Planning, Budget, and Initiatives

What it is

Seven pages cover how CMDash helps you plan security spend, prioritize work, and see what's coming:

• Budget & ROI Planner (/security-budget) — spend allocation across your initiatives and landscape-atlas capability areas, and what that spend is projected to buy, expressed as cost-per-maturity-point and cost-per-risk-dollar.
• Initiatives (/initiatives) — program-office initiatives that close specific gaps against your maturity target profile: an owner, a budget, milestones, and a projected (never measured) impact.
• Regulatory Horizon (/horizon) — a countdown-ordered radar of incoming regimes (DORA, NIS2, SEC cyber disclosure, the EU AI Act, CMMC 2.0, NYDFS 500), each crosswalked against your existing control assessments.
• What-If Simulator (/what-if) — fund an initiative, or adjust a FAIR input, and see the projected maturity delta and simulated financial-loss delta, with confidence bands rather than a single number.
• Predictions (/predictions) — AI-generated risk-score forecasts at 30, 60, and 90 days.
• Benchmarks (/benchmarking, page title "Peer Benchmarking") — how your posture compares to your industry peer group.
• Landscape (/landscape) — a 72-area atlas of the cybersecurity/GRC tool market, embedded in-app.

When to use it

• Building next year's security budget request and wanting cost-per-maturity-point or cost-per-risk-dollar numbers you can defend, rather than a bare spend total.
• Deciding what to fund next: Initiatives tracks the work, What-If Simulator tells you what funding this initiative is projected to move before you commit.
• Preparing for a regulation that isn't in force yet — Regulatory Horizon shows how much runway you have and how ready your existing controls already leave you.
• Explaining a risk trend to leadership before it becomes a current-quarter problem — Predictions forecasts risk scores forward.
• Positioning your program against peers for a board conversation — Benchmarks — or researching what category of tool would close a specific gap — Landscape.

Before you start

How to

Build a defensible budget case

1. Open Budget & ROI Planner from the Security section. You'll need at least one initiative on file first — if you have none, the page tells you to create one.
2. The top section shows spend allocation across your initiatives (actual budget where recorded, planned budget otherwise) and a landscape-atlas cost reference per capability area — a reference range, not a committed spend.
3. Pick an initiative to see cost-per-maturity-point: how much you're spending per point of projected maturity gain, assuming every milestone on that initiative completes. This is always labeled projected — it is never a measured movement.
4. To see cost-per-risk-dollar, first run a simulation in the What-If Simulator (below) to get a projected ALE (annualized loss expectancy) delta, then bring that figure back here. This page never runs the risk-quantification engine itself.

Create and track an initiative

1. Open Initiatives from the Security section.
2. Click + New Initiative. Give it a name, owner, and budget.
3. Link it to a maturity dimension's target-profile gap so its projected impact can be tracked — an initiative with no linked dimension has nothing to project.
4. Add milestones as the work is planned out. Progress and projected impact both update against those milestones, never against a subjective "percent done."

Run a what-if scenario

1. Open What-If Simulator from the Security section (Enterprise tier).
2. Select a risk to see its measured FAIR baseline, or select an initiative to model funding it.
3. Adjust the input you want to test and click Run simulation.
4. Read the result as a confidence band (e.g. p10/p50/p90), not a single figure — the simulator is explicit that this is a fresh Monte Carlo re-run, never the persisted, measured assessment shown elsewhere.

Check the regulatory horizon

1. Open Regulatory Horizon from the Compliance section.
2. Each card shows a regime's status (Enacted, Adopted (phased), or Proposed), a countdown to its next milestone, and — where you have relevant controls assessed — a crosswalked readiness percentage and gap count.
3. Use the Sector and Jurisdiction filters to narrow the list. These are self-service hints, not an automatic legal-applicability determination — CMDash says so directly on the page.

Generate a risk forecast

1. Open Predictions from the Security section.
2. Click Generate Predictions. CMDash produces forecasts at 30-, 60-, and 90-day horizons for your current risk register.
3. Any organization member with access to risk data can generate a forecast — this is not restricted to Owners or Admins, unlike most other AI-generation buttons in CMDash.

Compare against peers

1. Open Benchmarks from the Overview section.
2. Select your industry from the dropdown and click Save.
3. Your posture is compared against the peer group for that industry.

Browse the tool landscape

1. Open Landscape from the Overview section. It renders as an embedded, self-contained atlas covering 72 cybersecurity/GRC capability areas.
2. Each area lists vendor/tool options with strengths, watch-outs, and a structured rating (capability, maturity, value, ease).
3. CMDash's own entries carry a visible "this product" disclosure wherever they appear — CMDash is self-listed in 21 of the 72 areas — but that disclosure carries zero scoring weight: it is purely presentational, so CMDash's own ratings in the atlas are computed by the exact same rules as every competitor's.

M&A Due Diligence

Security → All Security tools → M&A Due Diligence (/ma-diligence, Command tier and above) gives you time-boxed, audited workspaces for evaluating a prospective acquisition target's security posture and maturity without mixing its data into your own. Create a target, Enter workspace to work inside it, and End engagement when the evaluation closes; every enter and exit is written to the audit log. It is the same isolation model the vCISO console uses for client workspaces.

Common questions

Is the cost-per-maturity-point number a guarantee? No. It is explicitly a projection that assumes every milestone on the linked initiative completes — never a measured result. CMDash marks projected figures as projected: true throughout so they're never mistaken for a measured movement.

Who can generate a forecast? An Owner or Admin. Viewers can read the latest predictions but cannot generate new ones, the same rule as AI Suggestions.

Does the Landscape atlas favor CMDash? The scoring engine ignores the self flag entirely — it carries no weight in scoring. The visible disclosure exists so a reader can judge the conflict of interest for themselves, not to hide it.

Why is What-If Simulator Command-only when Initiatives and Budget aren't? The simulator runs the same FAIR Monte Carlo engine as FAIR Quantification, which is available on Starter and above; What-If Simulator requires Command tier.

Related

• FAIR Quantification — the underlying risk-quantification engine What-If Simulator runs
• Risk Register — the risks Predictions forecasts and What-If simulates against
• Board Reporting — turning these numbers into a board-ready deck