Cyber maturity you can show, not just claim.
CMDash turns the tools you already run into one live posture grade and a control-by-control record for the frameworks you answer to: CMMC, HIPAA, SOC 2, ISO 27001, NIST CSF and more. Start from your regulator, finish with one programme.
Pick the framework you answer to
20 frameworks, including ISO 42001 and CMMC Level 2, in one evidence engine. Five common starting points:
Defence
All 110 CMMC Level 2 practices across 14 domains, each with its status and evidence, and the SPRS score they add up to.
Healthcare
Track the HIPAA Security Rule safeguards as real controls with evidence, crosswalked to the other frameworks you answer to.
Finance
Track NYDFS Part 500, PCI DSS, SOX ITGC and DORA as controls with evidence, and carry status across the crosswalk.
SaaS
Track SOC 2 and ISO 27001 side by side: collect a piece of evidence once and see it against both.
AI governance
Track an AI management system against ISO/IEC 42001 and the NIST AI Risk Management Framework the same way you track your ISMS.
Stop opening six tools every morning.
Most security leaders piece their picture together from a SIEM, a vulnerability scanner, an identity console, a compliance tracker, and a risk spreadsheet — then translate it for the board by hand. CMDash collapses that into one authoritative dashboard, so the answer to “how are we doing?” is always one click away.
Read the white paper: why a unified cyber maturity dashboard →- 0:00CMDash, in ninety seconds and no sound. Everything you are about to see is a seeded demo workspace.
- 0:13Stop opening six tools every morning. Posture, compliance progress and open risk on one screen.
- 0:22Every evidence item is tied to a control, a framework and the source that produced it — manual, automated or integration.
- 0:32One evidence engine, every framework you report on, tracked side by side: done, in progress, not started.
- 0:42The posture grade is computed from several weighted signals, and the breakdown shows every one of them.
- 0:51A risk register scored by likelihood and impact, with the heat map that falls out of it.
- 1:00Each risk becomes a remediation task with a priority, a due date and an SLA — and a push to Jira.
- 1:08The board deck is assembled from that same live data — nine slides, generated rather than rebuilt by hand.
- 1:17Maturity is a trajectory, not a snapshot: the posture score and the risk count, tracked day by day.
- 1:23Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
One evidence engine between your tools and your frameworks
From the tools you run to the people who ask
One score, computed not entered
A live A–F posture grade from up to seven weighted signals — time to patch, MFA coverage, open critical and high vulnerabilities, incident frequency, policy compliance, SaaS sprawl and DLP events — recomputed every 4 hours once a tool is connected, and whenever you ask. The maturity trajectory shows which way it is moving.
Connect what you already run
A hosted catalog of 36 integrations you connect with an API key or token you create. Connections sync every 4 hours by default.
One control, every framework
A crosswalk carries a control’s status to the same control in other frameworks, POA&M tracking is on every plan with export on every paid plan, and evidence keeps its full upload and review history.
Show it to the people who ask
A board-pack PDF built from live data. On Essentials and above. A public Trust Center that can show your live posture grade when you turn it on. An evidence package export on Enterprise.
Maturity is a trajectory, not a snapshot.
A quarterly audit gives you one point in time. CMDash keeps a history of posture snapshots, so a team can see whether this month is better than last month — and act while there is still time to change the answer.
One platform, end to end
Posture & scoring
- ✓Live A–F posture score
- ✓30- and 90-day trend charts
- ✓Signal weights you can inspect
Compliance & frameworks
- ✓20 frameworks, including ISO 42001 and CMMC Level 2
- ✓Crosswalk between frameworks
- ✓POA&M tracking, with export on every paid plan
- ✓Custom framework upload (Enterprise)
Evidence & audit
- ✓Manual evidence with full upload history
- ✓Evidence review workflow
- ✓Evidence package export, a ZIP with a manifest (Enterprise)
Integrations
- ✓36 integrations you connect with an API key or token you create
- ✓Syncs every 4 hours by default
Enterprise & identity
- ✓SSO with SAML 2.0, and SCIM provisioning
- ✓vCISO multi-client management (Command and Enterprise)
- ✓Multi-business-unit roll-up (Enterprise)
- ✓White-label branding (Command+)
Built for the people who have to show it
MSPs & vCISOs
Client workspaces and posture scores from one login, with white-label branding on Command and Enterprise.
See the page for MSPs & vCISOs →Defence contractors
CMMC requirements are now appearing in DoD solicitations. Track CMMC Level 2 practices, evidence and your SPRS score.
See the page for Defence contractors →Where CMDash runs
CMDash runs as a managed SaaS that we host and operate on AWS, in us-east-1. A self-hosted install on your own servers, for the Enterprise plan. Coming soon
The same product in both · the trust boundary is what changes
Hosted and managed by us. Sign up and start the same day.
Runs on your own servers or in your own AWS account, on the Enterprise plan, from a signed license file that is checked offline.
Coming soonNo quotes to trust. Everything below is checkable.
CMDash has no paying customers yet, so there is no quote to put here. Every number below comes from the same code the product runs on, and every link goes to a real, live page — not a screenshot.
Go look for yourself
Every one of these is a real page you can read right now, on this domain — no form, no NDA, no sales call first.
Become a design partner — not a quote on a page
We are taking on a small number of design partners: early access, direct input into the roadmap, and a discounted rate in exchange for real feedback sessions. Pre-revenue, on demo data, roadmap-driven — told to you straight on the programme page.
Ready to show your maturity?
Start your 30-day trial of any paid plan — a card is required, and it converts unless you cancel — or open a free workspace, no card.