Tech Stacks lets you build one library of the vendors and products you deploy, bundle them into reusable stacks, and share a stack with a client so their compliance assessment gets answered for them — automatically.

This guide covers both sides of the feature: the partner (MSP) portal, where you build and share stacks, and the client portal, where your customers see and work with what you've shared.

Why use Tech Stacks

Most MSPs deploy the same core toolset across many clients — the same EDR, the same identity provider, the same backup tool. Without Tech Stacks, every client's compliance assessment treats those tools as brand new: the same questions get answered by hand, client after client.

Tech Stacks turns that repeated work into reusable assets:

• One library for everything you deploy. Maintain a single Product Library of your vendors and products. Add a tool once and reuse it everywhere instead of recreating it per client.

• Curated, reusable stacks. Group all the products you deploy for a similar client (or group of similar clients) into one named Tech Stack you can share to many clients and clone into variants. Because each client can have only one active stack, a stack should cover that client's whole toolset rather than being split into several.

• Auto-answered assessments. Each product is mapped to the compliance controls it helps satisfy. When you share a stack, ControlMap uses those mappings to pre-answer the matching assessment questions in the client's environment — so a client starts with real progress instead of a blank slate.

• Built-in vendor due diligence. A Quick Assessment on every vendor captures the short risk questionnaire (handles PII? has a SOC 2?) in one place, and shares with the client when relevant.

• Consistency across your clients. Every client gets the same vetted products, mappings, and answers — so your compliance posture is uniform and easy to defend in an audit.

The chain that makes it work: Product → mapped controls → shared stack → auto-answered client questions. Keeping your product-to-control mappings accurate is what drives the time savings.

You reach the feature from the top menu: Tech Stacks.

Key terms at a glance

Partner (MSP) portal

Everything you do as a partner happens in the partner portal: build your product library, assemble stacks, and share them with clients. New and existing partners start in the same place and follow the same flow — both import products from the global catalog the same way. The only thing that differs for an existing partner is what happens when a product they add involves a vendor a client already has, which the sharing section below covers.

Getting started: what you see first

Everyone starts here the first time they open Tech Stacks — whether you're new to ControlMap or an existing partner. With no products and no stacks yet, Tech Stacks opens on a Get started screen with a single action: Import products from global catalog. Existing partners build their library and first stack from this same screen — there's nothing to manage until you start building.

Once you add your first product, the feature organizes into two tabs:

• Product Library — every vendor and product you've added.

• Tech Stacks — your reusable bundles. This tab only appears once you've created your first stack.

Until you create a stack, the Tech Stacks tab stays hidden and you see a "Create your first Tech Stack" prompt. Your library stays intact whether or not you have stacks.

The natural order is: build your local product library → group products into a stack → share the stack with a client. The sections below follow that path.

Already using ControlMap? Bring your existing vendors into stacks

If you already manage clients in ControlMap, you don't start over. Adopting Tech Stacks is additive, and it's built to protect the work your clients have already done.

What we recommend

1. Start from the tools you deploy most widely. Think about the vendors and products you roll out across the most clients, then import those from the global catalog to build your library. You're building the library from the catalog — nothing is pre-loaded, so there's nothing to find or recreate.

2. Build one standard stack first. Group your common core tools (identity, EDR, backup) into a single stack. Most catalog products arrive with their control mappings already set up for you — review them and adjust if you like, then share. One solid stack shared widely beats many half-built ones.

3. Share to a pilot client, confirm, then roll out. Share to one client, check the result in their portal (see the Client portal section), then share the same stack to the rest.

How sharing treats clients who already have vendors

• No duplicate client vendors. When you share a stack to a client who already has a vendor with the same name, ControlMap links to that existing vendor instead of creating a second copy, and keeps the client's history intact.

• Client Quick Assessment answers are never overwritten. Any Quick Assessment question the client has already answered keeps the client's answer exactly as they left it. Only Quick Assessment questions the client has left unanswered get filled in from your stack; Quick Assessment questions you supply that the client hasn't seen are added as managed by you.

