Reach through developers and integrations
Terraform provider on the official registry
The CMDash Terraform provider, published to the official Terraform registry, with more resources than today.
No dates — a date on a roadmap is a promise waiting to be late. Just what’s shipped, what’s in flight, what’s next, and what’s further out. Vote “This matters to us” on anything you want to see sooner.
In flight, in the release we’re shipping right now.
The CMDash Terraform provider, published to the official Terraform registry, with more resources than today.
On the roadmap, with no release assigned.
Try a Command feature free for seven days, one trial per feature per org. Built and tested; it turns on once the trialable set is chosen.
Already live — linked to the release notes that shipped it.
Trial timing, checkout, dunning and attribution fixed end to end, so a visitor who becomes a trial and a trial who becomes a customer is tracked all the way through.
Shipped in v7.2.0 →Social sign-up, role-based onboarding, guided tours, a real activation checklist, a win-back sequence and an admin trial pipeline — everything between signing up and paying.
Shipped in v7.3.0 →Coupons, a referral programme, seat packs, AI-credit top-ups, a TPRM add-on, Stripe Tax, renewal reminders, published support tiers and SLA, a self-serve quote builder and a proper cancel flow.
Shipped in v7.4.0 →Articles on frameworks, compliance strategy and what's changing in the market, drawn from CMDash's own research and product data.
Shipped in v7.5.0 →Every shipped release, in one place, with an RSS feed and a direct link to each release.
Shipped in v7.5.0 →See exactly which controls each integration evidences for a given framework, with a setup guide for that pairing.
Shipped in v7.5.0 →Browse framework control text, control families and the crosswalks between frameworks, in the open.
Shipped in v7.5.0 →An SPRS calculator, a CMMC level finder and a quick CSF check, free, with the result emailed as a PDF.
Shipped in v7.5.0 →Twenty policy templates, previewable and mapped to frameworks, downloadable or opened directly inside a CMDash trial.
Shipped in v7.5.0 →The Trust Center — questionnaires, the DPA, subprocessors and the security disclosure policy — served directly from www.cmdash.com.
Shipped in v7.5.0 →The full landscape atlas of GRC and security areas, browsable publicly, area by area.
Shipped in v7.5.0 →FAQ, breadcrumb and product-detail markup so CMDash pages show up richer, and are easier to evaluate, straight from search results.
Shipped in v7.5.0 →Head-to-head comparisons against named alternatives, and category pages for the major kinds of GRC platform.
Shipped in v7.5.0 →Short recorded walkthroughs for the CISO morning check-in, a CMMC OSC scoring to SPRS, and an MSP roll-up.
Shipped in v8.0.0 →A monthly posture-and-product brief by email — confirmed on sign-up, one click to leave, nothing else in between.
Shipped in v7.5.0 →Browse community-published integration templates and install one directly.
Shipped in v7.5.0 →The API's OpenAPI spec and a ready-made Postman collection, published for anyone evaluating the API before signing up.
Shipped in v7.5.0 →Vote for the integration you want CMDash to build next.
Shipped in v7.5.0 →Logos, boilerplate, a founder bio and product screenshots, all in one place for press and partners.
Shipped in v7.5.0 →A monthly "what changed in the GRC landscape" post, drawn from the atlas itself.
Shipped in v7.5.0 →Apply to become a CMDash partner directly on the website.
Shipped in v7.6.0 →MSPs and partners manage API keys, managed accounts, licences and statements from their own console.
Shipped in v7.6.0 →Onboard many clients at once from a spreadsheet, each into its own pre-configured workspace.
Shipped in v7.6.0 →A public directory of partner MSPs, vCISOs, auditors and C3PAOs, filterable by region and framework.
Shipped in v7.6.0 →Partners register a deal and get protection on it while they work it.
Shipped in v7.6.0 →Partners with white-label rights can brand every export as their own, with no CMDash footer at all.
Shipped in v7.6.0 →A dedicated page for C3PAOs, auditors and vCISOs describing the assessor workflow end to end.
Shipped in v7.6.0 →A margin calculator and a generated price sheet for MSPs reselling CMDash.
Shipped in v7.6.0 →Partners get a statement emailed on the 1st of the month: revenue share, usage and the next volume tier.
Shipped in v7.6.0 →One page with every document a buyer's procurement team needs: datasheet, architecture overview, security overview, DPA, VPAT, subprocessors and questionnaires.
Shipped in v7.6.0 →A WCAG 2.2 AA accessibility conformance report, published for accessibility reviewers.
