ControlMap

Is there a REST API or plans for a REST API for ControlMap? A couple things I’m trying to do:Pull all Policies from our clients to do an AI analysis of deviations from the standard as well as provide updates to policies in bulk through automations. Provide a standardized piece of Evidence for certain Evidence types. I would want to search all clients for whether they need a particular evidence type and then upload an Evidence document in bulk via automations. There are a couple more ideas in the future but they are mostly focused around Policies and Evidence. I just want to be able pulls list of Policies and Evidence and make updates.

I would like to know if if the Cyber Risk Institute framework v 2.0 is on the roadmap for an assessment/framework inside of control map? https://cyberriskinstitute.org/cri-issues-profile-version-2-0/This has been the choice of 2 of our FIs knowing that the FFIEC CAT will become obsolete this coming August. I am currently setting them up with NIST CSF 2.0 as the assessment control and we are using a manual excel spreadsheet to track CRI profile for them.  Thanks,   

https://ag.ny.gov/resources/organizations/data-breach-reporting/shield-act

Good morning,I have identified a bug when cloning a ControlMap tenant to create a new company.Expected behavior: All risks should appear under Risks → Risk Register → List.Actual behavior: The List view is completely empty after cloning (see screenshots). However, the risks do appear correctly in the Dashboard view. If I manually add a risk via "Add Risk", the Dashboard updates accordingly — but the List view still remains empty.Important: The master tenants (source tenants) display all risks correctly in the List view. The issue only occurs in the newly cloned tenants.I have reproduced this issue multiple times by creating new tenants. The same error occurs consistently.Please fix this urgently. We onboarded a new company on Friday and three more are joining today — they all need a working Risk Register.Screenshots attached.Golden Tenant (Master)

With the “Implementation” tab in each objective, I can put notes as the how the objective is implemented. This doesn’t seem to show up in any report. Is there a point to this field? I’d love to have my reports give this bit of free-text information against each objective without a copy-and-paste.

Am I missing a way to sort the tenant dashboard in the UI? E.g. by company name? If not, guess this is a feature request.

We have modified how we want to organize a few of our controls and it will be easier to restart.  I deleted the framework and recreated it but it kept our answers!   Is there a way to reset a framework to default?

Is there a way to change the language of the Title for the Objectives on the SOC2 framework specifically?   For example, looking at the default language for SOC2 framework for Objective CC 1.1.1 it says ‘Sets the Tone at the Top’.  We would like to modify this title to align with our client’s controls.  We found how to modify the description, but can you modify this title?I think technically this CC1.1.1 is an objective but is usually considered the actual control and evidence is tied directly to this identifier.  In ControlMap it isn’t, instead it would be tied to control HRM-1 for example. We are just trying to make it easier to onboard new clients that are unfamiliar with with CC1.1.1 as an objective and more of the control.

What are the differences between Controls and Objectives? 

Is there a way that I am missing to link an existing uploaded Policy as evidence? 

How do I delete an action Item? I have a whole bunch I want to delete.

I noticed a new option in our tenants within the dashboard view in ControlMap: Progress Stage. The Assessment, Planning, Implementation and Monitoring stages are self explanitory, but can you tell me what the intent is with “clear stage”? I want to be able to articulate the mean to our users. Thank you!

I’m hoping this is a pretty easy solve, but I’ve tried different menus, mappings, and Community posts with no luck yet. When I answer an Assessment question, I want to attach Risks to it. This is not handled within the Assessment section; it’s apparently populated/connected elsewhere, and I can’t figure out where.I’ve attached Risks to individual controls in the Controls section, I’ve tried clicking the “Attach” and “Edit” buttons on the assessment question (you can attach policies, procedures, etc. but not risks), I’ve tried mapping it via the Risk Register, I’ve tried looking at the tenant’s general settings, etc. I’ll create a separate topic for this one, but similarly, I’m looking for all my previously uploaded Evidence to appear under the “Evidence” tab shown above. This is the same general type of issue/qu

The only audit report (Audit Evidence & Result) provided in ControlMap is missing key critical info found in the detailed evaluation section of a given Request:1) testing approach 2) recommendations and findingsI have looked for other ways/reports to export this information to give to our client and have reached a dead end. Am I using the wrong report or is the content in these fields NOT exportable via report?  If not exportable, why? This is important information to share as part of an audit and/or audit readiness. 