• Client-added content is preserved. Documents, links, and notes your client added on their own side stay in place across a reshare.

Best practices

• Mappings stay in sync. Many catalog products arrive with their control mappings already done for you. For products that don't have mappings — custom products you create, or catalog products without a preset mapping — you can set the mappings yourself. Either way, any change you make to a product's mappings flows automatically to every client you've shared it with — no reshare needed.

• Reshare only when you add a new vendor or product. Adding a new vendor or product to a stack reaches the client only after you reshare. Content changes within products already shared — documents, links, detail edits, and mapping changes — flow automatically (see "Keeping clients in sync").

• Use one stack per client. Each client can have only one active stack at a time. A stack should cover all the products you deploy for that client (or a group of similar clients) rather than being split into several stacks per client.

• Clients keep their own vendors. Your clients can still create vendors manually in their own portal, exactly as before. A vendor a client creates stays client-owned and is not synced to any stack — unless you later share a stack that includes a vendor of the same name, in which case ControlMap links the two. A standalone client vendor uses the original default Quick Assessment questions and is not tied to your customizable stack question set, so edits you make to your stack's default questions don't change it.

You can roll Tech Stacks out across an existing client base without wiping out work clients have already done.

1. Build your Product Library

Your first action as a new partner is to bring in the tools you deploy. You do that by importing from the global catalog — and from the moment you start selecting products, you get a live preview of the value they'll bring.

Add products from the global catalog

To bring in catalog products:

1. Open Tech Stacks and click Import products from global catalog.

2. Search or filter by category, then select the products you use. Products already in your library show a Selected pill.

3. Click Add products and close to save.

Most catalog products arrive with their control mappings already in place, so once a stack containing them is shared with a client, they can auto-answer that client's assessment questions right away.

The auto-answer preview widget. As soon as you open the global catalog, a live Auto-Answered Assessment Questions panel sits alongside your selections — this is your first look at it. It's a projection of how many of a client's assessment questions the products you've selected would answer automatically once a stack is shared, broken down by framework (e.g. NIST CSF 2.0, CIS Controls, SOC 2). It updates as you add or remove products, so you can see each product's contribution before you ever share. The same panel follows you through the Product Library and stack screens.

Your populated Product Library

Once you've imported products, the Product Library tab lists them and the header shows how many vendors and products you have. Use View By to change how the library is organized:

• Vendors — grouped by vendor; expand a vendor to see its products.

• Categories — grouped by category (a product can appear under more than one).

• Products — a flat, sortable list with a status column and multi-select.

There's a Search box on every view, and Import products from global catalog stays available to add more.

Add a custom product (and vendor / category)

If a product isn't in the catalog, add it manually.

1. Open the Add product drawer. Click + Add New Product (the first card), then fill in the name, description, and URL.

2. Set the vendor. Start typing in the Vendor field; if there's no match, choose + Add New Vendor "{name}" to create it. A custom vendor is tagged Custom, and you can upload your own logo — an initials placeholder stands in only until you do.

3. Set the category. Do the same in the Category field — + Add New Category "{name}" creates it inline.

4. Save. Click Add Product. The new product, vendor, and category appear immediately and the counts update.

Mapping controls is optional. A custom product starts with no mapped controls. Without them it simply won't contribute auto-answers when its stack is shared — auto-answering is an added benefit, not a requirement. Map controls only if you want this product to help answer the client's assessment questions.

A product's details

Click a product to open it. It has three tabs:

• Details — logo, name, vendor, categories, and an editable description, URL, and notes.

• Documents and Links — attach supporting documents (up to 10 MB each) and reference links.

• Mapped Controls — the compliance controls this product helps satisfy, grouped by program/framework. This mapping drives the auto-answers when you share a stack, so keeping it accurate matters.

To change mappings, open Mapped Controls → Add Mapping, search a control, and click it to map. Click Unlink to remove one.

