For CIOs & IT leaders
Run the security program, not just the audit.
“Security landed on my desk, and I don’t know where to begin.”
Tuesday morning: A CMMC deadline, a customer’s security questionnaire and a cyber insurance renewal, each asking a different question, and no single program that answers all three.
They search for:
security program management softwarecyber maturity assessmentCMMC and ISO 27001 compliance softwareIT security roadmap
How CMDash answers it
A program you can see, not a project list
Charter, security objectives, committees and management reviews in one module, with named owners and segregation-of-duties conflicts flagged — the structure the program runs on, before the next framework arrives.
A maturity score that moves
Computed from live control state and the tools you already run, not entered by hand, so the trend line answers the one question that matters: is the program improving?
One control record, every framework
Start with CMMC. Add ISO 27001 or SOC 2 when the business needs it: the controls you already have carry across, so the next framework starts from what is done, not from a blank spreadsheet.
Watch: the CMDash product walkthrough
- 0:00CMDash, in ninety seconds and no sound. Everything you are about to see is a seeded demo workspace.
- 0:13Stop opening six tools every morning. Posture, compliance progress and open risk on one screen.
- 0:22Every evidence item is tied to a control, a framework and the source that produced it — manual, automated or integration.
- 0:32One evidence engine, every framework you report on, tracked side by side: done, in progress, not started.
- 0:42The posture grade is computed from several weighted signals, and the breakdown shows every one of them.
- 0:51A risk register scored by likelihood and impact, with the heat map that falls out of it.
- 1:00Each risk becomes a remediation task with a priority, a due date and an SLA — and a push to Jira.
- 1:08The board deck is assembled from that same live data — nine slides, generated rather than rebuilt by hand.
- 1:17Maturity is a trajectory, not a snapshot: the posture score and the risk count, tracked day by day.
- 1:23Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
Frameworks a program grows into
CMMC Level 2
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
Where the evidence comes from
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
ServiceNow
Security incidents flow in from ServiceNow, and cmdash pushes remediation tasks back as records so the work is tracked where your team already tracks it.