Features
Everything the morning briefing needs
Posture scoring, framework compliance, risk quantification, evidence, board reporting, and 47 catalog integrations, delivered as a managed SaaS.
01Integrations47 connectors read what your tools already know
02EvidenceEach finding stored with its source, time and hash
03Control mappingsOne piece of evidence satisfies a control in every framework that shares it
04ComplianceLive control status across 20 frameworks
Remediation tasks pushed to your ticketing tool when you choose (Essentials+)
AI governance & AI security
Govern the AI your organization builds and buys, on the same evidence engine as the rest of your programme.
- ✓ISO/IEC 42001:2023 — the AI management system standard, tracked as real controls with owners, status, and evidence (Annex A)
- ✓NIST AI Risk Management Framework 1.0 — GOVERN, MAP, MEASURE and MANAGE, with verbatim public-domain subcategory text
- ✓Crosswalked to ISO 27001, so the ISMS evidence you already collect carries into your AI programme instead of being gathered twice
- ✓EU AI Act on the regulatory radar, with its obligation dates mapped to the ISO 42001 and NIST AI RMF controls that demonstrate readiness
- ✓CSA AI-CAIQ v1.1 as a vendor questionnaire — assess the AI your suppliers are shipping to you, across all 18 AICM domains
How CMDash secures its own AI
A GRC product that uses AI should be able to show its work. This is how the AI features are designed, and the self-assessments are published. Coming soon
- ✓Public OWASP LLM Top 10 (2025) self-assessment — answered honestly, including the items we do not satisfy
- ✓Public CSA AI-CAIQ v1.1 self-assessment across all 18 AICM domains
- ✓CMDash does not train, fine-tune, or self-host any model on your data
- ✓Every AI answer is grounded in your own records: cited control, evidence and policy IDs are re-validated against your data, and invented references are dropped before you see them
- ✓Organization-authored content reaching a model is delimited and escaped, and model output is schema-validated before it is used
- ✓Per-organization AI request rate limits, and a per-organization daily token budget that is unlimited unless one is set
- ✓Anthropic disclosed as a subprocessor, with a documented data-handling assessment
Security posture & scoring
A single live grade your whole organization can rally around.
- ✓Live A–F posture score, recomputed every 4 hours once a tool is connected, and on demand
- ✓Up to seven weighted signals: time to patch critical CVEs, MFA coverage, open critical and high vulnerabilities, 30-day incident frequency, policy compliance, SaaS sprawl and DLP events
- ✓30-day and 90-day trend charts, with the change since the previous snapshot
- ✓An industry reference baseline to compare against (Essentials+); comparison with real peers starts once enough organizations in your industry opt in
External exposure & reputation
How your organization looks from outside — checked continuously, not once a year.
- ✓Daily DNS and e-mail authentication checks (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC, CAA, dangling-CNAME takeover) on the domains you have proven you own, with an A-F grade tracked over time (Essentials+)
- ✓IP blocklist and reputation tracking for the addresses your domains publish plus any you declare, with a history of every listing and delisting guidance (Essentials+)
- ✓An explainable outside-in reputation score built only from your own DNS, TLS, IP and exposure findings, with every lost point traced to a named finding, shown beside your SecurityScorecard or Bitsight rating if you add your own key (Essentials+)
- ✓Lookalike-domain and certificate-transparency monitoring for the domains you have verified — detection only, no takedown filing
Compliance & framework tracking
20 frameworks, tracked control by control.
- ✓NIST CSF 5-function dashboard (Starter+)
- ✓CMMC Level 2 — all 110 practices across 14 domains, with practice-level evidence and an SPRS score
- ✓CMMC Level 3 — the 24 NIST SP 800-172 enhanced requirements selected in 32 CFR 170.14(c)(4), with the rule's text
- ✓NIST SP 800-171 Revision 3 — the 97 requirements in NIST's 03.xx.xx numbering with NIST's text, tracked beside CMMC Level 2 rather than replacing it
- ✓ISO 27001:2022, SOC 2 Type II, PCI DSS v4.0.1, HIPAA, CIS Controls v8.1, GDPR, DORA, HITRUST CSF v11, TISAX, SOX ITGC, NYDFS 23 NYCRR 500, and FedRAMP Moderate — the full NIST SP 800-53 Rev 5 Moderate baseline
- ✓Framework crosswalk — a control status change carries to overlapping controls in other frameworks; carrying evidence across is opt-in
- ✓Custom framework ingestion via CSV (Enterprise)
- ✓POA&M tracking on every plan, and POA&M export in CMMC/FedRAMP format (Starter+)
Risk & quantification
A risk register, and a dollar figure for each risk.
