Added

• Wiz syncs can skip vulnerability and end-of-life findings on container images that exist only in a registry and that no workload runs, by setting wizDropUndeployedRegistryImages to true
• Wiz vulnerabilities now show, in their plugin output, how many Wiz issues each finding contributes to by severity and whether a container image was scanned from its registry or a running workload
• eMASS system export import now accepts the eMASS export .zip directly, including its artifact files
• Plan-field routing can match a plan field that lists several identifiers, such as every ComponentID of a system, with --plan-match-multi-value, and can treat named prefixes such as COMP- as not part of an identifier with --ignore-id-prefix; aws sync_findings_by_plan_field supports both
• Axonius v2 can route assets and findings to security plans by a plan field that lists several identifiers, such as a system's Component IDs, with the new sync_assets_by_plan_field and sync_findings_by_plan_field commands, which sync an identifier that two plans list to both and close records that left a plan unless --suppress-mop-up is given
• Scanner integrations can now pass KEV, internet reachability and EPSS data through to vulnerabilities for FedRAMP VDR evaluation
• Evidence, Change and AppGroup models include the new platform fields externalKey, canApproveChanges and canRequestChangeApproval

Changed

• eMASS system export import now exits with an error status when the import records any error, so scheduled runs no longer report a failed import as successful
• eMASS CAC authentication now uses the OpenSSL 3 PKCS#11 provider instead of the deprecated OpenSSL engine interface, and works through a tunnelling proxy
• Asset syncs run their per-asset follow-up lookups in parallel for faster imports
• Faster vulnerability imports by leaving vulnerability-to-asset links to the platform instead of creating them a second time from the CLI
• Security Hub compliance runs routed by plan field now report how many finding resources were left out of every plan's control assessments

Fixed

• Re-importing an eMASS system export no longer duplicates control tests and test results
• eMASS system export import now assigns new controls to the Security Plan's System Owner or ISSO and new assessments to the matched eMASS tester, ISSO, or System Owner instead of the importing user
• eMASS system export import no longer reads artifact files from outside the export folder
• Imports that run past midnight no longer risk closing findings that the same import had just created
• Importing the same eMASS system into more than one Security Plan no longer moves POA&Ms from one plan to another
• eMASS system export import now sets POA&M statuses the tenant actually offers, no longer blanks a POA&M's Identification on re-import, and keeps the system acronym on tenants without a DoD package
• eMASS system export import now imports POA&Ms on DoW tenants, with their due dates, owners, status and severity, and records control narratives, statuses and Not Applicable results correctly
• JCAM information types now match RegScale information types whose titles carry SP 800-60 section numbers or spell "and" as "&", re-importing no longer detaches information types from their plan, and a plan whose information types match none is reported as failed

