Quickstart Guide

This guide stands up a working compliance program in four phases, each one building on the last.

1. Configure your organization: settings, authentication, and your team
2. Represent your organization in the Registry: the systems, vendors, and people your program describes
3. Establish your compliance posture: your policies and the standards you're working toward
4. Align your program: controls grounded in your policies, and a plan for proving they operate

Configure Your Organization

Start by reviewing the available settings in Settings, and fill in your organization profile with a name, description, and avatar.

• Set up authentication. Review the authentication options and implement your preferred setup; Single Sign-On walks through identity provider configuration if that's your path.
• Create groups and set permissions to organize who owns what.
• Invite your team across Engineering, Security / IT, HR / People Ops, and Leadership. There are no per-user fees, so bring in everyone the program touches.

Represent Your Organization in the Registry

The Registry module in Openlane helps you narrow in on your audit scope: who is involved, what systems and vendors you rely on, and what is in scope. Creating or importing these records (via our UI, CSV upload, integrations) gives you something to point your policies and controls to.

• Add your Platforms, Vendors, Personnel, and key Assets
• Set up integrations to import records from the systems you already run, such as directory sync for personnel, instead of entering them by hand

Establish Your Compliance Posture

Create a program

Openlane Programs are containers for a compliance effort with a defined goal and timeline, and the program wizard is the fastest way to get a framework's controls added to your organization.

• Click the + button at the top of the side navigation, select Create Program
• Framework-based programs come pre-populated with the relevant controls. A SOC 2 program lets you scope which Trust Services Criteria (TSC) domains to include
• You don't have to have a program: you can enable a framework directly from the Standards Catalog instead. A program is just an easy way to get controls added, with a scope, timeline, and audit details attached
• You can enable multiple frameworks without duplicating work; one control can satisfy requirements across several frameworks

Write your policies

Policies are the backbone of your compliance program - they're the commitments your controls will operationalize. If you're writing from scratch, start with Writing Policies That Hold Up.

• Import existing policies if you have them (Markdown, Word, or synced from GitHub)
• Configure policies to be derived from an integration, like Google Drive
• Start from the open-source templates in our Policy Hub if you don't
• Or generate new ones using Openlane's integrated AI, then edit them to match reality

Align Your Program

Now connect the pieces - controls that put your policies into practice, mapped to your standard, with a plan for proving they operate.

Create your controls

Controls define how you actually meet requirements, grounded in the policies you just wrote. From Gaps to Controls covers how to turn requirements into well-written controls, and Writing a Good Implementation covers describing how each one is met.

• Clone controls from your enabled standard's catalog, or import controls you already have
• Link each control to the policies it operationalizes and map it to your framework(s)
• Assign owners: the people from your Registry personnel records who actually run each process

Establish evidence collection

Evidence is how you prove controls operate over time. Decide upfront how you'll collect it, rather than scrambling at audit time.

• Review the evidence guide and attach evidence to your controls as you go
• Use tasks to put recurring collection (access reviews, policy attestations) on a cadence

Prepare for Your Audit

We've created an audit preparation guide for you, and the work you did above flows into it.

1. Define the audit scope: what services, systems, and criteria the audit covers
2. Identify key stakeholders: who owns control design, evidence collection, policies, and the system description
3. Perform a gap analysis against your target framework, paired with a risk assessment, and remediate what they surface
4. Select an audit firm and set the audit dates

What's Next

Now that you have the foundation:

• Refine controls to match how your team actually works
• Track your first audit period in the program you created, including audit firm, auditor, and audit dates
• Explore Exposure to manage vulnerabilities, findings, and remediations
• Stand up your Trust Center to share your posture with customers

Want Help?

If you want implementation help, book time with us and we will build it with you.