> ## Documentation Index
> Fetch the complete documentation index at: https://docs.figorisk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Setup

> Set up your organization profile and configure FigoRisk

## Overview

After your first login as a super admin, you'll need to configure your organization settings to get started with FigoRisk.

***

## Initial Login

<Steps>
  <Step title="Access FigoRisk">
    Navigate to your FigoRisk instance URL (e.g.,
    `https://figorisk.yourcompany.com`)
  </Step>

  <Step title="Login as Super Admin">
    Use the credentials provided during deployment: - **Username**: `admin` -
    **Password**: From your `.env` configuration
  </Step>

  <Step title="Dashboard Access">
    You'll be redirected to the admin dashboard after successful login
  </Step>
</Steps>

<Warning>
  **Security First**: Change your default password immediately after first
  login!
</Warning>

***

## Organization Profile

### Update Organization Information

<Steps>
  <Step title="Navigate to Settings">
    Click on **Settings** in the main navigation menu
  </Step>

  <Step title="Organization Tab">
    Select **Organization** from the settings sidebar
  </Step>

  <Step title="Update Profile">
    Fill in your organization details: - **Organization Name**: Your company
    name - **Industry**: Select your industry sector - **Company Size**: Number
    of employees - **Country**: Primary location - **Address**: Physical address

    * **Contact Email**: Primary contact email - **Phone Number**: Contact phone
  </Step>

  <Step title="Save Changes">
    Click **Save** to update your organization profile
  </Step>
</Steps>

***

## Configure Organization Settings

### Compliance Frameworks

Choose which compliance frameworks your organization follows:

<AccordionGroup>
  <Accordion icon="shield-check" title="ISO 27001">
    Information security management system standard **When to enable:** - If
    you're pursuing ISO 27001 certification - If you need to comply with
    information security standards
  </Accordion>

  <Accordion icon="file-shield" title="NDPR (Nigeria Data Protection Regulation)">
    Nigerian data protection and privacy regulation **When to enable:** - If you
    operate in Nigeria - If you process data of Nigerian citizens
  </Accordion>

  <Accordion icon="scale-balanced" title="SOC 2">
    Service Organization Control 2 compliance **When to enable:** - If you're a
    SaaS provider - If customers require SOC 2 compliance
  </Accordion>

  <Accordion icon="lock" title="GDPR">
    General Data Protection Regulation (EU) **When to enable:** - If you operate
    in the EU - If you process EU citizen data
  </Accordion>
</AccordionGroup>

**To enable frameworks:**

1. Go to **Settings** → **Compliance**
2. Toggle on the frameworks you need
3. Click **Save Configuration**

***

## Set Up Departments

Organize your users into departments for better management:

<Steps>
  <Step title="Access Departments">
    Navigate to **Settings** → **Departments**
  </Step>

  <Step title="Create Department">
    Click **+ Add Department** Fill in: - **Department Name**: e.g., "IT",
    "Finance", "Operations" - **Department Head**: Assign a department leader -
    **Description**: Brief description of the department
  </Step>

  <Step title="Save Department">Click **Create** to save the department</Step>
</Steps>

**Common departments to create:**

* Information Technology (IT)
* Information Security
* Compliance & Legal
* Finance
* Human Resources
* Operations

***

## Configure Notification Settings

Set up how your organization receives alerts and notifications:

### Email Notifications

<Tabs>
  <Tab title="Risk Alerts">
    **When to receive:** - New high/critical risks identified - Risk status
    changes - Risk mitigation overdue **Configure:** 1. Go to **Settings** →
    **Notifications** 2. Enable **Risk Alerts** 3. Select severity levels:
    Critical, High, Medium, Low 4. Choose recipients: All admins, Department
    heads, Custom list
  </Tab>

  <Tab title="Compliance Reminders">
    **When to receive:** - Compliance assessments due - Control testing required

    * Audit deadlines approaching **Configure:** 1. Enable **Compliance
      Reminders** 2. Set reminder schedule: 7 days, 3 days, 1 day before 3. Select
      recipients
  </Tab>

  <Tab title="Incident Notifications">
    **When to receive:** - New security incidents - Incident escalations -
    Incident resolution **Configure:** 1. Enable **Incident Notifications** 2.
    Choose notification priority 3. Set escalation rules
  </Tab>
</Tabs>

***

## Set Up Approval Workflows

Configure maker-checker workflows for critical actions:

### Workflow Types

<CardGroup cols={2}>
  <Card title="Single Approval" icon="user-check">
    One approver required **Use for:** - Low-risk changes - Standard operations
  </Card>

  <Card title="Dual Approval" icon="users">
    Two approvers required **Use for:** - High-risk changes - Critical asset
    modifications - Compliance updates
  </Card>
</CardGroup>

### Configure Workflows

<Steps>
  <Step title="Access Workflows">
    Go to **Settings** → **Approval Workflows**
  </Step>

  <Step title="Select Action Type">
    Choose what requires approval: - User creation/deletion - Risk acceptance -
    Asset classification changes - Control implementation
  </Step>

  <Step title="Define Approval Chain">
    Set who can approve: - Department heads - Compliance officers - Security
    team - Custom roles
  </Step>

  <Step title="Save Workflow">Click **Save** to activate the workflow</Step>
</Steps>

***

## Integration Settings

### SMTP Email Configuration

<Info>Required for sending notifications, alerts, and reports</Info>

<Steps>
  <Step title="Access Email Settings">
    Navigate to **Settings** → **Integrations** → **Email**
  </Step>

