ControlMap

URGENTWhat is the conditional logic on how process maturity levels are assigned for a given framework objective requirement? I enabled process maturity for 2 frameworks for a client that previously did not have this enabled and were assessed last year. I now see that all of the existing requirements that were in scope have a maturity set automatically to the Tier 1/Initial and any new requirements that are now in scope are set to Tier 0/Not Implemented. I could use some additional information to have a more productive and informative discussion with the client and my peers so that we are clear on how this works. I already have hunted down the descriptions of the maturity levels for each of the frameworks I am using - found in a report by chance (you need to have these online somewhere in your docs too!) We are starting a new assesment with this client in the next few weeks and need this information as soon as possible. Thank you! 

I am trying to make sense of the numbers when viewing frameworks.  I do not know why I have three denominators in these calculations.   Are these objectives, controls, questions, or ?  What’s the unit of measure?   There are 197 questions in the assessment.We generated 175 Action Items through the assessment.I do not know where 125, 130, and 153 numbers are used as denominators.    Can someone point me to a calculation or KB article that makes sense of these numbers.  I have to be able to explain it to customers.  Am I the only one having issues?  

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

How do I delete an action Item? I have a whole bunch I want to delete.

I’d like to see a user role for the risk register. Compliance Manager has too many privileges. When a user is assigned as a risk owner or is assigned a task for a risk, I’d like to see a more least privilege user role managing that risk. One example is an additional checkbox for Contributor that allows them to see/manage the risk.

Add “Discovery Date” column to the Asset Inventory page. This will inform evidence collection for addressing unauthorized assets. A discovery date or date asset was imported via an integration will make newly discovered assets easily identified in the console.

In each control in this case for CMMC 2.0, there is a note section. This is located in two places one is at the bottom and a hyperlink where the customer can enter their response and there is another one at the top which is a summary of the control.In the note field that follows the hyperlink the save button is way out of place. In fact I would prefer to be able to simply paste my response into that box and then click out of the screen which will automatically save my response thereby saving me a lot of time.In the note field at the top of the control where the summary goes, the same thing applies with one other problem. When I click in the notes field it causes a format bar to drop down. This requires me to click in the notes box a second time and in many cases I will end up clicking on one of the formatting controls accidentally. When I click in the notes field here it should automatically go to edit and my cursor should be ready to go so I can paste something in usi

I scheduled a bunch of future assessment's but now I need to delete them. I do not see a way to do this in bulk. As it stands now I have approximately 99 scheduled assessment's across three vendors. It would be better if we could Bulk Delete Future Vendor Assessments that are scheduled.

I cannot seem to find any documentation explaining what the audit properties fields “class” and “category” are defined as.1.Can someone help define these for me?2.In what specific audit scenarios would you populate these fields?Thank you!

Hello everyone, I have a question about tracking Action Item remediation tasks in my PSA. It seems logical to me for there to be a integration between the ControlMap Action Items and the MSP’s PSA to track and manage remediation tasks. In my mind once a Risk is identified in ControlMap and an associated Action Item created, that action item needs to be handed off to the PSA so that a ticket can be created and managed through completion, just like all the other support tickets? Once the ticket is closed, it can then update the Action Item in ControlMap and serve as the evidence that the Action Item was remediated.  Does this make sense to everyone, or am I missing something. Maybe someone out there can let me know how you track and manage action items in ControlMap. Thank you all.Louis

Is there a REST API or plans for a REST API for ControlMap? A couple things I’m trying to do:Pull all Policies from our clients to do an AI analysis of deviations from the standard as well as provide updates to policies in bulk through automations. Provide a standardized piece of Evidence for certain Evidence types. I would want to search all clients for whether they need a particular evidence type and then upload an Evidence document in bulk via automations. There are a couple more ideas in the future but they are mostly focused around Policies and Evidence. I just want to be able pulls list of Policies and Evidence and make updates.

Do we have to use the Baseline Controls (and corresponding evidence) in every instance and every tenant? What are situations where we should use the BC and scenarios when we don’t?

Can anyone provide the roadmap/timeline for adding new Controls and Control Families to ControlMap? For example, right now there’s a set of controls for NIST CSF, but not for NIST CSF 2.0. And, as it stands for many Frameworks, the evidence is mapped to the controls, so without the right controls, completing evidence requests doesn’t change the status of the controls or assessment questions in the Framework.

What are all of the conditions by which Evidence Requests and other Documents get auto-created?I was doing some testing and had removed all evidence requests in the system that got pre-populated when I initially loaded CSF framework and some documents. Loaded other frameworks and no other evidence requests were auto-populated or asked if I wanted them re-populated.How can we “re-load” these when desired? Do only certain frameworks provide auto-created evidence requests? If so, which ones?Are Evidence Requests only created when the very first framework is loaded? I can’t find much documentation on this topic and really need some answers please.  

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

I am a Super Admin in our MSP and currently the person who creates most of the client tenants. I noticed that whoever creates a tenant is the person who gets auto assigned to the following:Framework owner Control set owner (when control sets are loaded) Evidence request owner AND assignee (when system auto-creates evidence request) Policies, procedures and governance documents (when created manually or by loading a template)In one of the tenants, I set all of the above to another user and I currently have my notification channels set to “email” and have my notification preferences as follows: Notify me only when I am added as a watcherYou will be notified of changes or updates to a policy, procedure, evidence, control, or risk when you explicitly add yourself as a watcher to that entity.Notify me only when I am an ownerYou will be notified of changes or updates to entities like policy or evidence tha

I have a tenant who one of my colleagues created, and when they created the frameworks, they didn’t use Quick Start, so none of the related evidence requests were populated in the evidence section. In order to get the mapped evidence to populate can I:Delete all existing frameworks and run the Quick Start again? Import the evidence with the mappings?Cheers

We sent an assessment to a client and they responded to the questions and attached artifacts to support their answers. We noticed in the system that when you click on the question they attached the artifact to, it lands in the Documents tab - and that tab does not exist for questions that the client did NOT attached items to. At the objectives level, the objective attached to that particular question shows the artifacts in the Policies & Procedure tab. How can we attach these artifacts as evidence to satisfy the requirement? Do we have to create a new evidence request and download them, then upload and attach? Seems counter productive. There seems to be no way the system identifies these as evidence or a way to map them. Please advise. Thanks! (screenshots attached)

Hi,Is there a way to change the date formatting from US to UK in ControlMap?

A few months ago, I set my policy review date to 10/31/25. Today, I (along with many other people in my tenant) got an email reminder for policy review. Why did everyone who is an admin or in a compliance manager role get this email not just the owner, contributor(if any) and approver who were listed? This seems noisy for users in the system and would be better suited for granular notifications as this caused some confusion for people. Is there a master list of what notifications are sent to what roles in ControlMap? 

Where can I find the prospecting questions that used to exist in the pre-client tenants? I can’t seem to find those in the new “free” tenants. 

I can’t seem to find a way to export assessment questions with guidance or a way to include guidance when sending a question set to a customer (as an option). I also don’t see a report with this option. Am I missing this somewhere? Thanks.

Request to add the GovRAMP (formerly StateRAMP) framework to ControlMap’s available frameworks.This framework is becoming a key compliance requirement for U.S. public sector and state-level contracts, and adding it would enable partners to manage, assess, and report on GovRAMP controls directly within ControlMap without relying on manual imports or custom mappings.

Can someone point to any documentation for integrating Kaseya BMS and VSA with Controlmap? The only one I see is ConnectWise.