[6.32.3.0] 07-25-2026

Enhancements

• Expanded Asset Scanning Configuration

  • Added an Asset Scanning Tool De-Duplication option, giving administrators greater control over how duplicate findings are identified and consolidated during asset scanning workflows.

• Improved Framework Template Experience

  • Renamed Framework Importer to Preset Configuration Templates to better reflect its purpose and improve discoverability within the application.

• Export Builder Template Downloads

  • Added the ability to download associated template files directly from the Export Builder configuration menu, making it easier to obtain and work with import/export templates.

Fixes

Administration & Security

• Fixed an issue where newly created users in newly provisioned tenants could be prevented from logging in.
• Resolved an issue where cross-tenant access events were not properly recorded.
• Corrected several User Management audit logging inconsistencies where events were either missing or incorrectly logged as failures.
• Fixed an issue where Service Accounts appeared in questionnaire user assignment lists, ensuring only appropriate assignable users are displayed.

User Experience

• Fixed an accessibility issue where opening the Approval History dialog did not properly prevent interaction with the left navigation panel.
• Corrected an issue that prevented the Save button loading indicator from displaying while save operations were in progress.
• Resolved an issue where custom dropdown fields could incorrectly display cached values when hovering over entries and could not be properly cleared or removed.
• Resolved issue where Asset Hardware Creation does not save certain Yes/No fields.

Export Builder

• Fixed an issue that prevented Import Mapping Functions from working correctly within Export Builder.
• Resolved an issue where the Export Field dropdown displayed no available values when configuring export mappings.
• Corrected a layout issue that caused the Export Builder configuration page to render in a narrow column instead of using the full available workspace.
• Restored the Clear option for Export Field selections, allowing mappings to be removed as expected.

Catalog & Framework Management

• Fixed an issue where catalog update-in-place operations could silently skip updating objectives, test plans, CCIs, and parameters, improving the reliability of catalog synchronization.

Platform Reliability

• Resolved an intermittent issue that could cause HTTP 500 errors immediately after login due to Entity Framework query compilation conflicts when adapting RAG embedding dimensions. This improves application stability and login reliability.

[6.37.45] - 2026-07-22

Added

• eMASS sync_system command to synchronize all structural records (assets, controls, POAMs, milestones, artifacts) between a RegScale SSP and its linked eMASS system in a single dependency-ordered invocation
• AWS Inspector sync --exclude_tags option to skip resources carrying the given tags, with --exclude_tags_match any|all
• CSAM organization-defined parameter (ODP) import into RegScale's OSCAL parameter model, with an Excel mapping workbook for reviewing unmatched values

Changed

• FIPS container image now built on a Python 3.12 base to align with the Airflow FIPS image and clear security policy scanning
• AWS Inspector V2 sync keeps only the most recently pushed image per ECR repository and names assets by repository and digest instead of image tag, and can be turned off with --no_dedupe_ecr_images or the inspectorDedupeEcrImages init.yaml setting to sync every image digest
• AWS Inspector V2 sync scopes compliance coverage and statistics to the selected resource types
• AWS Inspector V2 sync now applies the --tags filter server-side when pulling findings and coverage, so only tagged resources are retrieved instead of being downloaded and then filtered
• Minimum supported Python version raised to 3.11 (Python 3.10 is no longer supported)
• Jira Data Center tickets pushed from RegScale now include the issue's recommended actions and remediation description along with a direct link back to the source RegScale issue

Fixed

• Qualys sync now applies the configured Total Cloud include and exclude tag filters when the command-line tag options are not supplied, instead of silently ingesting all Total Cloud data
• FIPS container image now built on a Python 3.12 base to align with the Airflow FIPS image and clear security policy scanning
• Wiz container images pinned by digest now import with a version derived from the image digest instead of a blank value, so downstream eMASS hardware/software exports no longer fail validation on the required Version field
• Wiz secret findings that share a detection rule now consolidate into a single issue listing all affected resources instead of creating a near-identical issue for each resource
• Scanner imports no longer intermittently drop vulnerability-to-asset links under heavy multi-threaded processing

[6.32.2.0] 07-19-2026

Enhancements

AI & RegML Improvements

• Expanded AI provider compatibility with improved support for Azure OpenAI, AWS Bedrock, and OpenAI-compatible endpoints, providing greater deployment flexibility across enterprise environments.
• Improved configuration and validation for AI services with clearer error messaging and streamlined setup for embedding providers and API authentication.
• Enhanced RegML guidance, learning resources, and user experience with clearer instructional content and improved workflow navigation.
• Added feature flag support for additional AI-powered capabilities, allowing organizations to enable new functionality in a controlled manner.
• Improved long-running AI operations with better handling of complex SSP authoring, auditing, evidence mapping, and response automation scenarios.

