Skip to main content

ControlMap

A space to ask questions, get answers, and engage surrounding ControlMap

  • 27 Topics
  • 36 Replies
27 Topics
Andrea Ayala
Community Manager
Andrea AyalaCommunity Manager
published in ControlMap
ControlMap's New Command Center WalkthroughTutorial

Tulsie Narine, Solution Engineer for ScalePad, walks through new Command Center features in the latest Tech Bytes update. Watch our quick video to be in the know of our the latest enhancements to ControlMap!   

700
Andrea Ayala
Community Manager
Dan Fox
Rocketeer
Dan FoxRocketeer
posted in ControlMap
CMMC for the MSP - Webinar with Kevin Mann the "CMMC Jedi"

ScalePad’s ControlMap team hosts weekly community peer group webinars on Wednesdays at 10am PST focused on Cybersecurity Compliance.  This week of March 27th our special guest was Kevin Mann, a ControlMap partner and CMMC Certified Professional and Assessor and his company is a C3PAO candidate. Kevin is the President of Resilient IT with over 15+ years experience as a technology & cybersecurity consultant in the MSP industry . He has been dubbed the “CMMC Jedi “and regularly presents on the topic of CMMC within the MSP and tech community. The recording to the Webinar is below and after 5 minutes of brief introductions you can hear Kevin share insights on an MSP’s responsibilities when working with a client who requires CMMCassessment:  ControlMap Weekly Wed Mar 27th Recording: https://scalepad.wistia.com/medias/xce7ydgxouInvite to join future Weekly Webinars: Wednesday's 10am Pacific / 1pm Eastern (45min)Register here: https://scalepad.zoom.us/meeting/register/tZcud-ugqTwqHdXh26ql_

1231
Luis Giraldo
Community Manager
B
bbrehartNew Member
asked in ControlMap
Do You Have to Be A User of ControlMap to Be Assigned Tasks?

There’s a debate at my organization regarding the assigning of tasks (such as evidence collection or document uploading): can you assign tasks to anyone within an organization just using their email address, or do they have to be added to ControlMap as a user?

101
Dan Fox
Rocketeer
kelliemurphy
Rocketeer
kelliemurphyRocketeer
published in ControlMap
Catch Up on Our GRC vCISO Wave Webinar Series — Now On Demand!News

Missed our GRC vCISO Wave webinar series? No worries! You can now watch all the recordings on demand. Whether you're building your CaaS program or looking to scale it, these sessions are packed with practical insights to help you grow your business and wow your clients. Webinar 1: Why GRC Matters for MSPsFind out how compliance can build trust, boost retention, and set you apart. Get the lowdown on delivering GRC services using frameworks like NIST, SOC 2, and CIS Controls. Hear real-world success stories from MSPs in the field. Watch Webinar 1Webinar 2: Building Recurring Value with CaaSLearn why CaaS is more than a one-and-done project—it’s an ongoing program. Discover how assessments, vendor risk management, and audit prep create real value. Pick up tips for continuous monitoring and policy management. Watch Webinar 2Webinar 3: Showcasing Client Value & Scaling CaaSSee how reporting automations, trust centers, and executive dashboards impress clients. Get strategies to scale you

70
kelliemurphy
Rocketeer
C
CarrieBNew Member
asked in ControlMap
Spelling and Grammar Errors in Assessment Report Templates

I need to highlight an issue with the assessment report and errors either in the template or in the tables the report is pulling from.  The assessment report contains spelling, punctuation and grammatical errors. (I did see another post about the grammar, punctuation, and spelling errors in the Pre-Assessment Questions but I would like to expand that).  Each time I run the assessment report, I must manually review and correct 110+ pages in Word (for NIST 800-171). Through the assessment process as I make changes while trying to finalize the project, I may run the assessment report anywhere from 10-15 times and often against multiple frameworks per assessment. The process of correcting the errors in each report is extremely time-consuming and frustrating, as well as introducing a risk of errors slipping through to our customers. If, or really when, that happens, each error reflects poorly on me, as the assessor, my company and ControlMap directly impacting the quality and professionalis

161
Tom McGinley
L
leeNew Member
asked in ControlMap
When I try to connect Two out of five companies we have in ControlMap, I get the error "UnAuthorized: Your account is blocked".