Shipped in v7.6.0 →Buy and run CMDash through the AWS Marketplace, billed straight to your AWS account.
Shipped in v7.6.0 →Self-issue a 30-day self-hosted trial licence and follow the published install guide.
Shipped in v7.6.0 →An official Helm chart for self-hosting on Kubernetes, plus a CloudFormation template for a BYO-AWS deployment.
Shipped in v7.6.0 →Live SOC 2 readiness, tracked by running CMDash's own SOC 2 programme inside CMDash itself.
Shipped in v7.6.0 →A published vulnerability disclosure policy, and an executive summary of the independent penetration test once it lands.
Shipped in v7.6.0 →A live, read-only sandbox tenant to explore CMDash with real data — no sign-up required.
Shipped in v7.6.0 →Posture and open risks from a slash command, plus a daily brief posted to your channel.
Shipped in v7.7.0 →Share a read-only, expiring link to a board pack, a compliance report or a posture summary.
Shipped in v7.7.0 →Industry reference bands for benchmarking, so the page is never empty while enough peer data builds up for real comparisons.
Shipped in v7.7.0 →Vendors who complete a questionnaire, and assessors who close a review, get a fast path to start their own CMDash trial with their answers carried over.
Shipped in v7.7.0 →Import your controls, policies and evidence index directly from a competitor export, with a dry-run report before anything is committed.
Shipped in v7.7.0 →A one-screen mobile brief: today's posture, the three biggest changes since yesterday, and your tasks — approve in one tap.
Shipped in v7.7.0 →An official Python SDK, generated from the public API and published to PyPI.
Shipped in v7.7.0 →Connect CMDash to thousands of other apps through a Zapier integration and an n8n community node.
Shipped in v7.7.0 →A GitHub Action for the posture gate, published on the GitHub Marketplace with a ready-to-copy example workflow.
Shipped in v7.7.0 →Your interactions with the CMDash team kept in sync automatically, so follow-up is faster and better-informed.
Shipped in v7.7.0 →Continuous testing of the marketing site so it stays clear and fast to evaluate CMDash from — never on price.
Shipped in v7.7.0 →One-pagers and a fact sheet for every persona, regenerated from the live product catalog instead of going stale.
Shipped in v7.7.0 →An invitation to become a design partner — early access and closer input, in exchange for a case study.
Shipped in v7.7.0 →An easy way for happy customers to leave a review on G2 or Capterra.
Shipped in v7.7.0 →Public discussions, a Slack Connect or Discord link, and regular office hours.
Shipped in v7.7.0 →Monthly office hours and webinars, with recordings posted afterwards for anyone who couldn't make it live.
Shipped in v7.7.0 →Full WCAG 2.2 AA conformance across the most-used parts of the product, including keyboard navigation of the nav, palette, dialogs and tables.
Shipped in v7.7.0 →Security and Compliance menus shrink to the six most-used items each; features your plan cannot use fold into one "N more" row instead of a wall of locked links.
Shipped in v8.1.0 →A per-user Pinned group above Overview and a Recent list, so the pages you actually use are one click away.
Shipped in v8.1.0 →Every plan feature gets a human label and a one-line description, so plan cards and upgrade prompts stop showing internal key names.
Shipped in v8.1.0 →An upgrade prompt carries the feature and page you came from to the billing page, which explains that feature first.
Shipped in v8.1.0 →Published vulnerabilities and unpublished chatter from official and community sources, deduplicated, with a last-updated stamp.
Shipped in v8.1.0 →In-window threats joined to your tracked vulnerabilities and connected-tool data, so "affects us" is a fact, not a guess.
Shipped in v8.1.0 →Frameworks, the risk register, crosswalk reading and public API reads move to the Starter tier per the published parity matrix.
Shipped in v8.1.0 →An overview page for Security and Compliance with cards and descriptions, generated from the same navigation source as the sidebar.
Shipped in v8.2.0 →A locked route lands on a preview page — what it does, a screenshot, three capabilities — rather than a bare "upgrade" message.
Shipped in v8.2.0 →A matrix of connected tools against in-window threats — covered, exposed, unknown — from each tool's own content versions.
Shipped in v8.2.0 →Alert rules for a new zero-day touching your assets and for a tool whose coverage dropped, with evidence attached.
Shipped in v8.2.0 →The switching importer gains a CISO Assistant profile alongside Drata, Vanta and Secureframe.
Shipped in v8.2.0 →An alternatives page rendered from the same parity matrix the tier map is built from, honest about where each tool is ahead.