AI Report Builder

A new RegML AI agent turns plain-language requests into a ready-to-run report. Users describe what they want to see (i.e. show me all open issues with the name and status of the security plan they belong to, grouped by severity) and the agent drafts the entire report: it picks the right module, selects the fields, applies filters and grouping, joins in related modules, and even configures the chart.

Change Log Feature

This new scorecard tab within a Security Plan displays every control implementation change made within a time frame you select, grouped by control family, with drill-down into the field level for before and after comparisons.

Control Inheritance

Expanded Control Inheritance Capabilities
Control inheritance has been enhanced to provide a more complete and consistent experience for organizations leveraging shared compliance implementations. In addition to inheriting configuration settings such as assessment frequency, parameters, and control ownership, administrators can now choose to inherit associated evidence and assessment records, reducing duplicate effort and improving consistency across inherited controls.

Identity & Access Management

• Expanded SSO provisioning capabilities with support for additional application-specific user claims and improved synchronization of application access during user provisioning.
• Enhanced profile management and user administration with improved account management workflows and more intuitive administration experiences.
• Improved role-based access controls to better align permissions with administrative responsibilities throughout the platform.

Reporting & Analytics

• Added enterprise reporting enhancements to provide greater flexibility for creating and managing reports.
• Improved report filtering and support for date and time custom fields, enabling more accurate reporting and analysis.
• Enhanced dashboard reliability and data presentation across scorecards, visualizations, and reporting widgets.

Workflow & Automation

• Improved workflow management with enhanced workflow designer capabilities, notification processing, and automation reliability.
• Added batch API support for additional record types to improve performance when managing large datasets through integrations.
• Enhanced evidence approval and workflow collaboration capabilities.

Platform & Administration

• Improved export builder capabilities to provide more reliable document generation and token replacement.
• Enhanced application configuration and feature flag management for improved administrative control.
• Improved documentation accessibility and platform guidance throughout the user interface.

Fixes

User Experience

• Resolved multiple interface issues affecting dialogs, modals, date pickers, navigation, tab behavior, spacing, styling, and responsive layouts across user experiences.
• Corrected several display issues involving user names, organization fields, metadata presentation, read-only fields, dashboards, and status boards.
• Fixed inconsistencies in menus, action buttons, and contextual navigation to provide a more intuitive user experience.

Forms & Custom Fields

• Fixed issues affecting Form Builder, Rule Builder, questionnaires, and custom field processing to ensure rules, values, and conditions are saved and applied correctly.
• Resolved problems with date, date/time, checkbox, and filtering behavior for custom fields throughout reporting and forms.
• Corrected issues preventing questionnaire file uploads and improved questionnaire navigation and editing.
• Resolved issue where custom user dropdown fields auto-fill the wrong name. Custom name/user dropdown fields built with the Form Builder could display a name simply when the field was hovered over.
• Addressed issue which prevented stale custom-field values from crossing between modules.

Security & Permissions

• Fixed multiple permission validation issues affecting workflow designers, application administrators, external users, cause code management, and workflow access.
• Corrected several authorization inconsistencies to ensure users receive the appropriate access based on assigned roles.
• Strengthened HTML rendering protections to further reduce exposure to cross-site scripting (XSS) risks.

Compliance & Assessments

• Resolved issues affecting control implementations, security profiles, SSPs, questionnaires, CCIs, POA&M workflows, FedRAMP exports, and eMASS integrations.
• Fixed validation and save issues impacting maturity assessments, continuous monitoring, evidence mapping, and control ownership.
• Corrected several issues affecting control metadata, inheritance, responsibilities, and profile application.
• Improved Synchronization of Inherited Control Status
• Resolved an issue where inherited controls only copied the source control's status at the time inheritance was established. Inherited controls now remain synchronized with the source control's status, ensuring compliance posture accurately reflects changes made to the originating control.
• Resolved an issue that prevented inherited controls from including evidence associated with the source control. Customers can now optionally inherit evidence as part of the control inheritance configuration, streamlining evidence reuse across related compliance programs.
• Resolved an issue where assessment results were not inherited with controls. Customers can now optionally inherit assessments from the source control, providing greater visibility into inherited compliance activities and reducing the need to recreate assessment records.

