CMDash Help: Frequently Asked Questions

This document answers the most common questions from CMDash users. If your question isn't covered here, reach out via the in-app chat (the ? icon in the bottom-right corner of any page) or email support@cmdash.com.

Getting Started

What is CMDash and who is it for?

CMDash is a daily operations dashboard built for Chief Information Security Officers (CISOs) and their teams. It centralizes security posture scoring, compliance tracking, risk management, and board-level reporting into a single platform. CMDash is designed for security leaders at organizations that need to demonstrate continuous compliance (e.g., CMMC, SOC 2, NIST), manage an active risk register, and communicate security status to executives and boards. It is also used by fractional (vCISO) practitioners managing multiple clients from a single console.

How do I get access? Do I need to install anything?

CMDash is entirely browser-based — there is nothing to install. Access is provisioned by your organization's CMDash Owner, who will send you an invitation email with a link to set your password and activate your account. If you are setting up a new CMDash account, visit www.cmdash.com to start a trial or purchase a plan. Integration connectors run server-side within CMDash; you do not need to install agents or software in your environment.

How long does it take to get value from CMDash?

Most customers see their first meaningful data within a few hours of connecting integrations. The initial Posture Score appears as soon as at least one integration completes its first sync. A full compliance framework baseline — with controls automatically mapped from your connected tools — typically populates within 24 hours. Boards reports can be generated immediately after your posture data loads.

What integrations do I need to connect first?

The highest-impact integrations to connect first depend on your environment, but most customers start with:

1. An identity provider (Okta, Azure AD / Entra, or Duo) — drives MFA coverage, a heavily weighted posture signal
2. An endpoint security tool (CrowdStrike, SentinelOne, Microsoft Defender, or Carbon Black) — drives vulnerability and EDR coverage signals
3. A vulnerability management tool (Tenable or equivalent) — drives patch and vuln posture signals

Connecting these three categories typically surfaces 70–80% of your posture score data. Additional integrations (email security, network, insurance, etc.) add further signal fidelity.

Can I try CMDash before buying?

Yes. CMDash offers a 30-day free trial on the Starter, Essentials or Command plan — pick whichever you're evaluating. A valid card is required to start a trial, and unless you cancel before day 30, it converts automatically to the plan and price you selected. Cancel any time before then and your workspace drops to the Free plan instead — no charge, nothing deleted. If you'd rather not use a card at all, sign up for Free directly. Contact support@cmdash.com if you need a trial extension for procurement reasons.

I just signed up. What should I do first?

Follow this order for the fastest time-to-value:

1. Invite your team — go to Settings → Users → Invite User so colleagues can collaborate from day one.
2. Connect integrations — go to Integrations → Add Integration and connect your identity provider and endpoint security tool first.
3. Wait for the first sync — initial syncs take 5–30 minutes depending on the integration and data volume.
4. Review your Posture Score — once data loads, the dashboard displays your score and the top gaps driving it down.
5. Enable a compliance framework — go to Compliance → Add Framework, select the frameworks you are tracking, and CMDash will map your existing data to controls automatically.
6. Generate a board report — go to Reports → Board Report to produce your first executive summary.

Posture Score

Why is my Posture Score lower than I expected?

The Posture Score (graded A–F) reflects the security signals CMDash can observe through your connected integrations. A lower-than-expected score usually means one or more of the following:

• Gaps in integration coverage — if you haven't connected all of your security tools, CMDash scores missing signals conservatively (assuming a gap exists). Connect additional integrations to give CMDash a complete picture.
• Real gaps surfaced for the first time — CMDash may be surfacing issues you weren't previously measuring.
• Newly connected integrations revealing problems — it is common for a score to initially decrease when adding a new integration that surfaces previously invisible findings.

My MFA coverage shows 73% but I know it's higher — why?