- ✓Risk register with likelihood, impact, score, owner, status, and remediation tracking (Starter+)
- ✓Bulk risk import via CSV (Starter+)
- ✓FAIR cyber risk quantification — LEF × LM → annualized loss expectancy in dollars (Starter+)
Evidence & audit support
Audit prep that happens as you go, not the week before.
- ✓Integration data collected on a schedule (every 4 hours by default) and turned into evidence by mapping rules you install or write
- ✓Optional rule packs and mapping suggestions for FedRAMP (NIST 800-53 Rev 5), ISO 27001 and SOC 2, which you accept or install
- ✓Custom control-to-integration evidence mappings
- ✓Manual evidence uploads with full history
- ✓Reviewer workflow with timestamps and notes
- ✓Evidence package export — a ZIP with a manifest and the evidence files (Enterprise)
- ✓Compliance calendar with audit dates
Reporting & board communication
Outputs your executives actually read.
- ✓Board-pack PDF from the report builder, with posture, top open risks and FAIR loss exposure (Essentials+)
- ✓Multi-slide board deck (PPTX) with configurable sections (Command+; needs a verified e-mail address)
- ✓Custom org logo and color scheme on all exports (Command+)
Integrations & data
47 integrations in the catalog, most connected with an API key or token you create in the vendor's console.
- ✓EDR: SentinelOne, Palo Alto Cortex XDR, VMware Carbon Black
- ✓Vulnerability: Tenable.io, Qualys, Rapid7 InsightVM, Wiz, Orca
- ✓SIEM: Splunk, Elastic Security, Google Chronicle
- ✓Cloud & identity: AWS, AWS Security Hub, Microsoft Azure (with your own app registration), Google Cloud, Okta, Cisco Duo, JumpCloud
- ✓E-mail, code & ticketing: Proofpoint TAP, GitHub, GitLab, Jira, ServiceNow
- ✓Microsoft Entra ID, Defender for Endpoint, Defender for Cloud, Sentinel, Intune and Purview, Google Workspace, CrowdStrike Falcon, Cisco Umbrella, Workday and Gusto Coming soon
- ✓Syncs every 4 hours by default, with rate limiting and an in-app alert if a sync stalls
- ✓Read-only API on every paid plan; write API and webhooks on Enterprise. Creating an API key needs a verified e-mail address
Audit & assessor collaboration
The part of an audit that usually happens over email and shared logins.
- ✓Tracked POA&M records — owner, committed date, milestones, closure evidence, and the full history of every change, not a report regenerated at export time
- ✓External assessor seats: read-only access scoped to the frameworks you name, expiring on a date you set, with every page they open recorded
- ✓Official CMMC/NIST 800-171 self-assessment package with affirmation and POA&M, in the format a C3PAO expects
- ✓Evidence packages exported as a ZIP with a manifest
- ✓Audit-readiness assessment that finds the gaps before an assessor does
Customer trust & questionnaire deflection
Answer the security questionnaire once, then stop answering it.
- ✓A public Trust Center page for your organization on cmdash.com — certifications, posture, subprocessors, and policy summaries you curate
- ✓Prospects submit security questionnaires directly to that page instead of emailing you a spreadsheet
- ✓Nothing reaches the requester until someone at your organization has reviewed and approved every answer
- ✓NDA-gated document room for the material you cannot publish openly
Third-party & supply-chain risk
Your vendors are part of your attack surface and part of your audit.
