Typical workflows

The previous page showed how CMDash's record types relate. This one follows those relationships through a day's work — getting a workspace started, running the compliance loop, and the path each of exceptions, risks, policies, vendors, audits, CMMC/SPRS and incidents take from open to closed.

Getting started

The wizard runs once, after sign-up; every step but the role question can be revisited later from its own place in the sidebar. Landing on the dashboard starts a Getting Started checklist of six first milestones (a control assessment, an integration, a published policy, a teammate, a report, a piece of evidence), which disappears once every one is checked off.

The compliance loop

This is the loop a GRC lead runs most days. A quick note typed on a line becomes evidence the moment you press Add note — there is no separate "evidence" step — and one piece of evidence can attach to more than one line or control. Audit Readiness is a periodic check across everything you've enabled, not a step in every line's own path.

Evidence lifecycle

Fresh or stale is not one of these statuses — it is worked out on every read, from the collection date and a validity window, so it can never be wrong just because a scheduled check didn't run. When a slot goes stale, CMDash opens a renewal task for its owner automatically, and that task closes itself the moment new evidence lands.

Risk lifecycle

A risk can also open itself: a dropping vendor monitoring score, a rejected questionnaire, an overdue known-exploited-vulnerability match, or a missed POA&M milestone can each raise one automatically. Whichever way it opened, it's worked the same way from there.

Exception lifecycle

An exception formally accepts a risk instead of remediating it, so the approver identity check matters: whoever signs off can never be the same person who asked. Renewing an expired exception is only allowed while its compensating control still has current evidence — an exception cannot quietly outlive the safeguard it depends on.

Policy lifecycle

Whether publishing goes straight to Active or stops at In review depends on a workspace setting — approval is opt-in, not a permanent step for everyone. A single rejection is a full stop: the policy returns to Draft at once, even if other reviewers haven't decided. While a policy is Active, a separate attestation campaign can ask named people to confirm they've read it, without changing the policy's own status.

Vendor review

A questionnaire is one of two machines running for a vendor: the relationship itself moves separately, from Onboarding through Active, Under review and Offboarding to Retired. Accepted is final for a questionnaire — a re-assessment is a fresh one, never a re-opened one, the way an auditor expects a signed attestation to stay put. Independently of any questionnaire's outcome, a dropping monitoring score or an overdue known-exploited-vulnerability match can raise a risk on its own.

Audit engagement

Alongside the engagement, a provided-by-client (PBC) request loop runs during fieldwork: the assessor asks for something specific, you submit evidence, and the assessor accepts it, sends it back, or waives it if it's no longer needed. A firm returning for a second year gets a new engagement under the same standing grant, not a reopened one.

CMMC and SPRS

Every open practice becomes its own POA&M item, and closing one requires real closure evidence — self-reporting "done" moves an item to Pending verification, not to Completed, since an assessor treats the two differently. A SPRS submission attempt is recorded as Prepared, then Submitted or Failed, and CMDash flags any historical score computed under an earlier weight table so it can be recomputed.

Incident response

Action items — ordinary remediation tasks pointed at the incident — open as findings surface, and are tracked the way any other remediation task is, with the same due dates and the same one list of what's overdue. A postmortem documenting the timeline and root cause is written once the incident is closed, and stands as an evidence artifact in its own right.

Who does what

Related

• How CMDash Fits Together — the record types and hubs these workflows move between
• Exceptions
• Vendors (TPRM) & Questionnaires
• Audit Programme
• CMMC, POA&M & SPRS
• Incidents & Exercises
• Policies & Attestations
• Evidence Collection
• Risk Register