MFA coverage is calculated based on accounts visible through your connected identity providers. Common reasons for a lower-than-expected figure include:

• Not all identity providers are connected — if your organization uses Okta for employees but Azure AD for service accounts or a subsidiary, both must be connected and CMDash's MFA coverage will aggregate across all of them.
• Service accounts and break-glass accounts — accounts that are legitimately excluded from MFA policy still appear in the denominator unless they are tagged and excluded in CMDash.
• Incomplete API scopes — your integration credentials may lack permission to read MFA enrollment status. Check Integrations → [your IdP] → Credential Scopes for the required permissions.
• Sync delay — if MFA was recently enabled for a user, allow up to 15 minutes for the next sync to reflect the change.

My score dropped overnight — what happened?

Score changes are driven by changes in your underlying security signals. Common overnight causes include:

• A nightly vulnerability scan completed in your scanner (Tenable, Qualys, etc.) and surfaced new critical or high findings.
• MFA enforcement lapsed for newly onboarded accounts.
• An integration credential expired, causing that signal to go stale and be penalized.
• A compliance control that had passing evidence hit its evidence expiry date and regressed to "Not Met."

Navigate to Dashboard → Score History and click on the date the drop occurred to see which signals changed.

How often does the Posture Score update?

The Posture Score recalculates automatically each time an integration sync completes. Most integrations sync every 15 minutes. Some integrations that rely on periodic reports (e.g., vulnerability scanners) sync on the cadence of the scanner's own reporting schedule. You can also manually trigger a sync at any time from Integrations → [integration name] → Sync Now.

Can I customize the signal weights?

Signal weight customization is available on Command and Enterprise plans. Navigate to Settings → Posture Score → Signal Weights to adjust the relative importance of each signal category (e.g., increase the weight of MFA coverage if it is a top board priority, or reduce the weight of a signal that doesn't apply to your environment). Changes to weights are logged in the Audit Log.

What's a "good" posture score for my industry?

CMDash grades scores on an A–F scale, and displays industry benchmarks for context. General guidance:

• A (90–100): Excellent posture; above the 90th percentile for most industries.
• B (80–89): Strong posture; typical for mature security programs in financial services and healthcare.
• C (70–79): Moderate posture; common for organizations in early-stage compliance programs.
• D (60–69): Below average; indicates significant gaps that should be prioritized.
• F (below 60): High-risk posture; immediate remediation recommended.

Your Benchmarking tile on the dashboard shows how your score compares to similar organizations by industry and size.

Compliance Frameworks

Which compliance frameworks does CMDash support?

CMDash supports the following frameworks natively, with automatic control mapping from connected integrations:

• CMMC Level 2 and Level 3 (Cybersecurity Maturity Model Certification)
• NIST SP 800-171
• NIST CSF 2.0
• SOC 2 Type II (Trust Services Criteria)
• ISO 27001:2022
• CIS Controls v8
• HIPAA Security Rule
• FedRAMP Moderate
• PCI DSS v4.0
• CISA KEV (Known Exploited Vulnerabilities tracking)

Additional frameworks are added on a regular release cycle. Contact support@cmdash.com to request a framework.

Can I track multiple frameworks at the same time?

Yes. You can enable as many frameworks as your plan allows simultaneously. CMDash automatically applies framework crosswalk logic — a single piece of evidence or control can satisfy requirements across multiple frameworks. For example, your MFA implementation may satisfy CMMC IA.3.083, NIST 800-171 3.5.3, and SOC 2 CC6.1 simultaneously. Navigate to Compliance → Add Framework to enable additional frameworks.

How does CMDash map integration data to compliance controls?

CMDash maintains a continuously updated control mapping library that translates normalized signals from each integration into specific control requirements. For example, CrowdStrike endpoint coverage data maps to CMMC SI.1.210 (malicious code protection), and Okta MFA enrollment data maps to CMMC IA.3.083 (multi-factor authentication). When an integration syncs, CMDash evaluates each mapped control against the inbound data and updates the control status automatically. You can view the specific evidence driving each control status at Compliance → [Framework] → [Control] → Evidence.

A control shows "Not Met" but I know it's implemented — how do I fix this?