- ✓Vendor register with risk scoring, owners, and continuous monitoring (Enterprise)
- ✓SIG Lite, CSA CAIQ v4 and CSA AI-CAIQ questionnaire templates for vendors
- ✓SBOM ingestion (CycloneDX) with CISA KEV and EPSS enrichment
- ✓M&A due-diligence workspace with a time-boxed, automatically expiring engagement
Maturity, coverage & planning
Where the programme is now, and what to do next quarter.
- ✓Maturity model tracking against NIST CSF 2.0 tiers, CIS IG, C2M2 and CISA ZTMM
- ✓MITRE ATT&CK coverage heatmap, computed from your controls and your detection rules
- ✓Tested-vs-attested validation: breach-and-attack-simulation results distinguish controls that were tested from controls that were merely asserted
- ✓Regulatory radar tracking DORA, NIS2, SEC cyber disclosure, EU AI Act, CMMC and NYDFS 500, with dates and readiness mapping
- ✓Security budget planning and what-if scenario modelling
Identity, teams & enterprise
From a solo founder to a multi-subsidiary enterprise.
- ✓Role-based access (Admin / Viewer) and guided onboarding wizard
- ✓vCISO multi-client — manage multiple client workspaces from one login (Command+)
- ✓Multi-client roll-up (Command+) and white-label branding (Command+)
- ✓Multi-business-unit hierarchy with per-BU admins and executive roll-up (Enterprise)
- ✓SSO / SAML 2.0 (Okta, Azure AD, Google, Ping) (Starter+)
- ✓SCIM provisioning, and LDAP directory sync (Enterprise)
Compliance frameworks supported
AI Governance
ISO/IEC 42001:20232023
The first management-system standard for artificial intelligence. Track an AI management system the same way you track your ISMS — policies, roles, impact assessment, life cycle, data governance, and third-party AI.
Scope: Annex A controls. Clauses 4–10 are the management-system requirements and are not modeled as controls.
NIST AI Risk Management Framework 1.01.0
GOVERN, MAP, MEASURE and MANAGE, with the verbatim public-domain subcategory text. The voluntary framework US regulators and customers increasingly ask about, tracked as real controls with evidence.
Scope: The AI RMF Core. The Generative AI Profile (NIST AI 600-1) is not included.
Security Programs
NIST Cybersecurity Framework 2.02.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
NIST Cybersecurity Framework (1.1, legacy)1.1
Kept for programs still reporting against 1.1 during the move to 2.0.
Scope: Legacy. New programs should start on CSF 2.0.
ISO/IEC 27001:20222022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
Scope: Annex A controls. Clauses 4–10 are not modeled as controls.
CIS Controls v8.18.1
The prioritized safeguard set, useful as a starting programme when a formal certification is not the goal.
Scope: The 153 safeguard identifiers and their 18 groups are v8.1; the v8.1 security-function mapping and Implementation Group positioning ship as a separate maturity pack.
Government & Defense
CMMC Level 12.0
The 17 foundational safeguarding practices for Federal Contract Information, mapped to FAR 52.204-21, with an annual self-assessment tracker.
CMMC Level 22.0
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
NIST SP 800-171 Revision 3Rev 3
All 97 Revision 3 requirements for protecting CUI in nonfederal systems, in NIST's own 03.xx.xx numbering with the verbatim requirement text and the SP 800-171A evidence lists.
Scope: Revision 3 numbering, not the CMMC practice IDs: CMMC Level 2 is still defined by the Revision 2 requirements. The 33 requirements Revision 3 withdrew are not listed.
CMMC Level 32.0
The 24 NIST SP 800-172 enhanced requirements selected in 32 CFR 170.14(c)(4), with the rule's verbatim text, for programs that need them on top of Level 2.
FedRAMP ModerateRev 5
The full NIST SP 800-53 Rev 5 Moderate baseline across all 19 control families, with the verbatim public-domain control text.
Audit & Attestation
SOC 2 Type II2017
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
HITRUST CSF v11v11.2
The v11 control set for organizations whose customers require HITRUST.
Scope: r2 baseline, Implementation Levels 1 and 2.