  <Step title="Configure SMTP">
    Enter your SMTP details: - **SMTP Host**: e.g., `smtp.gmail.com` - **SMTP
    Port**: Usually `587` (TLS) or `465` (SSL) - **Username**: Your email
    address - **Password**: Your email password or app password - **From Name**:
    "FigoRisk Notifications" - **From Email**: Your sender email
  </Step>

  <Step title="Test Connection">
    Click **Send Test Email** to verify configuration
  </Step>

  <Step title="Save Configuration">Click **Save** if test is successful</Step>
</Steps>

<Tip>
  **Using Gmail?** You'll need to create an [App
  Password](https://support.google.com/accounts/answer/185833) instead of using
  your regular password.
</Tip>

### Cloud Storage (AWS S3)

<Info>Optional: For storing evidence documents, reports, and file uploads</Info>

<Steps>
  <Step title="Access Storage Settings">
    Navigate to **Settings** → **Integrations** → **Storage**
  </Step>

  <Step title="Select Provider">Choose **AWS S3**</Step>

  <Step title="Enter Credentials">
    * **Access Key ID**: Your AWS access key - **Secret Access Key**: Your AWS
      secret key - **Region**: Your S3 bucket region - **Bucket Name**: Your S3
      bucket name
  </Step>

  <Step title="Test Connection">Click **Test Connection** to verify</Step>

  <Step title="Save Configuration">
    Click **Save** if connection is successful
  </Step>
</Steps>

***

## Branding & Customization

### Upload Organization Logo

<Steps>
  <Step title="Navigate to Branding">Go to **Settings** → **Branding**</Step>

  <Step title="Upload Logo">
    Click **Upload Logo** and select your image **Requirements:** - Format: PNG,
    JPG, or SVG - Max size: 2MB - Recommended: 200x60 pixels
  </Step>

  <Step title="Preview">See how your logo appears in the interface</Step>

  <Step title="Save">Click **Save Changes**</Step>
</Steps>

### Color Scheme

Customize the platform colors to match your brand:

1. **Primary Color**: Main brand color
2. **Secondary Color**: Accent color
3. **Success Color**: For positive actions
4. **Warning Color**: For alerts
5. **Error Color**: For critical issues

***

## Security Settings

### Password Policy

Configure password requirements for all users:

<AccordionGroup>
  <Accordion icon="lock" title="Minimum Requirements">
    * **Minimum Length**: 8-16 characters - **Require Uppercase**: A-Z -
      **Require Lowercase**: a-z - **Require Numbers**: 0-9 - **Require Special
      Characters**: !@#\$%
  </Accordion>

  <Accordion icon="clock-rotate-left" title="Password Expiration">
    * **Expiry Period**: 30, 60, or 90 days - **Expiry Warning**: 7 days before
      expiry - **Password History**: Prevent reuse of last 5 passwords
  </Accordion>

  <Accordion icon="ban" title="Account Lockout">
    * **Failed Attempts**: Lock after 5 failed attempts - **Lockout Duration**:
      15 minutes - **Admin Override**: Allow admins to unlock accounts
  </Accordion>
</AccordionGroup>

### Session Management

* **Session Timeout**: Auto-logout after 30 minutes of inactivity
* **Concurrent Sessions**: Allow/disallow multiple logins
* **IP Restrictions**: Limit access to specific IP ranges (optional)

***

## Data Retention Policy

Configure how long data is retained:

| Data Type           | Default Retention | Configurable    |
| ------------------- | ----------------- | --------------- |
| Audit Logs          | 1 year            | Yes (1-7 years) |
| Risk Assessments    | Indefinite        | Yes             |
| Compliance Evidence | 3 years           | Yes             |
| User Activity       | 90 days           | Yes             |
| Reports             | 1 year            | Yes             |

**To configure:**

1. Go to **Settings** → **Data Retention**
2. Adjust retention periods for each data type
3. Click **Save Policy**

<Warning>
  Ensure retention periods comply with your regulatory requirements
</Warning>

***

## Initial Setup Checklist

Use this checklist to ensure your organization is properly configured:

<Steps>
  <Step title="✅ Organization Profile">
    * [ ] Updated organization name and details - \[ ] Set organization logo - \[
      ] Configured branding colors
  </Step>

  <Step title="✅ Compliance Configuration">
    * [ ] Selected applicable frameworks - \[ ] Configured compliance reminders
  </Step>

  <Step title="✅ Departments">
    * [ ] Created all departments - \[ ] Assigned department heads
  </Step>

  <Step title="✅ Notifications">
    * [ ] Configured SMTP email - \[ ] Tested email delivery - \[ ] Set up alert
      rules
  </Step>

  <Step title="✅ Security Settings">
    * [ ] Set password policy - \[ ] Configured session timeout - \[ ] Set up
      approval workflows
  </Step>

  <Step title="✅ Integrations">
    * [ ] Configured AWS S3 (if needed) - \[ ] Tested all integrations
  </Step>

  <Step title="✅ Data Retention">
    * [ ] Set retention policies - \[ ] Verified compliance requirements
  </Step>
</Steps>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Add Users" icon="user-plus" href="/guides/user-management">
    Invite team members to FigoRisk
  </Card>

  <Card title="Import Assets" icon="database" href="/guides/asset-management">
    Start building your asset inventory
  </Card>

  <Card title="Risk Assessment" icon="shield-check" href="/guides/risk-assessment">
    Begin risk assessment process
  </Card>

  <Card title="Compliance Setup" icon="list-check" href="/guides/compliance-management">
    Configure compliance requirements
  </Card>
</CardGroup>

***

## Need Help?

<Card title="Contact Support" icon="life-ring" href="mailto:support@figorisk.com">
  Our support team is here to help with your setup
</Card>