Integrations & CRMs

23 connectors, 30 curated CRMs. Inferred CRMs for the rest.

Connectors pull evidence directly from the vendor API. Curated Customer Responsibility Matrices say what each vendor covers and what stays with you, the split your SSP has to document. Where a vendor has no connector (PreVeil, Virtru, Brivo), you upload evidence against its curated CRM; Garde1 still needs a Microsoft 365, Google Workspace or AWS tenant to connect to. Anything else in your stack gets a CRM inferred from that product's profile and your scope.

Book a demo Read the scope policy

Or start a 14-day trial and connect one system yourself.

Connectors

Generally available

Curated CRMs

Default writes

Connectors

23 connectors. Evidence pulled directly via the vendor API.

5 are generally available; the rest are in beta. Read-only by default. Write-capable scopes are opt-in per integration for remediation and baseline workflows only.

Workspace

Microsoft 365GA

Identity, email, collaboration, device and data-protection evidence: Entra, Exchange, Teams, SharePoint, Intune, Defender, Purview. Curated CRM.

How many CMMC controls it covers →

Google WorkspaceGA

Identity, collaboration, device, Drive, activity and security-policy evidence. Curated CRM.

How many CMMC controls it covers →

Cloud Security

Microsoft AzureGA

Subscriptions, resources, IAM, policy, networking, logging and Defender for Cloud evidence. Curated CRM.

Google CloudGA

Projects, IAM, compute, storage, networking, organization policy, logging and Security Command Center evidence. Curated CRM.

Amazon Web ServicesBeta

IAM, compute, storage, networking, logging, Security Hub and infrastructure evidence. Curated CRM.

How many CMMC controls it covers →

Identity

OktaBeta

Users, groups, MFA, applications and access policy. Curated CRM.

DuoBeta

User status, MFA enrollment and enrolled factors. Curated CRM.

Ping IdentityBeta

PingOne user accounts, MFA devices, sign-in sources and last sign-on. Curated CRM.

SlackBeta

Enterprise Grid member status, activity, two-factor and SSO. Curated CRM.

Endpoint

CrowdStrike FalconGA

Devices, installed software, protection policy, file integrity, detections, identity and vulnerabilities. Curated CRM.

How many CMMC controls it covers →

SentinelOneBeta

Endpoint posture, threat detection and incident evidence. Curated CRM.

Jamf ProBeta

Apple device inventory, baselines and security configuration. Curated CRM.

NinjaOneBeta

Endpoint inventory, policy, patch and security configuration. Curated CRM.

SIEM

SplunkBeta

Audit-log collection, security monitoring and event evidence. Curated CRM.

Vulnerability Mgmt

TenableBeta

Vulnerability scanning, asset discovery and risk evidence. Curated CRM.

Network

Palo Alto NetworksBeta

Strata Cloud Manager firewalls, security zones, interfaces, routing and security rules. Curated CRM.

Cisco MerakiBeta

Networks, devices, VLANs, firewall rules and wireless. Inferred CRM.

HPE Aruba Networking CentralBeta

Managed wireless networks and SSID evidence. Curated CRM.

Ubiquiti UniFiBeta

Sites, gateways, switches, access points, WLANs and segmentation. Curated CRM.

Dev, ticketing & training

GitHubBeta

Members, repositories, merged pull requests, secret scanning and vulnerability alerts. Curated CRM.

GitLabBeta

Users and two-factor, merged merge requests, incidents and vulnerabilities. Curated CRM.

ServiceNowBeta

User roles, change requests, security incidents, vulnerabilities and policies. Curated CRM.

KnowBe4Beta

User roster, training enrollment and status, and group membership. Curated CRM.

First-class CMMC support

7 more vendors. Curated CRM plus evidence upload.

Garde1 has no connector for these yet, but they show up constantly in DIB scopes: PreVeil, Virtru and Kiteworks for CUI email and file sharing, Brivo for physical access. Garde1 ships the Customer Responsibility Matrix so you can document them cleanly in your SSP package, and the platform's manual evidence upload lets you attach screenshots, exports, and configuration dumps directly to the controls those CRMs cover. No API required, no control left unevidenced.