[6.42.32] - 2026-08-27

Added

• FedRAMP SSP interconnect and cryptographic module import commands, and an optional SSP ID on FedRAMP docx import so an existing plan is updated instead of duplicated

Fixed

• Bulk scan import no longer crashes when routing Prisma Cloud files
• OCSF and SBOM import command groups are now reachable from the CLI
• GCP sync asset-type, label, severity, source, and evidence options now change sync behavior instead of being silently ignored
• SAP Concur SysDig imports now honor the supplied scan date and the SysDig and Tenable subcommands are always registered
• Multi-collection GraphQL queries such as reminder lookups now paginate each collection independently instead of silently skipping records past the first page
• Cleanup bulk-delete commands now remove every matching record instead of silently stopping after the first page
• CVE cleanup discovery now finds issues with multiple CVEs instead of silently returning nothing
• eMASS control export retrieves every control with assessments for plans with more than 50 controls
• eMASS SLCM import no longer deletes control implementations missing from the workbook unless explicitly requested, and semi-annual review frequencies now calculate as 182 days
• eMASS POA&M pushes now carry issue details such as severity, comments, and completion dates instead of silently empty fields, and file-based DoD PKI client certificates can be configured
• Connector syncs from different vendors into the same security plan no longer close each other's findings
• Tanium Cloud compliance sync now passes through control mappings when available and alerts loudly instead of silently dropping every finding
• Dependabot sync now retrieves every alert page, fetches GitHub data once per run, and no longer creates duplicate issues on repeat runs
• GitLab issue sync now retrieves every page of issues and tracks them under a GitLab-specific identifier
• OpenSCAP compliance sync now ships its CCE mapping file and fails loudly when a configured mapping override is missing instead of silently resolving no controls
• STIG mapper now evaluates each asset against its own existing mappings so assets after the first receive complete STIG mappings
• File-based scan imports quarantine unparseable records with clear warnings instead of creating placeholder assets and findings
• Active Directory sync now aborts safely when the mapped role is missing instead of proceeding into the role-removal and deactivation flow
• Intune device sync compares versions numerically and correctly classifies macOS devices
• FedRAMP Rev 5 POAM export is now read-only by default with an opt-in flag for comment write-back, and comment templates and POAM ID prefixes are configurable
• Removed unreachable FedRAMP compatibility aliases and duplicate DRF import command that could never be invoked
• Veracode imports now assign correct severities instead of collapsing every finding to Low
• Wiz rollup and asset-identifier behaviors are now protected by contract tests to prevent silent regressions
• Model editor no longer carries one model's field layout into the next when processing multiple models in a single run
• Login failures now exit with a clear error message instead of crashing with an internal variable error
• Okta bearer tokens are no longer written to log output during authentication
• STIG checklist file parsing is hardened against XML external entity attacks
• Microsoft Defender API error handling no longer relies on assertions that disappear in optimized builds
• Salesforce sync no longer carries results across repeated runs and handles missing API responses without crashing
• Burp scan imports now accept export timestamps with or without a timezone

[6.33.3.0] 08-28-2026

Enhancements

Dashboard Consolidation

The dashboard experience has been consolidated to provide a more consistent and streamlined way to access and review organizational metrics.

Key Risk Indicator (KRI) System

Introduced a Key Risk Indicator system to help organizations monitor important risk metrics, identify threshold breaches, and track risk conditions over time.

FedRAMP POA&M Export Updates

The FedRAMP POA&M export has been updated to align with the current Rev. 5 format and now uses the Export Builder framework for improved consistency and maintainability.

Army Test Results and POA&M Exports

Added support for Army-specific Test Results and POA&M export requirements.

Army Framework Import Profile

Added a profile to support Army framework imports and simplify configuration for Army compliance requirements.

Crosswalk Importer and Converter

Added support for manually importing and converting crosswalk information from supported compliance sources.

RAG Embedding Backfill

Added support for automatically backfilling embeddings for SSPs, Control Implementations, Policies, Evidence, and Components when Retrieval-Augmented Generation (RAG) capabilities are enabled.

SSP Re-Approval for Substantive Changes

Security Plans can now be routed through the appropriate re-approval process when substantive modifications are made.

SSP Approval History

Approval history is now recorded for Security Plans when approval workflows are initiated by triggers, including configurations where the SSP Approval Workflow feature is disabled.

Evidence File Version Management

Improved Evidence file version management, including support for renumbering cycle versions to provide clearer version history.

Security Plan Bulk Editor

Improved the Security Plan Bulk Editor experience, including more consistent placement of drag handles in accordance with application UI conventions.

Catalog Navigation

Improved catalog navigation by selecting the Catalog module by default when appropriate.

Categorization Override

Added support for overriding categorization values where applicable.

AI SSP Author Selection

Improved file selection controls in AI SSP Author, including more reliable Select All and Deselect All functionality.

RegML Author Filtering

Improved bulk selection in RegML Author so that Select All respects the currently active control-family filter.

Accessibility Improvements

Improved accessibility across several areas of the application, including command palette controls, dashboard controls, theme colors, target sizes, and permission-related messaging.

GitHub and Jira Release Documentation

Added documentation describing how GitHub releases correlate with Jira release versions to improve release tracking and traceability.

Fixes

Tasks Navigation and Terminology

Corrected Tasks terminology and navigation across the main Actions module and its record-level subsystem.

File Versioning

Resolved an issue where file version increments could occur unpredictably and unrelated files could incorrectly be marked as superseded.

External Service Status

Resolved an issue preventing External Service entries from being changed to Cancelled status.

Planned Implementation Date

Fixed issues that prevented the Planned Implementation Date from being saved or persisted for controls, including Control Builder v2.

Inheritance Fields

Removed obsolete Inherited and Remote Inheritance Instance fields.

Related Policy Linking

Fixed an issue where a Related Policy selection did not correctly display or link to the associated policy in the Policy module.

Questionnaire Completion

Improved questionnaire completion calculations to provide more reliable completion status and a clear path to submission.