Shipped in v8.2.0 →Eleven Command pages still borrow the risk register’s key when they ask you to upgrade; each gets its own catalogue entry so the prompt names the feature you were actually opening.
Shipped in v8.3.0 →The Qualys adapter reads CVE ids from detection XML the Qualys schema does not define, so its coverage verdicts are unknown; parsing the QID→CVE knowledge base restores per-host answers.
Shipped in v8.3.0 →A workspace can hold its own controls, attach evidence to a framework line with one link endpoint, and turn a quick note on a line into an evidence entry — the compliance workbench.
Shipped in v8.5.0 →Filter by owner and type as well as status, search, and export with the filters applied — the register behaves like a register.
Shipped in v8.7.0 →The help docs show how the parts connect and the typical workflows as diagrams, and the context drawer tells you where the page you are on sits in them.
Shipped in v8.9.0 →The Integrations page groups the 46 adapters by category with search and filters, every adapter declares its setup fields, and a Migrate page imports Drata, Vanta, Secureframe or CISO Assistant exports after a dry-run preview.
Shipped in v8.10.0 →Deleting or archiving from a list offers an Undo and commits nothing until it expires; records can be favourited; the command palette remembers what you last opened; and both the in-app help and the public docs are searchable.
Shipped in v9.0.0 →The OpenAPI document on the website is generated from the server's own runtime spec — real path parameters, typed request bodies and response schemas — the Postman collection leads with v2, and both SDKs default to v2.
Shipped in v9.0.0 →Search, version history with change summaries, the owner and next review date, the organisation's logo, a downloadable bundle of the whole library, a link-only access code and a time-boxed auditor window.
Shipped in v9.0.0 →Self-hosted operators get a licence view, a banner when a licence lapses, self-update that can target a specific version rather than only the newest, and one-command backup and restore with a schedule for both.
Shipped in v9.0.0 →The staff admin portal and the policy portal join the same accessibility checks the main app and website already had — real dialogs with focus handling, named controls, heading order, reduced motion and print styles — with automated checks over every page template.
Shipped in v9.0.0 →Add-ons with a price sell themselves; every other add-on and the Enterprise plan take a quote request in-app or on the pricing page instead of a mail link. Receipts, plan-change and cancellation e-mails, an invoice history with PDF links, and cap meters that say "3 of 3 frameworks" before you hit the wall.
Shipped in v9.1.0 →Sign in once and move between the main app, the staff portal and the website without a second password; remember a device for 30 days after MFA. Breadcrumbs are derived from the navigation so they cannot disagree with it, settings has a real sub-menu, and "Switch from another tool" and "Restore a CMDash archive" are named so a buyer cannot pick wrong.
Shipped in v9.2.0 →www.cmdash.com/security publishes the DPA, subprocessors, SOC 2 readiness, the VPAT, status and data residency in one place, with the CAIQ/SIG answers as a download. Every marketing page has a call to action, and "Book a walkthrough" captures a demo request with the questions a sales call would ask.
Shipped in v9.3.0 →Continuous-compliance rules can now watch any record set, not only integration signals: risks, assets, exceptions, remediations, incidents, policies, evidence, POA&M items, vendors, access reviews, questionnaires, integration health and exercises. A rule that matches notifies the owner or opens a linked remediation task, once, and clears when the record stops matching.
Shipped in v9.4.0 →A Continuity & recovery area: business impact analysis, BCP and DRP plans split from the old combined template with a backup policy and the IR cross-reference, an RTO/RPO register over the asset inventory with recovery-test history, a recovery-dependency map, and the CP-2/4/9/10, A.5.29/5.30, CC9.1/A1.2/A1.3 and RC.RP/RS.MA control view behind it. Three new tabletop scenarios to rehearse it.
Shipped in v9.4.0 →CMMC claims are issued as signed receipts in an append-only transparency log, labelled self-attested where that is the truth. A client-side verifier checks a receipt without trusting CMDash, and a Signer's File blocks signing while any contradiction fires.
Shipped in v10.0.0 →A Free tier below Starter with focus navigation for the CMMC obligation (assess, prove, sign), verified-e-mail sign-up, one workspace per domain, and idle Free workspaces paused after 60 days.
Shipped in v10.0.0 →The data export carries every proof receipt and its transparency-log inclusion proof, and a public page states exactly what can be re-imported.
Shipped in v10.1.0 →Receipt freshness per client workspace in the vCISO rollup and partner console, with partner-branded proof share pages.
Shipped in v10.1.0 →Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.