Program Builder

What it is

The Program Builder takes you from an empty workspace to a working security program in layers. It starts with a three-step setup of about two minutes, then offers five more layers you can take at your own pace:

Layer	Name	What it covers
0	Start	About you, your starter pack of policies, and your home page
1	Foundations	Publish a policy, add assets, invite a teammate, the Operate pack of policies
2	Your framework	Pick a framework, check your readiness, the framework's policy pack, connect a tool
3	Evidence and risk	Attach evidence, log your top risks, add a vendor, the Resilience pack
4	Report and expand	A board snapshot, a second framework, your security program charter
5	Automate and scale	Evidence automation, third-party risk, the Trust Center, and for some teams the AI governance pack and client workspaces

Every layer is visible from the start and one is marked Recommended. Nothing is hard-locked: you can open any layer in any order. A step is done when the real thing exists in your workspace (a policy is published, a risk is logged), so work you do anywhere in CMDash moves the builder on, and you never have to tick a box twice.

When to use it

Use it when you are new to CMDash and want to know what to do next, or when you are setting up a program from scratch and want the policies, framework and first records in a sensible order. It is also a good way to see what a higher plan would add before you decide: steps on a plan you do not have say which plan includes them.

Before you start

Tier: available on every plan, including Free. Individual steps follow the plan that includes their feature (for example, the risk register is a Starter feature), and a locked step names the plan it needs.
Role: every member can see the roadmap and the Your program card on Home. Starting, skipping and applying a pack are Owner and Admin actions. Anyone can dismiss the Home card for themselves.
Time: the three-step start takes about two minutes. The later layers take as long as you want them to.

How to

Run the three-step start

The first time an Owner signs in, CMDash opens Onboarding.

About you. Pick your role, confirm your company name (it is filled in for you), and choose your industry and company size. The step also shows what Free includes. Only the CMMC role path chooses a framework at this point.
Your starter pack. CMDash creates five essential policies as drafts: Information Security, Acceptable Use, Access Control, Password and Authentication, and Incident Response. Nothing is published for you. The Explore with sample data switch is off by default, which keeps your workspace blank. Switch it on to look around with records labelled [SAMPLE], which you can remove in Settings.
Home. You land on the Home page. If your plan can start a trial, you see one offer for it here.

Save and exit takes you to Home at any point. Nothing is lost, and you can come back to the builder whenever you like.

Open the roadmap

Choose Build your program under Program in the sidebar, or follow Your program · Layer N of 5 on Home. The roadmap shows all layers. Open one to see its steps.

Open takes you to the real page for the step. A return bar at the top of that page brings you back to the layer.
Skip takes a step out of its layer's count when it does not apply to you. Undo skip brings it back.
The Plan to Grade C tab holds the three-phase plan toward Grade C that used to end the old setup. The old /onboarding/plan address now takes you there.

Follow your first 90 days

Open the First 90 days tab of Build your program, or use the row under Your program on Home. It shows a plan for your role, in three phases: days 0 to 30, days 31 to 60 and days 61 to 90.

Which plan you get. The role you chose at setup picks it: CISO, vCISO or MSP, IT lead, or compliance owner. A CISO or security leader gets the CISO plan, a vCISO or MSP gets the client plan, a compliance analyst or CMMC organization gets the compliance owner plan, and "just exploring" gets the IT lead plan. An assessor sees a picker. An Owner or Admin can switch to another role's plan from the Plan list, and Use my role's plan switches back.
How a step is done. Where CMDash can see the work (a published policy, three logged risks, a scheduled tabletop) the step ticks itself. The few it cannot see, such as a security mailbox, have a Mark done box you tick yourself.
Open goes to the page that does the step, with a link back to the plan. Skip takes a step out of the count.
Plans you do not have. A step on a higher plan is shown with the plan that includes it, for example "Included with Starter". Organizations under $10M in revenue do not see the business units step.

Apply a policy pack

Some steps are packs of policy templates: Starter, Operate, a pack for your framework, Resilience, and AI governance. A pack panel shows up to eight titles with a more link for the rest. Applying a pack creates drafts only, skips any policy you already have, and can be repeated safely. Review each draft and publish it on the Policies page.

Pick your framework

In Layer 2, CMDash recommends a framework from your role and industry. Adding one never replaces a framework you already use. On Free, which includes one framework (CMMC Level 1, Level 2 or NIST CSF 2.0), a recommendation your plan does not include is shown as Included with Starter and the step offers the Free framework instead.

Check your readiness

The readiness check is eight short questions and you can skip it. If you answer some now, the button reads Answer N more for the rest. Free shows your grade and your top gaps. The full score and the breakdown are Starter and above.

Ask for the 30-day trial

Locked layers and steps show a single trial offer. While card checkout is off, an Owner or Admin can request the 30-day trial from inside the app; the request reaches the CMDash team, and an e-mail link remains as a fallback. A repeat request within 30 days is accepted without sending a second message.

Common questions

Is anything published for me? No. Policies are created as drafts and a person publishes them.

Can I use the builder out of order? Yes. Every layer opens, and the Recommended mark is only a suggestion.

I did the work somewhere else. Will the builder know? Yes. A step is done when its data exists, wherever you created it.

Where did the old setup wizard go? The first screens are now the three-step start. Team invitations, integrations and the readiness check moved into the layers, and each has its own page in the sidebar as before.

Is the First 90 days plan the same as Plan to Grade C? No. Plan to Grade C counts the controls and policies behind a Grade C posture. First 90 days is a role-based list of things to do in three phases.

Can I hide the Home card? Yes, dismiss it from the card. Only your own view changes, and Build your program keeps working.

Free tier: what Free includes, now with NIST CSF 2.0 as a choice of framework
Policies & Attestations: publishing the drafts a pack creates
Security Program: the charter and governance pages from Layer 4
Compliance frameworks: adding and tracking frameworks
Quick start guide: signing in and the first session
Developers: Program Builder API

This page is the product manual, published from the repository at docs/user/feature-guides/program-builder.md. Customers read the same text inside CMDash under Help. Last updated November 2, 2026.