Component and Security Plan Associations

Resolved issues that prevented some Components from being attached to Security Plans.

Control Implementation Display

Fixed the Control Implementation list so that the associated Security Plan title is displayed correctly.

Export Builder and DOCX Templates

Resolved several export-related issues, including:

• Diagram field placeholders not being replaced correctly in DOCX templates.
• Export names incorrectly displaying "template."
• FedRAMP POA&M exports returning errors.
• Incorrect formatting of the FedRAMP POA&M export dialog.
• Raw template tokens appearing in FedRAMP Rev. 5 SSP DOCX exports.
• eMASS SSP exports failing for larger Security Plans.
• Incorrect MIME type being used for Excel downloads.

Compliance Hygiene Dashboard

Corrected the ISO 27001 catalog information displayed in the Compliance Hygiene Dashboard.

RegML Auditor

Fixed chart scaling that could display values outside the expected 0–100 range.

Evidence and Files

Resolved issues affecting the Evidence and Files experience, including:

• Incorrect Evidence badge counts.
• Evidence cycle toggle alignment.
• Evidence upload styling.
• Evidence file version numbering.
• Hard-deleted Evidence records continuing to appear in module lists.

SSP Inventory Workspace

Fixed the SSP Inventory Workspace so vulnerability and issue counts display correctly.

POA&M Status Board

Resolved issues affecting POA&M Status Board record pages and dashboard analytics, including secondary Baseball Cards that could not be selected for drill-down.

Report Builder

Fixed filtering and time-bucketing issues that could cause errors, incorrect filter behavior, or unexpected handling of dates.

XCCDF and STIG Imports

Improved XCCDF import processing to correctly handle valid Boolean values and resolved issues where imported benchmarks could not subsequently be accessed.

Questionnaire Authorization

Corrected authorization controls for Questionnaire endpoints to ensure appropriate permission checks are applied.

API Authorization and Tenant Isolation

Strengthened authorization and tenant-isolation protections across several API operations to prevent unauthorized access to data across application or tenant boundaries.

HTTP Authorization Responses

Corrected API responses so permission failures return the appropriate 403 Forbidden response instead of 401 Unauthorized.

Issue Management

Resolved several issues affecting Issues, including:

• Facility fields appearing when they should be inactive.
• Deviation Summary appearing when configured as inactive.
• Issues becoming unsavable after automation populated Date First Detected.
• Due Dates being unexpectedly replaced by SLA dates.
• Blank Date First Detected values being incorrectly populated with the current date and time.

Authorization Boundary Diagrams

Fixed an issue preventing authorization boundary diagrams from being attached or linked within the system authorization boundary description.

Workflow Designer

Resolved an issue where the workflow template designer could fail to load due to invalid automatically saved steps.

Workflow Assignments and History

Fixed workflow tooltips and history displays that incorrectly showed Assigned to: None for Manager-type workflow steps.

Policy Workflows

Resolved an issue where starting a Policy custom workflow could incorrectly activate the Evidence workflow.

Scheduled Audits

Fixed the Lightning Assessment action in Scheduled Audits so that it opens within the appropriate audit context instead of navigating away.

Third-Party Risk Assessments

Corrected the display of control descriptions in Lightning Assessments so that raw HTML is no longer displayed.

Policy Requirement Assessments

Resolved an issue preventing multiple Requirement Assessments from being created from the Assess Requirements workspace.

Security Plan Creation and Naming

Fixed intermittent errors that could occur when creating or renaming Security Plans.

Breadcrumb Navigation

Fixed an issue where Controls did not refresh correctly when navigating from a Component to its parent Security Plan using breadcrumbs.

Implementation Statements

Corrected Control behavior requiring an Implementation Statement when the Control is configured as Fully Inherited.

Form Builder

Fixed an issue where duplicating a field did not create the corresponding custom form field.

Hard Delete Processing

Resolved issues affecting deletion and record cleanup, including records remaining visible after deletion and problems with changes and interconnect deletion workflows.

Catalog Import

Fixed catalog import failures that could occur when users did not have a workspace or application in scope.

Catalog and External Mapping Updates

Improved catalog synchronization and external mapping updates to ensure changes are correctly tracked and existing mapping data is preserved.

Dashboard Drill-Down

Fixed an issue where dashboard drill-down operations could continue retrying indefinitely when underlying module data failed to load.

Application Hierarchy

Resolved concurrency issues that could cause application deletion or creation operations to become blocked or take several minutes to complete.

My Dashboard Accessibility

Improved dashboard control sizing to meet accessibility requirements for interactive target sizes.

Command Palette Accessibility

Restored appropriate accessibility semantics for the command palette and its decorative elements.

Security Plan Creation Stability

Resolved intermittent errors during Security Plan creation when newly created records could not immediately be retrieved within the request scope.

Migration Reliability

Improved migration resilience so migration circuit-breaker state persists across container restarts.

Paging and Sorting

Fixed paging behavior that could cause records to be duplicated or omitted when queries did not have consistent ordering.

KRI Grid

Resolved an issue preventing the KRI grid Save control from displaying correctly.

KRI Breach Processing

Fixed an issue where subsequent KRI threshold breaches could create duplicate Issues instead of updating the existing open Issue.

Request Logging

Corrected request logging so the logged response status accurately reflects the status returned to the client.

Token and Application Context

Resolved an issue where requests without an application identifier could receive an invalid application context, causing subsequent operations to fail.

Cascade Delete Processing

Improved cascade-delete processing to prevent database deadlocks when multiple test suites or delete operations execute concurrently.

Production Container Security

Removed unnecessary build tooling from the production application image to reduce the deployed runtime footprint.

Removed Legacy Automation Credentials

Removed an obsolete plaintext-token service account purpose associated with the retired Automation Manager functionality.

Risk Display

Fixed an issue where risks associated with a Control Implementation were not displayed correctly.

Compliance and Security

Additional security and reliability improvements were made across the platform, including stronger tenant isolation, authorization enforcement, audit handling, error responses, and protection against unintended information disclosure.

