Compliance Frameworks

The Compliance section manages your organization's alignment with security and privacy frameworks. CMDash supports a comprehensive library of frameworks and tracks your progress at the control level, automatically linking evidence from integrations wherever possible.

Supported Frameworks

• NIST Cybersecurity Framework (CSF)
• CMMC Level 1, Level 2, and Level 3 [Essentials+] / [Command+]
• ISO 27001
• SOC 2 Type I and Type II
• PCI DSS
• HIPAA Security Rule
• CIS Controls
• GDPR
• DORA (Digital Operational Resilience Act)
• FedRAMP (Moderate and High baselines) [Command+]
• Custom frameworks via CSV import [Enterprise]

Selecting and Enabling Frameworks

Navigate to Compliance in the sidebar. Click Add Framework to see the full library of available frameworks. Select a framework to preview its domain structure and control count, then click Enable to activate it in your workspace.

Once enabled, a framework appears in the framework list. You can have multiple frameworks active simultaneously. On Command and above plans, there is no limit to the number of active frameworks. Starter is limited to NIST CSF only; Essentials adds CMMC L2.

To disable a framework without losing your control status data, click the framework name and select Deactivate. The framework and all its data remain in your workspace; it simply no longer appears in your active compliance view or dashboard snapshot.

Framework View: Domains, Controls, and Status

Each framework is organized hierarchically:

Framework → Domains → Controls

Click a framework name to open its domain list. Each domain shows a completion percentage and a count of controls by status. Click a domain to expand it and see its framework lines.

Each line reads as a record, not a spreadsheet row:

• Control ID and title (e.g., PR.AC-1 for NIST CSF), and its full requirement text behind a disclosure
• Status — an inline pill you change directly on the row (see below)
• Evidence and control chips — "N evidence" and "M controls" open a popover listing what covers this line, with an item to open, an existing item to link, or a new one to add or create
• Crosswalk chips — a control mapped from another framework, labelled with how strong the mapping is; opens that line's own record
• A quick note — turns into a dated, attributed evidence entry (see "Adding a Quick Note" below)
• Clicking the line's code opens its full record: status history, every linked evidence item and control, and its comment thread, either as a panel over this page or at its own page address for sharing

Tenant controls — what your organization actually built, as opposed to the catalogue requirement a line describes — are a separate, related concept; see Your Own Controls below.

Control Status Values

Each line is assigned one of six status values:

At Risk and Failing are read-only: they say a monitored signal changed, and hand-setting either would overwrite what the CCM engine is the system of record for. A line already in one of them still shows it; you cannot pick it from the status control.

Updating Control Status Manually

Change the status pill directly on the line's row — there is no separate edit screen and no Save button. The new value is written the moment you pick it; if the save is refused (for example, the framework isn't included in your plan) the pill snaps back to its old value and tells you why, with a link to upgrade when that's the reason.

The change is reflected immediately in the framework's overall completion percentage, in the Dashboard compliance summary, and in the line's own activity history.

Adding a Quick Note

Every line has a note box below it. What you type becomes a dated, attributed TEXT evidence entry linked to that line — not a single shared notes field that the next person overwrites. On a line that is still Not Started, a checkbox next to the box lets you set it to In Progress in the same step; whether that box is ticked by default is a per-workspace setting under Settings → Compliance ("Adding a note to a not-started line sets it to In progress"). A note never changes the status on its own — only the checkbox does. Press Ctrl/⌘+Enter to post without reaching for the mouse.

Automated Evidence Linking from Integrations

When an integration syncs data, CMDash maps the incoming data to relevant framework controls automatically. For example:

• A vulnerability scan result from Tenable may link as evidence to NIST CSF ID.RA-1 (Asset Vulnerabilities Identified)
• An MFA enforcement report from Duo may link to multiple controls across NIST CSF, CIS Controls, and CMMC that require multi-factor authentication
• Endpoint detection telemetry from CrowdStrike may satisfy controls in the Detect and Respond categories

Automatically linked evidence shows up in the line's "N evidence" chip and, opened, in the evidence record itself, with a timestamp indicating when it was collected. You do not need to take any action for automated evidence to appear; it populates as integrations sync.

Framework Crosswalk [Command+]

When you have multiple frameworks enabled, CMDash maps controls that address the same requirement across frameworks. For example, a strong MFA policy implementation may satisfy controls in NIST CSF, CMMC, ISO 27001, and CIS simultaneously.