There are several reasons a control may show "Not Met" despite being implemented:

1. Integration not connected — the control may rely on data from an integration you haven't connected. Check which integrations are required under Compliance → [Framework] → [Control] → Required Integrations.
2. Integration credential issue — if the integration is connected but lacks the required API scopes, it cannot pass the relevant data. Check Integrations → [integration name] → Health.
3. Evidence expired — manually uploaded evidence has an expiry date. If the evidence has expired, re-upload it.
4. Manual override required — for controls that cannot be automatically evaluated (e.g., physical controls, contractual controls), add a manual attestation under Compliance → [Framework] → [Control] → Add Evidence → Manual Attestation.

I need to track a framework that isn't in CMDash's list. What can I do?

Enterprise plan customers can request a custom framework. Contact your Customer Success Manager or email support@cmdash.com with the framework specification. For standard frameworks under active development, you can subscribe to notifications when the framework becomes available under Settings → Framework Notifications. In the interim, you can approximate coverage using a similar framework (e.g., NIST 800-171 as a proxy for CMMC Level 2) and upload manual evidence for any gaps.

What is the difference between CMMC Level 2 and Level 3?

CMMC Level 2 requires implementation of all 110 practices from NIST SP 800-171 and is required for defense contractors handling Controlled Unclassified Information (CUI). Level 2 assessments can be self-assessed for some contracts or require a third-party assessment organization (C3PAO) for contracts with higher criticality. CMMC Level 3 builds on Level 2 with an additional 24 practices derived from NIST SP 800-172 and is required for programs involving the most critical CUI — Level 3 assessments are conducted by DCSA (the Defense Contract Management Agency). CMDash supports both levels and tracks the additional Level 3 practices as a delta on top of Level 2.

Integrations

How long does the first sync take after connecting an integration?

Initial sync times vary by integration and data volume:

• Identity providers (Okta, Azure AD, Duo): 5–15 minutes for most environments.
• Endpoint security (CrowdStrike, SentinelOne, Defender): 10–30 minutes; longer for large fleets.
• Vulnerability management (Tenable): 15–60 minutes; depends on scan history volume.
• Email security (Proofpoint, Defender for Office): 10–20 minutes.

If no data appears after 60 minutes, check Integrations → [integration name] → Last Synced and Sync Logs for error messages.

My integration shows "Unhealthy" — what do I do?

Work through the following checks in order:

1. Check credentials — API keys and OAuth tokens can expire. Navigate to Integrations → [integration name] → Edit Credentials and re-enter valid credentials.
2. Check network/firewall — if your environment restricts outbound HTTPS, ensure CMDash's IP ranges are allowlisted. See www.cmdash.com/docs/ip-ranges — the SaaS has no fixed egress IP list, and that page explains what to allowlist instead.
3. Check API rate limits — if the source system is rate-limiting CMDash, wait 15 minutes and click Sync Now.
4. Check the CMDash status page — visit www.cmdash.com/status to confirm there are no active incidents affecting your integration.
5. If none of the above resolves the issue, open a support ticket via in-app chat with the integration name and your tenant ID.

Does CMDash store my credentials?

CMDash stores the API keys and tokens your integrations need in its database. It never asks for or stores your login password: for OAuth-based integrations, CMDash stores only the access and refresh tokens.

Can I connect the same vendor integration multiple times (e.g., two CrowdStrike instances)?

Yes. CMDash supports multiple instances of the same integration. This is common for organizations with separate CrowdStrike tenants (e.g., corporate and subsidiary), multiple Tenable sites, or multi-tenant Okta environments. Navigate to Integrations → Add Integration and add each instance separately with its own credentials. Data from all instances is aggregated in your posture score and compliance views. You can label each instance for clarity (e.g., "CrowdStrike — HQ" and "CrowdStrike — EU Subsidiary").

What happens to my data if I disconnect an integration?

When you disconnect an integration, CMDash immediately stops pulling new data from that source. Historical data from that integration is retained in your tenant for 90 days, after which it is purged unless you re-connect the integration. Your Posture Score will reflect the absence of that integration's signals — if the integration was contributing positively, you may see a score decrease. Compliance controls that relied on that integration will revert to "Not Met" until the integration is reconnected or manual evidence is provided.