[6.42.0] - 2026-08-26

Added

• jcam position-to-role name mapping override, and a dry run that reports positions whose people would not be imported at all
• Splunk evidence owner and approver settings, and a splunkSids setting for offline evidence backfill runs
• Opt-in Wiz incremental pulls that fetch only the inventory, issues, and vulnerabilities changed since the last successful sync
• New jcam preview_poc_roles command reports which points of contact would import as system roles, how many people would be assigned as users versus held as stakeholders, and which positions have no matching role, without writing anything
• JCAM points of contact are imported into RegScale system roles of the same name where one exists, alongside the existing custom fields, so repeated approver and reviewer positions no longer need a custom field each
• New jcam check_custom_fields command reports every custom field the import needs that a tenant is missing, grouped by module and tab, in one pass instead of one failed import at a time
• Prisma Cloud CSPM asset and vulnerability sync
• Palo Alto Networks SCM Compliance Center integration with control assessments, control tests, evidence collection, and POA&M creation
• FIPS-validated cryptographic modules in FedRAMP OSCAL SSPs are now imported into the RegScale Cryptography module

Changed

• Splunk evidence ingestion now refreshes the owner, approver and description on evidence it reuses across runs
• Scheduled automation guidance now covers CRON and Kubernetes CronJobs in place of Airflow DAGs
• Retired Airflow support: the Airflow container image, DAGs, and the airflow install extras are no longer published
• Stakeholder and system role external assignment records are no longer duplicated when an import is re-run

Fixed

• AWS ECR evidence collection now scopes Inspector V2 vulnerability findings by account ID and tags
• AWS findings evidence generation and OCSF export runs now honor account ID and tag filters instead of ingesting every finding in the region
• AWS findings runs scoped by account ID or tags no longer close existing issues that belong to accounts or tags outside the requested scope
• AWS Security Hub findings sync now honors account ID and tag scoping instead of returning findings for the entire region
• JCAM import now reports how many points of contact were imported and skipped instead of dropping unmatched people silently, and fails with an actionable message when required custom fields are missing
• QRadar event sync now scopes queries to the configured lookback window, which previously failed against the QRadar API
• FedRAMP OSCAL import now reads component types and property values from Rev4-era (OSCAL 1.0-Milestone2) documents in addition to Rev5
• FedRAMP SSP import now creates interconnection records and preserves connection security, data direction, information transmitted, and external point of contact details

[6.33.2.2] 08-24-2026

Fixes

Resolved an issue preventing users from logging in after a version upgrade

Fixed an issue where users could be unable to log in after a RegScale version upgrade if they did not click the Refresh option in the version update notification before it disappeared. This issue was related to browser caching and could also affect users who were signed out due to inactivity and subsequently attempted to sign in.

Users can now access the application normally after an upgrade without being blocked by a missed refresh notification.

ROH 6.32.0.5 Release

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.32.0.5

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What’s Fixed

• Single sign-on “no configuration found for tenant” bug: customers that use single sign-on with users previously encountering this error will now be able to log into their Orchestration Hub and RegScale instance after fixes to the single sign-on processor.

Deployment Notes

The Orchestration Hub 6.32.0.5 Release requires RegScale 6.33.2.0 or newer for compatible, single sign-on fixes.

[6.33.2.1] 08-21-2026

Fixes

Resolved Duplicate Fields in the Control Implementation Parts Tab

Resolved an issue where fields in the CI Parts tab could appear multiple times, creating duplicate entries and making it difficult to accurately review and manage control implementation information.

The CI Parts tab now displays each field as expected, providing a cleaner and more consistent user experience.

[6.33.2.0] 08-20-2026

Enhancements

FedRAMP and Compliance

• FedRAMP Deployment Provider Gating
  Added provider gating for FedRAMP in-boundary deployments to help ensure that government and dedicated environments use supported and compliant service providers.

• POA&M Status Board Enhancements
  Enhanced the POA&M Status Board with interactive charts and tables, allowing users to select dashboard metrics and drill into the underlying POA&M records.

• POA&M Date Filtering
  Added improved date filtering capabilities to the POA&M Status Board for more targeted analysis of POA&M activity.

• POA&M Workflow Status Filtering
  Added workflow status values and corresponding Status Board filters to make it easier to track POA&M progress.

• POA&M Deviation Request Filtering
  Added the ability to filter POA&Ms based on whether a deviation request is required.

• FedRAMP POA&M Export Improvements
  Improved POA&M exports to support long asset-identifier lists without exceeding Excel cell-size limitations.

• FedRAMP Inventory Export Reliability
  Improved background processing and error handling for FedRAMP Inventory exports.

• OSCAL/XCCDF File Support
  Added to supported file formats, enabling users to upload XCCDF-formatted content.

Security and Access Control

• Authentication and JWT Hardening
  Strengthened authentication and JWT handling to improve platform security.

• Service Account Token Rotation
  Added a service-account token rotation capability to support recovery when signing keys change.

• Improved Service Account Security
  Improved application scoping for service-account operations to ensure users only interact with accounts available within their authorized application context.

• Enhanced Access Control Filtering
  Improved user and group selection controls and filtering to provide more efficient and appropriately scoped access-management experiences.

• View-Only Evidence Protection
  Strengthened access controls to prevent view-only tenant users from accessing raw evidence payloads outside their authorized capabilities.

• Assessor Authorization Improvements
  Added additional tenant and engagement validation when recording assessor determinations.

• Cross-Tenant Data Protection
  Strengthened tenant isolation across questionnaire, vulnerability, GraphQL, and other API operations.

Audit and Governance

• Evidence Access Auditing
  Expanded auditing for evidence access so activity is captured on the application paths most commonly used by tenant members.

• Validation Mapping Audit Visibility
  Improved audit information for validation mappings, including visibility into who confirmed a mapping and when.

• KSI Revision Chain Auditing
  Improved revision-chain auditing to preserve the actor associated with KSI assertions.