Can you please provide a link the documentation on jumpstart option within ControlMap? 

URGENTWhat is the conditional logic on how process maturity levels are assigned for a given framework objective requirement? I enabled process maturity for 2 frameworks for a client that previously did not have this enabled and were assessed last year. I now see that all of the existing requirements that were in scope have a maturity set automatically to the Tier 1/Initial and any new requirements that are now in scope are set to Tier 0/Not Implemented. I could use some additional information to have a more productive and informative discussion with the client and my peers so that we are clear on how this works. I already have hunted down the descriptions of the maturity levels for each of the frameworks I am using - found in a report by chance (you need to have these online somewhere in your docs too!) We are starting a new assesment with this client in the next few weeks and need this information as soon as possible. Thank you! 

I am trying to make sense of the numbers when viewing frameworks.  I do not know why I have three denominators in these calculations.   Are these objectives, controls, questions, or ?  What’s the unit of measure?   There are 197 questions in the assessment.We generated 175 Action Items through the assessment.I do not know where 125, 130, and 153 numbers are used as denominators.    Can someone point me to a calculation or KB article that makes sense of these numbers.  I have to be able to explain it to customers.  Am I the only one having issues?  

I was looking at the dashboard for one of my tenants, and under the Compliance Achieved and Recent Activity sections, I saw Automated Scan, and I’m not familiar with what exactly it is, how to use it, or where it gets its data from. Does anyone know how to use Automated Scan? Is it part of Integrations?

I’d like to see a user role for the risk register. Compliance Manager has too many privileges. When a user is assigned as a risk owner or is assigned a task for a risk, I’d like to see a more least privilege user role managing that risk. One example is an additional checkbox for Contributor that allows them to see/manage the risk.

Add “Discovery Date” column to the Asset Inventory page. This will inform evidence collection for addressing unauthorized assets. A discovery date or date asset was imported via an integration will make newly discovered assets easily identified in the console.

In each control in this case for CMMC 2.0, there is a note section. This is located in two places one is at the bottom and a hyperlink where the customer can enter their response and there is another one at the top which is a summary of the control.In the note field that follows the hyperlink the save button is way out of place. In fact I would prefer to be able to simply paste my response into that box and then click out of the screen which will automatically save my response thereby saving me a lot of time.In the note field at the top of the control where the summary goes, the same thing applies with one other problem. When I click in the notes field it causes a format bar to drop down. This requires me to click in the notes box a second time and in many cases I will end up clicking on one of the formatting controls accidentally. When I click in the notes field here it should automatically go to edit and my cursor should be ready to go so I can paste something in usi

I scheduled a bunch of future assessment's but now I need to delete them. I do not see a way to do this in bulk. As it stands now I have approximately 99 scheduled assessment's across three vendors. It would be better if we could Bulk Delete Future Vendor Assessments that are scheduled.

I cannot seem to find any documentation explaining what the audit properties fields “class” and “category” are defined as.1.Can someone help define these for me?2.In what specific audit scenarios would you populate these fields?Thank you!

Hello everyone, I have a question about tracking Action Item remediation tasks in my PSA. It seems logical to me for there to be a integration between the ControlMap Action Items and the MSP’s PSA to track and manage remediation tasks. In my mind once a Risk is identified in ControlMap and an associated Action Item created, that action item needs to be handed off to the PSA so that a ticket can be created and managed through completion, just like all the other support tickets? Once the ticket is closed, it can then update the Action Item in ControlMap and serve as the evidence that the Action Item was remediated.  Does this make sense to everyone, or am I missing something. Maybe someone out there can let me know how you track and manage action items in ControlMap. Thank you all.Louis

Do we have to use the Baseline Controls (and corresponding evidence) in every instance and every tenant? What are situations where we should use the BC and scenarios when we don’t?