Which integrations are available on my tier?

All CMDash tiers can connect from the same integration library — which specific connectors are available doesn't vary by plan. What does vary is how many you can have active at once: Starter is capped at 3 integrations, Essentials at 10, and Command/Enterprise are unlimited. Tiers also differ on number of users, advanced features (custom signal weights, white-labeling, SCIM, custom frameworks), and support level. See pricing-matrix.md or www.cmdash.com/pricing for a full tier comparison.

Users & Access

How do I invite a new user?

Navigate to Settings → Users → Invite User. Enter the user's email address, select their role (Owner, Admin, or Viewer), and click Send Invitation. The user will receive an email with a link to activate their account. Invitation links expire after 7 days; you can resend an invitation from Settings → Users → [user] → Resend Invite.

What is the difference between Owner, Admin, and Viewer?

• Owner: Full access to all features including billing, plan management, and deleting the tenant. Each CMDash account has at least one Owner. Owners can change any other user's role.
• Admin: Full access to operational features (integrations, compliance, risk register, reports) and user management, but cannot change billing or delete the tenant.
• Viewer: Read-only access to dashboards, compliance status, and reports. Viewers can download exports an Owner or Admin has generated, but cannot generate exports, add comments or notes, use the AI assistant, edit risks, manage integrations, invite users, or access Settings. Ideal for executives and board members. Invite external auditors as assessors instead (see below).

Enterprise plan customers can create Custom Roles with granular permission sets — see Settings → Roles.

I need a user to see only specific data. How do I restrict their access?

On Enterprise plans, you can create Custom Roles with field-level and Business Unit (BU) scoping. For example, you can create a role that grants read-only access to only the CMMC compliance module for a specific subsidiary BU. Navigate to Settings → Roles → Create Custom Role and configure the permission set and BU scope. On Starter, Essentials, and Command plans, access control is limited to the built-in Owner/Admin/Viewer roles applied globally.

A user left our company — how do I remove their access immediately?

Navigate to Settings → Users → [user] → Deactivate. This immediately revokes their session and prevents future logins. Their historical activity in the Audit Log is preserved. If your organization uses SCIM provisioning (Enterprise), deactivating the user in your identity provider will automatically deprovision them in CMDash within the next SCIM sync cycle (typically within minutes).

Can external auditors access CMDash?

Yes. The recommended approach for external auditors is an Assessor Grant (Settings → Security & Access → External Assessors → Invite Assessor), which gives them time-boxed, read-only access scoped to the frameworks under assessment, plus the assessor actions they need (evidence requests, findings). For formal audits where you want to share a point-in-time snapshot without granting live system access, use Reports → Evidence Package → Export to generate a downloadable audit evidence package that does not require a CMDash account to review.

Billing & Plans

How do I upgrade my plan?

Navigate to Settings → Billing → Change Plan and select the plan you want to upgrade to. Upgrades take effect immediately; you are billed a prorated amount for the remainder of the current billing period. If you need a custom quote for Enterprise, click Contact Sales on the billing page or email sales@cmdash.com.

What happens if I exceed my seat limit?

If you attempt to invite a user that would exceed your plan's seat limit, CMDash will prompt you to upgrade your plan before the invitation can be sent. Existing users are never locked out due to a seat limit change. If your seat count drops (e.g., after deactivating a user), you do not need to take any action — the seat becomes available immediately for a new invitation.

Can I downgrade my plan?

Yes, you can downgrade at the end of your current billing period. Navigate to Settings → Billing → Change Plan and select the lower tier. Note that downgrading may result in loss of access to features exclusive to your current plan (e.g., custom roles, white-labeling, SCIM). CMDash will display a warning listing which features will be unavailable on the lower tier before you confirm the downgrade.

Do you offer annual pricing?

Yes. Annual billing is available for all plans and includes a discount equivalent to two months free (approximately 17% savings) compared to monthly billing. Contact sales@cmdash.com or navigate to Settings → Billing → Switch to Annual to convert your plan. Annual plans are billed upfront for the full year.

What is your refund policy?

