Launch notes and engineering write-ups, each one sourced to the changelog, the landscape atlas, or a white paper already on this site — no claim here that isn’t traceable to something we shipped.
The DoD SPRS Basic Assessment formula, the real 42/14/51 Annex A weight split, the two partial-credit exceptions, and the one requirement that can stop the assessment cold - using the same numbers CMDash's own scoring function computes.
A line-by-line account of what CMDash's switching importer reads out of a Vanta export, what it deliberately leaves behind, and why - the same claims /switch/vanta makes, with the source.
A recap of ROADMAP-V80 waves 1 through 3 — the trial funnel, activation, and monetisation releases that shipped before this blog did, and why we built them in that order.
The Cybersecurity Landscape Atlas is 72 areas and 565 vendor entries, kept current by a biweekly refresh that checks source APIs rather than vendor marketing pages — including our own listing, which carries zero scoring weight.
Every mechanism behind the vCISO multi-client roll-up already shipped — the cross-client view, the partner console, the white-labelled board pack. What was missing was any data to render, and why.
How the DoD Basic Assessment score is actually calculated, which gaps can go on a POA&M and for how long, and the one sentence every CMMC tool should say about itself but most do not.
A board or audit committee asks a small, repeatable set of questions about security. The hard part is rarely the metric — it's knowing which dashboard tile, report slide, or register already has it.
Mission, ISMS scope, a starting RACI, committee terms of reference, and the clause 9.3 review cycle — a fill-in-the-blanks charter for a security programme with no written charter.