Choose the CommandShield software capabilities that fit your program. Professional services are scoped separately.
| Feature | Essentials | Starter | Growth | Enterprise |
|---|---|---|---|---|
| 13-domain maturity self-assessment | ||||
| Roadmap register | ||||
| Risk register and treatment records | ||||
| Policy ownership and review register | ||||
| Program snapshot reports and PDF | — | |||
| Vendor due-diligence workspace | — | — | ||
| Versioned vendor questionnaires and answer bank | — | — | ||
| Incident plans, breach clock, and tabletops | — | — | ||
| Meeting records and action items | — | — | ||
| AI-assisted drafting in supported workflows | — | — | ||
| Service-request tracking (services scoped separately) | — | — | — |
A subscription covers the CommandShield software capabilities listed for the selected tier. Human advisory, audit, penetration-testing, and response services are not included unless they are separately scoped in writing.
No. CommandShield records and governs a vCISO program. Control-level compliance work belongs in ClearTrust; any audit or penetration-testing engagement requires a separately approved scope and rules of engagement.
It is a manual five-level self-assessment across 13 security-program domains. CommandShield stores the scores, evidence, and notes; it does not represent the result as a certification or control-level audit.
Reports are snapshots generated from the program records held in CommandShield. They are not independent assessments, certifications, or a substitute for source evidence.
No staffing level, meeting cadence, dedicated advisor, or response-time SLA is included in the software plan. Those commitments apply only when documented in a separate services agreement.
Need a full security program?
View RogueOne bundles