Quick-Start Guide for Administrators

When an instance of Isora GRC is started, there is at least one user with administrative capabilities. Before SSO has been enabled, you will need to locally authenticate with Isora GRC.

1. Navigate to your Isora GRC URL provided by SaltyCloud, type in your user credentials and click the “Login” button.

1. On the Settings page, go to Organizational Units.
   

2. Use the CSV upload button to add a CSV containing multiple units at once.
   

   (See also: Reference: (Organizational) Unit CSV Upload )

3. Or you can add a single unit by clicking the + button.
   

4. Fill in the fields.
   

5. You can optionally use the Permissions area to add people who are already in Isora GRC to this unit. Click the + button to assign a user to this OU, and select their role from the drop-down list.
   

6. Click Save to finish.

As a superuser, you can add people into Isora GRC using the Settings page. Assessment Managers can also assign existing users roles within their own OUs.

1. On the Settings page under Organization click the “People” link. Then click the + sign to create a new user.
   

2. Fill in the fields with details about the new user.
   

   The username field should be required. Leave the password blank unless you are using local authentication (you should not be using local authentication unless you are still very early in the setup process). If any user needs to have administrative privileges, you can click the “superuser” checkbox when you add the user. You can also add this capability later. Do not give superuser authority to anyone other than Isora GRC administrators, since superusers have unrestricted privileges. The "service account" checkbox should be used if a non-person entity needs to access Isora GRC. No authorization is used with service accounts, and although they could be authenticated through LDAP or local password, service accounts should normally access Isora GRC through the API.

3. Use the bottom half of the Add User dialog to optionally assign permissions. Use permissions to assign roles within specific organizational unit(s) to the user. Click the Save button when finished.
   

   See also: Reference: Roles and Capabilities .

4. You can also use the upload button to upload details about multiple users at once using a CSV file. Each line of the file should consist of a username, first name, last name, and email address.
   

See also:

See also: Reference: Roles and Capabilities

After adding information about people and organizations, you will likely want to add inventory to Isora GRC. In some cases, you (the administrator) will add this data yourself. In other cases, you will allow Isora GRC users to add the inventory data.

There are three types of inventory tracked in Isora GRC- assets (formerly hosts), applications (formerly apps) and third-party vendor products.

Assets (Hosts)

You may wish to track where your inventory assets are located. If you want to track location information in Isora GRC, then before you import inventory, you should add locations into Isora GRC. Only superusers can manage location data.

See also:

Applications (Apps)

Application inventory is only needed if you plan to perform application assessments. These types of assessments are less frequently used compared to the other methodologies. They usually represent internally-developed applications or systems.

See also:

Third-Party Vendor Products

These products can be added into inventory at the time of creating an assessment. However, if you want to add them into inventory first, you can do so.

See also: