Product Discussions

For accounting purposes, we are looking to add a GL code to items we quote clients. When adding products from the “Product Cloud”, are we able to see/update the products “Integration Cross Reference” field for CW Manage?I do not see that field event when I add a product from the CW Manage either.Is there a way to see/modify a default product field from CW Manage in Quoter for accounting purposes.  

URGENTWhat is the conditional logic on how process maturity levels are assigned for a given framework objective requirement? I enabled process maturity for 2 frameworks for a client that previously did not have this enabled and were assessed last year. I now see that all of the existing requirements that were in scope have a maturity set automatically to the Tier 1/Initial and any new requirements that are now in scope are set to Tier 0/Not Implemented. I could use some additional information to have a more productive and informative discussion with the client and my peers so that we are clear on how this works. I already have hunted down the descriptions of the maturity levels for each of the frameworks I am using - found in a report by chance (you need to have these online somewhere in your docs too!) We are starting a new assesment with this client in the next few weeks and need this information as soon as possible. Thank you! 

I am working on creating content blocks. This is a small ask, but I was wondering if you could make the 'Add Content Block' area larger so that we can see the whole name of the content blocks? I have a screenshot to show what I am asking, because I don't know if this is making the most sense :)  

We’d like to have a feature implemented within Backup Radar to show if backups are encrypted and/or immutable backups are enabled within Microsoft Azure for each client.

Hello, I am really hoping the product improves over time. What good are assessments to assess potential clients when we cannot create new companies without them being created in CW WITH assets/configurations? Please let me know if I am wrong, but there is no way to create a client without them having assets to sync… right?The more I try to use the product, the more half-baked and thought out it feels. 

I am trying to make sense of the numbers when viewing frameworks.  I do not know why I have three denominators in these calculations.   Are these objectives, controls, questions, or ?  What’s the unit of measure?   There are 197 questions in the assessment.We generated 175 Action Items through the assessment.I do not know where 125, 130, and 153 numbers are used as denominators.    Can someone point me to a calculation or KB article that makes sense of these numbers.  I have to be able to explain it to customers.  Am I the only one having issues?  

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

In Backup Radar, the it would be a nice option to allow the “Agreement” field to be configurable or otherwise automatically populated with a default value. Currently, the Agreement field is left empty and needs to be manually adjusted for each ticket generated by Backup Radar.

Good morning. I'm new to Lifecycles Manager, and we just integrated Ninja and pulled all endpoints into the manager. My question is, we have several systems that have Microsoft ESU licenses added. Is there a way to instruct lifecycles not to include those systems in the unsupported OS category? 

I’d like to see a user role for the risk register. Compliance Manager has too many privileges. When a user is assigned as a risk owner or is assigned a task for a risk, I’d like to see a more least privilege user role managing that risk. One example is an additional checkbox for Contributor that allows them to see/manage the risk.

As I have been working on building Assessment Templates, I have run into a problem with “Session Expired” even though I am interacting with the screen, entering questions, clicking “Done”, or rearranging questions, etc.  The only way to stop it is hitting “Save Changes” constantly.  The timeout needs to be longer, and a warning should be provided before the “Session Expired” message pops up and I lose my work.Has anyone else run into this issue as you are configuring your system?

Add “Discovery Date” column to the Asset Inventory page. This will inform evidence collection for addressing unauthorized assets. A discovery date or date asset was imported via an integration will make newly discovered assets easily identified in the console.

In each control in this case for CMMC 2.0, there is a note section. This is located in two places one is at the bottom and a hyperlink where the customer can enter their response and there is another one at the top which is a summary of the control.In the note field that follows the hyperlink the save button is way out of place. In fact I would prefer to be able to simply paste my response into that box and then click out of the screen which will automatically save my response thereby saving me a lot of time.In the note field at the top of the control where the summary goes, the same thing applies with one other problem. When I click in the notes field it causes a format bar to drop down. This requires me to click in the notes box a second time and in many cases I will end up clicking on one of the formatting controls accidentally. When I click in the notes field here it should automatically go to edit and my cursor should be ready to go so I can paste something in usi

Assets can be sorted during initiative creation; however, the sorting does not persist when the report is downloaded. Maintaining asset order in reports is critical and should be considered a high priority. This functionality is essential and needs to be implemented immediately.  