Reporting & Exports

• Fixed multiple export reliability issues affecting FedRAMP, OSCAL, eMASS, report exports, custom exports, and document generation.
• Corrected report builder issues involving custom fields, dashboard data, report accessibility, and export formatting.
• Improved handling of incomplete or missing data during export operations.

APIs & Integrations

• Corrected several API validation and error handling issues to provide more accurate responses and improve integration reliability.
• Fixed issues affecting application provisioning, batch processing, deviation creation, export endpoints, and data validation.
• Improved consistency across REST APIs by returning appropriate validation responses instead of unexpected server errors.

Dashboards & Data Integrity

• Fixed dashboard rendering issues, data rollup inconsistencies, scorecard calculations, and stale data presentation.
• Resolved several issues affecting dashboard permissions, access control, and inventory reporting accuracy.

Notifications & Email

• Fixed issues preventing notifications from being generated during record reassignment.
• Corrected inconsistent email history displayed on user records.
• Resolved issues affecting evidence request email links and approval workflow comments.

Platform Stability

• Resolved numerous stability issues related to upgrades, application provisioning, feature flags, background processing, validation, and data integrity.
• Improved reliability of application configuration, imports, workflow processing, and catalog synchronization.
• Corrected several edge cases that could lead to unexpected errors when processing incomplete or invalid data.
• Resolved issue where expired passwords no longer lock users out. Previously, when a user's password expired under a tenant's password-rotation policy, they could be logged out and returned to the login screen without ever reaching a working Change Password page.
• Fixed an issue that prevented the system from automatically capturing a snapshot of record data when a workflow was saved without a snapshot supplied by the browser. Server-side snapshot capture now works as intended, ensuring workflow history reflects the correct record state.

ROH 6.32.0.2 Release

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.32.0.2

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What's Fixed

• Ingesting Qualys data with complex filters: Jobs that ingest data from Qualys will now ingest data correctly when users configure the job to include or exclude assets based by combining multiple asset group names and tags.
• Synchronizing Jira issues with RegScale tasks: Jobs will now correctly ingest Jira issues with rich content and custom metadata fields to properly sync with tasks in their RegScale instance.

Maintenance and Updates

• Routine dependency and security updates across backend components.

[6.37.39] - 2026-07-15

Added

• eMASS API hardware and software baseline sync commands to pull asset inventory from eMASS, create or update RegScale assets, and push new assets back to eMASS
• Stakeholder records now expose the v2 address fields (type, city, stateProvince, postalCode, country) so callers can supply structured address data on create and update
• CAC/PIV smart card (PKCS#11) authentication for regscale emass_api register, enabling mTLS with an on-card private key that never leaves the device

Changed

• Airflow container image now built on a FIPS 140-3 compliant base

Fixed

• Airflow container no longer ships a Starlette version affected by high-severity security advisories
• Jira Data Center issue sync now records an error for the affected issue and continues instead of aborting the whole batch when Jira returns an unexpected error while updating or closing one issue
• File uploads through the API (such as checklist import) no longer fail with an HTTP 415 error caused by an incorrect JSON content type on multipart requests
• Jira task sync no longer crashes when a Jira issue has no priority assigned; such issues now use the default due-date timeline instead of aborting the entire sync
• Jira sync now renders rich-text (ADF) issue descriptions to plain text so tasks and issues sync successfully instead of being rejected with an empty request body
• CSAM system security plan import now creates plans successfully instead of failing when the source identifier is numeric
• CSAM control implementation import now retrieves control statements correctly instead of failing on the report query endpoint
• CSAM front matter import now maps the Sub-Organization field correctly
• AWS Security Hub, EC2, and ECR issue imports now post successfully to the batch endpoint instead of being silently rejected and retried one issue at a time, making those syncs faster and quieter
• Scanner-imported issues now link to their assets in the Related Assets view instead of remaining unlinked
• Wiz issue titles no longer repeat the CVE identifier (for example "CVE-2024-30105: CVE-2024-30105")
• Wiz issue remediation guidance no longer reads "Update to version None" and now uses the rule's remediation instructions
• Wiz issue last-seen date is now populated from the scan time instead of being left empty
• Wiz synchronization now refreshes its access token during long-running syncs instead of failing partway through when the token expires
• Wiz synchronization now reports a clear "not configured" error when the Wiz client ID or secret is left at its placeholder value instead of returning an opaque authentication failure
• Security patches for bundled Python dependencies
• FedRAMP SSP party imports no longer fail to create stakeholders when the OSCAL party has an address but no country, by populating structured address fields (with country) when available and otherwise sending no address fields
• StakeHolder model field validator that converts None to empty string for nullable text fields now actually runs, so callers passing explicit None values get coerced to "" as documented
• eMASS SLCM workbook import now retries failed control implementation updates through the bulk /batchUpdate endpoint instead of a manual single-record fallback
• Jira Data Center sync commands now honor the configured TLS verification setting instead of always verifying certificates unless the CLI flag was passed
• Jira Data Center CSV import no longer drops the first row's key when the export file starts with a UTF-8 byte-order mark, and XML import no longer crashes on a non-numeric attachment size
• Jira Data Center sync now reports a clear configuration error for a non-numeric page size or timeout instead of crashing, and quote characters in project keys or task titles no longer break the generated Jira query
• Jira Data Center sync no longer stops after the first page of results when the server enforces a smaller page size, so all matching issues are imported

