This guide covers every major CMDash feature, one page per topic. If you are new to CMDash, start with the Quick Start Guide instead — it gets you logged in, an integration connected, and your first Posture Score in about 15 minutes. Come back here for the full walkthrough of day-to-day workflows.
Pick the path below that matches your role. Each one names the 3–4 pages people in that role read first; the full page list is at the bottom.
Start here if you're a CISO or security leader
Your Tuesday morning problem is a board update due Thursday, built from six consoles and a spreadsheet that is already out of date. Start with Overview for how the modules fit together, then Dashboard for the live view you'll open every morning. Posture Score is where the A–F grade and peer benchmarking trend live — the numbers you'll actually defend in the room. When it's reporting time, Reports & Exports covers the one-click Board Snapshot PDF and the Board Deck .pptx.
Start here if you're a GRC analyst or compliance manager
Your Tuesday morning problem is chasing screenshots for a control you already collected screenshots for last quarter. Start with Compliance Frameworks for how frameworks, domains, and control status work, then Evidence Collection for how evidence gets linked automatically from integrations instead of by hand. Risk Register covers linking risks to the controls they threaten, and Audit Log is where every status change and evidence action is recorded for an assessor.
Start here if you're a workspace admin
Your job is keeping the workspace itself running — who has access, where alerts go, and what's provable after the fact. Start with Navigation for the full sidebar map, including what lives under Settings. Notifications & Alerts covers configuring alert rules and channels (email, Slack, Teams) for the rest of the team. Audit Log is the append-only record of every action in the workspace. For SSO/SAML/SCIM, user roles, API keys, and billing, see the Admin Guide — that content lives there, not in this guide.
Start here if you're an MSP or vCISO
Your Tuesday morning problem is twelve client tenants, twelve spreadsheets, and no way to compare them. Start with Overview for how the multi-client control plane fits together, then the vCISO / Multi-Client feature guide for the client switcher and cross-client roll-up. Reports & Exports covers the white-labelled Board Deck you'll bill for, and Integrations covers connecting each client's own security stack.
All guide pages
| Page | What it covers |
|---|---|
| Overview | What CMDash is, who it's for, and the daily workflow |
| How CMDash Fits Together | The relationships between frameworks, controls, evidence, risks, and remediation tasks |
| Typical Workflows | Getting started, the compliance loop, and each record's lifecycle, step by step |
| Navigation | The sidebar, every section, and global controls |
| Dashboard | The daily snapshot view and how to customize it |
| Your Brief | The mobile-first daily screen, install-as-app, and posture-drop push |
| Posture Score | The A–F grade, the five signals, trends, and peer benchmarking |
| Compliance Frameworks | Enabling frameworks, control status, quick notes, your own controls, crosswalk, POA&M, custom imports |
Risk Register [Command+] | Adding, scoring, filtering, and exporting risks; FAIR quantification |
| Remediations | Tracking remediation tasks and generating POA&M exports |
| Integrations | Connecting data sources, sync frequency, and health alerts |
Evidence Collection [Command+] | Automated and manual evidence, evidence packages, review workflow |
AI Narrative [Command+] | The daily LLM-generated exposure summary and how to use it |
| Reports & Exports | Board Snapshot, Board Deck, Custom Report Builder, data export |
| Policies & Attestations | Policy lifecycle, approval workflows, attestations, renewal tracking |
| Notifications & Alerts | Alert rules, channels (email, Slack, Teams), digests |
| Search, Tags & Saved Views | Global search, tagging, and reusable filtered views |
| Audit Log | The immutable record of every action in the workspace |
For workspace administration — users, roles, SSO/SAML/SCIM, API keys, and billing — see the Admin Guide.