[6.50.0] - 2026-10-06

Added

• Wiz asset syncs now fill the public-facing FQDN, IP address and URL fields from the application endpoints Wiz confirmed, and network exposure vulnerabilities now carry their port and protocol
• AWS Audit Manager sync now filters assessments with --tags and scopes evidence to tagged resources with --resource_tags
• AWS Security Hub compliance sync commands assess controls from Security Hub standards, route results to one or many security plans by plan field or ComponentID mapping file, and record the unmodified Security Hub findings as evidence by default
• CLI options now accept both snake_case and kebab-case spellings everywhere, with kebab-case shown in --help, and unambiguous Security Plan ID options accept a friendly --ssp-id alias
• Opt-in REGSCALE_STRICT_EXIT_CODES=1 makes scanner syncs that finish with item-level failures exit 3 instead of 0, and the CLI exit-code contract is now documented
• Optional machine-readable output via regscale --output json (or REGSCALE_OUTPUT=json), including a standard run summary and JSON records for supporting commands
• New --preview flag on cleanup deletes, JCAM and eMASS push commands and set_permissions load lists every record that would be created, updated or deleted without writing anything
• New configurations store integration secrets in the RegScale secret store by default, and existing configurations can move theirs with the reversible regscale config migrate-secrets command
• Automated secret scanning on every source change to keep credentials out of published releases
• regscale config validate checks init.yaml for unknown, deprecated, missing and mistyped keys and leftover placeholders, with JSON output and a non-zero exit on errors
• Read-only config mode (REGSCALE_CONFIG_READONLY=1 or --no-write-config) never creates or writes init.yaml, and every setting can also be supplied as a REGSCALE_<NAME> environment variable
• Set REGSCALE_USE_PROXY_ENV=1 to route RegScale API and integration traffic through HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and custom CA bundles now apply to proxied and GraphQL connections
• Trust Center, QRadar and Prisma Cloud CSPM requests now retry automatically with bounded backoff when the vendor API throttles or is briefly unavailable
• Releases now include signed build provenance for the wheel and sdist, keyless cosign signatures and SBOM attestations on the Docker images, and a CycloneDX SBOM attached to each GitHub release, with verification steps in the release verification guide
• Deprecated commands, options and settings now print a warning naming their replacement and the release they will be removed in, following a published deprecation policy
• Shell tab completion for bash, zsh, fish and PowerShell (regscale completion), a regscale integrations list command showing each integration's category, description and docs link, and a regscale --help grouped by category
• Usage examples in the --help of the most-used commands, and corrected command examples in the documentation and in several AWS command help pages
• Opt-in structured JSON logging via regscale --log-format json or REGSCALE_LOG_FORMAT=json, with a run ID shared with the run summary and secret values redacted from every log line
• Added a --force-refresh option to Axonius v2 sync commands to re-pull every record instead of only recently changed ones
• make help now lists the model schema and Azure AD sync regeneration commands
• regscale devsecops run validates the full .regscale-devsecops.yml configuration (change, approval, targets, mapping, SAR, policy, assess, schedule and module settings) and reports each problem with its field path, line number and accepted values
• regscale devsecops ssp snapshot command that exports a Security Plan's control IDs, catalogs and evidence-type mapping coverage to a credential-free file for offline control resolution
• Pipeline readiness check with regscale devsecops doctor, reporting TLS, service-account identity and expiry, missing or excess permissions, configured SSP and component, mapping coverage and schedules
• Pipeline Change records with typed trace links to work items, pull requests, approvals, builds and artifacts via regscale devsecops change open|update|close
• regscale devsecops evidence collect and publish commands that capture branch protection, pull request approvals, CODEOWNERS and JUnit test results as evidence mapped to the security plan and its controls
• regscale devsecops sbom generate, diff and publish commands that produce SBOMs from the GitHub dependency graph or syft, compare them with the previous release and publish them as inventory, evidence and change trace links
