Getting started
Find your way around, learn how changes are approved, and work through a first-week checklist.
5 min read7 sectionsEveryone new to a workspace
Whether you have just set up this workspace or been invited into one, this page gets you oriented. Learn where everything lives, how changes reach a register, and what to look at in your first week, then use the checklist to track your progress.
Your first steps depend on whether you set this workspace up or were invited into it.
You set up the workspace
The setup wizard took you through Organization, Organization Structure, Team, Taxonomy, Assessment & Thresholds, Timelines & Cadences, Import Data and Review. You can change most of it later under Settings. The data region is fixed.
You were invited
Whoever invited you chose your role, the units you see, and whether you can open Confidential or Privileged records. Admins and members find their units under Your Organization Access in Settings. Everyone's grants are on User Profile.
The sidebar holds every area of ShelfGRC. When it is collapsed, hover over it to see the labels.
Dashboard
Your personal briefing and the actions waiting for you.
Risks
What could go wrong, rated by likelihood and impact.
Obligations
The requirements you must meet, and whether you comply.
Incidents
Breaches and incidents, from first report to close.
Controls
Your control library, rated where each control is linked.
Policies
Governing documents, their status and review dates.
Evidence
The proof behind your controls and obligations.
Treatment Plans
The remediation work that brings risks back within tolerance.
Uploads
Bring existing registers in from a spreadsheet.
Proposals
Every change waiting for review and approval.
Reports
Standard reports and report history. Owners and admins also get the Reporting Canvas.
Executive Overview
A board-ready summary of your posture. Owners and admins only.
Help
A step-by-step guide for every area.
Settings
Notifications and security, plus team and configuration for owners and admins.
User Profile
Your photo, role and access grants.
The top bar holds New, which creates any type of record, and your notifications box. Your account menu there has Sign out.
Three places give you a quick read on where the organisation stands. Each card opens its guide.
Dashboard
Opens with My actions, then tiles for open risks, risks at your high band and above, control coverage and overdue treatment plans, followed by the Risk Pulse and the heatmap.
Executive Overview
Owners and admins only. Headline tiles for risks at your high band and above, open incidents at your critical severity, Compliance Rate, Overdue Treatment Plans and Policies Overdue. Then a Forward-Look Workload chart for the next 12 months and six sections to expand.
AI assistant
Type a question into the ShelfGRC AI bar at the foot of the page, such as "Which obligations are Not Compliant?" It answers from Public, non-privileged records only.
Nothing is added to or changed in a register until an owner or admin approves it.
- 1
Start the change
Click New in the top bar for a new record, or Propose Update on an existing one.
- 2
Submit it
Fill in the form, click Submit (propose), then Submit to Queue. You are taken to your new proposal.
- 3
An owner or admin decides
They open it in Proposals and click Approve or Reject.
- 4
The register updates
Once approved, the record appears in its register.
Your role decides what you can see and approve. Your role is shown on User Profile.
Member
Browse the registers for your units. Use New and Propose Update to suggest changes, then follow them in Proposals. You can generate standard reports from Reports.
Admin
Approve or reject waiting Proposals. Read the Executive Overview. In Settings, check Team Members and the Access log, and invite members for the units you look after.
Owner
Everything an admin does, across every unit. Check that you hold the Confidential and Privileged grants — owners need them too. Review your severity labels, scales and category tolerances. See the Settings guide.
Read before you change: spend the first days understanding what is already there.
- 1
Day 1 — Get set up
In Settings, click Set Up MFA under Security and choose your notification emails. Add a photo on User Profile and check your access grants there.
- 2
Day 2 — Read the big picture
Work through your Dashboard and My actions. Owners and admins read the Executive Overview top to bottom; everyone can ask the AI assistant for a summary.
- 3
Day 3 — Understand the risk picture
In Risks, read the highest-rated risks and the heatmap, and turn on Over tolerance. In Treatment Plans, look for plans marked Overdue.
- 4
Day 4 — Understand compliance and incidents
Filter Obligations to Not Compliant. In Controls, look for links rated Ineffective (or your organisation's lowest rating). Use Overdue only in Policies, and review open Incidents.
- 5
Day 5 — Make your first contribution
Fix one gap you found with Propose Update or New. Then generate the Enterprise Risk Profile Report and the Obligations Report from Reports to see the programme the way leadership does.
Tick items off as you go. Your progress is saved in this browser, for your account.
0 of 11 done