Organization Settings

Manage your organization's identity, the legal and personnel details that appear in your System Security Plan, connected integrations, and the security controls that govern AI assistant access.

Organization Settings is where an admin manages your organization's identity and its security posture in one place. From here you set the name and general details your team sees, record the legal and personnel details that feed your System Security Plan (SSP), review your connected integrations, and control whether an AI assistant may read your compliance data.

Most of what lives here shapes documents and access that an assessor will scrutinize — the affirming official named on your submission, the security officer of record, the tenant you've connected for automated checks — so it's kept behind organization-admin access and edited deliberately, not casually.

Find it in the sidebar under Organization Settings. Opening the page and changing anything on it requires organization-admin access — see Permissions. If you don't have that access, ask an admin in your organization to make the change.

Key concepts

The sections of the page

Organization Settings is organized into distinct sections, each covering one part of your organization's identity or security.

Section	What it covers
General	Your organization's display name, logo, plan, and creation date
SSP Organization Details	The legal name, address, and named personnel that appear in your System Security Plan
Connections	Integrations you've connected — such as your Microsoft 365 tenant — for automated control checks
Security	The controls that govern AI assistant access to your compliance data

SSP organization details

These are the identity and personnel facts your System Security Plan must state. They're recorded once here and reused wherever your SSP is generated, so the plan is consistent and current.

Detail	What it is
Legal name & address	Your organization's formal legal name and physical address
Primary security contact	The person who fields day-to-day security questions
Affirming official	The senior official who affirms your compliance to the government
System Security Officer	The individual accountable for the security of your CUI environment

Each person is recorded with their name, title, and contact details. You can pre-fill the legal name from your organization name, and the primary contact from your own profile, then adjust — you don't have to type everything from scratch.

Security controls

The Security section governs the AI Connector — the read-only channel that lets an approved AI assistant answer questions about your compliance data.

Control	What it does
AI Connector On / Off	The organization-wide switch that allows or blocks AI assistant access
Revoke all connections Emergency	Immediately invalidates every existing AI connection and turns the connector off

Using Organization Settings

Edit your organization name and general details

Open the General section

The General section is at the top of the page. It shows your organization's logo, name, plan, and the date it was created.

Rename the organization

Edit the name in place and save. The new name is what your team sees across the app.

Update the logo

Upload an image to set your organization's logo, or remove it to fall back to a default. This is the picture that represents your organization in the interface.

Record your SSP organization details

Open the SSP details section

Find SSP Organization Details and choose to edit.

Fill in the legal name and address

Enter your organization's formal legal name and physical address. You can pre-fill the legal name from your organization name and adjust it.

Name your security personnel

Record the primary security contact, the affirming official, and the System Security Officer, each with their title and contact details. You can pre-fill the primary contact from your own profile.

Save

Your details are validated and saved, and will flow into your System Security Plan the next time it's generated.

An affirming official and a System Security Officer are expected on a CMMC submission. Filling these in early means your SSP is complete when you need it, rather than blocked at the finish line.

Review connected integrations

The Connections section lists the integrations you've connected — for example, your Microsoft 365 tenant — and lets an admin connect a new one, run a fresh scan, review findings, or disconnect.

Open the Connections section

You'll see any connected tenants along with when each was last scanned.

Connect or manage a tenant

Connect your Microsoft 365 tenant, re-run a scan to refresh findings, view the findings, or disconnect a tenant you no longer use.

Connecting Microsoft 365 lets DIBFI check a set of CMMC controls automatically against your live tenant. See the Microsoft 365 page for what it checks and how to connect.

Control AI assistant access

The Security section is where you decide whether an AI assistant may read your compliance data at all.

Turn the AI Connector on or off

Use the switch to allow or block AI assistant access for your whole organization. When it's off, no assistant can read anything, regardless of who connected.

Revoke all connections in an emergency

If a connection is leaked or one you don't recognize appears, choose Revoke all. This immediately invalidates every existing connection and disables the connector.

Revoke all cannot be undone. Every assistant that was connected loses access at once and must sign in and approve access again. Re-enabling the connector later does not restore the old connections — that's the point. Use it for a genuine security concern. See the AI Connector page for how the connection works.

Permissions

Access to Organization Settings is governed by the role matrix.

Capability	Permission
Open Organization Settings; edit the name, general details, SSP details, and Security controls	MANAGE_ORG
Connect, scan, or disconnect an integration such as Microsoft 365	MANAGE_INTEGRATIONS

MANAGE_ORG is held by organization admins (and the equivalent MSP admin roles). Opening the page requires it, and every change on the page — renaming, editing SSP details, toggling the AI Connector, revoking connections — requires it too.

The Security controls are admin-only by design. The AI Connector switch and Revoke all decide, for your entire organization, whether assistants can read your data — so they never appear for members without organization-admin access.

How it works

Extra detail on how these settings behave — product behavior, not internals.

General details

Your organization name is the display name shown throughout the app; renaming it here updates it everywhere. Your logo is stored privately and shown wherever your organization is represented in the interface.

SSP details feed your plan

The legal name, address, and named officials you record are not just kept for reference — they're the source your System Security Plan draws from when it's generated. Keeping them current here keeps every future SSP correct, without editing the plan by hand. The details are validated on save so a malformed email or missing required fact is caught before it reaches a document.

The AI Connector has two independent controls

The on/off switch and Revoke all do different things:

On/off is a reversible gate. Turn it off and all AI access stops; turn it back on and connected assistants can read again.
Revoke all is a one-way incident action. It invalidates the underlying connections themselves and turns the connector off. Re-enabling the switch afterward will not bring the revoked connections back — anyone who wants access must reconnect from scratch with a fresh sign-in.

Turning the connector off, or revoking connections, never changes any of your compliance data — it only governs who may read it. The AI Connector is read-only in the first place; these controls simply decide whether that read access exists.

Each organization controls its own connector

The AI Connector switch and revoke action apply to your organization only. For a partner managing several client organizations, each client's connector is governed separately — enabling or revoking for one never affects another.

AI Connector

Give an approved AI assistant read-only, permission-scoped access to your data.

Microsoft 365

Connect your Microsoft 365 tenant to check CMMC controls automatically.

System Security Plan

Generate your SSP from the organization details recorded here.

Onboarding

Set up a new organization the first time you sign in — choose your CMMC level, tell us what's in your environment, and get an initial set of systems and a first assessment scoped and ready to work.

Roles & Permissions

The roles in DIBFI and exactly what each one can see and do — for direct organizations, assessors, and MSP partners.