For Cyber insurers & underwriters
The controls you ask about, measured rather than stated.
“The application says MFA is on everywhere. Nothing on it shows me that.”
Tuesday morning: A renewal application with a page of yes/no answers, a broker who needs it back by Friday, and no way to tell which answers were measured and which were typed.
They search for:
cyber insurance application evidenceverify MFA for cyber insurancecyber insurance security controls attestationcyber insurance underwriting evidence
How CMDash answers it
A grade computed from the tools the insured already runs
The insured’s posture grade is computed from signals such as MFA coverage, time to patch and open critical and high vulnerabilities, read from its connected tools and recomputed as they change, not typed into a form.
A dated record behind each answer
Evidence the insured uploads keeps an append-only history: who uploaded it, when, and a hash of the file. A control the application says is in place has a record with a date on it.
A snapshot the insured can send you, and a receipt you can check
The insured can share a frozen snapshot of its posture summary through a link that expires, and issue a signed receipt for a measured control that you can verify without contacting CMDash.
Watch: the CMDash product walkthrough
- 0:00CMDash, in ninety seconds and no sound. Everything you are about to see is a demo organization with sample data.
- 0:10Stop opening six tools every morning. Posture, compliance progress and open risk on one screen.
- 0:19Every evidence item is tied to a control, a framework and the source that produced it — manual, automated or integration.
- 0:29One evidence engine, every framework you report on, tracked side by side: done, in progress, not started.
- 0:38The posture grade is computed from several weighted signals, and the breakdown shows every one of them.
- 0:47A risk register scored by likelihood and impact, with the heat map that falls out of it.
- 0:57Each risk becomes a remediation task with a priority, a due date and an SLA — and a push to Jira.
- 1:06The board deck is assembled from that same live data — nine slides, generated rather than rebuilt by hand.
- 1:15Maturity is a trajectory, not a snapshot: the posture score and the risk count, tracked day by day.
- 1:22Pricing is public and the trial is self-serve. Everything shown was sample data in a demo organization.
Frameworks an insured can report against
CIS Controls v8.1
The prioritized safeguard set, useful as a starting program when a formal certification is not the goal.
NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
Where the evidence comes from
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
Microsoft Azure
Reads your Azure subscription configuration directly — storage account public access and secure transfer, managed-disk encryption, and activity-log export. Needs a Reader role assignment; no Defender for Cloud plan required.
What the insured can hand you
For a control CMDash measures, the insured can issue a signed receipt: a cryptographically signed statement of what was counted (the numerator, the denominator and what could not be read), verifiable without contacting CMDash.
When someone at the insured has to put a name on a statement, the Signer’s File assembles it from signed receipts. Every contradiction in the insured’s records routes to fix, disclose or narrow before the owner signs; “acknowledge and sign” is never offered.
The verifier that checks a receipt, its specifications and its test vectors are published as an open-source repository.
The insured can also send you a frozen snapshot of its posture summary through a public link that expires (14 days by default, 90 at most), with an optional passcode.
What is measured, and from where
The insured’s posture grade, A to F, is computed from up to seven weighted signals: time to patch, MFA coverage, open critical and high vulnerabilities, incident frequency, policy compliance, SaaS sprawl and DLP events. It is recomputed every 4 hours for an organization with a connected tool, and on demand. Posture scoring is included on every paid plan.
From Starter, daily e-mail and DNS security checks run for one domain the insured has proven it owns (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, CAA and dangling-CNAME takeover), graded A to F and tracked over time, with an alert when a check gets worse.
Evidence the insured uploads by hand keeps an append-only history (the uploader, the time and the file’s SHA-256) and goes through an evidence review workflow.
Cyber-insurance core controls
The controls a cyber-insurance underwriter asks about most: multi-factor authentication, endpoint-detection coverage, backups and e-mail authentication. Each line says whether it is measured or only stated by the supplier.
| Line | Basis | How it is established |
|---|---|---|
| Multi-factor authentication | Measured | Enrolment counted over identities reconciled from the supplier’s connected identity providers; an identity whose state is unknown is not counted as enrolled. |
| Endpoint-detection coverage | Measured | Hosts running an endpoint-detection agent, counted over the supplier’s connected integrations; an unknown host is not counted as covered. |
| Backups | Measured | Read from the supplier’s connected AWS accounts through AWS Backup: an account counts only when a backup plan that selects resources exists and every resource enrolled in AWS Backup has a recovery point from the last seven days. No plan, an empty plan, a stale backup, or a read that failed is not counted as met. Data outside connected AWS accounts is not measured; resources not enrolled in AWS Backup are not counted. Where no AWS account is connected, nothing is measured and no backup claim is issued. |
| E-mail authentication (SPF, DKIM, DMARC) | Measured | Read from public DNS for each domain the supplier has verified: a domain counts only when SPF, DMARC at quarantine or reject, and a strong DKIM key were all observed. A missing or weak DMARC policy, or a record that could not be read, is not counted as met. |
Where CMDash stops
CMDash is not an insurer, a broker or an underwriting tool. It does not rate risk, price coverage or change a premium. What the insured shows you, and what you make of it, stays between you and the insured.
Deploy where your obligations say
CMDash Cloud is where most teams start. If your data has to stay inside a boundary you control, the same product can run on your own servers or in your own AWS account, in early access on the Enterprise plan. These are deployment choices, not compliance claims: CMDash does not certify your environment.
- EU data residency (GDPR) Run CMDash in your own EU cloud account or on your own servers, so the database, uploaded files and backups stay where you put them.
- CUI, ITAR and GovCloud Keep the data inside your own boundary, including AWS GovCloud (US) from a CloudFormation template, so controlled information is not hosted by CMDash.
- SOC 2 and customer audits Your controls and your logs: you operate the environment, so the access, backup and change evidence an auditor asks for is yours to produce.
Start on CMDash Cloud to test it on real work, then move with export and import: the organization owner exports a full archive and imports it into the new installation. How export and import work and the deployment options.