• System Document Version History
  Improved system document lifecycle management by adding version-history support and safer handling of deleted documents.

• Evidence Ingest Monitoring
  Improved automated evidence ingestion visibility so rejected evidence and validation failures can be surfaced rather than silently disappearing.

App Builder and Administration

• Search and Replace Utility
  Added a Search and Replace utility to simplify bulk updates to applicable platform content.

• Security Profile Management
  Improved installation, display, and management of RegScale security profiles.

• Color Theme Administration
  Improved tenant validation and error handling when configuring color themes.

• Categorization Engine Configuration
  Improved the categorization-engine workflow so users can continue configuring questions immediately after creating an engine.

• Security Plan Wizard
  Expanded access to the Security Plan Wizard from applicable Security Plan creation workflows.

• Access Control User Pickers
  Modernized user and group selectors for improved performance and usability.

Questionnaires and Workflow

• Questionnaire Scoring Improvements
  Improved questionnaire scoring behavior, including checkbox-based scoring and maximum-score calculations.

• Questionnaire Assignment and Notification Improvements
  Improved questionnaire assignment, feedback, and submission notification workflows.

• Questionnaire Rules Engine Experience
  Improved the Rules Engine interface to provide a clearer and more consistent save experience.

• Workflow Approval Experience
  Improved approval workflow panels, comments, rejection routing, and handling of deleted records associated with approval workflows.

Reporting and Dashboards

• Report Builder Improvements
  Improved report generation and handling of vulnerability-related report modules.

• Dashboard Drill-Down Improvements
  Improved dashboard drill-down behavior to ensure users receive appropriately filtered results.

• Compliance Explorer Improvements
  Improved cross-framework coverage calculations so partial coverage is accurately represented.

• Security Plan Export Improvements
  Improved exports so objective-row control mappings are correctly represented.

• MAC Address Validation
  Standardized MAC address formatting and validation across supported interfaces and backend services.

Performance and Reliability

• Vulnerability Processing Performance
  Improved vulnerability batch processing by reducing unnecessary database queries and duplicate operations.

• Background Job Reliability
  Improved background-job status handling so unsuccessful operations are no longer incorrectly reported as completed.

• Artifact Lifecycle Management
  Improved artifact expiration processing to ensure expired artifacts are handled as expected.

• Application Logging Improvements
  Improved application logging and monitoring integration to provide better visibility into application activity and failures.

• Event and Webhook Management
  Improved webhook administration and event-management interfaces, including better responsive behavior and accessibility.

• Responsive Dashboard Experience
  Improved dashboard layouts for narrower screen sizes to prevent horizontal overflow.

---

Fixes

Compliance and FedRAMP

• Fixed an issue where SSP Control Implementations were sorted correctly in the middle panel but not in the left navigation panel.
• Fixed mismatches between Control Implementation fields exposed through the UI and API.
• Fixed an issue preventing Security settings from being cleared on child records when using Apply to Child Records.
• Fixed an issue where CIS/CRM imports did not advance the last-updated timestamp for control parts.
• Fixed SSP Author processing that caused the entire plan to be processed regardless of accepted mappings.
• Fixed assessment-generated POA&Ms receiving identical or non-descriptive titles.
• Fixed automatic POA&M creation when a failed test references a missing parent test.
• Fixed several FedRAMP import services that failed to populate audit timestamps on imported records.
• Fixed FedRAMP Inventory exports that could report completion without generating an output file.
• Fixed inventory exports that could fail because of memory limitations.
• Fixed an issue where the FedRAMP Inventory export background process could fail and prevent subsequent exports.
• Fixed Security Plan exports where objective-row control mappings were displayed incorrectly.
• Fixed an issue where Not-Applicable KSIs were incorrectly included in provider compliance percentages.
• Fixed Compliance Explorer reporting that incorrectly represented partial cross-framework coverage as full coverage.

Evidence and Files

• Fixed the Upload Multiple Files functionality.
• Fixed file uploads being rejected because the extension was not included in permitted file extensions.
• Fixed replaced and deleted file uploads remaining in cloud storage.
• Improved evidence-file lifecycle handling during version-to-cycle transitions.
• Fixed Evidence & Files behavior within the SSP Subsystem workflow.
• Fixed an issue where rejected evidence from automated ingestion was not surfaced to users.
• Fixed an issue where evidence validation could stop without providing an indication that processing had failed.

Security and Tenant Isolation

• Fixed tenant-isolation issues involving questionnaire instances accessed without the appropriate tenant scope.
• Fixed GraphQL vulnerability-mapping queries that could bypass tenant and application filtering.
• Fixed a security issue where RegML could retrieve implementation statements from another application or the default application.
• Fixed an issue where assessor determinations did not adequately validate the associated engagement and tenant.
• Fixed an issue where view-only tenant users could access raw evidence payloads.
• Fixed service-account operations that were inconsistently scoped between listing and individual account operations.
• Fixed application and tenant validation issues affecting color-theme endpoints.
• Fixed an issue where administrators could receive incorrect authorization responses from GraphQL parameter queries.

Authentication and Identity

• Fixed Entra SAML thin provisioning so newly provisioned users receive their email address, first name, and last name.
• Fixed AD/LDAP synchronization from the AD/SYNC Preview page.
• Fixed authentication failures affecting the Harvester following security updates to the platform.
• Fixed an issue where valid lockout duration values of were rejected.
• Fixed Swagger-generated API commands that omitted the required API-version header for v1 and v2 calls.
• Fixed several API authorization responses that incorrectly returned HTTP 500 instead of HTTP 403.

Questionnaires

• Fixed questionnaire assignment and submission notifications that were not consistently generated.
• Fixed the Send Feedback workflow routing respondents to My Workbench instead of the questionnaire.
• Fixed question-level feedback emails that were not being sent to external respondents.
• Fixed questionnaire checkbox scoring that could report a maximum score lower than the actual possible score.
• Fixed questionnaire score calculations that could exceed 100%.
• Fixed questionnaire rule-builder behavior involving assignment-month calculations and boolean/zero-valued responses.
• Fixed confusing Rules Engine behavior caused by multiple Save buttons.
• Fixed questionnaire view-model handling.

Workflows

• Fixed approval workflows and notifications that remained after the associated record was deleted.
• Fixed workflow-template loading failures caused by invalid auto-save submissions.
• Fixed workflow instances incorrectly returning HTTP 403 when an authorized user had no visible workflow steps.
• Fixed workflow approval comments and rejection-routing behavior.
• Fixed background workflow processing where unsuccessful results could incorrectly be reported as completed.

Reporting and Dashboards

• Fixed unexpected data appearing in Report Builder columns.
• Fixed the Issue by Security Plan and Deviation Status report drill-down link.
• Fixed vulnerability report generation failures caused by unsupported module handling.
• Fixed dashboard drill-down queries that could load unfiltered data.
• Fixed issues-by-status-and-owner components that could fail when API responses were not returned as arrays.
• Fixed Issues by Status and Owner reports to correctly process paginated API responses.
• Fixed Manage Risks drill-down pagination alignment.
• Fixed ScoreCard Issues, Milestones, and Tasks tabs appearing empty for certain record types.
• Fixed Gantt views incorrectly capping displayed issues and reporting the page size as the total.
• Fixed AI-generated narrative citations being calculated but not displayed to reviewers.

Export Builder

• Fixed Export Builder mappings that displayed Select... instead of the saved field name when reopened.
• Fixed Sub Template mapping dropdowns that displayed Select rather than the mapped field name.
• Fixed Export Builder service and worksheet-related contract issues.
• Fixed export-template validation messages to provide more specific guidance.
• Fixed seeded export names and descriptions being unintentionally reset to their defaults.
• Fixed FedRAMP inventory and POA&M export reliability issues.

App Builder and UI

• Fixed the Duplicate hover state in App Builder App Management appearing continuously.
• Fixed the Security Profile installation page displaying raw catalog UUIDs instead of readable profile names.
• Fixed the Security Profile deletion workflow.
• Fixed the Profile Importer page title being overwritten by an embedded registry component.
• Fixed the SSP Wizard Finish button displaying an incorrect toast message.
• Fixed builder-wizard completion behavior when no profile was selected.
• Fixed Form Builder factory-reset operations that displayed an error toast despite the operation completing.
• Fixed required-field validation appearing during Summarize Control Parts instead of at the appropriate Save operation.
• Fixed validation errors displayed when summarizing controls.
• Fixed the per-data-type C/I/A override behavior to ensure an override applies only to its intended information type.
• Fixed inherited and remotely inherited controls displaying duplicate entries per control part in Control Builder.
• Fixed Status Board title issues.
• Fixed filter controls that were visually misaligned with their associated filter rows.
• Fixed Webhook administration dialogs where action buttons could be inaccessible at the bottom of the viewport.
• Fixed My Dashboard layouts overflowing horizontally on narrow screens.
• Fixed dark-mode rendering issues for Control Details in Lightning assessments within Third Party Risk.

Issues and Risk Management

• Fixed a 405 error encountered when navigating to vulnerabilities.
• Fixed deletion workflows to account for VulnerabilityMapping dependencies before removing records.
• Fixed issue batch processing where affected controls and asset identifiers were not included in batch requests.
• Fixed risk dashboard drill-down behavior and stale list-view reuse.
• Fixed validation errors that could occur when saving or updating requirements.
• Fixed cleanup failures that could leave orphaned subsystem records after security controls were deleted.
• Fixed risk records being incorrectly categorized under an unspecified bucket.

Data Integrity and Reliability

• Fixed seeding-lock database errors.
• Fixed application changes endpoints returning errors for authenticated users.
• Fixed Control Implementation API requests returning incorrect responses.
• Fixed pagination behavior that could duplicate or omit records during paged reads.
• Fixed migration circuit-breaker logic that could fail to activate because failure timestamps could not be parsed.
• Fixed application logging issues that prevented logs from reaching Application Insights.
• Fixed silent subsystem-cleanup failures.
• Fixed error-log date filtering so the end date includes the complete day.
• Fixed constraint violations being exposed as technical errors instead of user-friendly messages.
• Fixed API behavior for non-existent Security Plan identifiers so requests return an appropriate not-found response instead of HTTP 500.

Security Profiles and System Management

• Fixed RegScale Profiles installation when default profiles were not displayed.
• Fixed profile prerequisite messages that exposed raw catalog UUIDs rather than readable names.
• Fixed issues preventing Security Profiles from being deleted.
• Fixed Trust Center behavior so the New System button is hidden when an applicable FedRAMP system already exists.
• Added a Trust Center notification identifying when a system is non-production.

KSI and Validation

• Fixed KSI revision history so the actor associated with assertion creation is retained.
• Fixed the Public KSI page displaying literal Boolean values instead of user-friendly status information.
• Fixed the Public KSI page so the last validation date is displayed.
• Fixed KSI compliance calculations so Not-Applicable KSIs are not incorrectly included.
• Improved validation audit visibility and historical accountability.

User Experience and Notifications

• Fixed drill-down modals that could not be closed.
• Fixed Save buttons and dialogs that could become inaccessible due to viewport positioning.
• Fixed workflow and release notification failures.
• Fixed Slack and Teams background-process notifications when the associated tenant could not be resolved.
• Fixed questionnaire notification inconsistencies.
• Fixed an issue where service-account token exceptions could unnecessarily appear in logs.
• Improved user-facing validation and error messages throughout the platform.

Security Hardening

• Strengthened SaaS configuration-secret handling, including Key Vault reference resolution and validation of JWT signing keys.
• Fixed authorization and tenant-scoping gaps across questionnaire, evidence, vulnerability, service-account, and assessment workflows.
• Improved audit coverage for evidence access and validation activity.
• Improved handling of sensitive authentication and service-account operations.

[6.41.0] - 2026-08-19

Changed

• A custom CA bundle path that does not exist now fails immediately with a message naming the file and the setting that configured it, instead of failing later without either
• Per-integration TLS verification settings such as taniumVerifySsl, splunkSSLVerify, splunkHecSSLVerify, and snowVerifySsl are no longer read and each logs a warning at startup naming the top-level sslVerify that replaces it, so a configuration that relied on one of them to reach a self-signed endpoint must set sslVerify: false to keep connecting
• A deprecated qradar.verify_ssl setting is now migrated to the top-level sslVerify at startup with a deprecation warning, so existing QRadar configurations keep working
• Splunk, QRadar, and Axonius V2 now read TLS certificate verification from the shared top-level sslVerify setting instead of their own per-integration keys
• CrowdStrike integration now requires FalconPy 1.6.4

Fixed

• FedRAMP SSP import now reports when OSCAL validation could not run instead of attaching an empty validation report and logging success
• AWS EventBridge inventory now honors the configured account ID and tag filters instead of returning rules from all accounts
• eMASS DoD CA bundle (emass.ssl_ca_cert) is now applied to all API connections, resolving SSL certificate verification failures against DoD-signed eMASS servers
• QRadar commands no longer fail with a header type error when the API version or API token is written without quotes in the configuration file
• QRadar event sync no longer fails on deployments without the AWS DSM extension, and event properties can now be selected explicitly with the qradar event_fields setting
• SSL verification and custom CA bundle settings now take effect on every HTTP client, and clients no longer report verification as disabled while it is enabled
• Response bodies are only decoded for debug logging when debug logging is enabled, reducing memory use on large API responses
• Configured connect, write, and connection-pool timeouts are now applied to every API request instead of being overridden by the read timeout
• Relative API paths such as /api/files are no longer rewritten to an invalid host, restoring Prisma SBOM evidence upload
• Sicura, Rapid7 cloud, Tanium CIS benchmark and ports/protocols syncs, ServiceNow, eMASS, and catalog file downloads now honor the top-level sslVerify setting instead of verifying certificates unconditionally
• CrowdStrike alert sync now fixed a pagination issue for alerts
• CrowdStrike alert tagging now applies every supplied tag rather than only the first
• CrowdStrike incident tables now render alerts returned by the current Alerts API
• CrowdStrike compliance notes are now written for frameworks mapped from NIST, such as CMMC, ISO, and SOC 2
• CrowdStrike authentication failures now report a credential error instead of an unrelated internal error
• AWS security collector now passes configured tag filters to CloudTrail, AWS Config, IAM, and KMS sub-collectors

[6.33.1.0] 08-14-2026

Enhancements

AI and RegML

• Expanded AI Agent Capabilities — Added AI Agent capabilities for Lines of Inquiry, Corrective Action Plans, Risk Treatment Mappings, Questionnaire Scoring, Lightning Assessment Tests, and Security Control Test Generation.
• RegML Mapping Recommendations — Enhanced RegML capabilities with recommendations to assist users in mapping relevant content.
• Azure OpenAI Connectivity Validation — Added startup connectivity validation to provide earlier detection of Azure OpenAI configuration or connectivity issues.
• Improved RegML Reporting — Enhanced Report Builder support for RegML-generated reports and related-module fields.
• Improved RegML Error Handling — Improved error reporting so connectivity and network issues are no longer incorrectly reported as API-key permission problems.

Evidence and Control Management

• Evidence Improvements — Expanded evidence management capabilities and improved evidence workflows throughout Control Implementation and assessment experiences.
• Evidence-to-Control Mapping Propagation — Improved the propagation of evidence-to-control relationships.
• Enhanced Evidence Linking — Updated Control Implementation and SSP assessment workflows to provide improved access to evidence and files.
• SSP Evidence Linking Options — Enhanced the System Security Plan creation wizard to support opting into evidence linking.
• Evidence Management Consolidation — Improved the Evidence experience by consolidating Locker and List View functionality.

Security Plans and Excel Import/Export

• Canonical SSP Excel Template — Added a standardized Security Plan Excel template schema with versioned metadata.
• Downloadable SSP Excel Template — Added the ability to download a blank canonical SSP Excel template directly from the application.
• SSP Excel Template Validation and Preview — Added validation, preview, and confirmation capabilities when uploading an SSP Excel template.
• SSP Excel Import — Added support for creating and updating Security Plans from the canonical Excel template.
• SSP Excel Export — Added the ability to export a Security Plan to the canonical Excel template format.
• Export Builder Templates — Added the ability to download Export Builder templates.
• Improved Export Integration Testing — Expanded automated integration coverage for export functionality.

Compliance and Catalogs

• Control Framework Gap Assessment — Added enhanced support for evaluating gaps across control frameworks.
• Automated Risk Mappings — Added automation capabilities to simplify risk-to-control mapping activities.
• Expanded Compliance Settings — Expanded compliance configuration capabilities to support additional security management use cases.
• Improved CRI Catalog Support — Enhanced support for CRI-related catalog functionality, including AI and cloud catalog capabilities.
• OpenSSF Catalog — Added support for the OpenSSF catalog.
• Security Plan Changelog — Added changelog visibility for Security Plans to improve traceability of changes.
• SBOM Child Visibility — Added support for viewing child records associated with SBOM information.

Risk Management

• Risk Module Enhancements — Improved risk management capabilities to support expanded risk workflows.
• Aggregate CCM Dashboard — Added an aggregate dashboard for improved visibility into CCM-related information.
• Risk Treatment Control Selection — Enhanced risk treatment workflows with improved control selection and filtering.
• Risk Mapping Automation — Added capabilities to automate risk mappings and improve consistency across risk management workflows.

Workflow and Navigation

• Kanban Navigation — Added Next/Previous navigation to Kanban workflows.
• Workflow Designer Improvements — Enhanced workflow configuration and approval experiences.
• Workflow Approval Accessibility — Improved access to workflow instances and approvals across applications.
• Improved Record Navigation — Enhanced record navigation so Back actions return users to the expected previous screen.
• Improved Grid Views — Continued UI and usability improvements to custom grid views.