A crosswalk chip on the line names the mapped framework and control and, when the mapping is partial or weak, says so in the chip itself rather than only in a tooltip; clicking it opens that line's own record. When you mark a control Implemented, CMDash offers to update the status of mapped controls in other frameworks within your plan's allowance and link the same evidence — a toast tells you if any crosswalked controls were skipped because the target framework isn't included in your plan.

Your Own Controls

A framework line is the catalogue's requirement — "employ least privilege." A control, under Controls in the sidebar, is what your organization actually built to satisfy it, and one control commonly covers several lines across several frameworks at once. Controls are your own: a title, description, owner, an implementation type (Preventive, Detective, Corrective, Administrative), and the same status values as a framework line.

Create a control from a line's "M controls" chip (+ New control, pre-linked to that line) or from the Controls list itself. From the list you can filter by status, owner and type; sort by any column; select rows to set a status or an owner on several controls at once; and export exactly the rows your current filters produce to CSV. A control's own record — opened from its title — shows every line and evidence item linked to it and its own activity history, the same shape as a line's or an evidence artifact's record. Both POA&M exports name the controls linked to each open requirement, so an assessor reading the register can see what you have already built against it.

How to fix

When a framework line a control covers is At risk or Failing, or has an open remediation task, the control's record shows a How to fix block with one entry per such line:

• The signal. What the monitoring rule needs (for example a setting that must be on) and the value it last read, with the collection date. If the last reading is not a single value, the entry says so. A line no monitoring rule has read yet says that instead.
• The steps. A one-sentence summary and two to five ordered steps, written by hand for each built-in monitoring rule, with a Vendor guide link where one exists. The steps are done by a person in your own tools; CMDash does not make these changes for you. A monitoring rule your workspace wrote has no written fix, and the entry points you back to its signal.
• The open task. The remediation task raised for the line, with its status and due date, and the Send to Jira button (see Remediations). Members without access to Remediations see the task's status but not its title or due date.

If the fix steps cannot be loaded, the block shows a note with a Retry button and the rest of the record is unaffected.

Compliance Calendar

The Compliance Calendar is accessible from the Compliance section via the Calendar tab. It consolidates:

• Audit dates — scheduled external or internal assessment dates for each framework
• Policy renewal deadlines — dates when policies expire and must be reviewed
• Attestation due dates — individual or bulk attestation completion deadlines

To add a calendar entry, click Add Event and fill in the event type, associated framework or policy, date, and responsible owner. Events appear as alerts in the notification system as the deadline approaches. Lead time for notifications is configurable per event.

POA&M Export [Starter+]

A Plan of Action and Milestones (POA&M) is a structured document required by CMMC and FedRAMP assessors. CMDash generates a POA&M from your Risk Register and open remediation tasks.

To export, navigate to Reports and select POA&M Export. Configure the scope (framework, date range, status filter) and select the output format (XLSX or CSV). The exported document follows the standard CMMC/FedRAMP column structure expected by assessors.

Framework Import (Custom CSV) [Enterprise]

Enterprise workspaces can import a custom framework using a CSV template. This supports proprietary frameworks, regulatory requirements unique to your industry, or internal control sets.

To import a custom framework:

1. Go to Compliance, then open the Import tab (it renders locked below Enterprise, with a link to what unlocks it).

2. Click Load template to insert a sample CSV, or prepare your own with these columns:

   Column	Required	Notes
   Control ID	yes	Your identifier, e.g. CTRL-001
   Domain	yes	Grouping the control appears under
   Title	yes	Short control name
   Description	no	Summary of the requirement
   Evidence Requirements	no	What satisfies the control
   Full Text	no	The verbatim control text — see below

3. Paste the CSV or choose a .csv file, give the framework a name and version, and import.

The framework is created and active immediately. It behaves like a built-in framework: assign owners, set statuses, link evidence, and include it in reports. You can also export it back to CSV, which round-trips every column including Full Text.

The Full Text column, and licensed standards

CMDash ships the verbatim control text for frameworks whose text is public domain or openly licensed. For the standards that are sold per copy — ISO 27001, ISO 42001, SOC 2, PCI DSS, HITRUST, TISAX, CIS Controls — it ships a summary and a link to buy the official document instead, and never redistributes the text.

If your organization is licensed for one of those standards, the Full Text column is how you bring your own copy in. Populate it and the text appears on each control, labelled Source: Tenant-provided.

This creates a separate framework private to your organization. It does not add text to the built-in ISO 27001 (or other licensed) framework you see in the framework list. That is deliberate: built-in frameworks and their controls are shared by every organization on the platform, so writing one customer's licensed text there would expose it to all of them — and breach a per-copy licence. Your imported copy is visible only to your own workspace.