> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.method.security/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server.

# Data organization

> Choose Environments to separate data and Organizational Units to identify responsible teams.

Start with one Environment for your organization, and use Organizational Units (OUs) to identify the teams responsible for its Objects. Add another Environment when you need to keep data separate, such as an independent portfolio company's dataset or experimental scan results.

## Compare Environments and OUs

An Environment defines a data boundary. Each Object belongs to exactly one Environment and cannot move to another. Each Task also runs within one Environment, so keeping related data together gives Tasks a more complete view of your infrastructure.

An OU identifies responsibility: which team, office, or business unit is responsible for an Object. An Object can have multiple OU associations, and an OU can span multiple Environments. These associations leave each Environment's data separate.

For example, your Europe and America offices may have different domains and CIDR ranges while sharing services. Keep their data in one Environment, and create a Europe OU and an America OU to identify responsibility.

## Connect OUs and Environments through scans

Add each OU to the Environment where you want its scans to run. In that Environment, add the OU's identifiers, such as domains and CIDR ranges, then configure its scans. The scans associate discovered Objects with the OU and keep them in the selected Environment.

For the two offices, configure the Europe OU's scans with its domains and CIDR ranges, and the America OU's scans with its own identifiers. Run both in the shared enterprise Environment. You can see who is responsible for the discovered Objects without splitting the dataset by office.

If an OU also needs scans in another Environment, add it there and configure identifiers and scans for that Environment. The same OU can identify the responsible team in both datasets.

## Configure access and scanning controls

Before starting scans, give the relevant users Environment access, choose where scans run, and set their schedules. Configure no-scan windows and egress rate limits for the domains, IP addresses, and CIDR ranges that need them.

The Europe and America offices can use different scanning schedules and restrictions in the same Environment. Scan configuration and identifier-based controls determine how scans run. OU associations identify responsibility, and setting an OU owner does not grant that person access.

## Examples

#### [Organize a large enterprise](/guides/platform-setup/organize-a-large-enterprise)

Share a dataset across offices with different responsible teams and scanning requirements.

#### [Separate portfolio company data](/guides/platform-setup/separate-portfolio-company-data)

Keep company datasets separate while using OUs to represent shared security teams.

#### [Separate prototype and staging data](/guides/platform-setup/separate-prototype-and-staging-data)

Separate experimental results and decide when staging data can share your primary Environment.

> **Note**
>
> For the platform concepts, see [Environments and Organizational Units](/platform/core-platform/administration/overview#environments). When you have chosen your data boundaries, [create a new Environment](/guides/platform-setup/create-a-new-environment).