Skip to main content

ControlMap

A space to ask questions, get answers, and engage surrounding ControlMap

  • 38 Topics
  • 50 Replies
38 Topics
Andrea Ayala
Community Manager
Andrea AyalaCommunity Manager
published in ControlMap
ControlMap's New Command Center Walkthrough
ControlMap's New Command Center WalkthroughTutorial

Tulsie Narine, Solution Engineer for ScalePad, walks through new Command Center features in the latest Tech Bytes update. Watch our quick video to be in the know of our the latest enhancements to ControlMap!   

1010
Andrea Ayala
Community Manager
Dan Fox
Community Manager
Dan FoxCommunity Manager
posted in ControlMap
CMMC for the MSP - Webinar with Kevin Mann the "CMMC Jedi"

ScalePad’s ControlMap team hosts weekly community peer group webinars on Wednesdays at 10am PST focused on Cybersecurity Compliance.  This week of March 27th our special guest was Kevin Mann, a ControlMap partner and CMMC Certified Professional and Assessor and his company is a C3PAO candidate. Kevin is the President of Resilient IT with over 15+ years experience as a technology & cybersecurity consultant in the MSP industry . He has been dubbed the “CMMC Jedi “and regularly presents on the topic of CMMC within the MSP and tech community. The recording to the Webinar is below and after 5 minutes of brief introductions you can hear Kevin share insights on an MSP’s responsibilities when working with a client who requires CMMCassessment:  ControlMap Weekly Wed Mar 27th Recording: https://scalepad.wistia.com/medias/xce7ydgxouInvite to join future Weekly Webinars: Wednesday's 10am Pacific / 1pm Eastern (45min)Register here: https://scalepad.zoom.us/meeting/register/tZcud-ugqTwqHdXh26ql_

1601
Luis Giraldo
Community Manager
C
ccreynoldsNew Member
asked in ControlMap
How to remove reference to out of scope requirements from questions?

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

214
C
C
ccreynoldsNew Member
asked in ControlMap
Is there a master list of Common Assessment questions?

Is there a master list of common assessment questions with pre-mapped requirements from all available frameworks in ControlMap that I could use to build a custom assessment from? If so, where can I get this?

30
C
C
ccreynoldsNew Member
asked in ControlMap
CSA CCM Framework Control Mapping

I loaded both CSA-CCM v3.0.1 and CSA-CCM v4.03 and it appears that neither of these map to the pre-loaded CSA CCM controls v4 or v3.1. Why? 

50
C
C
ccreynoldsNew Member
asked in ControlMap
Timestamp for integration scans

Is there a setting to enable a (local time) timestamp on integration scan ? It would be especially useful to have this if you run more than one on demand scan in a day - due to testing or fixes, etc. Timestamp should be noted in logs, reports, evidence, scan results, etc.  I would also like to see the evidence reports to list the most recent report by date/time at top and not bottom. Can a filter be added? Thanks!

102
C
B
bbrehartNew Member
asked in ControlMap
What Are Automated Scans?

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

151
Dan Fox
Community Manager
C
ccreynoldsNew Member
asked in ControlMap
Auto create risks from assessment response

Is there a way to auto create risks based off answers from assessments with any framework? If not, I would like to request it.Example: question: does your company do xyz?If the response is “no” or “partially”, have an option to create risk with pre-populated info and then action plan could be used as potential remediation plan. 

60
C
C
CarrieBNew Member
asked in ControlMap
Spelling and Grammar Errors in Assessment Report Templates

I need to highlight an issue with the assessment report and errors either in the template or in the tables the report is pulling from.  The assessment report contains spelling, punctuation and grammatical errors. (I did see another post about the grammar, punctuation, and spelling errors in the Pre-Assessment Questions but I would like to expand that).  Each time I run the assessment report, I must manually review and correct 110+ pages in Word (for NIST 800-171). Through the assessment process as I make changes while trying to finalize the project, I may run the assessment report anywhere from 10-15 times and often against multiple frameworks per assessment. The process of correcting the errors in each report is extremely time-consuming and frustrating, as well as introducing a risk of errors slipping through to our customers. If, or really when, that happens, each error reflects poorly on me, as the assessor, my company and ControlMap directly impacting the quality and professionalis

692
Dan Fox
Community Manager
C
cgforcertain
posted in ControlMap
Looking to bounce ideas off others who are using ControlMap for CMMC

Anyone using ControlMap for CMMC readiness and/or assessment?What I’m most curious about are any customizations you’ve made to the tenant along the way. I’ve found myself creating lots of custom tags based on the documentation, figuring out the best way to track different scopes within the same org/CAGE code/tenant, and making sure any CM docs line up with the official documentation.I have a good grasp on the standard and attestation themselves, so I’d be interested in comparing notes with anyone going through all of this with CM as their platform.