• regscale devsecops scan import command that imports SARIF, Trivy, Grype and Wiz CLI results as vulnerabilities and records them as control assurance on the target Security Plan, whatever framework it uses
• regscale devsecops openssf scan and sync publish results to Security Plans without OSPS Baseline controls as a summary assessment and evidence record mapped to the plan's own controls, record them in the run ledger, and weigh AI-assessed observations as added risk only
• regscale devsecops schedule show and apply set the OpenSSF drift-monitor cadence as a RegScale Orchestration Hub job or a scheduled GitHub Actions or GitLab workflow, choosing between the Scorecard API and a fresh scan for each repository
• regscale devsecops assess command that rolls a pipeline run's evidence up to findings for the Security Plan's own controls, publishes them as assurance results, raises issues for failing tool-observed results and closes them once they pass, without changing implementation status unless asked
• regscale devsecops sar build and sar validate commands that produce the run's OSCAL Security Assessment Results and assessment plan from the run ledger and validate them against the pinned NIST OSCAL schema, failing closed when no schema is available
• regscale devsecops sar merge builds a release SAR from the run SARs between two release tags, and sar publish attaches a run or release SAR as a CI artifact, SSP file, SSP child assessment or Evidence record
• regscale devsecops attest writes an in-toto attestation over the run ledger, SAR and policy decision, optionally Sigstore-signs it (never in FIPS mode), attaches it as Evidence and has the platform verify it
• regscale devsecops gate, policy evaluate and policy pull commands that evaluate the digest-locked OPA gate bundle against the run's policy input without RegScale credentials, map the decision to a CI exit code, and skip credentialed steps on fork pull requests
• regscale devsecops policy init command that locks a framework-neutral default gate policy, deciding on evidence types, change categories and per-check OpenSSF Scorecard thresholds, without a RegScale connection
• regscale devsecops change request-approval and change verify commands that submit a Change to the platform's tolerance-policy approval and gate deployments on approved artifact digests, with change close always recording the deployment
• regscale devsecops change shadow-report command that compares shadow-mode Change approval decisions with CCB outcomes, reports agreement, false auto-approval rate, auto-approval share and approval wait time, and checks each component against configurable readiness thresholds before enforcement
• Opt-in regscale devsecops review impact command that reviews a change against the SSP's own controls with a pluggable AI provider (Anthropic, Amazon Bedrock, Azure OpenAI or RegML via the ai extra), records an advisory AI-assessed result and writes the Change's impact analysis section
• regscale devsecops scan import --offline records a scan in the run ledger without RegScale credentials
• regscale devsecops run --stage pr|build|release|deploy|scheduled runs the modules the manifest enables for each pipeline stage, split into a credential-free collect job that writes a verifiable run bundle and a trusted publish job that publishes it
• OpenSSF OSPS Baseline assurance commands (regscale devsecops openssf sync and scan) that run or ingest Scorecard, OSV-Scanner, Privateer, Security Insights, OpenVEX and SLSA provenance results and report per-requirement test results, control assessments, issues and evidence against an OSPS Security Plan
• Signed OSPS conformance attestations (regscale devsecops openssf attest and verify) packaging verdicts as in-toto statements with optional Sigstore keyless signing via the regscale-cli[attest] extra
• Scheduled OSPS drift detection (regscale devsecops openssf monitor) that compares published Scorecard results with the Security Plan and flags regressed controls without running scans
• Evidence tier (Declared, Observed or Verified) recorded on OSPS assessments and control test results
• Reusable GitHub Action that runs OSPS Baseline assurance, with an optional signed attestation, in a pipeline
• Self-contained HTML OSPS conformance report that pipeline runs can publish as an artifact
• QRadar compliance assessment minimum event threshold is now configurable through min_events in the qradar config block
• regscale devsecops change open|update options for the Change's title, description, case notes, test results, outage summary, type, priority, owner, change window and test date, --change-id with --adopt for existing records, a change attach command for files and URL links, --output json on the change, evidence and SBOM publish commands, and sbom publish --parent-asset --name

