← CMDash as an alternative to CISO Assistant
Switching
Moving from CISO Assistant to CMDash
Export your controls, policies, evidence index, risk scenarios and third parties from CISO Assistant as CSV. CMDash maps them onto its own framework catalogs and policy templates and shows you, line by line, what it matched, what it is only guessing about, and what it could not place at all — before it writes anything.
The switching offer
Two months free on Command or Enterprise
Show us a current CISO Assistant contract and your first 2 months on a monthly Command or Enterprise plan are 100% off. Use code SWITCH2MO at checkout.
The code is entered at card checkout. Coming soon
- Monthly billing only — the discount runs for 2 months, so on an annual plan it would discount a whole year rather than two months.
- New customers only, and one to a company: Stripe refuses the code for anyone who has already paid us.
- Limited to 25 redemptions, and the code stops working 180 days after it is issued.
What carries over
5 exports, 5 answers. Each list below is read from the importer’s own capability table — if the code stops doing one of these, this page stops saying it.
Controls
From: Compliance assessment (audit) → Action plan → Export as CSV · CISO Assistant’s own documentation, read 2026-09-11
Carries over
- The implementation status of every control whose "Covered requirements" cell (formatted `<ref id> - <name>`, one per line) matches a control in CMDash’s own catalog for that framework.
- The exported control’s name and description, kept as the note on the CMDash assessment so you can see where the status came from.
- One exported row mapping to several CMDash controls, when its "Covered requirements" cell lists several.
Does not carry over
- Category, CSF Function, Priority, ETA, Expiry date, Effort, Impact and Cost — real columns of this export with no CMDash control-assessment equivalent. They appear in the report as ignored headers, never read.
- Controls for a framework CMDash does not ship, or a row citing no framework requirement at all. The report names the framework label it could not resolve, per line.
- Anything matched only by title similarity. Those lines are reported with their score and their best candidate, and are never written; a person decides.
- Any control that is not covered by a compliance AUDIT in CISO Assistant. This export is per-audit (a `ComplianceAssessment`); a control tracked only against a risk scenario, with no audit requirement citing it, never appears in this file.
Policies
From: Policies → Export as CSV (semicolon-delimited) · CISO Assistant’s own documentation, read 2026-09-11
Carries over
- A policy whose title matches one of CMDash’s starter policy templates is created in your library from that template, pre-linked to the framework controls the template declares.
Does not carry over
- The policy TEXT you wrote in the other tool. CMDash creates the document from its own template — a policy is a document people attest to, and silently importing prose CMDash cannot vouch for into an attestation flow is not a migration, it is a liability.
- Acceptance and attestation history — who acknowledged which version, and when.
- Approval history, version numbers, effective dates and review cadences from the other tool.
- A policy with no matching CMDash template. It is reported by line with its best candidate, never guessed at.
- category, csf_function, reference_control, cost and effort — real columns of this export, because `Policy` is implemented as an `AppliedControl` subclass in CISO Assistant. CMDash’s policy-from-template import has no equivalent slots for them.
Evidence index
From: The SAME Action Plan CSV as the controls file, above — CISO Assistant has no separate evidence-index export · CISO Assistant’s own documentation, read 2026-09-11
Carries over
- One evidence record per evidence name found in a control’s "Associated evidences" cell, attached to the framework requirement(s) that control’s "Covered requirements" cell names, filed as PENDING review and tagged `switching:ciso-assistant` plus the source line.
Does not carry over
- The evidence FILES. This is an index import, not a file transfer: CMDash records that the artifact existed and what it covered, and files it for review.
- Rows whose control reference does not resolve to a CMDash control — reported by line.
- Reviewer state from the other tool. Every migrated row lands as PENDING, deliberately: a competitor’s CSV is not a review, and letting one satisfy a freshness check would make a control look evidenced when nobody here has looked at it.
- A direct link or upload date for the evidence file — CISO Assistant’s Action Plan export names the evidence, not where to find it.
- Any evidence attached to a control that no compliance audit covers, for the same reason the controls file misses that control: this export is per-audit.
Risk scenarios
From: Risk scenarios → Export as CSV (semicolon-delimited) · CISO Assistant’s own documentation, read 2026-09-11
Carries over
- A CMDash risk is created for every scenario with a name and a recognised current probability AND impact, titled from the scenario name with its CISO Assistant description carried over as CMDash’s own description.
- The scenario’s CURRENT probability and impact (not inherent or residual), translated from the matrix label to CMDash’s 1-5 scale, and the treatment column mapped to CMDash’s risk status.
- The scenario’s justification text, carried over into CMDash’s risk notes.
- A second import of the same scenario TITLE creates nothing new — an existing CMDash risk with that exact title is treated as already migrated, the same "skip, do not duplicate" rule the policies file uses.
Does not carry over
- Inherent and residual probability/impact, linked assets/threats/vulnerabilities/applied controls, owners and qualifications — CMDash’s risk register has no equivalent slots and these are read for the report only.
- A row whose current probability or impact renders as "--" (unrated in CISO Assistant) or as a label this importer does not recognise. Reported by line, never guessed at.
- Risk assessment / risk matrix identity — which named assessment or matrix produced the scenario. CMDash risks are not grouped by source assessment.