Security and Platform Hardening

• Authentication and JWT Hardening — Strengthened authentication and JWT handling to improve platform security.
• Account Lockout Improvements — Enhanced account lockout and brute-force protection capabilities.
• Authentication Rate Limiting — Improved authentication request throttling and protection against automated account enumeration.
• Tenant Isolation Improvements — Strengthened tenant isolation across platform services and data access.
• Security Audit Improvements — Enhanced auditing of API-created records and security-sensitive operations.
• FedRAMP High UI Support — Added a FedRAMP High badge to the application footer.
• Improved Accessibility — Improved UI accessibility, including WCAG-related color contrast and disabled-control styling.

User Interface Improvements

• UI Polish — Continued visual and usability improvements across UI interface.
• SSP Author Experience — Updated the SSP Author page to align with the current application branding and UI standards.
• Export Builder UI Improvements — Improved template upload and management controls.
• Status Board Improvements — Enhanced Status Board presentation and Baseball Card layouts.
• File Upload Guidance — Improved the file upload experience by displaying supported file type restrictions.
• Form Validation Improvements — Enhanced field validation behavior within Form Builder.
• Questionnaire Improvements — Improved questionnaire self-assignment URL capabilities.
• Workbench Link Support — Improved handling of hyperlinks in task and issue descriptions.

Fixes

Authentication and Security

• SSO Role Assignment — Fixed an issue that could allow users authenticating through SSO to manipulate local application roles and produce unexpected access behavior.
• SSO Application Administration — Fixed application administrator claim handling so app-admin privileges are correctly aligned with application group membership.
• JWT Authentication — Fixed an intermittent issue where authentication tokens could be issued without the required expiration claim.
• Authentication Regression — Resolved an issue causing authenticated API requests to intermittently return HTTP 401 responses in UI.
• Account Enumeration Protection — Secured login configuration endpoints against unauthenticated account and tenant enumeration.
• MFA Information Exposure — Prevented pre-authentication endpoints from exposing tenant identifiers, tenant names, or MFA posture.
• Authorization Enforcement — Corrected missing module-permission checks on Control Implementation endpoints.
• Exception Information Exposure — Fixed validation errors that could expose unnecessary exception details through API responses.
• Tenant Isolation — Corrected cross-tenant data access paths in lineage and module-related services.
• Security Audit Logging — Fixed security audit logging for password changes and API-created records.
• Rate Limiting — Corrected authentication rate-limit calculations and ensured throttling responses report the appropriate limit and retry information.
• Account Lockout — Fixed an issue where account lockout settings could be ineffective when the lockout duration was configured with a zero value.

Export Builder and Exports

• Export Template Creation — Fixed an issue preventing users from creating Export Builder templates.
• Export Template File Removal — Fixed errors that could occur when removing files from Export Builder templates.
• Export Field Mapping — Fixed an issue where the Export Field mapping dropdown appeared empty in Nova.
• Export Status Visibility — Fixed the Export Status box appearing behind the Export modal.
• POA&M Re-Export — Fixed an issue requiring users to refresh or navigate away from the page before exporting a Rev5 POA&M again.
• SSP Export Generation — Fixed an issue where SSP document exports could be generated as empty documents.
• OSCAL Export — Fixed OSCAL SSP export failures when the Authorization Boundary was not populated.
• OSCAL Non-NIST Catalogs — Fixed export failures for controls without Control IDs, including controls from non-NIST catalogs.
• FedRAMP Rev5 SSP Export — Corrected cover-page typography and Ports & Protocols table formatting.
• FedRAMP Rev5 Appendix A Export — Corrected fonts, colors, bullets, and Customer Responsibility content.
• FedRAMP Rev5 Appendix Q Export — Corrected title, color, and formatting issues.
• FedRAMP Rev5 CIS/CRM Export — Corrected control ordering in the High CIS worksheet.
• FedRAMP Inventory Export — Addressed issues affecting FedRAMP inventory exports.
• eMASS POA&M Export — Improved conditional handling of comments and milestones based on issue status.
• eMASS Export Licensing Display — Corrected an incorrect Syncfusion license expiration message displayed during eMASS exports.

SSP and Compliance

• SSP Compliance Scores — Fixed an issue preventing compliance scores from being generated on the SSP Dashboard.
• SSP Control Population — Fixed SSP creation so controls are correctly populated from the selected profile and manually added controls can be added successfully.
• Compliance Settings — Fixed the Control Builder so it correctly honors compliance settings when compliance configuration is changed on an existing SSP.
• Inherited Controls in ScoreCards — Fixed an issue preventing inherited controls from appearing in ScoreCards.
• SAP/SAR Export — Corrected the RMF Effort field in Section 1 of SAP/SAR exports.
• Security Plan Status by Family — Corrected erroneous information indicators appearing in the Status by Family table.
• Control Implementation Status Dashboard — Fixed an issue causing the By Status dashboard view to display no results.
• Policy-to-Control Mapping — Fixed policy relationships so policies linked through Related Policies are correctly mapped to the associated control.

Risk Management

• Risk Drill-Down — Fixed Manage Risks dashboard drill-down behavior so selecting a pie-chart segment displays only the risks represented by that segment.
• Risk Treatment Control Filtering — Fixed control selection in Risk Treatments so users can filter the available controls.
• Risk Treatment Control View — Fixed blank View Control dialogs when a control could not be loaded and improved error handling.
• Risk Assessment Guidance — Improved the Risk Assessment experience when required risk configuration has not yet been established.
• Risk Control Treatment Messaging — Fixed an erroneous "No Available Controls" warning after canceling a treatment and relinking controls.
• Risk Assessment Help Modal — Fixed an issue preventing the Risk Assessment Help modal from closing correctly and corrected its styling.

