For Private equity, VC & investors
One security standard across the portfolio, measured the same way.
“Every company in the portfolio reports security differently, if it reports at all.”
Tuesday morning: A quarterly portfolio review, a lender’s or insurer’s security questions about one company, and a target in diligence, each answered from a different spreadsheet.
They search for:
portfolio company cybersecurityprivate equity cybersecurity due diligenceportfolio cyber risk managementcybersecurity standard for portfolio companies
How CMDash answers it
Every portfolio company on one screen
Each company runs in its own workspace under your account, reached from one login. The roll-up shows each company’s posture grade and score, its open risks, whether its signed receipts are fresh and whether it has drifted from your template, with the portfolio average above them. Open any company from the same row.
A maturity score every company earns the same way
Computed from each company’s live control state and the tools it already runs, not typed into a survey. The group maturity rollup reads each company’s own score and recomputes nothing, so the number you compare is the number the company sees.
The board pack, from live data
A board pack PDF built from the company’s own records (posture headline, top open risks and loss exposure), for its board and for yours, without a week of slide-building first.
Watch: the CMDash product walkthrough
- 0:00CMDash, in ninety seconds and no sound. Everything you are about to see is a seeded demo workspace.
- 0:13Stop opening six tools every morning. Posture, compliance progress and open risk on one screen.
- 0:22Every evidence item is tied to a control, a framework and the source that produced it — manual, automated or integration.
- 0:32One evidence engine, every framework you report on, tracked side by side: done, in progress, not started.
- 0:42The posture grade is computed from several weighted signals, and the breakdown shows every one of them.
- 0:51A risk register scored by likelihood and impact, with the heat map that falls out of it.
- 1:00Each risk becomes a remediation task with a priority, a due date and an SLA — and a push to Jira.
- 1:08The board deck is assembled from that same live data — nine slides, generated rather than rebuilt by hand.
- 1:17Maturity is a trajectory, not a snapshot: the posture score and the risk count, tracked day by day.
- 1:23Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
Frameworks a portfolio standard can start from
NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
CMMC Level 2
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
Where the evidence comes from
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
Microsoft Azure
Reads your Azure subscription configuration directly — storage account public access and secure transfer, managed-disk encryption, and activity-log export. Needs a Reader role assignment; no Defender for Cloud plan required.
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
One standard, set once
Write the standard down once as a workspace template: the frameworks in scope, the connectors to set up and the policies to start from. Apply it to one company or to every company at once, re-apply it when the standard changes, and the roll-up’s Template drift column shows which companies have fallen behind it. An analyst can be assigned to some companies and see only those. On Command and above.
Diligence on a target, before it is yours
Link a prospective acquisition as its own target workspace and evaluate its security posture and maturity there. A target is kept out of the portfolio rollup. Only an owner or admin of your account can enter it, each engagement is time-boxed and can be ended early, and every entry and exit is written to the target’s own audit trail. On Command and above.
After close, the company’s onboarding proposes a starter policy set from the templates and ends on a 90-day program plan in three phases, computed from what the company already has and re-derived as the work gets done.
Proof a lender, insurer or buyer can check
A portfolio company can share a frozen snapshot of its board pack or posture summary through a public link that expires, with an optional passcode.
Its Board Pack is a PDF built from live data: the posture headline, the top open risks and the loss exposure. On Essentials and above.
For a claim it measures, it can issue a signed receipt: a cryptographically signed statement that is verifiable without contacting CMDash.
Capital spent on the program, not on starting over
One control record carries across 22 frameworks, so a program that starts with CMMC grows into ISO 27001 or SOC 2 without starting over.
Each portfolio company is one workspace under your account: your plan includes a number of them, and each one beyond that is priced per workspace. See pricing and the per-workspace price sheet.
On the roadmap for funds
These are on the roadmap, not in the product today. Beside each one is what CMDash does now.
A fund-level portfolio view is on the roadmap: an operating partner whose firm is not the parent account of each company would hold every company to one standard in one place, and a company would join by its own owner accepting an invitation for its existing CMDash workspace, revocable at any time, with every attach and revoke audited.
Today, the group rollup covers the client workspaces your own account runs.
A read-only investor seat is on the roadmap, for a limited partner or board observer who would see only the companies that consented to it and nothing else.
Today, an analyst can be granted specific client workspaces and sees only those.
Portfolio benchmarks are on the roadmap: each company compared with its peers in the same portfolio, and the trend over time, to show where the investment is protected and where it is drifting.
Today, every workspace keeps its own history of maturity snapshots, and the group rollup shows where each company stands now.
Fund pricing is on the roadmap: one price for a whole portfolio rather than company by company. Talk to us.
Today, each company is one workspace, and each one beyond those your plan includes is priced per workspace.