Mapping changes apply immediately — no save step or confirmation. If the product is in a stack you've already shared, adding or removing a control changes what gets auto-answered for that client, so edit mappings deliberately.

A vendor's record

Click a vendor to open its record: stat cards (products, categories, controls, stacks), the products it owns, an editable description, and a Quick Assessment tab (next section).

2. Vendor Quick Assessment

On a vendor record, the Quick Assessment tab captures a short vendor due-diligence questionnaire. Every vendor is seeded with the same default questions so you have a consistent starting point — for example:

• Does the vendor store personally identifiable information (PII) or protected health information (PHI)?

• Is there a fully executed contract in place that includes appropriate confidentiality terms?

• Did the vendor provide a SOC 2 audit report?

What each question has:

• Answer — Yes / No / Partial / N/A.

• Notes and Documents — per question.

• Risk level — Low / Moderate / High / None, derived from the answer you choose (you don't set it manually).

What you can do:

• Add a question — + Add Question: enter a Question Code and Question Text, and set the answer options.

• Reorder questions — drag the six-dot handle at the left of each row. The partner-set order carries through to what the client sees; clients can't reorder questions in their own portal.

Heads up — this applies to every vendor at once. Quick Assessment questions are shared across all vendors in your Product Library. Adding, editing, or deleting a question updates the Quick Assessment on every vendor — including vendors already shared with clients through a stack. ControlMap asks you to confirm before applying it, and the change can't be undone, so review it carefully.

3. Build a Tech Stack

From the "Create your first Tech Stack" prompt (or Create Tech Stack, top-right), the create page lets you:

1. Enter a Tech Stack Name (required) and an optional description.

2. Select the products to include from the catalog table.

As you select products, a live auto-answer preview shows how many assessment questions this stack would answer. Create Tech Stack activates once you've set a name and at least one product.

Once you click Create Tech Stack, the new stack opens with its products, metrics, and a Shared to Clients card — ready to share.

Add products to an existing stack

Open a stack and click Add products to {Stack}. Selections apply immediately and the auto-answer count updates live. Click Done adding to return. (If the stack is already shared, see Keeping clients in sync — adding a product needs a reshare to reach the client.)

Clone a stack

From a stack's actions (⋮) menu, choose Clone to start a new stack pre-filled with "Copy of {Stack}" and all its products — handy for a variant.

4. Share a stack with a client

Open a stack and click Share to launch the four-step wizard.

1. Clients. Choose one or more clients. A client that already has a different stack is greyed out, because only one stack can be active per client.

2. Product Status. Set each product's implementation status (Implemented / Partially Implemented / Not Implemented). A donut shows how many questions will be answered. Only products marked "Implemented" auto-answer the client's assessment questions — Partially Implemented and Not Implemented products are still shared (vendor, product, and mapped controls all appear in the client's portal) but contribute no auto-answers.

3. Impact. Review the requirements and questions that will be auto-answered, and which product answers each. Expand a requirement for detail.

4. Confirm. Review the summary and click Confirm Share Stack.

Implementation status gates the auto-answers. Auto-answering only happens for products you mark Implemented in this step. A product left at Partially Implemented or Not Implemented still shares its content with the client, but it stays out of the auto-answer count until you change its status to Implemented and reshare. This lets you share a tool you've only partly rolled out without it answering compliance questions on the client's behalf.

After sharing, the stack's Shared to Clients card lists each client.

5. Keeping clients in sync

Once a stack is shared, some of your later changes flow to the client automatically, while others wait until you reshare. Knowing the difference tells you when an extra step is needed.

Rule of thumb: changes within the products already shared flow on their own; adding something new to the stack requires a reshare to push it out.

The "needs reshare" indicator

When you make a change that requires a reshare (such as adding a new product to an already-shared stack), the Share button flags that the stack is out of sync with its clients — a reminder that there are MSP-side changes the clients haven't received yet. When you see it, re-run the Share wizard to push the new content. Resharing pre-selects the clients who already have the stack, so you only confirm.

Reshare

Click Share again on an already-shared stack. Clients split into those not yet shared (to add) and those that already have it (pre-checked). Completing the wizard updates existing clients with any newly added products.

6. Removing things (and what your client keeps)

Tech Stacks protects you from accidentally wiping out client data. When you remove something that is shared with a client, you're asked what should happen to that client's data, with three choices:

1. Keep and retain status — remove it from the stack but leave it active on the client.

2. Mark as Inactive — the data stays on the client but is excluded from assessments and reports.

3. Delete data — permanently remove the shared products, mappings, and auto-answered questions.

These options appear when you:

• Unlink a client (Shared to Clients → Unlink).

• Remove a shared product from a stack (per-product Remove, or multi-select then bulk Remove).

• Delete a stack that's shared (actions ⋮ → Delete).

If a product isn't shared with any client, removing it is a simple one-step confirmation — there's no client data to protect. Removing a product from your library (product detail → Delete) works the same way and takes it out of every stack it appears on.

"Delete data" is the only permanent option. To prevent accidents, it asks you to type `DELETE` before the button activates.

Tip: Read each option's description before confirming — your choice determines whether the client keeps, deactivates, or loses the shared data. Only "Delete data" is irreversible.

Client portal: what your customer sees

When you share a stack, your client doesn't see "a stack" as an object — they see the vendors, products, auto-answered assessment questions, and documents it brings into their own portal, each clearly marked as Partner managed. This section walks through their view so you can explain it and know what's safe for them to touch.

How a shared stack appears

The shared content lands in the client's existing workspace under Risks → Vendors. There's no separate "Tech Stacks" area on the client side — the products and vendors simply appear in the lists they already use, with a Partner managed label showing the content comes from you.

Vendors and products your client sees

Each vendor from the stack shows in the client's Vendors list with a Partner managed pill, alongside its Quick Assessment progress, status, risk score, and tier.

Opening a vendor reveals a Products tab listing the products you shared, each with its category, stack, type, status, and mapped-control count. Clients open a product to see its details, documents/links, and mapped controls.

A shared product's Mapped Controls tab shows the controls it satisfies and the AI rationale behind each match — the same mappings that power the auto-answers.

Quick Assessment on the client side

Each vendor carries the Quick Assessment questionnaire. On a partner-managed vendor, every question you supply is tagged with a Partner managed checkbox at the question level. While that box is checked, the question's answer is locked — the client sees your answer but the answer controls are disabled. The client still answers any questions you haven't filled, and can add and answer their own questions, with their risk score updating from those answers.

The client can take control of any individual question. A partner-managed question isn't permanently locked. The client can un-check its Partner managed box to take it over:

• The answer controls unlock, so the client can pick their own answer (Yes / No / Partial / NA). Their answer recalculates the question's and vendor's risk score and stamps a Last Answered date. A Delete control also appears for that question.

• While a question is taken over (un-checked), resharing the stack to that client won't overwrite their answer — their version is protected.

• The client can re-check Partner managed to hand control back. Their current answer is kept in view and the controls re-lock. Handing it back also makes the question managed by you again, so your future updates to that question can flow to it on a later reshare.

• This is local to that client: it doesn't change your MSP-side question, the seeded defaults, or any other client. There's no equivalent switch on the MSP side — every question that originates from you is partner-managed by default, and the client decides per question whether to take it over.

Vendors your client creates on their own

Your client can still add vendors manually in their own portal, just as before. These standalone vendors behave differently from the ones a stack brings in:

• They stay client-owned and unsynced. A vendor your client creates is not tied to any stack and isn't managed by you — as long as you haven't shared a stack with that client that includes a vendor of the same name. If you do share a same-name vendor, ControlMap links the two; otherwise the client's vendor keeps working the way it always has.

• They use the original default questions. A standalone client vendor starts with the original default Quick Assessment set — it is not tied to your customizable stack question set, so any edits you make to your stack's default questions don't change it.

The original default Quick Assessment questions are:

1. VQ-001 — Does the vendor store personally identifiable information (PII) or protected health information (PHI)?

2. VQ-002 — Is there a fully executed contract in place that includes appropriate confidentiality terms?

3. VQ-003 — Did the vendor provide a SOC 2 audit report?

4. VQ-004 — Is the vendor certified for ISO 27001 or similar and relevant certifications?

5. VQ-005 — Is an SLA in place if the vendor provides business-critical services?

Auto-answered assessment questions and their source

A key benefit for your client shows up in their compliance Assessment: questions your stack covers arrive already answered. Each auto-answered question shows a source line explaining where the answer came from — the stack, the product, who confirmed it, and when — so the answer is traceable for an audit.

Example source line: "Auto-answered Yes — from tech stack 'Core Security Stack' (product: ThreatLocker Application Allowlisting). Confirmed by Jamie Kandola on Jun 24, 2026."

Documents and links: what's visible and editable

Documents and links you attach to a shared product appear on the client's product → Documents and Links tab as read-only — the client can view and download them but can't edit or delete them (an info icon notes they're Managed in the MSP Admin Portal). The client can still upload their own documents and add their own links, which stay on their side.

How partner-managed content is shown

Across the client portal, anything you control is labeled so the client knows not to expect to edit it:

• Vendors carry a Partner managed pill in the list and on the record.

• Documents and links you attach are read-only with a Managed in the MSP Admin Portal indicator.

• Quick Assessment questions you manage arrive locked, but each one carries a Partner managed checkbox the client can un-check to take over and answer themselves.

• Auto-answered questions show their stack/product source line.

The client always keeps the ability to add their own vendors, questions, documents, and links — your managed content sits alongside theirs without overwriting it.

Activity Log: a record of every tech-stack change

Every stack change you make flows into your client's own audit trail under Settings → Activity → Activity Log. Each entry names the stack, the person who confirmed it, and the date, so your client — and an auditor — can trace exactly what arrived from you and when.

What gets logged today:

The auto-answer entry records the committed answer — 'Yes', 'No', 'Partial', or 'NA' — matching whatever the mapped controls resolved to.

A couple of things to know:

• Unsharing from a single client while keeping their data writes no removal entry — nothing is removed from that client, so there's nothing to log.

• Documents and links don't get their own log line — they arrive attached to the vendor and product entries above.

Frequently asked questions

Do I have to rebuild vendors I already set up for my clients?

No. Products already in your library go straight into a stack, and when you share to a client who already has a same-name vendor, ControlMap links to it instead of creating a duplicate.

Will sharing a stack overwrite answers my client already entered?

No. Answers your client has already given are never overwritten. Only unanswered questions get filled from your stack.

I added a product to a shared stack but my client doesn't see it. Why?

Adding a new product or vendor reaches the client only after you reshare. The Share button flags when a stack is out of sync — re-run the wizard to push the new content.

What's the difference between removing a product from a stack and deleting it from my library?

Removing it from a stack only takes it out of that bundle. Deleting it from your local Product Library (your own list of products, not the global catalog) removes it from every stack it appears on. The global catalog is unaffected either way — you can always re-import the product later. And whenever the product is shared with a client, you choose what happens to the client's data.

Can my client edit the things I manage?

Mostly it's read-only: managed vendors, and the documents and links you've attached, stay locked on the client side (they can view and download, not edit or delete). Quick Assessment questions are the exception — each managed question has a Partner managed checkbox the client can un-check to take that question over and set their own answer (and re-check to hand it back, keeping their answer). And on any managed vendor the client can always add and edit their own documents, links, and questions. Your managed content sits alongside theirs without blocking it.

Can a client have more than one stack?

No. Only one stack can be active per client at a time, which is why a client already on another stack is greyed out in the Share wizard.

How does my client know an answer came from me?

Auto-answered questions show a source line naming the stack, the product, and who confirmed the answer — so it's traceable in an audit.