Monthly plans: no refunds are issued for partial months. If you cancel, access continues until the end of the current billing period. Annual plans: a prorated refund is available within the first 30 days if you cancel; after 30 days, no refund is issued for the remaining term. All refund requests should be submitted to support@cmdash.com with your account email and reason for cancellation.

I'm a fractional CISO managing multiple clients — what plan do I need?

Fractional CISOs (vCISOs) should consider the Command or Enterprise plan, which includes the multi-client (multi-tenant) vCISO console. The vCISO console provides a single login with a client-switcher, a consolidated multi-client posture overview, and the ability to generate white-labeled board reports for each client. Each client organization must have their own CMDash subscription; the vCISO console aggregates across them without requiring separate logins for each. Contact sales@cmdash.com for vCISO partner pricing.

Reports & Exports

How do I generate a board report?

Navigate to Reports → Board Report → Generate. CMDash assembles a board-ready PDF and PowerPoint deck containing your current Posture Score, score trend, top risks, compliance framework status, and an AI-generated executive narrative. The report generates in approximately 30–90 seconds depending on your data volume. Once generated, you can download the PDF or .pptx, or share a read-only link directly.

Can I customize the board deck with my company logo?

Logo customization is available on Command and Enterprise plans. Navigate to Settings → Branding → Upload Logo to add your company logo and color scheme. The logo and colors will be applied to all generated board decks and PDF exports. Enterprise customers can also white-label reports under a custom domain with no CMDash branding.

How do I schedule a weekly report to be emailed automatically?

Navigate to Reports → Scheduled Reports → Create Schedule. Set the frequency (daily, weekly, monthly), the day and time, and the recipient email addresses. Scheduled reports use the same format as a manually generated board report. Recipients do not need a CMDash account to receive or view scheduled report emails. You can manage, pause, or delete scheduled reports at any time from Reports → Scheduled Reports.

What format is the POA&M export? Can I import it into another tool?

The POA&M (Plan of Action and Milestones) export comes in two shapes, both from Compliance → [framework] → Download POA&M:

• XLSX — a real Excel workbook whose columns are in the order of the FedRAMP POA&M Template ("Open POA&M Items" worksheet), the DoD/GSA-lineage template CMMC and FedRAMP programmes both work from.
• CSV — CMDash's own column set, which is what the in-app download has always produced.

Two honest caveats about the XLSX. First, CMDash does not model every column the template defines (asset inventory, vendor-dependency tracking, deviation requests) and those cells are left blank rather than filled with a plausible-looking value — an invented entry in a federal POA&M is worse than a blank you can see and complete. Second, CMDash has not verified ingestion by any particular release of CSAM, Xacta or eMASS, so expect to confirm the column mapping on your first import rather than assuming it is a drop-in.

Security & Privacy

Where is my data stored?

CMDash stores customer data in AWS us-east-1 (North Virginia). There is no EU region yet: choosing EU at sign-up records a preference but does not move data. The third parties that process customer data are listed at /trust/subprocessors.

Is CMDash SOC 2 certified?

No. CMDash does not hold a SOC 2 report, and no auditor has been engaged yet. Our readiness self-assessment is at /trust/soc2. Questions: security@cmdash.com.

Does CMDash use my data to train AI models?

No. CMDash does not use customer data — including security posture data, risk register entries or compliance evidence — to train or fine-tune any AI model. See the CMDash Privacy Policy for full details.

How does CMDash ensure my data is isolated from other customers?

CMDash uses logical multi-tenancy with strict tenant ID scoping on every database query and API call. Customer data is never commingled — each API request is validated against the authenticated tenant context before any data is returned or written. No penetration test has been completed yet; the planned scope is at /trust/pentest. Enterprise customers can self-host CMDash on their own servers.

What happens to my data if I cancel?

Upon cancellation, your account is immediately suspended (no new logins or data writes). Your data is retained in an archived state for 30 days, during which you can reactivate your account or request a full data export. After 30 days, all data is permanently deleted from CMDash systems, including backups, within a 90-day purge cycle. To request an expedited data deletion, contact privacy@cmdash.com.