Workflow

• Workflow Template Steps — Fixed an intermittent issue where newly added workflow template steps appeared to save successfully but were not persisted.
• Workflow Step Deletion — Fixed Visual Designer errors that could prevent workflow steps from being deleted and leave the UI unresponsive.
• Workflow Branch Approval — Fixed an issue preventing halted branch steps without an assignee from being approved or rejected.
• Workflow Branch Navigation — Improved validation of "Go to step" targets so unreachable workflow steps cannot be selected without appropriate warning.
• Workflow Approvals Access — Fixed inconsistent permissions that could prevent users from accessing the workflow approvals inbox.
• Workflow Security Plan Scoping — Corrected application scoping for System Role data used during SSP exports.

Data and Records

• Data Save Handling — Fixed UI behavior where rejected saves could incorrectly navigate users back to a list.
• Data Editor Validation — Fixed stale invalid text remaining in the Data editor after a rejected save.
• Record Back Navigation — Corrected the Back button so users return to the previous screen instead of the module list.
• Component Deletion — Fixed an issue preventing users from deleting multiple components at once.
• ConMon Cleanup — Fixed cleanup behavior that could leave orphaned Vulnerability Mappings and inflate vulnerability counts.
• Module Access Validation — Fixed errors returned when requesting a module outside the caller's tenant.
• User Removal — Fixed errors that could occur when removing a user from an application.
• Risk Record Permissions — Corrected permissions that could allow users with CRU access to delete risk records.

Questionnaires and Forms

• Questionnaire Save — Fixed the Save button when field validation errors are present.
• Questionnaire Self-Assignment — Fixed an issue preventing self-assignment URLs from being enabled.
• Form Builder Validation — Corrected new-field validation behavior so validations do not trigger prematurely.
• Questionnaire Data Export — Fixed Export Orchestration so it uses the most recent questionnaire response data rather than the original response data.

Evidence

• Evidence Mapping Dialog — Added vertical scrolling support to the Evidence control-mapping dialog.
• Evidence Relationships — Fixed evidence-to-control relationship propagation.
• Evidence and Files Tabs — Corrected Evidence tab behavior in Control Implementation and SSP assessment workflows.

User Interface and Usability

• POA&M Status Board — Fixed navigation, refresh and download actions, deviation-type filtering, empty owner/scope filters, and search behavior.
• Compliance Hygiene Status Board — Fixed errors affecting the Compliance Hygiene Status Board.
• Status Board Baseball Cards — Corrected header rendering issues on Status Board Baseball Cards.
• Report Builder Layout — Fixed chart filter controls overflowing their container in Nova.
• Security Profiles — Fixed control mappings disappearing after saving column changes.
• Disabled Controls — Added appropriate visual styling for disabled dropdowns.
• File Upload UI — Corrected positioning of the file-drop icon and improved upload control presentation.
• Export Builder Layout — Corrected vertical alignment of uploaded template files and remove controls.
• Add User Performance — Improved the Add User dialog, which could previously take several seconds to open.
• Workbench Actions — Fixed issue detail Actions controls that could not be clicked because of global navigation hit-testing.
• Security Plan UI — Corrected styling issues in inheritance model fields and other Security Plan controls.
• Classification Banner Accessibility — Corrected insufficient color contrast in the light-theme classification banner to improve WCAG AA compliance.
• CMMC Export Dialog — Fixed the CMMC SSP pre-export dialog so it opens in the correct layer above the export interface.
• Save Navigation — Fixed navigation behavior when saves are rejected.

Platform and Infrastructure

• Concurrent App Creation — Fixed SQL Server deadlock handling during concurrent application creation by adding appropriate retry behavior.
• Environment Setup — Fixed first-time environment setup failures that could prevent tenant creation on a clean database.
• Log Event Cleanup — Corrected the nightly process responsible for cleaning the LogEvents table.
• Syslog Audit Delivery — Fixed duplicate audit records that could be sent to a SIEM when a TLS syslog connection experienced a mid-stream TCP interruption.
• API Error Handling — Improved API validation responses so users receive more specific error messages rather than generic failures.
• API Routing — Fixed unmatched routes incorrectly returning the application index page instead of an HTTP 404 response.
• Release Notifications — Fixed release-notification email failures caused by invalid logger configuration.
• Application Builds — Resolved stale namespace references that prevented the main application and automated test projects from building successfully.
• Automated Testing — Corrected end-to-end test data generation issues involving vulnerability field length and invalid CVE values.
• Coverage Reporting — Updated coverage configuration to include asynchronous method bodies.
• Audit and Data Access — Corrected service-level data access patterns to ensure tenant isolation, soft-delete behavior, auditing, and webhook processing are consistently applied.

ROH 6.32.0.4 Release

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.32.0.4

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What's Fixed

• Duplicate software inventory on repeated asset syncs: Asset syncs no longer add a second copy of an asset's software inventory each time they run. Previously every run appended the full list again, so a package that should appear once was listed twice after the second sync and gained another entry with each run after that. Software inventory is now reconciled against the records RegScale already holds, and packages reported more than once within a single scan are collapsed into one entry. This affects every integration that synchronizes assets in batches. Note that this fix prevents new duplicates from being recorded; it does not remove entries already written, so any duplicates accumulated before upgrading need to be cleared separately.
• Tanium Cloud vulnerability and compliance synchronization on large data sets: Tanium Cloud jobs that collect vulnerability and compliance findings no longer stop before ingesting any records when a request exceeds the Tanium gateway's data limit. ROH now reduces the amount of data requested per page and retries automatically, so these synchronizations complete. Previously an affected run could finish and report success while ingesting nothing.
• Consistent Qualys asset identifiers: Qualys assets are now recorded with the same identifier whether the asset is created for the first time or updated by a later synchronization. Previously the two paths wrote different values, which could leave an asset's vulnerabilities and issues unlinked from the asset itself. Existing Qualys assets are updated in place to the corrected identifier, so they keep their RegScale IDs and their existing links.

Maintenance and Updates

• Routine dependency and security updates across backend components.