TISAX (VDA ISA v6)v6
The VDA ISA catalog required across the automotive supply chain.
Scope: Information Security catalog. Prototype Protection and Data Protection are not included.
SOX ITGCCOSO 2013 / PCAOB AS 2201
IT general controls — access, change management, and operations — for the technology half of a SOX programme.
Privacy & Sector Regulation
GDPR2016/679
The security and accountability articles, with verbatim public-domain text.
HIPAA Security Rule2013
Administrative, physical and technical safeguards under 45 CFR 164, with verbatim public-domain text.
Scope: § 164.308, § 164.310 and § 164.312 only. § 164.314 (organizational requirements) and § 164.316 (policies, procedures and documentation) are not seeded.
PCI DSS v4.0.14.0.1
The v4.0.1 requirements for organizations in scope for cardholder data.
Scope: ROC line-item level rather than the full sub-requirement tree.
DORA2022/2554
The EU digital operational resilience requirements for financial entities and their ICT providers, with verbatim public-domain text.
NYDFS Cybersecurity Regulation23 NYCRR 500 (2023 Second Amendment)
23 NYCRR 500 as amended in 2023, for entities regulated by the New York Department of Financial Services.
Every framework above is available on every paid tier. Tiers cap how many you run at once — Starter three, Essentials five, Command and Enterprise unlimited — not which ones you may choose.
7 of these frameworks are sold per copy by their publishers. CMDash does not redistribute their control text — you get the full control structure, evidence mapping, and scoring, with a link to buy the official document. If your organization is already licensed, you can import your own copy of the text with the Enterprise custom-framework import.
It runs the programme, not just the audit
- 01CharterMandate, scope and accountable roles
- 02ObjectivesMeasurable targets for the year
- 03CommitteesTerms of reference and cadence
- 04Management reviewsISO 27001 cl. 9.3, on the record
- 05TrainingCampaigns tied to the objectives
What makes CMDash different
It runs the programme, not just the audit
Programme charter, security objectives, committee terms of reference, ISO clause 9.3 management reviews, and role accountability with segregation-of-duties conflict detection — the Program module, live and ungated today.
The maturity number is computed, not entered
The posture score's signals and their weights are documented and inspectable, and the maturity trajectory moves when the programme moves — not a number a person typed into a form.
Check it yourself
No quotes to trust. Everything below is checkable.
CMDash has no paying customers yet, so there is no quote to put here. Every number below comes from the same code the product runs on, and every link goes to a real, live page — not a screenshot.
20frameworksEvery one seeded as real controls, not a logo on a slide.1,812seeded controlsCounted from the same seed files the product runs on, not a rounded claim.47integrationsAdapters that exist on disk today — see what each one actually reads.814crosswalk mappingsControl-to-control mappings so one piece of evidence satisfies several frameworks.
Go look for yourself
Every one of these is a real page you can read right now, on this domain — no form, no NDA, no sales call first.
Live status pageCurrent component health and incident history — not asserted, fetched.Trust CenterIndex of every section below.Security overviewIdentity, encryption, tenant isolation, the HTTP header set, and RLS enforcement.SOC 2 Type II statusNo SOC 2 report and no auditor engaged yet: a readiness self-assessment, not a badge.Penetration testingThe planned scope. No penetration test has been completed or contracted yet.Responsible disclosureScope, safe harbour, and the reporting channel.Data portabilityThe export-then-reimport round trip, described — not just promised.SubprocessorsEvery third party that processes customer data, dated.Data Processing AddendumDraft GDPR Article 28 terms; no clause is binding until it is reviewed and signed.QuestionnairesPre-filled SIG Lite, CAIQ, AI-CAIQ and OWASP LLM Top 10 answers, downloadable; treat an answer as a starting point.Customer trust directoryEvery customer trust center that has opted in to being listed.
No customers yet — by design
Become a design partner — not a quote on a page
We are taking on a small number of design partners: early access, direct input into the roadmap, and a discounted rate in exchange for real feedback sessions. Pre-revenue, on demo data, roadmap-driven — told to you straight on the programme page.