I scheduled a bunch of future assessment's but now I need to delete them. I do not see a way to do this in bulk. As it stands now I have approximately 99 scheduled assessment's across three vendors. It would be better if we could Bulk Delete Future Vendor Assessments that are scheduled.

I cannot seem to find any documentation explaining what the audit properties fields “class” and “category” are defined as.1.Can someone help define these for me?2.In what specific audit scenarios would you populate these fields?Thank you!

Hello everyone, I have a question about tracking Action Item remediation tasks in my PSA. It seems logical to me for there to be a integration between the ControlMap Action Items and the MSP’s PSA to track and manage remediation tasks. In my mind once a Risk is identified in ControlMap and an associated Action Item created, that action item needs to be handed off to the PSA so that a ticket can be created and managed through completion, just like all the other support tickets? Once the ticket is closed, it can then update the Action Item in ControlMap and serve as the evidence that the Action Item was remediated.  Does this make sense to everyone, or am I missing something. Maybe someone out there can let me know how you track and manage action items in ControlMap. Thank you all.Louis

Is there a REST API or plans for a REST API for ControlMap? A couple things I’m trying to do:Pull all Policies from our clients to do an AI analysis of deviations from the standard as well as provide updates to policies in bulk through automations. Provide a standardized piece of Evidence for certain Evidence types. I would want to search all clients for whether they need a particular evidence type and then upload an Evidence document in bulk via automations. There are a couple more ideas in the future but they are mostly focused around Policies and Evidence. I just want to be able pulls list of Policies and Evidence and make updates.

Do we have to use the Baseline Controls (and corresponding evidence) in every instance and every tenant? What are situations where we should use the BC and scenarios when we don’t?

Can anyone provide the roadmap/timeline for adding new Controls and Control Families to ControlMap? For example, right now there’s a set of controls for NIST CSF, but not for NIST CSF 2.0. And, as it stands for many Frameworks, the evidence is mapped to the controls, so without the right controls, completing evidence requests doesn’t change the status of the controls or assessment questions in the Framework.

What are all of the conditions by which Evidence Requests and other Documents get auto-created?I was doing some testing and had removed all evidence requests in the system that got pre-populated when I initially loaded CSF framework and some documents. Loaded other frameworks and no other evidence requests were auto-populated or asked if I wanted them re-populated.How can we “re-load” these when desired? Do only certain frameworks provide auto-created evidence requests? If so, which ones?Are Evidence Requests only created when the very first framework is loaded? I can’t find much documentation on this topic and really need some answers please.  

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

I am a Super Admin in our MSP and currently the person who creates most of the client tenants. I noticed that whoever creates a tenant is the person who gets auto assigned to the following:Framework owner Control set owner (when control sets are loaded) Evidence request owner AND assignee (when system auto-creates evidence request) Policies, procedures and governance documents (when created manually or by loading a template)In one of the tenants, I set all of the above to another user and I currently have my notification channels set to “email” and have my notification preferences as follows: Notify me only when I am added as a watcherYou will be notified of changes or updates to a policy, procedure, evidence, control, or risk when you explicitly add yourself as a watcher to that entity.Notify me only when I am an ownerYou will be notified of changes or updates to entities like policy or evidence tha

I have a tenant who one of my colleagues created, and when they created the frameworks, they didn’t use Quick Start, so none of the related evidence requests were populated in the evidence section. In order to get the mapped evidence to populate can I:Delete all existing frameworks and run the Quick Start again? Import the evidence with the mappings?Cheers

We sent an assessment to a client and they responded to the questions and attached artifacts to support their answers. We noticed in the system that when you click on the question they attached the artifact to, it lands in the Documents tab - and that tab does not exist for questions that the client did NOT attached items to. At the objectives level, the objective attached to that particular question shows the artifacts in the Policies & Procedure tab. How can we attach these artifacts as evidence to satisfy the requirement? Do we have to create a new evidence request and download them, then upload and attach? Seems counter productive. There seems to be no way the system identifies these as evidence or a way to map them. Please advise. Thanks! (screenshots attached)