Third parties
From: Third parties (Entities) → Export as CSV (semicolon-delimited) · CISO Assistant’s own documentation, read 2026-09-11
Carries over
- A CMDash vendor is created for every entity row with a name, named and described from the export, honouring ROADMAP-V81 D2’s vendor-register-lite cap the same way creating a vendor by hand does.
Does not carry over
- Country, currency, legal identifiers (LEI/EUID/DUNS/VAT), and the default dependency/penetration/maturity/trust stakeholder-assessment scores — real columns of this export CMDash’s vendor register has no equivalent fields for.
- Website and industry — fields CMDash’s vendor form has that this CISO Assistant export does not carry.
- Parent-entity hierarchy (`parent_entity_ref_id`) and CISO Assistant’s folder/domain scoping (`domain`).
- Any row beyond your plan’s remaining vendor-register-lite capacity. A Starter/Essentials/Command org without the Third-Party Risk Management add-on holds a 5-vendor lite register; rows beyond the remaining slots are reported, never created, with the same upsell message the product shows when you try to add one vendor too many by hand.
The columns CMDash reads
Header names, not column positions — CISO Assistant’s exports do not have a fixed column set. Anything CMDash does not recognise is ignored rather than treated as an error, and the import report shows you your own header row so you can see what it skipped. Of the 22 columns below, 22 are spelled the way CISO Assistant documents them and 0 had to be inferred.
Controls
| Accepted header | Needed? | Where the name comes from |
|---|---|---|
| Name | Optional | Documented |
| Description | Optional | Documented |
| Status | Optional | Documented |
| Covered requirements | Required | Documented |
Policies
| Accepted header | Needed? | Where the name comes from |
|---|---|---|
| name | Required | Documented |
| description | Optional | Documented |
| status | Optional | Documented |
| owner | Optional | Documented |
| ref_id | Optional | Documented |
Evidence index
| Accepted header | Needed? | Where the name comes from |
|---|---|---|
| Name | Optional | Documented |
| Covered requirements | Required | Documented |
| Associated evidences | Required | Documented |
Risk scenarios
| Accepted header | Needed? | Where the name comes from |
|---|---|---|
| name | Required | Documented |
| description | Optional | Documented |
| treatment | Optional | Documented |
| current_proba | Required | Documented |
| current_impact | Required | Documented |
| ref_id | Optional | Documented |
| justification | Optional | Documented |
Third parties
| Accepted header | Needed? | Where the name comes from |
|---|---|---|
| name | Required | Documented |
| description | Optional | Documented |
| ref_id | Optional | Documented |
What we could not confirm
CISO Assistant does not publish the header row of any export. Everything below is a limit of this importer that we know about and are telling you before you sign, rather than after you upload. If your export does not parse, the error names your own header row — send it to us and the accepted spellings get extended.
Controls
- Whether the Status cell carries the raw token or the UI label — see the column note.
- That a self-hosted CISO Assistant instance has not customised `ComplianceAssessmentActionPlanSerializer`’s field list. The fourteen columns this file cites are what the shipped open-source view emits at the pinned commit; a fork could differ.
Policies
- Whether the Status cell carries the raw token or the UI label — see the column note.
- This export uses SEMICOLON as its field delimiter (`csv.writer(response, delimiter=";")`, `ExportMixin.export_csv`, cited above) — unlike the Action Plan CSV the controls/evidence files use, which is comma-delimited. `parseSwitchingCsv` accepts either, auto-detected.
Evidence index
- CISO Assistant publishes NO row-per-evidence export anywhere in its source (confirmed by reading `core/views.py` in full: `EvidenceViewSet` does not inherit `ExportMixin`). What exists is this column, embedded in the controls export — read this file’s header comment for why the evidence file reuses it via an explode step rather than declaring its own export.
- `Evidence attachments` (filenames) exists in the same source row but is not read — the evidence NAME (`Associated evidences`) is what becomes the imported row’s title; the filename would be redundant with it in most exports and is not itself a working link (`Evidence.filename()` has no accompanying download URL in this serializer).
Risk scenarios
- The full label vocabulary a customer’s own risk matrix uses. A 3×3 or 4×4 matrix, or a 5×5 matrix with renamed levels, produces label words this importer does not recognise — those rows are reported unmapped by their raw label, never force-fit onto a guessed number.
- This export uses SEMICOLON as its field delimiter, the same `ExportMixin.export_csv` as the policies file — see that file’s note.
Third parties
- This export uses SEMICOLON as its field delimiter, the same `ExportMixin.export_csv` as the policies and risks files — see the policies file’s note.
Nothing is written until you say so
- The import runs as a dry run by default. It performs every lookup the real run performs — including checking each matched control actually exists in your workspace — and stops before writing.
- The report gives every line one of three outcomes: matched, low-confidence, or unmatched — each with the reason, by line number.
- A control matched only because its TITLE resembled one of ours is never written. It is reported with its score and its best candidate, and a person decides.
- Nothing already done in CMDash is overwritten: a control you have already assessed and a policy you already have are skipped and counted, not replaced.
- The whole import is one audit-log entry, carrying what it declined to map as well as what it wrote.
Want us to run the import with you, or got an export shape this page does not cover? Email us and send the header row.