351
Dan Fox
Community Manager
J
Jeremy-BloughTechNew Member
asked in ControlMap
Cyber Risk Institute framework v 2.0

I would like to know if if the Cyber Risk Institute framework v 2.0 is on the roadmap for an assessment/framework inside of control map? https://cyberriskinstitute.org/cri-issues-profile-version-2-0/This has been the choice of 2 of our FIs knowing that the FFIEC CAT will become obsolete this coming August. I am currently setting them up with NIST CSF 2.0 as the assessment control and we are using a manual excel spreadsheet to track CRI profile for them.  Thanks,   

151
Dan Fox
Community Manager
B
bbrehartNew Member
asked in ControlMap
What Is Meant By the Use of "Password Configuration" In Evidence?

I was working through evidence requests with one of my tenants, and four of them asked about passwords, but used the term “password configuration” in the request. We’re a little confused about what is meant by the term “configuration”. Does it mean password complexity requirements in the policy documents, or does it mean evidence of configuration of said requirements in systems (for example, a Group Policy in AD). Or does it mean both working together? 

161
Dan Fox
Community Manager
B
bbrehartNew Member
asked in ControlMap
Controls vs Objectives

What are the differences between Controls and Objectives? 

601
Dan Fox
Community Manager
Andrea Ayala
Community Manager
Andrea AyalaCommunity Manager
published in ControlMap
We want to hear from you - Share your ControlMap Journey!
We want to hear from you - Share your ControlMap Journey!News

We're excited to continue our new Partner Advocacy Program and invite you to share your ControlMap success story! We value your partnership and want to spotlight how ControlMap has transformed your business through a genuine customer testimonial. As a thank you, we’re offering a $100 Gift Card from our selection for your participation. What we're asking of you:Before: Describe the challenge your company faced before using ControlMap. What issues or inefficiencies did you encounter? After: Explain how ControlMap has enhanced your MSPs operations—whether by reducing manual workload, streamlining audits with a single compliance tool, bolstering cybersecurity, or building stronger client trust. How will we use your testimonial?Your story will be featured on our LinkedIn channel and shared to new and prospective ControlMap users in promotional materials. We’ll also be directing viewers of your testimonial to our ControlMap demo page (https://www.scalepad.com/controlmap/demo/) to learn more.

330
Andrea Ayala
Community Manager
B
bbrehartNew Member
asked in ControlMap
Do You Have to Be A User of ControlMap to Be Assigned Tasks?

There’s a debate at my organization regarding the assigning of tasks (such as evidence collection or document uploading): can you assign tasks to anyone within an organization just using their email address, or do they have to be added to ControlMap as a user?

783
Dan Fox
Community Manager
kelliemurphy
Rocketeer
kelliemurphyRocketeer
published in ControlMap
Catch Up on Our GRC vCISO Wave Webinar Series — Now On Demand!
Catch Up on Our GRC vCISO Wave Webinar Series — Now On Demand!News

Missed our GRC vCISO Wave webinar series? No worries! You can now watch all the recordings on demand. Whether you're building your CaaS program or looking to scale it, these sessions are packed with practical insights to help you grow your business and wow your clients. Webinar 1: Why GRC Matters for MSPsFind out how compliance can build trust, boost retention, and set you apart. Get the lowdown on delivering GRC services using frameworks like NIST, SOC 2, and CIS Controls. Hear real-world success stories from MSPs in the field. Watch Webinar 1Webinar 2: Building Recurring Value with CaaSLearn why CaaS is more than a one-and-done project—it’s an ongoing program. Discover how assessments, vendor risk management, and audit prep create real value. Pick up tips for continuous monitoring and policy management. Watch Webinar 2Webinar 3: Showcasing Client Value & Scaling CaaSSee how reporting automations, trust centers, and executive dashboards impress clients. Get strategies to scale you

850
kelliemurphy
Rocketeer
L
leeNew Member
asked in ControlMap
When I try to connect Two out of five companies we have in ControlMap, I get the error "UnAuthorized: Your account is blocked".