[6.31.1.5] 07-15-2026

Known Limitations and Important Information

This release is a hotfix that is only applicable to the 6.31.1.x releases. If your current version is equal to or greater than the 6.32.0.0 release DO NOT APPLY this hotfix.

Enhancements

POA&M Custom Rules

Added support for configurable custom rules for Plans of Action and Milestones (POA&Ms), providing organizations with greater flexibility to tailor POA&M management to their internal processes and compliance requirements.

Automated Cyber Reportable Risk Flagging

Enhanced automation for POA&Ms and milestones by automatically setting the Cyber Reportable Risk flag based on configured workflows, helping ensure reportable risks are consistently identified and tracked.

Improved Test Result Export Labels

Updated the eMASS test result exports to include the [r5] prefix on applicable controls, providing clearer identification of NIST SP 800-53 Revision 5 content.

Updated CIA Value Color Scheme

Refined the visual presentation of Confidentiality, Integrity, and Availability (CIA) values by introducing an updated color scheme for Low impact ratings, improving readability and consistency across the platform.

Hardware and Software Export Improvements

Improved hardware and software inventory exports by eliminating duplicate component assets, resulting in cleaner and more accurate exported data.

Fixes

Vulnerability Status Board Asset Counts

Resolved an issue where the Vulnerability Status Board always displayed zero affected assets, ensuring accurate asset counts are presented.

Issue Milestone Persistence

Fixed a problem that could cause milestones created on issues to disappear after creation. Milestones are now retained correctly.

FedRAMP POA&M Export Asset Completeness

Resolved an issue where FedRAMP POA&M exports could omit associated assets. Exports now include the complete set of related assets.

Over Time Dashboard Stability

Fixed an issue where the Over Time dashboard reset the selected time period when switching tabs and could display stale data from a previously viewed SSP. The selected timeframe and displayed data now remain accurate throughout navigation.

Scan History Ordering

Corrected the ordering of entries on the Scan History tab so scan history is displayed in the expected chronological order.

CIS/CRM Import Status Mapping

Resolved an issue affecting CIS/CRM imports where setting controls could incorrectly populate the Other Status field. Imported status values are now mapped correctly.

Security Fixes

Updated HTML-to-PDF Conversion Engine Dependencies

Resolved multiple security vulnerabilities affecting the HTML-to-PDF conversion component used for document and report exports. The underlying third-party dependencies were updated to address several critical and high-severity security issues in the legacy rendering engine. This update strengthens the security of PDF generation while maintaining existing export functionality.

Customer impact: Improved security for document and report export capabilities with no expected changes to the end-user experience.

Updated OpenAPI/Swagger Dependencies

Updated the OpenAPI and Swagger components used to generate REST API documentation to remediate a high-severity security vulnerability in a transitive dependency. This enhancement improves the security posture of the API documentation framework while preserving compatibility with existing API documentation and developer workflows.

Customer impact: Enhanced security for API documentation generation with no expected changes to published APIs or the Swagger user experience.