Changed

• AWS Security Hub tag filtering is now applied server-side so fewer findings are pulled over the wire
• Command reference documentation now covers every CLI command, with a complete generated command index and corrected command, option, and configuration examples across the user guides
• Dependency versions are now capped below their next major release so a new major version of a third-party package can no longer break a fresh pip install
• eMASS client reads and writes the eMASS API v3.31 field names for systems, POA&Ms, milestones and hardware, still reads the older names from earlier eMASS versions, and now sends the required POA&M source field under its correct name
• QRadar assess-compliance now runs through the standard compliance sync, creating a QRadar SIEM asset and scan history, and attaches the recommended fix to issues for failed controls
• Scanner asset syncs no longer look up or store raw source data per asset, which makes large asset imports faster
• FedRAMP SSP XML import no longer calls the retired OSCAL validation service or attaches an OSCAL validation report

Fixed

• License-gated commands now honour the platform's 5-day grace period after the RegScale license expires, warning on each command with the expiry date and grace days left, and after it ends report that the license expired on that date
• jcam import_ssp no longer stops partway through creating plans when JCAM reports a system with no categorization or system type, a new plan now gets its organization at creation, and one organization that cannot be read no longer stops the import
• JCAM control inheritance import again writes the plan lineage and inherited control records the RegScale inheritance views read
• FedRAMP CIS/CRM import now sets the inheritance model on control objectives and rolls it up to the control implementation
• Control matching now skips a missing, blank or non-text control ID instead of crashing the import
• Help text for the Axonius combine_data_parts and file_stats commands, and corrected descriptions for pull_data and pull_data_axonius
• Negated CLI flags (--no-x) now accept both snake_case and kebab-case spellings
• Settings supplied through environment variables are no longer written into init.yaml, so a secret in the environment can no longer overwrite a secret-store reference on disk
• A secret passed to regscale config --param is no longer written to the debug log
• Prisma Cloud imports no longer drop vulnerabilities whose published or fix dates are millisecond timestamps
• Issues whose asset identifier list is too long for the field now say how many identifiers were left out
• Scanner imports no longer silently drop every vulnerability when the RegScale tenant lookup fails
• GitHub SBOM sync no longer fails when the security plan already has component mappings, and the client-side outdated-issue closure and control objective lookup by catalogue no longer fail on every call
• JCAM import no longer stops when a FISMA rollup would move a security plan under a different parent; that plan is skipped and reported in the run summary
• Axonius v2 sync no longer fails on Axonius 6.1, and synced assets and findings now include hostname, IP, OS, CVE, severity and other details
• Fixed debug log issue in login and api modules.
• JCAM inheritance import no longer resets provider controls to not inheritable, and skips inheritances that name a plan as its own provider
• Updating an existing Security Plan no longer fails when the instance has disabled plan fields; those fields are skipped with a warning
• Asset imports, including Nessus, no longer fall back to slow one-by-one uploads when the same host appears more than once in a file
• QRadar compliance assessments now state why each control passed or failed and recommend how to fix it, instead of only the result
• Trivy and Grype imports now link vulnerabilities to their scanned assets
• DevSecOps hints, example manifests and the regscale-devsecops GitHub Action now match the commands and configuration keys the CLI actually reads, and unread module keys log a warning
• An invalid RegScale token no longer appears in login error messages, and devsecops run collect jobs no longer create an init.yaml in the working directory or refuse to publish a bundle whose configuration file differs only in line endings
• QRadar assess-compliance now creates issues for failed controls when complianceCreation is set to Issue or POAM
• Wiz inventory sync no longer fails when no project ID is supplied, and several integrations no longer fail on null values returned for optional fields
• Microsoft Defender for Cloud resource sync no longer fails on subscriptions with more than about 96,000 resources
• Microsoft Defender syncs now follow relative pagination links from the Defender API instead of sending them to the RegScale server
• Records queued for batch saving, such as Splunk Data records and Jira or SonarCloud issue updates, are no longer dropped when disableCache is enabled
• GCP runs now warn when a configured service account credential is invalid, name the rejected setting and the reason, and stop with an error when no configured credential is valid instead of continuing on a different credential
• regscale evidence start now creates the assessment for each project listed in list.json, instead of stopping with an error or attaching one program's results to another project
• Platform version checks now treat an internal build of the RegScale platform (one that reports a build number and date instead of a release version) as a development build rather than as a very new release. Features that stay off on development builds, such as linking one issue to multiple controls, are no longer switched on against these servers, and a server that reports an unrecognized version no longer causes a version-parsing error.
• Updating an existing task under a parent record that already has tasks no longer fails
• Installing the CLI now requires a PyJWT release free of the known critical and high severity vulnerabilities

Bug Fixes and Usability Enhancements

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[Action Required] Legacy service account tokens expire 30 days after upgrading to 6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade to 6.34.4.0. After the upgrade, RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, check that service account's roles and application access.

Rich Text Editor Upgrade: The Rich Text Editor has been replaced to provide more reliable formatting. Bulleted and numbered lists, tables, links, and text copied from Word now behave more consistently. Content you've already saved in these fields will not be modified.

Preset Configurations: When profile layering is disabled, the preview now clearly shows which catalogs and profiles will be excluded from the install.

[6.49.8] - 2026-09-29

Fixed

• Axonius v2 asset sync now works with older Axonius versions such as 6.1 and no longer fails with a bad request error

[6.49.5] - 2026-09-28

Added

• Added an about command to the Axonius v2 integration to show connected instance details

Fixed

• Axonius v2 asset sync pagination now sends valid requests, fixing full asset sync

[6.49.0] - 2026-09-28

Added

• Wiz STIG and CIS benchmark results now record, in each control test's observations, which configuration criteria produced the pass or fail result and what Wiz found on the host
• Wiz Ports and Protocols records now include ports reachable over VPN, from another cloud account or from a custom IP range, flag VPN-reachable ports, and record Wiz's exposure level in the purpose
• Optional Wiz setting that keeps only the stable Representative Resource when a workload is also reported as an ephemeral instance, so the asset register stops double-counting it, with a dry-run mode that reports what would collapse without changing anything
• Improved schema-drift detection tooling reliability
• Warning in CLI logs when the connected RegScale platform returns fields the CLI does not recognize, signaling the CLI may be behind the platform version
• Catalog revision family, number, and state are now available on catalog records
• The CLI's ControlImplementation model now carries inheritanceModel, so a caller can read
  back whether a control is offered for inheritance and as what. Writing it still goes
  through the platform's provider-model endpoint, which sets it and the legacy inheritable
  flag together.
• Complete example configuration file covering all supported settings
• • Options to save a new service account token to init.yaml or copy it to the clipboard
• Wiz excessive access findings are now synced, covering identity over-permissioning alongside the other Wiz finding types
• Axonius sync_assets can now sync every asset in a file to a single specified security plan instead of mapping by FISMA ID
• New regscale trust-center vdr push sends a Security Plan's RegScale issues to the Trust Center VDR bulk-ingest feed (idempotent per issue, batched, exits non-zero on rejects), and vdr job-template prints ready-to-paste systemd unit/timer and cron schedules for a turnkey push job

