Roles & Permissions

The roles in DIBFI and exactly what each one can see and do — for direct organizations, assessors, and MSP partners.

Everyone in your organization has a role, and the role decides what they can see and do. DIBFI keeps roles deliberately simple: a few clear levels that map to how compliance work actually gets divided — admins who run the program, members who do the day-to-day work, and assessors who review it. MSP partners have their own two roles for managing client organizations.

Roles are set when you invite someone and can be changed later. Only an Organization Admin (or an MSP admin, for managed clients) can invite people or change roles.

The roles

Direct organization roles

Role	Who it's for
Organization Admin	Runs the compliance program — full control of settings, users, billing, and all compliance work
Member	Does the day-to-day work — assessing objectives, uploading evidence, managing risks and tasks
Assessor	A reviewer with read-only access who can record review notes, but cannot change your data

MSP partner roles

Role	Who it's for
MSP Super Admin	Full control of the MSP account — managed clients, MSP billing, white-label branding, and shared templates
MSP Admin	Manages client compliance work and shared templates, without MSP billing or branding control

Platform Admin is a separate role reserved for DIBFI staff. It is not something you assign inside your organization — see Platform Administration.

What each role can do

The table below shows the main capabilities. "View" access to your compliance data (assessments, evidence, risks, policies, tasks, assets) is available to every role, including Assessors.

Capability	Org Admin	Member	Assessor	MSP Super	MSP Admin
View all compliance data	✅	✅	✅	✅	✅
Manage organization settings	✅	—	—	✅	—
Invite users & change roles	✅	—	—	✅	—
Manage systems & build the SSP	✅	—	—	✅	✅
Assess objectives & write narratives	✅	✅	—	✅	✅
Upload & edit evidence	✅	✅	—	✅	✅
Delete evidence	✅	—	—	✅	✅
Manage evidence requests	✅	—	—	✅	✅
Create & manage risks and POA&Ms	✅	✅	—	✅	✅
Complete compliance-ops tasks	✅	✅	—	✅	✅
Generate & edit policies	✅	✅	—	✅	✅
Approve & publish policies	✅	—	—	✅	✅
Manage integrations (e.g. Microsoft 365)	✅	—	—	✅	✅
Request a readiness review	✅	—	—	✅	✅
Write review notes	—	—	✅	—	—
Access billing	✅	—	—	—	—
Manage MSP clients & templates	—	—	—	✅	✅
MSP billing & white-label branding	—	—	—	✅	—

The Assessor role is built for an outside reviewer or an internal QA check: they can read everything and leave review notes, but they can't alter a status, upload evidence, or change settings — so your record stays exactly as your team left it.

Managing your team

Invite a user

Open your user management

As an Organization Admin, go to your users list.

Send an invitation

Enter the person's email and choose their role. They receive an invitation to join your organization.

Once they accept, they appear in your team with the role you assigned.

Your plan sets how many users you can have. On the Foundation plan that's a small fixed number; higher plans allow unlimited users. If you're at your limit, you'll need to upgrade before inviting more — see Billing & Subscriptions.

Change a role or remove someone

An Organization Admin can change any member's role or remove them at any time from the users list. Removing a person immediately revokes their access; the compliance work they did (evidence, notes, assessments) stays with your organization.

How it works

Access is checked everywhere

Your role is enforced consistently across the whole platform — the web app, exports, and the AI Connector all honor the same permissions. An assistant connected on your behalf can only ever see what your role allows, and role changes take effect immediately.

MSP access to managed clients

An MSP's admins act on behalf of the client organizations they manage. They can do compliance work inside a managed client, but each client's data stays isolated to that client — an MSP only reaches the clients it actually manages.

Organization Settings

Manage your organization's identity and security controls.

MSP Portal

Run compliance across multiple client organizations.

AI Connector

Read-only AI access that honors these same permissions.

Organization Settings

Manage your organization's identity, the legal and personnel details that appear in your System Security Plan, connected integrations, and the security controls that govern AI assistant access.

Overview

Run CMMC assessments, track objectives, follow the guided journey, and watch your SPRS score.