Quickstart
This guide walks you through creating your first compliance program in Claw GRC. By the end, you will have an organization, a framework selected, evidence uploaded, and a live compliance dashboard.
Prerequisites
- A modern web browser (Chrome, Firefox, Safari, or Edge)
- An email address for account creation
Step 1: Create Your Account
Navigate to app.clawgrc.com and click Sign Up. You can create an account with your email address or sign in with Google.
After signing in, you will be prompted to create your organization. Enter your company name and a URL-friendly slug (e.g., acme-corp). This creates your isolated tenant with its own data, users, and compliance programs.
Every organization gets its own isolated PostgreSQL tenant with Row-Level Security. Your data is cryptographically separated from other tenants at the database level.
Step 2: Select Your First Framework
From the dashboard, navigate to Frameworks in the sidebar. You will see the 11 pre-loaded compliance frameworks. For most organizations starting their compliance journey, we recommend SOC 2 Type II.
Click on SOC 2 Type II to view its controls. The platform shows you the 64 SOC 2 controls organized by Trust Services Criteria (TSC):
- CC -- Common Criteria (Security)
- A -- Availability
- PI -- Processing Integrity
- C -- Confidentiality
- P -- Privacy
Each control maps to one or more unified controls, which means work you do for SOC 2 automatically counts toward overlapping requirements in other frameworks.
Step 3: Review Your Controls
Click into a control to see its details:
- Control ID -- The framework-specific identifier (e.g.,
CC6.1) - Title -- A human-readable name
- Description -- What the control requires
- Testing Procedures -- How an auditor would test this control
- Mapped Frameworks -- Other frameworks that share this requirement
The unified control mapping means that if you implement CC6.1 (Logical Access Security), you also satisfy portions of ISO 27001 A.9, NIST 800-53 AC-2, and HIPAA 164.312(a)(1).
Step 4: Upload Your First Evidence
Navigate to Evidence in the sidebar. Click Upload Evidence to add your first artifact. Evidence in Claw GRC represents any artifact that demonstrates your compliance with a control:
- Select the source type (e.g.,
screenshot,document,api_export,log) - Provide a source identifier (e.g.,
AWS IAM Policy - Production) - Upload the file or paste a link
- Map the evidence to one or more controls
The platform automatically tracks evidence freshness. If your evidence requirement specifies a 90-day freshness window, the dashboard will alert you when evidence is approaching expiration.
Step 5: View Your Compliance Dashboard
Navigate back to the Dashboard. You will now see your compliance posture at a glance:
- Overall Compliance Score -- Percentage of controls with valid, current evidence
- Framework Progress -- Per-framework completion breakdown
- Evidence Status -- How many artifacts are current, expiring, or expired
- Recent Activity -- Latest actions by humans and agents
The dashboard updates in real time as you and your team upload evidence, create policies, and manage risks.
What's Next?
Now that you have the basics set up, explore these areas:
| Next Step | Description |
|---|---|
| Create Policies | Document your organizational security policies |
| Manage Risks | Add risks to your register and track treatment plans |
| Run Assessments | Conduct security assessments and track findings |
| Integrate Agents | Connect AI agents to automate compliance workflows |
| Generate Reports | Create audit-ready compliance reports |
If you are integrating AI agents with your compliance program, start with the Agent Integration Quickstart. Agents can automate evidence collection, trigger security scans, and create findings -- all with full audit trail coverage.