Every paid plan includes posture scoring. Starter, Essentials and Command each start with a 30-day free trial through the same checkout you buy with — see each card for what that means. Prefer no card at all? CMDash is free forever for a small team on one framework.
Command highlighted for comparison; every value is labeled — bar length is a visual aid, not the only way to read a figure.
30-day free trial. A card is required to start it; the trial converts to Starter at the price shown unless you cancel before day 30. Cancel and your workspace drops to Free — never locked.
For small security teams getting started with maturity measurement.
30-day free trial. A card is required to start it; the trial converts to Essentials at the price shown unless you cancel before day 30. Cancel and your workspace drops to Free — never locked.
For growing teams that need board-ready reporting and more integrations.
30-day free trial. A card is required to start it; the trial converts to Command at the price shown unless you cancel before day 30. Cancel and your workspace drops to Free — never locked.
Advanced program management with priority support.
Volume licensing, purchase orders, and dedicated success management.
Besides the plans above: what else is on the table.
Promo codes are entered at card checkout. Coming soon
One month free for both of you, credited through card billing once the friend you refer is on a paid plan. Coming soon
A discounted rate for as long as you stay a design partner, in exchange for a real programme run through CMDash and a few short feedback sessions. See what’s involved.
Save 15% versus paying monthly, same plan.
Generated from the same configuration the product enforces. Every limit and every tick below is what a plan’s licence actually grants — if the two ever disagree, this page fails its own tests.
| Capability | Free | Starter | Essentials | Command | Enterprise |
|---|---|---|---|---|---|
| Plan limits | |||||
| Max usersSeats that can sign in to the workspace. | 2 | 5 | 25 | Unlimited | Unlimited |
| Max integrationsConnected systems feeding evidence, counted per connection. | 1 | 3 | 10 | Unlimited | Unlimited |
| Max frameworksCompliance frameworks you can report against at once. | 1 | 3 | 5 | Unlimited | Unlimited |
| Included vendors (register)Vendors in the register. Continuous monitoring and per-vendor overage are Enterprise (TPRM); Starter, Essentials and Command get the register only. | 0 | 5 | 5 | 5 | 25 |
| Included managed workspacesvCISO/MSP client workspaces before per-workspace overage applies. | 0 | 0 | 0 | 5 | 25 |
| Feature entitlements by tier | |||||
| Security posture score | Not included | Included | Included | Included | Included |
| Core compliance tracking | Included | Included | Included | Included | Included |
| POA&M tracking | Included | Included | Included | Included | Included |
| System security plan | Included | Included | Included | Included | Included |
| Proof receiptsComing soon | Included | Included | Included | Included | Included |
| Signer’s fileComing soon | Included | Included | Included | Included | Included |
| POA&M export | Not included | Included | Included | Included | Included |
| AI drafting and analysisComing soon | Not included | Included | Included | Included | Included |
| Board snapshot reports | Not included | Not included | Included | Included | Included |
| Weekly email digest | Not included | Not included | Included | Included | Included |
| Report builder | Not included | Not included | Included | Included | Included |
| Peer benchmarkingCompares against a reference baseline, not real peers, until ten organizations in your industry opt in. | Not included | Not included | Included | Included | Included |
| Domain security posture | Not included | Not included | Included | Included | Included |
| IP reputation monitoring | Not included | Not included | Included | Included | Included |
| External reputation score | Not included | Not included | Included | Included | Included |
| Ticket push | Not included | Not included | Included | Included | Included |
| AI narrativeComing soon | Not included | Not included | Not included | Included | Included |
| Ask your postureComing soon | Not included | Not included | Not included | Included | Included |
| Risk register | Not included | Included | Included | Included | Included |
| Tool coverage grading | Not included | Not included | Not included | Included | Included |
| Framework crosswalk (read-only) | Not included | Included | Included | Included | Included |
| Read-only API access | Not included | Included | Included | Included | Included |
| Vendor register (5 vendors) | Not included | Included | Included | Included | Included |
| Framework crosswalk engine | Not included | Not included | Not included | Included | Included |
| Security3 capabilities in this area | Not included | Not included | Not included | Included | Included |
| Compliance16 capabilities in this area | Not included | Not included | Not included | Included | Included |
| Integrations7 capabilities in this area | Not included | Not included | Not included | Included | Included |
| Reports4 capabilities in this area | Not included | Not included | Not included | Included | Included |
| Admin7 capabilities in this area | Not included | Not included | Not included | Included | Included |
| Full trust centerComing soon | Not included | Not included | Not included | Included | Included |
| White-label exports | Not included | Not included | Not included | Included | Included |
| SAML single sign-on | Not included | Included | Included | Included | Included |
| SCIM provisioning | Not included | Not included | Not included | Not included | Included |
| Public API | Not included | Not included | Not included | Not included | Included |
| Webhooks | Not included | Not included | Not included | Not included | Included |
| Third-party risk management | Not included | Not included | Not included | Not included | Included |
| Custom frameworks | Not included | Not included | Not included | Not included | Included |
| FAIR risk quantification | Not included | Included | Included | Included | Included |
| Multi-business-unit support | Not included | Not included | Not included | Not included | Included |
| Board Deck Generator | Not included | Not included | Not included | Included | Included |
| Audit evidence packages | Not included | Not included | Not included | Included | Included |
| Enterprise billing | Not included | Not included | Not included | Not included | Included |
| LDAP sync | Not included | Not included | Not included | Not included | Included |
| Operations3 capabilities in this area | Not included | Not included | Not included | Not included | Included |
Every paid plan includes support. What differs is the channel and the commitment — see the SLA definitions for what “business hours”, “first response” and the uptime commitment mean.
