ControlMap

Hi,Is there a way to change the date formatting from US to UK in ControlMap?

A few months ago, I set my policy review date to 10/31/25. Today, I (along with many other people in my tenant) got an email reminder for policy review. Why did everyone who is an admin or in a compliance manager role get this email not just the owner, contributor(if any) and approver who were listed? This seems noisy for users in the system and would be better suited for granular notifications as this caused some confusion for people. Is there a master list of what notifications are sent to what roles in ControlMap? 

Where can I find the prospecting questions that used to exist in the pre-client tenants? I can’t seem to find those in the new “free” tenants. 

I can’t seem to find a way to export assessment questions with guidance or a way to include guidance when sending a question set to a customer (as an option). I also don’t see a report with this option. Am I missing this somewhere? Thanks.

Request to add the GovRAMP (formerly StateRAMP) framework to ControlMap’s available frameworks.This framework is becoming a key compliance requirement for U.S. public sector and state-level contracts, and adding it would enable partners to manage, assess, and report on GovRAMP controls directly within ControlMap without relying on manual imports or custom mappings.

Can someone point to any documentation for integrating Kaseya BMS and VSA with Controlmap? The only one I see is ConnectWise.

Did the pre-client/pre-assessment option go away with the new tiers within ControlMap? 

ControlMap doesn’t warn the user when content is not saved before leaving the page or changing some Metadata on the right side. This already did cost me a lot of time and caused a lot of frustration

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

Is there a master list of common assessment questions with pre-mapped requirements from all available frameworks in ControlMap that I could use to build a custom assessment from? If so, where can I get this?

I loaded both CSA-CCM v3.0.1 and CSA-CCM v4.03 and it appears that neither of these map to the pre-loaded CSA CCM controls v4 or v3.1. Why? 

Is there a setting to enable a (local time) timestamp on integration scan ? It would be especially useful to have this if you run more than one on demand scan in a day - due to testing or fixes, etc. Timestamp should be noted in logs, reports, evidence, scan results, etc.  I would also like to see the evidence reports to list the most recent report by date/time at top and not bottom. Can a filter be added? Thanks!

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

Is there a way to auto create risks based off answers from assessments with any framework? If not, I would like to request it.Example: question: does your company do xyz?If the response is “no” or “partially”, have an option to create risk with pre-populated info and then action plan could be used as potential remediation plan. 

I need to highlight an issue with the assessment report and errors either in the template or in the tables the report is pulling from.  The assessment report contains spelling, punctuation and grammatical errors. (I did see another post about the grammar, punctuation, and spelling errors in the Pre-Assessment Questions but I would like to expand that).  Each time I run the assessment report, I must manually review and correct 110+ pages in Word (for NIST 800-171). Through the assessment process as I make changes while trying to finalize the project, I may run the assessment report anywhere from 10-15 times and often against multiple frameworks per assessment. The process of correcting the errors in each report is extremely time-consuming and frustrating, as well as introducing a risk of errors slipping through to our customers. If, or really when, that happens, each error reflects poorly on me, as the assessor, my company and ControlMap directly impacting the quality and professionalis

Anyone using ControlMap for CMMC readiness and/or assessment?What I’m most curious about are any customizations you’ve made to the tenant along the way. I’ve found myself creating lots of custom tags based on the documentation, figuring out the best way to track different scopes within the same org/CAGE code/tenant, and making sure any CM docs line up with the official documentation.I have a good grasp on the standard and attestation themselves, so I’d be interested in comparing notes with anyone going through all of this with CM as their platform.

I would like to know if if the Cyber Risk Institute framework v 2.0 is on the roadmap for an assessment/framework inside of control map? https://cyberriskinstitute.org/cri-issues-profile-version-2-0/This has been the choice of 2 of our FIs knowing that the FFIEC CAT will become obsolete this coming August. I am currently setting them up with NIST CSF 2.0 as the assessment control and we are using a manual excel spreadsheet to track CRI profile for them.  Thanks,   

I was working through evidence requests with one of my tenants, and four of them asked about passwords, but used the term “password configuration” in the request. We’re a little confused about what is meant by the term “configuration”. Does it mean password complexity requirements in the policy documents, or does it mean evidence of configuration of said requirements in systems (for example, a Group Policy in AD). Or does it mean both working together? 

What are the differences between Controls and Objectives? 

There’s a debate at my organization regarding the assigning of tasks (such as evidence collection or document uploading): can you assign tasks to anyone within an organization just using their email address, or do they have to be added to ControlMap as a user?

I have superadmin privileges in ControlMap, so I am not sure why I am being blocked.  Three of the companies I can connect to with out issue.  I previously was able to access all five companies.