ControlMap

I scheduled a bunch of future assessment's but now I need to delete them. I do not see a way to do this in bulk. As it stands now I have approximately 99 scheduled assessment's across three vendors. It would be better if we could Bulk Delete Future Vendor Assessments that are scheduled.

I cannot seem to find any documentation explaining what the audit properties fields “class” and “category” are defined as.1.Can someone help define these for me?2.In what specific audit scenarios would you populate these fields?Thank you!

Hello everyone, I have a question about tracking Action Item remediation tasks in my PSA. It seems logical to me for there to be a integration between the ControlMap Action Items and the MSP’s PSA to track and manage remediation tasks. In my mind once a Risk is identified in ControlMap and an associated Action Item created, that action item needs to be handed off to the PSA so that a ticket can be created and managed through completion, just like all the other support tickets? Once the ticket is closed, it can then update the Action Item in ControlMap and serve as the evidence that the Action Item was remediated.  Does this make sense to everyone, or am I missing something. Maybe someone out there can let me know how you track and manage action items in ControlMap. Thank you all.Louis

Is there a REST API or plans for a REST API for ControlMap? A couple things I’m trying to do:Pull all Policies from our clients to do an AI analysis of deviations from the standard as well as provide updates to policies in bulk through automations. Provide a standardized piece of Evidence for certain Evidence types. I would want to search all clients for whether they need a particular evidence type and then upload an Evidence document in bulk via automations. There are a couple more ideas in the future but they are mostly focused around Policies and Evidence. I just want to be able pulls list of Policies and Evidence and make updates.

Do we have to use the Baseline Controls (and corresponding evidence) in every instance and every tenant? What are situations where we should use the BC and scenarios when we don’t?

Can anyone provide the roadmap/timeline for adding new Controls and Control Families to ControlMap? For example, right now there’s a set of controls for NIST CSF, but not for NIST CSF 2.0. And, as it stands for many Frameworks, the evidence is mapped to the controls, so without the right controls, completing evidence requests doesn’t change the status of the controls or assessment questions in the Framework.

What are all of the conditions by which Evidence Requests and other Documents get auto-created?I was doing some testing and had removed all evidence requests in the system that got pre-populated when I initially loaded CSF framework and some documents. Loaded other frameworks and no other evidence requests were auto-populated or asked if I wanted them re-populated.How can we “re-load” these when desired? Do only certain frameworks provide auto-created evidence requests? If so, which ones?Are Evidence Requests only created when the very first framework is loaded? I can’t find much documentation on this topic and really need some answers please.  

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

I am a Super Admin in our MSP and currently the person who creates most of the client tenants. I noticed that whoever creates a tenant is the person who gets auto assigned to the following:Framework owner Control set owner (when control sets are loaded) Evidence request owner AND assignee (when system auto-creates evidence request) Policies, procedures and governance documents (when created manually or by loading a template)In one of the tenants, I set all of the above to another user and I currently have my notification channels set to “email” and have my notification preferences as follows: Notify me only when I am added as a watcherYou will be notified of changes or updates to a policy, procedure, evidence, control, or risk when you explicitly add yourself as a watcher to that entity.Notify me only when I am an ownerYou will be notified of changes or updates to entities like policy or evidence tha

I have a tenant who one of my colleagues created, and when they created the frameworks, they didn’t use Quick Start, so none of the related evidence requests were populated in the evidence section. In order to get the mapped evidence to populate can I:Delete all existing frameworks and run the Quick Start again? Import the evidence with the mappings?Cheers

We sent an assessment to a client and they responded to the questions and attached artifacts to support their answers. We noticed in the system that when you click on the question they attached the artifact to, it lands in the Documents tab - and that tab does not exist for questions that the client did NOT attached items to. At the objectives level, the objective attached to that particular question shows the artifacts in the Policies & Procedure tab. How can we attach these artifacts as evidence to satisfy the requirement? Do we have to create a new evidence request and download them, then upload and attach? Seems counter productive. There seems to be no way the system identifies these as evidence or a way to map them. Please advise. Thanks! (screenshots attached)

Hi,Is there a way to change the date formatting from US to UK in ControlMap?

A few months ago, I set my policy review date to 10/31/25. Today, I (along with many other people in my tenant) got an email reminder for policy review. Why did everyone who is an admin or in a compliance manager role get this email not just the owner, contributor(if any) and approver who were listed? This seems noisy for users in the system and would be better suited for granular notifications as this caused some confusion for people. Is there a master list of what notifications are sent to what roles in ControlMap? 

Where can I find the prospecting questions that used to exist in the pre-client tenants? I can’t seem to find those in the new “free” tenants. 

I can’t seem to find a way to export assessment questions with guidance or a way to include guidance when sending a question set to a customer (as an option). I also don’t see a report with this option. Am I missing this somewhere? Thanks.

Request to add the GovRAMP (formerly StateRAMP) framework to ControlMap’s available frameworks.This framework is becoming a key compliance requirement for U.S. public sector and state-level contracts, and adding it would enable partners to manage, assess, and report on GovRAMP controls directly within ControlMap without relying on manual imports or custom mappings.

Can someone point to any documentation for integrating Kaseya BMS and VSA with Controlmap? The only one I see is ConnectWise.

Did the pre-client/pre-assessment option go away with the new tiers within ControlMap? 

ControlMap doesn’t warn the user when content is not saved before leaving the page or changing some Metadata on the right side. This already did cost me a lot of time and caused a lot of frustration

Is there a master list of common assessment questions with pre-mapped requirements from all available frameworks in ControlMap that I could use to build a custom assessment from? If so, where can I get this?

I loaded both CSA-CCM v3.0.1 and CSA-CCM v4.03 and it appears that neither of these map to the pre-loaded CSA CCM controls v4 or v3.1. Why? 

Is there a setting to enable a (local time) timestamp on integration scan ? It would be especially useful to have this if you run more than one on demand scan in a day - due to testing or fixes, etc. Timestamp should be noted in logs, reports, evidence, scan results, etc.  I would also like to see the evidence reports to list the most recent report by date/time at top and not bottom. Can a filter be added? Thanks!

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

Is there a way to auto create risks based off answers from assessments with any framework? If not, I would like to request it.Example: question: does your company do xyz?If the response is “no” or “partially”, have an option to create risk with pre-populated info and then action plan could be used as potential remediation plan.