Get started.
Keep moving.

01 / GET SET UP

Your first workspace

Start small: one process, a clear owner and a few useful tasks. An existing workspace and the appropriate module permissions are required. New online registrations are not yet available.

1. Agree the scope. Decide which part of your organization and which standard you are managing. Use your own approved scope and responsibilities.
2. Add a requirement structure. In Requirements, choose Import Template and the relevant standard. Templates are a starting structure; review the version and applicability yourself.
3. For ISO 27001, add Annex A separately. Import the Annex A template before using the Statement of Applicability. Record applicability and implementation status with appropriate justification.
4. Define one process and its owner. Add the process in your organization architecture and connect the related risks or requirements.
5. Create a real task. Assign an owner and a due date, then complete one execution with a useful note or evidence.

02 / BUILD A ROUTINE

Keep recurring work traceable

Use a recurring task for work such as access reviews or supplier checks. Choose the frequency that fits your policy and risk assessment.

1. Create the task with an owner, start date and recurrence.
2. Review upcoming work in Yearly Plan and the assigned work in My Tasks.
3. Record the outcome on the relevant execution, rather than overwriting the definition of the recurring task.
4. Add a useful note or permitted evidence. If the check finds a problem, create a follow-up action with an owner and deadline.
5. Check that the next occurrence is scheduled and the previous outcome is still available.

Example: an access review can record when it was performed, who reviewed it and where the approved result lives. Do not upload passwords or unnecessary personal information.

03 / REVIEW & IMPROVE

Prepare an audit with context

1. Review your requirements and identify the processes and controls in scope.
2. Plan the audit and prepare its checklist. Add evidence and observations against the relevant items.
3. Record findings accurately. Give corrective actions a responsible owner and a due date.
4. For ISO 27001, review the Statement of Applicability and use Export SoA when a PDF is needed.
5. Use Management Reviews to document inputs and decisions, and turn relevant outputs into follow-up actions.

A completed task or exported report is not proof that a control is effective. Review the substance and agree the required evidence with your auditor.

04 / BRING YOUR EXISTING WORK

Move one process at a time

Keep an original copy of your current records. Clean up duplicates and decide which information you actually need before importing.

• Use Requirements → Import Template for a standard structure.
• The spreadsheet import workflow supports defined data types and column mappings. Use its reference template and preview a small, non-sensitive sample before a larger import.
• Data Management → Import Data is for a compatible Bop JSON export. It is not a general spreadsheet importer.
• Check owners, dates and relationships after import. Upload documents separately where the workflow requires them.

Export options depend on the module. An administrative JSON export is not a complete recovery backup and does not replace separately managed file backups.

05 / CLEAR EXPECTATIONS

Software support, in writing

The planned Bop Complete subscription is designed for teams that configure and run their own workspace.

If you need help, include the page, what you expected, what happened and the steps to reproduce it. Keep confidential records, passwords and access tokens out of the message. Include an existing ticket reference when following up.

Requests are handled in writing. There is no guaranteed immediate response.