For GRC leads & compliance managers
One evidence engine between your tools and your frameworks
“The evidence request goes out again next week.”
Tuesday morning: Chasing screenshots for controls they collected screenshots for last quarter.
They search for:
SOC 2 compliance automationevidence collectioncontrol mapping crosswalkPOA&M tracking
How CMDash answers it
Live control status, not a quarterly snapshot
Every framework you report on, with control status that moves when your tools do — not a spreadsheet somebody updates before the audit.
Evidence traced back to where it came from
Click any evidence item and see the integration that produced it. When an assessor asks 'how do you know', the answer is already attached.
One connection, mapped everywhere it applies
Connect a tool once. The crosswalk keeps the mapping visible rather than magic, so one control satisfying four frameworks is something you can inspect, not just trust.
Watch: the CMDash product walkthrough
- 0:00CMDash, in ninety seconds and no sound. Everything you are about to see is a seeded demo workspace.
- 0:13Stop opening six tools every morning. Posture, compliance progress and open risk on one screen.
- 0:22Every evidence item is tied to a control, a framework and the source that produced it — manual, automated or integration.
- 0:32One evidence engine, every framework you report on, tracked side by side: done, in progress, not started.
- 0:42The posture grade is computed from several weighted signals, and the breakdown shows every one of them.
- 0:51A risk register scored by likelihood and impact, with the heat map that falls out of it.
- 1:00Each risk becomes a remediation task with a priority, a due date and an SLA — and a push to Jira.
- 1:08The board deck is assembled from that same live data — nine slides, generated rather than rebuilt by hand.
- 1:17Maturity is a trajectory, not a snapshot: the posture score and the risk count, tracked day by day.
- 1:23Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
Frameworks GRC teams track evidence against
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
HIPAA Security Rule
Administrative, physical and technical safeguards under 45 CFR 164, with verbatim public-domain text.
PCI DSS v4.0.1
The v4.0.1 requirements for organizations in scope for cardholder data.
Where the evidence comes from
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
AWS Security Hub
Findings and compliance-standard results from Security Hub, so AWS control state is evidence rather than a screenshot.
GitHub Advanced Security
Dependabot, code-scanning, and secret-scanning alerts across your repositories, as evidence for secure-development controls.
Jira
Two-way: security issues flow in, and cmdash can open a Jira issue for a remediation task so the work happens where your team already works.