ControlMap

DIBCAC released a Self-Assessment Database that they themselves use when conducting assessments. It has very explicit expectations of minimally 320 evidence checks--some of which can be met by a single document/artifact. DIBCAC has evidence expectations for each of the 320 assessment objectives. How has ControlMap’s default expectations for evidence for CMMC landed on 53 pieces (and the same count for 171r2 framework)?  

first problem, your pci dss 4.0 is based on the ‘prioritized approach;’361 questions.https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Supporting%20Document/Prioritized-Approach-For-PCI-DSS-v4-0.pdf Basically useless. and I do 3 or 4 PCI readiness audits a year (and I can’t use controlmap, Example: if a client needs to be pci compliant, and can use the SAQ A, there are only 22 controls.So if I ask the client to go through the 360 questions and mark 338 of them as ‘out of scope’ they will compare me to.. ok, bozo the clown.how to fix? don’t know.  you would need to tag each control with the SAQ that requires is, and let us mark ‘all out of scope except’  these tags.here is the list: The number of questions in each PCI Self-Assessme

Is there some type of report we can use for our own compliance needs that shows all the users and the associated privileges?  I am looking for this for our own compliance requirements internally.

With the “Implementation” tab in each objective, I can put notes as the how the objective is implemented. This doesn’t seem to show up in any report. Is there a point to this field? I’d love to have my reports give this bit of free-text information against each objective without a copy-and-paste.

We are seeing duplicate entries of evidence with different objectives for some of our customers.   We have no idea if this is expected behavior.   We only have one framework associated with the customer.  Please advise.  

Preparation for incident response can often be over looked until its too late. There is a reason incident response is a best practice and a requirement for most cybersecurity compliance frameworks as well as an often questioned on vendor due diligence forms.The recent incidents with CDK Global and United Health’s Change Healthcare multi-week outages from ransomware both resulting in 10’s and 100’s of Millions in losses + ransom payments or the recent Microsoft outages in July including O365 and Azure with a botnet DDOS attack and the entire industry from

This was such a fun interview to do with Dan Fox! We got into everything from the genesis of ControlMap to the challenges MSPs have with deploying and scaling a Compliance-as-a-Service practice.Some questions for the community:What are some of the challenges you’re seeing in getting your clients on the compliance train? What roadblocks are you seeing internally in your MSP to get more diligent with your own compliance journey?We’d love to do more sessions/workshops on compliance topics, please let us know if you’d like to see any specific topics explored!Check out the interview: 

Greetings,  Do we have an idea when the NISF CSF Controls will be reformatted to the CSF 2.0 with the Govern pillar? 

HelloIs there a roadmap on future integrations available to see what integrations are in the works? Particularly looking for Tenable Nessus (Vuln scans) and any SIEM integration data (ConnectWise, QRadar, Splunk, Sentinel, ETC) that could be pulled in.  Thanks Glenn 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal standard specifically designed to secure protected health information (PHI). Regulated by the Office for Civil Rights, HIPAA outlines the permissible use and disclosure of PHI in the USA as set forth by HHS guidelines.  HIPAA compliance around security and technology maintains a sizeable mind share within the MSP community as the healthcare industry is both technology dependent and ranges in size from large medical organizations and hospitals on the enterprise side on down to small doctor and dental offices on the SMB side and everything in between.Regardless of the size of organization, PHI data and the systems processing PHI data must be scoped, secured and protected. First off, what is considered PHI data? The detailed definition is below but at a high level it would be any data that would identify a patient or individual. The good news is that if PHI data is encrypted

A couple months ago we announced that ControlMap had surpassed 50+ Cybersecurity Frameworks!A summary of those frameworks which span the globe and several industries can be found here: ControlMap Frameworks Over the last couple of months we have added several more including those released in May, 2024 which include:DORA: EU Based Digital Operational Resilience ActNIST AI: NIST’s Artificial Intelligence Cybersecurity Compliance FrameworkNYDFS: New York Department of Finance NYCRR 500 As we continue to expand the list of Cybersecurity Compliance Frameworks this opens up several questions such as: Why so many Frameworks and how many are out there? Why does ControlMap launch and support the ones we do?  What others are coming and how do I request one in the future?To

ControlMap’s April 2024 release came out with a new compliance feature to manage shared responsibilities directly within frameworks.In cybersecurity compliance, a responsibility matrix is essential. It provides clarity, accountability, and structure, guiding efforts to manage and mitigate risks. This foundational tool supports effective governance and demonstrates commitment to protecting sensitive information and assets. Some purposes of a shared responsibility matrix for cybersecurity management:It clarifies roles and responsibilities, reducing confusion and ensuring tasks are addressed. It fosters accountability by assigning specific responsibilities to individuals or teams. It promotes collaboration among departments and stakeholders, leading to more effective outcomes. It helps identify gaps and redundancies in cybersecurity processes, enabling resource optimization. It supports

 The first version of NIST’s Cybersecurity Framework aka NIST CSF was released in 2014 and has become enormously popular with businesses and organizations of all sizes. In fact, it is a top 5 framework within ControlMap’s MSP community alongside CIS, SOC 2, ISO 27001, and CMMC/NIST 800-171. The appeal of NIST CSF is its logical approach to Cybersecurity with control objectives organized into 5 easy to understand functional groups: “Identify” →  “Protect” →  “Detect” →  “Respond” →  “Re

A place to discuss CMMC compliance along with some helpful links:  ControlMap provides the CMMC framework based on NIST 800-171r2 with special assessment tools including SPRS scoring, POAM reporting and SSP report builder. CMMC Framework Screenshot DOD’s CMMC Home Page: https://dodcio.defense.gov/CMMC/Model/Assessment Overview and Levels 1//2/3 explained: https://dodcio.defense.gov/CMMC/Assessments/Who needs NIST 800-171: 

Research shows that 90% of IT service providers are not compliant with any framework; the reality is this number is closer to 99%. Why aren’t they compliant? Prepping for an audit and managing different frameworks can be complicated and a major time waste for MSPs.For growing and scaling MSPs that need a system to manage compliance operations, ControlMap is an automation platform that expedites compliance for over 35 frameworks such as SOC 2, ISO 27001, CMMC, CIS, and more. Unlike any other compliance solutions,  ControlMap helps MSPs jumpstart a compliance as a service (CaaS or vCISO) offering, increasing revenue and building trust with clients.Manage compliance operations within a single platform with a structured and repeatable approach with ControlMap. Check out our ControlMap overview document below!