I have superadmin privileges in ControlMap, so I am not sure why I am being blocked.  Three of the companies I can connect to with out issue.  I previously was able to access all five companies.

221
AJ Suurhoff
Rocketeer
B
BrettRNew Member
asked in ControlMap
Custom attributes on assets in ControlMap

Is there a way to add other attributes/columns to assets in ControlMap, so it can be the basic asset register for an organisation? e.g. equipment barcode? Ideally, custom attributes would not be overwritten when rows are updated from an integration. I thought this existed but looking again, cannot see the option to add additional columns.

322
B
B
buchananNew Member
asked in ControlMap
Preassessment error

Trying to complete a pre-assessment, I get through question 28 and there’s no NEXT or COMPLETE button.  see attached imaged.  what am I doing wrong?

231
Shay Macgabhann
Rocketeer
R
richiecoanActive Member
asked in ControlMap
NIST 800-171 and CMMC SSP

Need the ability to upload diagrams for several areas of the SSP to define system boundaries, define data flow for protected data, system boundaries, etc.

683
R
P
poppyNew Member
asked in ControlMap
Link existing uploaded policy to evidence

Is there a way that I am missing to link an existing uploaded Policy as evidence? 

312
P
N
NorthfieldNew Member
asked in ControlMap
Control Map Outtage?

Hello, when trying to login to my MSP portal on ControlMap, none of my links are loading. Is there any known issues with the application now? There was the database maintenance last night and I can’t seem to login.Just shows up gray screen and when I try to go through the Lifecycle manager way, it just says redirecting to your region then freezes up. I’ve tried logging through incognito, deleting my cache, as well as logging in from another device on another network and it is not working.  Please help!

361
Andrea Ayala
Community Manager
D
Dr. MikeNew Member
asked in ControlMap
ControlMap CMMC/171 evidence expectations vs DIBCAC expectations

DIBCAC released a Self-Assessment Database that they themselves use when conducting assessments. It has very explicit expectations of minimally 320 evidence checks--some of which can be met by a single document/artifact. DIBCAC has evidence expectations for each of the 320 assessment objectives. How has ControlMap’s default expectations for evidence for CMMC landed on 53 pieces (and the same count for 171r2 framework)?  

240
D
Andrea Ayala
Community Manager
Andrea AyalaCommunity Manager
published in ControlMap
The vCISO Wave – Why and How GRC Will Revolutionize Your BusinessNews

In our most recent webinar series, we tasked Secure Dan ( @Dan Fox ) with laying out why Governance, Risk, and Compliance (GRC) isn’t just about protecting your clients—it’s about creating new business opportunities while reducing liability. In our most recent webinar, Dan explains: Why GRC matters: You’ll learn how compliance builds trust, differentiates MSPs like yours, and helps with client retention—all while avoiding hefty regulatory fines. How to implement GRC as a service: We’ll walk through different approaches, from choosing the right framework like NIST, SOC 2, or CIS Controls, to structuring flexible service models such as monthly retainers or project-based pricing. The process: You’ll see how key phases like assessing gaps, audits, and ongoing monitoring create long-term value and deliverables like compliance assessments, risk management, and policy documentation. Lessons from the field: We’ll share success stories and common pitfalls, like ensuring framework alignmen

