Skip to main content
CMDashCybersecurity Maturity Dashboard
DocsMigrate from another GRC tool

Migrate from another GRC tool

What it is

The Migration page (/migration) reads a CSV export from Drata, Vanta, Secureframe or CISO Assistant and maps it onto CMDash's own framework catalogs, policy templates, risk register and vendor register. It always runs as a preview first: a real dry run that performs every lookup a real import performs — including resolving each match to a row that actually exists in your workspace — and reports what it would do, mapped / low-confidence / unmapped, before anything is written. Nothing is written until you explicitly choose Apply.

This is the same importer CMDash's public switching comparison pages describe for each of the four tools; the Migration page is where you actually run it, in the app, with your own sign-in — no API token or separate tool required.

When to use it

Use it once, when you are moving your compliance program into CMDash from one of the four supported tools and want a head start rather than re-entering everything by hand. It is not a sync: running it again later only adds rows you have not already imported, so it is safe to re-run while you clean up a column name or add a file you did not have the first time, but it is not a substitute for keeping two tools in step.

If you want an ongoing, live connection to CISO Assistant instead of a one-time migration, connect it under Integrations — see Integrations.

Before you start

You need:

  • Owner or Admin on this CMDash workspace.
  • The framework(s) you are migrating already enabled here. A row that cites a framework CMDash has not seeded is reported as unmatched, by name, rather than silently skipped — enable the framework first, then re-run.
  • The export file(s) from your current tool — CSV, one per file type you want to bring over. Every file type is optional and independent, so send only the ones you have.

The Migration page lists exactly which export screens each of the four tools produces this from, and names each vendor's own name for that export, once you pick a tool on step 1.

How to

  1. Open Migrate from GRC tool (Admin section) and pick the tool you are moving from.
  2. For each file type your tool exports — Controls, Policies, Evidence, Risks, Third parties (vendors) — either upload the CSV or paste its text. Skip any you do not have.
  3. Optionally name the framework the export came from — this helps rows that cite only a bare requirement code (rather than the full framework name) resolve correctly. One import normally covers one framework.
  4. Click Preview. Nothing is written yet: the report shows, per file, how many rows parsed, how many mapped, how many were low-confidence (a title-similarity guess CMDash will never write on your behalf), and how many were unmapped, with the first few unmapped names so you can see what did not resolve.
  5. When the preview looks right, click Apply to write the mapped rows for real. The result names how many records were created per area, with a link to each one so you can review them immediately.

If a small number of rows fail to write, everything else still lands — re-running the same files retries only the ones that failed.

Common questions

Why does the importer only recognise some frameworks? It maps onto whatever CMDash's own catalog ships. A framework your tool supports that CMDash does not is reported as an unresolved framework, by name, rather than silently dropped.

My export uses a column name this guide does not expect — what happens? Nothing is guessed. The preview report names what it could not find a match for, so you can either rename the column in your export or ask CMDash support to have the accepted spellings extended.

Does this import the policy text, evidence files, or approval history from my old tool? No. Policies are created from CMDash's own starter templates (a policy is a document people attest to, and importing text CMDash cannot vouch for into an attestation flow would be a liability, not a migration); evidence imports as an index filed for review, not the underlying files; and attestation/approval/review history from the old tool does not carry over. Each file type's preview names exactly what does and does not come across.

Is this the only way to bring CISO Assistant data in? No — CISO Assistant can also be connected under Integrations for an ongoing, live sync. Use this page for a one-time move; use the integration for a connection you keep.

This page is the product manual, published from the repository at docs/user/migrate-from-another-grc-tool.md. Customers read the same text inside CMDash under Help. Last updated September 15, 2026.

Migrate from another GRC tool — CMDash Docs