You are a prime, an insurer or a customer’s TPRM team, and you ask suppliers for evidence. Send a request from a template, the supplier answers with signed proof receipts of its own choosing, and each line says whether it was measured, self-assessed or only self-attested. Checking a receipt needs no CMDash account and no install.
Every line of every request shows its basis next to it, so a statement a person typed is never read as a measurement.
| Label | What it means |
|---|---|
| Measured | CMDash counted it from the supplier’s connected systems or from public DNS. Anything it could not read is never counted as met. |
| Self-assessed | A figure computed from the supplier’s own assessment of itself, such as an SPRS score. It is a self-assessment, signed as one. |
| Self-attested | A status a person at the supplier recorded. Nothing was measured; the receipt shows what was stated and when. |
| It proves | It does not prove |
|---|---|
| The supplier’s key signed exactly this statement. | That the source system told the truth. |
| The statement has not been altered since it was signed. | That a control is effective, or that the supplier is compliant. |
| The receipt was entered in the transparency log, and when it stops being fresh. | Anything about a system the supplier did not connect or state. |
| The basis of each line: measured, self-assessed or self-attested. | That a stale receipt is a failure: stale means a newer one has not arrived. |
An unknown is never counted as met. Where a reading could not be taken, the receipt says so instead of rounding it into a pass.
/verify checks a receipt’s signature, its transparency-log entry and its freshness window in your own browser. The receipt is never uploaded, and the page never asks CMDash whether a receipt is valid, so a verdict does not depend on trusting CMDash. It needs no account and costs nothing.
A template is a named list of claims. The supplier may grant a subset when it accepts, never a claim outside the template.
The supplier’s SPRS Basic Assessment score, the status of each five-point NIST SP 800-171 practice, and its POA&M summary. The SPRS score and the practice statuses are the supplier’s own assessment, not an independent measurement.
| Line | Basis | How it is established |
|---|---|---|
| SPRS score | Self-assessed | Computed from the supplier’s own practice assessments; it is a self-assessment. |
| Five-point practices (44) | Self-attested | The status a member of the supplier last recorded for each practice. Self-attested; nothing was measured. |
| POA&M summary | Self-assessed | Open and closed items counted from the supplier’s own plan of action; a self-assessment. |
The controls a cyber-insurance underwriter asks about most: multi-factor authentication, endpoint-detection coverage, backups and e-mail authentication. Each line says whether it is measured or only stated by the supplier.
| Line | Basis | How it is established |
|---|---|---|
| Multi-factor authentication | Measured | Enrolment counted over identities reconciled from the supplier’s connected identity providers; an identity whose state is unknown is not counted as enrolled. |
| Endpoint-detection coverage | Measured | Hosts running an endpoint-detection agent, counted over the supplier’s connected integrations; an unknown host is not counted as covered. |
| Backups Coming soon | Measured | Read from the supplier’s connected AWS accounts through AWS Backup: an account counts only when a backup plan that selects resources exists and every resource enrolled in AWS Backup has a recovery point from the last seven days. No plan, an empty plan, a stale backup, or a read that failed is not counted as met. Data outside connected AWS accounts is not measured; resources not enrolled in AWS Backup are not counted. Where no AWS account is connected, nothing is measured and no backup claim is issued. |
| E-mail authentication (SPF, DKIM, DMARC) Coming soon | Measured | Read from public DNS for each domain the supplier has verified: a domain counts only when SPF, DMARC at quarantine or reject, and a strong DKIM key were all observed. A missing or weak DMARC policy, or a record that could not be read, is not counted as met. |
There is also a full CMMC Level 2 template that asks for every Level 2 claim CMDash issues: SPRS score, five-point practices, MFA enrolment, malicious-code protection, POA&M summary and evidence freshness, each with the basis shown above.
| Limit | Value |
|---|---|
| Requests | 50 per day |
| Invitation e-mails (first sends and re-sends) | 100 per day |
| Re-sends of one request | 3 per day |
| Invitation link life | 14 days |
| Grant life | Up to 365 days |
| Portfolio CSV export | Up to 500 suppliers |
Nothing beyond a workspace. The Relying-Party Desk and Supplier Assurance are part of the proof receipts entitlement, which every plan holds, Free included, and the verifier needs no account. See pricing for the plans themselves.
No. The desk is available on every plan including Free, so a supplier answers from a free workspace. The supplier opens the link in your request e-mail, signs in or creates its workspace, proves it owns the e-mail domain the request was sent to, and accepts. The link lives 14 days.
Asking, reading what suppliers share and verifying receipts need no paid plan: the Relying-Party Desk and Supplier Assurance are part of the proof receipts entitlement, which every plan holds, Free included. The verifier needs no account at all.
No. You read signed receipts for the claims the supplier granted: the statement, the numbers the receipt signs, the dates and the basis. Evidence, evidence salts and everything else in the supplier’s workspace stay with the supplier.
No. A valid receipt proves who signed a statement, that it has not changed since, and that it was logged. It does not prove the source system told the truth, that a control is effective, or that the supplier is compliant. The basis label tells you how much weight each line can bear.
Reads stop at the next request. A supplier can withdraw a grant at any time, and a grant ends on its own after at most a year. Receipts already delivered stay verifiable because they are signed documents. You get an alert when a supplier revokes.
It feeds one. The portfolio exports as a CSV with labels, ids and dates only, up to 500 suppliers.
Sign up for Free with no card, pick a template and send it to a supplier.