---
title: Onboarding
description: Set up a new organization the first time you sign in — choose your CMMC level, tell us what's in your environment, and get an initial set of systems and a first assessment scoped and ready to work.
navigation:
  icon: i-lucide-rocket
---

# Onboarding

**Onboarding** is the short, guided setup you complete the first time you sign in to a brand-new organization. It's where you tell DIBFI two things: **which CMMC level** you're pursuing, and **what's in your environment** — the identity providers, devices, storage, and specialized systems that touch federal information. From those answers, DIBFI builds your starting point: an initial list of **systems** and your **first assessment**, already scoped to the right level and ready to work.

Onboarding is a **one-time, organization-wide** setup. One person completes it on behalf of the whole organization; once it's done, everyone who joins later lands directly in the dashboard.

::note
Onboarding launches **automatically** the first time you open a new organization — you don't go looking for it. Once complete, DIBFI takes you to your dashboard and you won't see the wizard again.
::

---

## Key concepts

### CMMC level

Onboarding first establishes the level you're assessing against. This is driven by whether your organization handles **CUI (Controlled Unclassified Information)** or only **FCI (Federal Contract Information)**.

| Level | Who it's for |
| --- | --- |
| :badge[Level 1]{color="neutral"} | You only handle general **FCI** — basic safeguarding requirements |
| :badge[Level 2]{color="info"} | You receive, store, or process **CUI** — the fuller NIST SP 800-171 baseline |

::tip
If you might handle CUI now or in the future, choose **Level 2** — it's the safer, broader baseline and covers Level 1. You can revisit your level later from your assessment settings.
::

### System categories

You describe your environment one category at a time. Each category asks about the systems that **actually touch FCI or CUI** — not every tool your company uses.

| Category | What it covers |
| --- | --- |
| **Identity & Collaboration** | How users sign in and collaborate — e.g. Microsoft 365, Google Workspace, on-prem Active Directory |
| **User Access** | Where users work from — laptops and desktops, virtual desktops, jump hosts, mobile devices |
| **Data Storage** | Where FCI or CUI lives — SharePoint/OneDrive, file servers, other cloud storage |
| **Specialized / OT** | Purpose-built systems — manufacturing/OT, ERP, lab systems, and other specialized platforms |

::note
Only include a system if it **stores, processes, or transmits** FCI or CUI. A file share, laptop, or ERP that never touches contract data is out of scope and should be left out.
::

### Environment boundary

Finally, you tell DIBFI how your regulated systems relate to the rest of your business. This sets expectations for your scope.

| Boundary | Meaning |
| --- | --- |
| **Separate** | Your FCI/CUI systems sit on their own network or enclave, isolated from everyday business systems |
| **Mixed** | Your FCI/CUI systems share a network with the rest of the business — email, accounting, HR, and so on |
| **Not sure** | You're not certain how things are set up yet — that's fine, you can refine it as you go |

### What onboarding produces

When you finish, DIBFI turns your answers into a working starting point.

:::field-group
::field{name="Your systems"}
One entry per system you selected, ready to manage, scope, and attach evidence to.
::
::field{name="Your first assessment"}
A CMMC assessment created at your chosen level, named for the current quarter, with your systems already linked to it.
::
::field{name="Your starting scope"}
The full set of objectives for your level is loaded into that assessment, so you can begin implementing and scoring controls immediately.
::
:::

---

## Using onboarding

The setup runs as a short wizard with a progress bar across the top. You move forward with **Next**, and you can step **Back** at any point to change an answer before you finish.

::steps{level="4"}

#### Get oriented

The welcome step introduces what you're about to do. Onboarding also confirms your **CMMC level** based on your DoD work and whether you handle CUI — handling CUI points you to **Level 2**, FCI-only to **Level 1**.

#### Add your identity & collaboration systems

Select the platforms users authenticate and collaborate through when working with FCI or CUI — for example Microsoft 365 or Google Workspace. Leave out sign-in tools that never touch regulated data.

#### Add where users work from

Choose the endpoint types used to access, process, or store FCI or CUI — company laptops and desktops, virtual desktops, jump hosts, and the like.

#### Add where data is stored

Select the storage locations that actually hold FCI or CUI — SharePoint/OneDrive, file servers, or other cloud storage. Skip shares that hold only internal, non-regulated content.

#### Add specialized or operational systems

Include any purpose-built systems — manufacturing/OT, ERP, or lab systems — that directly handle regulated data.

#### Set your environment boundary

Tell DIBFI whether your regulated systems are **separate** from the rest of the business, **mixed** in with it, or you're **not sure** yet.

#### Review and finish

The summary lists the systems you selected and the assessment that will be created. Confirm to complete onboarding — DIBFI builds your systems and first assessment and takes you into the platform.

::

::tip
You don't need a perfect inventory to finish. Onboarding is your **starting** scope, not your final one — you can add systems, adjust your boundary, and refine scope any time from the dashboard.
::

---

## Permissions

Onboarding is completed by the person who **sets up the organization** — typically an owner or administrator. It runs once, at the organization level, so a single completed setup applies to everyone.

| Capability | Who |
| --- | --- |
| Complete onboarding for a new organization | The organization owner or administrator setting it up |
| Skip onboarding (already done) | Everyone who joins after setup is complete |

::warning
Because onboarding defines your organization's initial systems and first assessment, it should be run by someone who understands your environment. Team members you invite afterward won't repeat it — they inherit the scope you established here.
::

---

## How it works

A little more on how onboarding behaves — product behavior, not internals.

### It runs once, for the whole organization

Onboarding is tied to your **organization**, not to individual users. The first person through the wizard sets things up for everyone; once it's marked complete, DIBFI stops showing it and sends everyone straight to the dashboard.

### Your answers become real objects

Each system you select becomes a manageable **system** in your dashboard, and DIBFI creates your **first assessment** at your chosen level with those systems linked to it. The assessment is seeded with the full objective set for your level, so your scope is populated and ready — you're not starting from an empty page.

### Your level sets your scope

Choosing **Level 1** scopes your assessment to the Level 1 requirements; **Level 2** loads the fuller NIST SP 800-171 objective set. This is why the level question matters early: it determines how much you'll be assessed against and how your **SPRS** score is calculated.

::note
If your plan is limited to Level 1, onboarding keeps your assessment at Level 1 automatically. You can always review your level and scope later from your assessment settings.
::

### It's safe to re-enter

Onboarding is designed to be forgiving. If setup is somehow started again, DIBFI recognizes systems and an assessment that already exist and won't create duplicates — you keep the environment you already built.

### What to do next

With onboarding complete, you land in the dashboard with systems and a first assessment in place. From here you can invite your team, begin implementing and scoring controls, collect evidence, and follow DIBFI's guided journey toward certification.

---

## Related features

:::card-group

::card{title="Systems" icon="i-lucide-server" to="https://app.dibfi.com/dashboard/systems"}
Manage the systems onboarding created and refine what's in scope.
::

::card{title="Assessments" icon="i-lucide-clipboard-check" to="https://app.dibfi.com/dashboard/assessments"}
Work your first assessment — implement, document, and score each control.
::

::card{title="Billing & Plans" icon="i-lucide-credit-card" to="https://app.dibfi.com/dashboard/billing"}
Review your plan, which sets your available CMMC level and limits.
::

:::