[6.37.6] - 2026-07-11

Changed

• Security patches for Airflow container dependencies

Fixed

• FedRAMP DRF import now sends the evidence attachments column to RegScale (the field was silently dropped from the payload), and False Positive rows missing an evidence description or evidence attachments are reported in the import report instead of failing with repeated API errors
• FedRAMP CIS/CRM import no longer overwrites a control part's implementation statement with customer responsibility text, preserving the existing statement while still updating customer and cloud responsibility fields
• Wiz vulnerability, end-of-life, and issue synchronization now correctly scope to the selected Wiz project instead of returning findings from every project in the tenant
• Wiz vulnerability and issue scans now cache results per project and filter so syncing different projects no longer overwrite each other's cached data
• Wiz synchronization no longer closes findings as resolved when a query fails partway through fetching results, preventing open findings from being incorrectly marked closed after a transient Wiz API error
• Compliance control assessment synchronization no longer creates duplicate assessments when a transient error prevents loading existing assessments, and now keys deduplication off a wider set of date fields

[6.32.1.1] 07-09-2026

Fixes

• Enabled SemanticMapping feature as default for installations.

• Hide the AI provider selection when bring-your-own-LLM is disabled

[6.32.1.0] 07-08-2026

Enhancements

• Added support for PIV card authentication architecture

  • Introduced foundational platform enhancements to support environments that require Personal Identity Verification (PIV) card authentication, improving readiness for organizations with advanced identity and access management requirements.

• Introduced a feature-flagged Issue Workflow

  • Added a new configurable Issue Workflow, modeled after the existing Security Plan approval process. This provides organizations with greater flexibility to define and manage issue review and approval lifecycles before broad availability.

• Improved Workbench Preview Visibility –

  • The Workbench preview now correctly displays counts for assigned and owned workflow steps, providing users with an accurate summary of pending workflow activities directly from the preview experience. This aligns Workbench behavior with other modules for a more consistent user experience.

• Expanded form capabilities

  • Delivered additional form enhancements to improve flexibility and support evolving data collection requirements across the platform.

• Improved backend scalability

  • Optimized child record counting operations by consolidating multiple database queries into a single aggregated request, improving performance when viewing complex data structures.

• Improved accessibility

  • Enhanced Form Builder accessibility by improving label association to better meet WCAG 2.5.3 (Label in Name) requirements.
  • Increased color contrast for dashboard elements in dark mode to provide a more accessible experience for all users.

Fixes

• Fixed an intermittent issue where creating child Issues from Controls was not consistently available.

• Resolved intermittent failures when creating Control Implementations caused by database operations during save processing.

• Fixed an issue that prevented questionnaire reviewers from successfully submitting completed reviews.

• Corrected navigation issues caused by Custom Tab system names containing special characters, restoring reliable navigation and deep-link behavior.

• Fixed inconsistent email information displayed on User cards within the Email Log.

• Improved the stability of RegML AI services under heavy load, reducing service interruptions experienced by Author, Auditor, Explainer, and Evidence Mapping capabilities.

• Fixed an issue where duplicating fields in Form Builder could bypass the maximum field limit for a section.

• Corrected tenant cause retrieval logic to properly determine Global Administrator permissions using role-based authorization rather than username matching.

• Updated API create endpoints to return the appropriate view models instead of raw database entities, improving API consistency.

• Hardened SubModuleForm write operations by enforcing module permissions, strengthening service-layer validation, and improving overall reliability.

• Fixed an issue where Interconnection records created beneath Security Plans were not correctly maintaining parent relationships.

• Resolved an issue where advanced Issue searches using the Equals operator against the Comments field returned no matching results.

• Fixed a that could occur when generating required-only DOCX exports for CMMC and DOE Security Plans using Export Builder.

• Resolved errors that could occur when applying templates to Security Plans.

• Fixed an issue that prevented users from entering values into date fields in certain forms.

• Fixed an issue where the Workbench preview did not display counts for Workflow Steps Assigned and Workflow Steps Owned, even though other module counts were shown correctly. Workflow step counts are now calculated and displayed as expected.

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.32.0.1

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What's Fixed

• Ingesting Qualys data with filters: Jobs that ingest data from Qualys will now ingest data correctly when users configure the job to include or exclude assets based upon specific tags.

Maintenance and Updates

• Updated the bundled RegScale user interface with the latest fixes and refinements.
• Routine dependency and security updates across backend components.
• Expanded automated end-to-end and regression test coverage, including checks that guard against duplicated records during data ingestion.