| Capability | FREE | STARTER | ESSENTIALS | COMMAND | ENTERPRISE |
|---|---|---|---|---|---|
| Support channel | Priority queue | Dedicated CSM | |||
| First response | None on the Free plan | 2 business days | 1 business day | 8 business hours | 4 hours |
| Uptime SLAwith service credits | — | — | — | — | 99.9% |
| Named CSM | — | — | — | — | Yes |
Not included in any plan. Each attaches to a paid plan as a separate subscription line item. Book a walkthrough to enable.
| Add-on | Price | What it adds | Available on |
|---|---|---|---|
| The SkepticAI_COPILOT | — | AI policy drafting, control suggestions, questionnaire answers and executive briefings. | Coming soon |
| Trust CenterTRUST_CENTER | Custom | The full public Trust Center on Starter or Essentials: subprocessor lists, policy summaries, live posture badges, an NDA document room and questionnaire intake — the same surface Command and Enterprise bundle. Coming soon | Starter and Essentials, as a separate line item — included on Command and Enterprise · priced on request |
| 5 additional seatsSEATS_5 | Custom | Five more seats on your current plan, billed by the pack — buy as many as you need instead of moving up a tier for headcount alone. | Starter and Essentials · priced on request |
| Third-Party Risk ManagementTPRM | $499/mo | The full vendor register on Command: vendor risk tiering and rollup, security questionnaire templates, SBOM and KEV monitoring, and vendor rating monitoring with your own SecurityScorecard or Bitsight key — the same surface Enterprise bundles. Questionnaires reach vendors by e-mail. | Command, as a separate line item — included on Enterprise · online purchase Coming soon · or request a quote |
Three questions, answered against the table above. Nothing you pick here is sent anywhere.
Answer the three questions and the plan that covers them appears here.
Answered from how the product is built and billed.
30 days, on whichever plan you choose — Starter, Essentials or Command. A card is required to start it, so the trial runs at the real features of the plan you picked, not a fixed lower tier.
If you do nothing, the trial converts to the plan and price you selected at signup. Cancel any time before day 30 and your workspace drops to Free — no further charge, and nothing is locked: Free keeps a working self-assessment.
Owners and admins. The billing screen in the app is gated on the signed-in role being Owner or Admin, and there is no separate owner-only check inside it, including for cancellation.
For card subscriptions, in Stripe’s hosted billing portal, opened from Settings → Billing in the app: payment method changes, plan changes and downloadable invoice history are Stripe’s screens, and CMDash does not render its own invoice list or PDFs for them. A plan bought through a quote instead is invoiced on an annual contract.
Yes, on an annual contract: a contract with an annual value, start and end dates, payment terms such as NET 30, and a billing contact, with its invoices tracked on the same screen. Being straight about a gap: those contract invoices have no PDF or CSV export today — the screen shows the record, and the numbers on it are the numbers to key in.
Usage above an allotment is not blocked. Overage is metered at the published rates below. Coming soon
Yes — the table is generated from the same configuration the product enforces, and this page fails its own tests if the two disagree. A per-deal licence override can widen a limit or add a feature; overrides never subtract, so you cannot end up with less than the table shows.
Client workspaces can only be created on the plans whose included allotment above is non-zero. Workspaces past that allotment are priced per workspace at banded volume rates that fall as the count rises. CMDash has no visibility into what you bill your own clients, so it does not compute a margin. Coming soon
Plans and add-ons include usage allotments. The rates below are what usage beyond an allotment is priced at. Coming soon
AI runs beyond The Skeptic add-on’s included allotment.
API requests are counted for your usage dashboards and are not billed.
Actively monitored vendors beyond your plan’s included allotment.
Active vCISO client workspaces beyond your plan’s included allotment.
| Total active managed workspaces | Price per workspace |
|---|---|
| 1–10 | $49 / month |
| 11–25 | $39 / month |
| 26–50 | $29 / month |
| 51 and above | $19 / month |
Hosted and managed by us. Sign up and start the same day.
Runs on your own servers or in your own AWS account, on the Enterprise plan, from a signed license file that is checked offline.
Coming soon