350
Andrea Ayala
Community Manager
S
scheidellActive Member
asked in ControlMap
your PCI DSS 4.0 has extremely limited use

first problem, your pci dss 4.0 is based on the ‘prioritized approach;’361 questions.https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Supporting%20Document/Prioritized-Approach-For-PCI-DSS-v4-0.pdf Basically useless. and I do 3 or 4 PCI readiness audits a year (and I can’t use controlmap, Example: if a client needs to be pci compliant, and can use the SAQ A, there are only 22 controls.So if I ask the client to go through the 360 questions and mark 338 of them as ‘out of scope’ they will compare me to.. ok, bozo the clown.how to fix? don’t know.  you would need to tag each control with the SAQ that requires is, and let us mark ‘all out of scope except’  these tags.here is the list: The number of questions in each PCI Self-Assessment Questionnaire (SAQ) varies based on the SAQ type. Here's a breakdown of the number of questions per SAQ type: SAQ A: ~22 questions This SAQ is for merchants who have fully outsourced all cardholder data functions to third-party service providers. SAQ A-

551
Dan Fox
Rocketeer
S
SFleisherHelper
asked in ControlMap
Report showing users and rights for Control Map

Is there some type of report we can use for our own compliance needs that shows all the users and the associated privileges?  I am looking for this for our own compliance requirements internally.

221
Dan Fox
Rocketeer
B
BrettRNew Member
asked in ControlMap
Objectives - Implementation notes in reports

With the “Implementation” tab in each objective, I can put notes as the how the objective is implemented. This doesn’t seem to show up in any report. Is there a point to this field? I’d love to have my reports give this bit of free-text information against each objective without a copy-and-paste.

262
B
D
dkmooreNew Member
asked in ControlMap
Seeing duplicate evidences

We are seeing duplicate entries of evidence with different objectives for some of our customers.   We have no idea if this is expected behavior.   We only have one framework associated with the customer.  Please advise.  

1304
Andrea Ayala
Community Manager
Dan Fox
Rocketeer
Dan FoxRocketeer
posted in ControlMap
Incident Response + AI Generated Table Top Exercise with Itza White

Preparation for incident response can often be over looked until its too late. There is a reason incident response is a best practice and a requirement for most cybersecurity compliance frameworks as well as an often questioned on vendor due diligence forms.The recent incidents with CDK Global and United Health’s Change Healthcare multi-week outages from ransomware both resulting in 10’s and 100’s of Millions in losses + ransom payments or the recent Microsoft outages in July including O365 and Azure with a botnet DDOS attack and the entire industry from a bad update combined CrowdStrike and Microsoft Update Service are really good examples of why incident response and readiness prep are not just a good idea, but should be an essential practice for every organization.ControlMap includes an Incident Response Policy template along with Responsibility Matrix to assign responsible parties for objectives and Risks to Manage and consider alongside your chosen framework objectives that align

590
Dan Fox
Rocketeer
Luis Giraldo
Community Manager
Luis GiraldoCommunity Manager
posted in ControlMap
I Interviewed Dan Fox from ControlMap!

This was such a fun interview to do with Dan Fox! We got into everything from the genesis of ControlMap to the challenges MSPs have with deploying and scaling a Compliance-as-a-Service practice.Some questions for the community:What are some of the challenges you’re seeing in getting your clients on the compliance train? What roadblocks are you seeing internally in your MSP to get more diligent with your own compliance journey?We’d love to do more sessions/workshops on compliance topics, please let us know if you’d like to see any specific topics explored!Check out the interview: 

1273
Luis Giraldo
Community Manager
C
ctstewardNew Member
asked in ControlMap
Control Map - NIST CSF 2.0 Controls

Greetings,  Do we have an idea when the NISF CSF Controls will be reformatted to the CSF 2.0 with the Govern pillar? 

