For MSPs & vCISOs
One view across every client, not twelve.
“I run twelve clients and I bill for the report.”
Tuesday morning: Twelve tenants, twelve spreadsheets, and no way to compare them.
They search for:
multi-tenant GRC platformvCISO platformMSP compliance tooling
How CMDash answers it
Every client on one screen
Average posture across the portfolio, and the one client that slipped this week — without opening eight tabs to find it. Open any client from the same row.
Every client, the same daily view
One login, one dashboard shape per client workspace — so moving from client 3 to client 9 does not mean relearning where anything lives.
Run the programme the same way for every client
Charter, objectives, committees and management reviews, per client, on the same module — not a bespoke process you rebuild for each engagement.
The report you bill for, white-labelled
A board pack built from live data, exported under the client’s own branding — the deliverable, not the busywork before it.
Watch: the cross-client roll-up
- 0:00Running every client from one screen, in a silent minute. Everything shown is a seeded demo MSP practice.
- 0:09Every client's posture on one roll-up — without opening eight tabs to find the one that needs you.
- 0:19Open any client and land on the same daily view — moving from client 3 to client 9 means relearning nothing.
- 0:29The same programme model for every client: charter, objectives, committees — not a bespoke process per engagement.
- 0:38The evidence behind every client's controls, in the same place, traced the same way, client after client.
- 0:48The report you bill for, exported under the client's own branding — the deliverable, not the busywork before it.
- 0:54Pricing is public and a walkthrough is one click away. Everything shown was sample data in a demo MSP practice.
Frameworks your clients ask for
NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
CMMC Level 2
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
Where the evidence comes from
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
Microsoft Sentinel
Incidents from Microsoft Sentinel, plus analytics-rule coverage showing which ATT&CK techniques you can actually detect.
For CMMC RPOs, vCISO practices and MSSPs
Whether you are a CMMC Registered Provider Organization (RPO), a fractional-CISO practice or an MSSP, each client is a managed workspace under your login. The vCISO roll-up carries a Proof column: per client, whether that client’s proof receipts are Fresh, Stale, have No receipts, or are Unavailable. The state is read from the receipts themselves, so you see which client’s proof has lapsed before the client’s customer or insurer does. A client can send proof under your firm’s name, with no CMDash mark.
What CMDash costs you, at your practice’s size
Managed workspaces require a Command or Enterprise plan. The cost is the plan fee plus the workspaces above that plan’s included allotment, at CMDash’s published band rates. White-label branding is included on Command and Enterprise.
By arrangement — contact us to start: $179 per active managed client per month, billed monthly, from your first client, with no platform fee and no minimum. You are billed per client, never more than Command; at 10+ clients we move you to Command. White-label branding and the Proof column are included. From 10 clients the per-client column shows Command’s price, which is what you pay after the move.
| Managed clients | Command / mo | Per-client plan / mo | Per client on per-client plan / mo |
|---|---|---|---|
| 1 | $1,499 | $179 | $179 |
| 3 | $1,499 | $537 | $179 |
| 5 | $1,499 | $895 | $179 |
| 9 | $1,695 | $1,611 | $179 |
| 10 | $1,744 | $1,744 | $174 |
| 12 | $1,822 | $1,822 | $152 |
| 20 | $2,134 | $2,134 | $107 |
| 50 | $3,054 | $3,054 | $61 |
Required to have any managed workspace at all — includes 5 free. Plan fee $1,499/mo billed annually.
1–5,000 clients — the first 5 are included free on Command
Illustrative: opens at $400 — edit to match your own pricing
CMDash cost
$1,822/mo
$1,499 Command plan fee + $323 for 7 workspaces above the 5 included; your 12th is priced at $39/mo.
Your revenue
$4,800/mo
12 clients at $400/mo each.
Your margin
$2,978/mo (62%)
After the plan fee, at ~$152/mo all-in CMDash cost per client.
On Command, CMDash cost is the plan fee plus each managed workspace above your allotment at its own band’s rate — a bigger practice’s LAST client is never priced at the same rate as its first. These are the published rates. What you charge your own clients is entirely up to you; see the full schedule and worked examples in the MSP partner price sheet (PDF).