What is new in CMDash, newest first. Subscribe via RSS.
Developer documentation written for the people who integrate with CMDash.
The API, webhook, idempotency, pagination, concurrency, partner API, SDK and Terraform provider pages now describe only the public contract: paths, headers, fields, limits and errors.
On-demand JSON exports now carry a tamper-evident seal, described in the data export format reference.
A System Security Plan on every plan, honest evidence, and a calmer product tour.
View, edit and export your System Security Plan for CMMC Level 2 on any plan. Your own narrative sections are saved with a version history, so a signer can see who changed what and when.
Each CMMC Level 2 practice now carries its NIST 800-171A assessment objectives. A practice counts as met only when its objectives are, and your score and exports apply the same rule.
Automatically collected evidence is now filed only when the condition it depends on is actually met, once per control and source, and never overrides a reviewer’s decision.
You can now deactivate an integration. It keeps its settings, stops syncing and drops out of your health counts, and reactivating re-checks the connection before it shows as healthy.
Integration setup guides are formatted as proper documents, and the trust pages on the main site now load their styling correctly.
The product tour now highlights the relevant part of the screen with a simple box instead of dimming the page, and the button that opens it is called Take the product tour.
MSPs and virtual CISOs can arrange per-client pricing from the first client, never more than the Command plan. Contact us to set it up.
Settings, Updates now shows the release you are running.
A more honest readiness score, accurate comparisons, and the real CMMC Level 3 catalog.
Answers from the quick readiness check are now recorded as claims, shown with a clear “Claimed — add evidence to confirm” marker, and kept out of your verified score until you back them with evidence. You still get a fast provisional score to start with.
The Level 3 catalog now contains the 24 requirements from the CMMC program rule, with their full text and source, replacing the earlier working draft.
The assessor-ready evidence package, the bundle you hand to an assessor or auditor, is now available from the Command plan instead of Enterprise only.
Primes, insurers and customers who check suppliers now have a page that explains how to request evidence, what the measured, self-assessed and self-attested labels mean, and how to verify a receipt for free.
Our comparison pages now cover the tools buyers actually shortlist, cite their sources with the date each was checked, and count where each tool leads correctly. Vendors that do cover CMMC are shown as doing so.
The MSP margin calculator now includes the plan fee and the managed-workspace allotment, so the monthly cost it shows matches what you would pay.
Availability on the status page is now computed from individual health checks, shows “insufficient data” instead of a misleading percentage when there is too little history, and keeps showing the last known good data if a refresh fails.
Free workspaces can have up to three active shares at a time; paid plans are not limited.
MSPs see every client side by side, and every failing control says how to fix it.
The vCISO overview compares every client workspace side by side, with a drilldown per client and a Compare tab, so you can see who needs attention first.
A partner can read its client workspaces’ posture programmatically with a partner API key created from the API keys page, to feed your own dashboards and reports.
Each failing control now carries plain-language fix steps and can be sent to Jira as a ticket. The weekly brief also lists what is overdue.
The AWS connectors sign in through a cross-account role that you create from a one-click launch template.
Onboarding offers presets for common tool stacks and a trimmed navigation, so a new workspace shows only what matters first.
Each framework page shows how much of it your rules cover, with dated evidence behind the numbers.
For self-hosted installs, release images are scanned for known vulnerabilities, ship with a software bill of materials and are signed.
Client workspaces follow your plan, the public policies page is fixed, and ten new guides.
Client and acquisition-target workspaces move to your plan when it changes or ends, unless they pay for themselves, so nothing is left on a plan nobody is paying for.
The public policies page could load and then go blank in some browsers. It now loads and stays visible.
Event pages offer an Add to Google Calendar link next to each calendar file.
New step-by-step guides cover the newer parts of the product, with help links inside the app.
Professional services, and a security hardening pass.
An AWS security posture assessment, CMMC Level 2 readiness, AI governance readiness and fractional security leadership, each with a sample deliverable and a description of the method.
Secrets you enter for integrations are encrypted when stored and are read only where an integration needs them.
Microsoft sign-in links to an existing account only on a domain you have proven, and a new account is confirmed at its first verified mailbox.
Stored files are scoped to your workspace, and imported references to another workspace’s files are refused.
Members now see and count only their own notifications and the ones sent to the whole workspace.
Switching between apps works again with two-factor sign-in.
Choosing the customer or admin portal from the user menu failed with an invalid-link message for some accounts with two-factor sign-in. It now works, and a failed switch explains what happened.
See how your organization looks from the outside.
Add your domains by publishing a DNS record that proves you control them. Nothing is checked until a domain is verified.
Twenty-seven daily checks per domain, including SPF, DMARC, DKIM, MTA-STS, DNSSEC and dangling-record risk. Each check shows what was found, in plain English, with a corrected record you can copy. A check that could not run says Unknown instead of passing.
Your public addresses are checked daily against public blocklists and reputation sources, with history, delisting guidance and alerts when an address is newly listed.
A 0 to 100 score built from DNS posture, certificate health, IP reputation and exposed services. Every lost point links to the finding behind it, and it shows insufficient data rather than a guess.
Anyone can check a domain’s e-mail authentication at www.cmdash.com/tools/email-security, with no account.
Custom rules across every module, and continuity and recovery planning.
Rules can now watch risks, assets, exceptions, tasks, incidents, policies, evidence, vendors and more, and notify the owner or open a task once per record.
A business impact analysis register with recovery time and data-loss targets, continuity and recovery plans linked to policies, a view of declared targets against the last drill, a dependency map, new policy templates and three new tabletop scenarios.
A product-wide accessibility and quality pass.
The customer app, admin console, policy portal and public site were brought under one accessibility and quality standard, with many fixes found along the way.
Deleting or archiving shows an Undo option before anything is written. You can favourite records, and the command palette remembers what you opened last.
A seat meter warns before you reach the limit, and billing shows your next invoice and a warning before a card expires.
The SDKs’ default namespace now points to API version 2. Review your integrations before upgrading an SDK.
Lists that work the way you expect.
Every key register has a search box, a column chooser and a compact or comfortable view, remembered per saved view.
Import risks from a template, see every bad row and its reason before anything is written, and import only the valid rows.
Detail pages show who created and last updated a record, when, its status, and links to related records.
Share a read-only link, start the day from a brief, and bring your data from other tools.
Share a board pack, compliance report or posture summary as an expiring link, optionally passcode-protected, that you can revoke at any time.
A mobile-friendly daily screen with your posture, and an alert when your score drops by three points or more.
Import their control and policy exports. Anything inferred during import is labelled as inferred.
A Python SDK, a Zapier app, an n8n node and a GitHub Action that checks your posture in a pipeline.
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.