882
C
G
Gsween1000New Member
asked in ControlMap
Controlmap Future Integrations

HelloIs there a roadmap on future integrations available to see what integrations are in the works? Particularly looking for Tenable Nessus (Vuln scans) and any SIEM integration data (ConnectWise, QRadar, Splunk, Sentinel, ETC) that could be pulled in.  Thanks Glenn 

1946
Dan Fox
Rocketeer
Dan Fox
Rocketeer
Dan FoxRocketeer
posted in ControlMap
Compliance Corner: HIPAA Expanded Security + Privacy + Breach Notification

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal standard specifically designed to secure protected health information (PHI). Regulated by the Office for Civil Rights, HIPAA outlines the permissible use and disclosure of PHI in the USA as set forth by HHS guidelines.  HIPAA compliance around security and technology maintains a sizeable mind share within the MSP community as the healthcare industry is both technology dependent and ranges in size from large medical organizations and hospitals on the enterprise side on down to small doctor and dental offices on the SMB side and everything in between.Regardless of the size of organization, PHI data and the systems processing PHI data must be scoped, secured and protected. First off, what is considered PHI data? The detailed definition is below but at a high level it would be any data that would identify a patient or individual. The good news is that if PHI data is encrypted it is considered protected and

741
S
Dan Fox
Rocketeer
Dan FoxRocketeer
posted in ControlMap
New Frameworks: DORA + NIST AI + NYDFS alongside 50+ others - why so many?

A couple months ago we announced that ControlMap had surpassed 50+ Cybersecurity Frameworks!A summary of those frameworks which span the globe and several industries can be found here: ControlMap Frameworks Over the last couple of months we have added several more including those released in May, 2024 which include:DORA: EU Based Digital Operational Resilience ActNIST AI: NIST’s Artificial Intelligence Cybersecurity Compliance FrameworkNYDFS: New York Department of Finance NYCRR 500 As we continue to expand the list of Cybersecurity Compliance Frameworks this opens up several questions such as: Why so many Frameworks and how many are out there? Why does ControlMap launch and support the ones we do?  What others are coming and how do I request one in the future?To address the first question: Why so many?The main reason comes down to the intended audience of the framework and it’s support of a specific industry such as financial / healthcare / legal / government / tech etc.Layer in the e

940
Dan Fox
Rocketeer
Dan Fox
Rocketeer
Dan FoxRocketeer
posted in ControlMap
Shared Responsibility Matrix - what and why?

ControlMap’s April 2024 release came out with a new compliance feature to manage shared responsibilities directly within frameworks.In cybersecurity compliance, a responsibility matrix is essential. It provides clarity, accountability, and structure, guiding efforts to manage and mitigate risks. This foundational tool supports effective governance and demonstrates commitment to protecting sensitive information and assets. Some purposes of a shared responsibility matrix for cybersecurity management:It clarifies roles and responsibilities, reducing confusion and ensuring tasks are addressed. It fosters accountability by assigning specific responsibilities to individuals or teams. It promotes collaboration among departments and stakeholders, leading to more effective outcomes. It helps identify gaps and redundancies in cybersecurity processes, enabling resource optimization. It supports compliance efforts by documenting task implementation and management. It facilitates continuous improve

1310
Dan Fox
Rocketeer
Dan Fox
Rocketeer
Dan FoxRocketeer
published in ControlMap
Compliance Corner: NIST CSF 2.0 Released!News

 The first version of NIST’s Cybersecurity Framework aka NIST CSF was released in 2014 and has become enormously popular with businesses and organizations of all sizes. In fact, it is a top 5 framework within ControlMap’s MSP community alongside CIS, SOC 2, ISO 27001, and CMMC/NIST 800-171. The appeal of NIST CSF is its logical approach to Cybersecurity with control objectives organized into 5 easy to understand functional groups: “Identify” →  “Protect” →  “Detect” →  “Respond” →  “Recover” Now a newly introduced sixth functional group added to NIST CSF 2.0 is “Govern,” focusing specifically on Governance.You’ll likely find NIST CSF requested by small- and mid-sized government agencies such as water authorities, city/state/county departments, and Port Authorities, among other critical infrastructure organizations and their vendors. Private-sector organizations are also looking to align with insurance requirements or well-recognized Federal standards.ControlMap will continue to support

1301
A
Terms & ConditionsCookie settings