I have superadmin privileges in ControlMap, so I am not sure why I am being blocked.  Three of the companies I can connect to with out issue.  I previously was able to access all five companies.

341
AJ Suurhoff
Rocketeer
B
BrettRNew Member
asked in ControlMap
Custom attributes on assets in ControlMap

Is there a way to add other attributes/columns to assets in ControlMap, so it can be the basic asset register for an organisation? e.g. equipment barcode? Ideally, custom attributes would not be overwritten when rows are updated from an integration. I thought this existed but looking again, cannot see the option to add additional columns.

542
B
B
buchananNew Member
asked in ControlMap
Preassessment error

Trying to complete a pre-assessment, I get through question 28 and there’s no NEXT or COMPLETE button.  see attached imaged.  what am I doing wrong?

311
Shay Macgabhann
Rocketeer
R
richiecoanActive Member
asked in ControlMap
NIST 800-171 and CMMC SSP

Need the ability to upload diagrams for several areas of the SSP to define system boundaries, define data flow for protected data, system boundaries, etc.

1003
R
P
poppyNew Member
asked in ControlMap
Link existing uploaded policy to evidence

Is there a way that I am missing to link an existing uploaded Policy as evidence? 

462
P
N
NorthfieldNew Member
asked in ControlMap
Control Map Outtage?

Hello, when trying to login to my MSP portal on ControlMap, none of my links are loading. Is there any known issues with the application now? There was the database maintenance last night and I can’t seem to login.Just shows up gray screen and when I try to go through the Lifecycle manager way, it just says redirecting to your region then freezes up. I’ve tried logging through incognito, deleting my cache, as well as logging in from another device on another network and it is not working.  Please help!

461
Andrea Ayala
Community Manager
D
Dr. MikeNew Member
asked in ControlMap
ControlMap CMMC/171 evidence expectations vs DIBCAC expectations

DIBCAC released a Self-Assessment Database that they themselves use when conducting assessments. It has very explicit expectations of minimally 320 evidence checks--some of which can be met by a single document/artifact. DIBCAC has evidence expectations for each of the 320 assessment objectives. How has ControlMap’s default expectations for evidence for CMMC landed on 53 pieces (and the same count for 171r2 framework)?  

390
D
Andrea Ayala
Community Manager
Andrea AyalaCommunity Manager
published in ControlMap
The vCISO Wave – Why and How GRC Will Revolutionize Your Business
The vCISO Wave – Why and How GRC Will Revolutionize Your BusinessNews

In our most recent webinar series, we tasked Secure Dan ( @Dan Fox ) with laying out why Governance, Risk, and Compliance (GRC) isn’t just about protecting your clients—it’s about creating new business opportunities while reducing liability. In our most recent webinar, Dan explains: Why GRC matters: You’ll learn how compliance builds trust, differentiates MSPs like yours, and helps with client retention—all while avoiding hefty regulatory fines. How to implement GRC as a service: We’ll walk through different approaches, from choosing the right framework like NIST, SOC 2, or CIS Controls, to structuring flexible service models such as monthly retainers or project-based pricing. The process: You’ll see how key phases like assessing gaps, audits, and ongoing monitoring create long-term value and deliverables like compliance assessments, risk management, and policy documentation. Lessons from the field: We’ll share success stories and common pitfalls, like ensuring framework alignmen

480
Andrea Ayala
Community Manager
S
scheidellHelper
asked in ControlMap
your PCI DSS 4.0 has extremely limited use

first problem, your pci dss 4.0 is based on the ‘prioritized approach;’361 questions.https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Supporting%20Document/Prioritized-Approach-For-PCI-DSS-v4-0.pdf Basically useless. and I do 3 or 4 PCI readiness audits a year (and I can’t use controlmap, Example: if a client needs to be pci compliant, and can use the SAQ A, there are only 22 controls.So if I ask the client to go through the 360 questions and mark 338 of them as ‘out of scope’ they will compare me to.. ok, bozo the clown.how to fix? don’t know.  you would need to tag each control with the SAQ that requires is, and let us mark ‘all out of scope except’  these tags.here is the list: The number of questions in each PCI Self-Assessment Questionnaire (SAQ) varies based on the SAQ type. Here's a breakdown of the number of questions per SAQ type: SAQ A: ~22 questions This SAQ is for merchants who have fully outsourced all cardholder data functions to third-party service providers. SAQ A-

641
Dan Fox
Community Manager
Terms & ConditionsCookie settings