Turned a painful confusing process into an achievable one. And my support interaction with them was first class.

At Conquest Security, our GRC practice focuses on designing, implementing, and sustaining Information Security Management Systems (ISMS) that help organizations manage risk, demonstrate compliance, and continuously improve their cybersecurity maturity. We use SAMMY as a core platform to support NIST CSF–based programs, ISO/IEC 27001 implementations, and CMMC Level 1 and Level 2 readiness as a CMMC Registered Practitioner Organization (RPO). ISO/IEC 27001 and CMMC both require more than documented controls. They require operational discipline, defined responsibilities, and evidence of sustained execution. SAMMY provides a practical platform for documenting control implementation, assigning ownership, tracking risk treatment actions, and maintaining evidence over time. For our CMMC Level 1 and Level 2 readiness work, this is critical. We can clearly show how practices are implemented, monitored, and sustained rather than assembled as one-time compliance artifacts. SAMMY brings together assessments, control libraries, and evidence tracking in a single system. This integration is particularly valuable for organizations that align enterprise risk management, NIST CSF outcomes, ISO/IEC 27001, and CMMC practices. It reduces duplication, improves traceability, and supports consistent results across internal reviews, readiness assessments, and external audits. From an ISMS perspective, this directly supports continuous monitoring and management review activities. The Codific team demonstrates a strong practical understanding of cybersecurity frameworks and real-world GRC implementation challenges. Their support reflects how organizations actually build and operate CSF-aligned programs, implement ISO/IEC 27001, and prepare for CMMC assessments. This domain expertise accelerates onboarding and improves long-term adoption, particularly for small and mid-sized organizations without dedicated internal GRC teams.

It's the best commercially supported tool for rolling out SAMM, and scales well from a single scope to complex multinational organizations. It really shines when teams are empowered to take charge of their own improvement roadmap, as it creates a central hub for all stakeholders to keep tab on progress. The pace of development is fast and the codific team is always ready to listen to feedback and incorporate suggested improvements if they believe it benefits the wider usebase. The tool has evolved from a SAMM tool to a more generic maturity management suite with coverage for several widely used frameworks in the GRC and product security space.