1
Sign the agreements. For ATLAS, have the scanning mandate signed early.
2
Make the sign-in decisions: identity provider, email domains and the first administrator.
3
Publish DNS records: BAIT receiving domains, ATLAS domains and, if you use one, your own web address. They can take up to an hour to be visible.
4
Your workspaces are created by Soveryne or your partner.
5
The first administrator signs in. They check their role before inviting others.
6
Command set-up wizard: open it from the profile menu with Set-up wizard, then work through Organisation › Departments › Single sign-on › Assets › Template bundle › Generate.
7
Invite people, and check their roles in Users & roles.
8
Connect MESH sources and verify them. The first import starts as soon as a connection is verified, and then runs every hour.
9
ATLAS: complete the onboarding wizard, verify your domains, record the mandate, then run the first scans.
10
BAIT: complete Set up your programme, name your Data Protection Officer and make sure a second person can approve.
11
Publish your first policies to Counsel.
Ready for go-live?
[ ] The first administrator can sign in and has administrator access.
[ ] A test user on each email domain signs in with the expected role.
[ ] The organisation profile is complete, and a test policy generates.
[ ] Every connected source shows Connected, the first import has run, and no import question is left open.
[ ] ATLAS shows every domain verified and a mandate on file.
[ ] BAIT shows every receiving domain verified, a Data Protection Officer, two people on the programme team, and your employee groups.