Changed

• JCAM imports no longer report a 500 as a failure. JCAM answers 500 both when an endpoint
  has no data and when something is wrong, and nothing in the response tells the two apart,
  so these are now counted and reported separately as indeterminate. A domain where every
  call answered 500 and nothing succeeded is still called out as an outage.
• Platform secret store resolution is now opt-in via the secretStoreEnabled setting or SECRET_STORE_ENABLED environment variable, and any problem pulling secrets while enabled produces one clear, actionable message naming the cause and the fallback. Upgrading from 6.47.0, where resolution was always on: if you removed credentials from init.yaml after running push-secrets, set secretStoreEnabled to true to restore resolution
• JCAM control inheritance import now records inheritance linkage to support accurate display in RegScale
• The first Wiz sync after upgrading imports previously excluded resolved and ignored cloud configuration findings, which on an established tenant can be substantially more records than the open findings alone
• The provider inheritance-model setter is now InheritanceProviderModel.set_for_controls, and rejects an unrecognized inheritance model before sending it to RegScale

Fixed

• Wiz messaging services such as SNS topics and SQS queues now sync as Applications instead of Other, and an unmapped Wiz asset type is reported instead of being silently classified as Other
• An invalid Wiz filter setting now stops the sync with a message naming the setting, instead of failing with a raw JSON error or silently pulling the entire tenant unfiltered
• JCAM artifact import no longer re-downloads and re-uploads the same files on every run.
  The check for "already imported" was built by a different rule than the filename RegScale
  stores, so any artifact whose name contained punctuation never matched and was attached
  again each time.
• A GraphQL field-level error, such as one field a service account may not read, no longer aborts the whole sync; the remaining fields are imported and the refused fields are named in the log
• FedRAMP POA&M import no longer sets an asset's type from the free-text "Resources Required" column
• Wiz issue and STIG syncs now read the configured Wiz settings block instead of falling back to built-in defaults, so scheduled completion dates, past-due handling and known-exploited-vulnerability windows all follow the Wiz configuration, with high severity shifting from 60 to 90 days under the shipped defaults on plans that do not define compliance-setting SLAs
• Asset, issue, and vulnerability updates no longer drop platform fields the CLI did not previously recognize
• ServiceNow date parsing now zero-pads very small years consistently across platforms, preventing invalid dates on Linux
• AWS Security Hub checklist statuses now reflect compliance pass and fail results instead of always showing Not Reviewed
• Wiz vulnerability sync now reports when a Representative Resource arrives in an unrecognized provider format, instead of silently skipping the findings it would have rolled up onto the parent asset
• JCAM inheritance now appears in RegScale. The importer marks a provider's control as
  inheritable using the inheritance data JCAM already sends, rather than inferring which
  plans are providers from their system type. Nothing was being marked before, so the new
  inheritance API refused every link and the older display had no inheritable source controls
  to show.
• eMASS CAC authentication settings in the example configuration no longer conflict with baseline sync settings
• Wiz cloud configuration findings are now synced in every status, and a misconfiguration ignored in Wiz as a false positive, by-design setting, accepted risk or exception carries that adjudication into the RegScale issue's deviation fields
• Wiz findings resolved at the source are now closed in RegScale again, after a query that failed on every run stopped suppressing stale-finding cleanup for the whole sync
• The JCAM POA&M import summary now counts POA&Ms. Its successes were security plans and its
  failures were individual records, so the numbers could not be reconciled against anything
  without reading the source. Plan-level outcomes are reported as notes beneath the tally,
  and a plan whose POA&Ms could not be fetched, a failed POC lookup and a refused custom
  field value each have their own domain.
• Qualys VMDR report import now creates issues successfully instead of failing, and their due dates honor the configured remediation timelines for each severity
• Axonius pull_data_axonius no longer reports a successful import when it has only downloaded a file, and names each output file after the saved query so pulling several in sequence no longer overwrites them
• A failed Wiz authentication now only retries alternative token endpoints within the same Wiz deployment, so credentials for Wiz for Gov are never sent to a commercial endpoint or the reverse
• jcam import_ssp now creates each security plan with the JCAM system id in the field the loaded mapping profile nominates, rather than always in otherIdentifier. On the recommended profile that field is the System Acronym and the id belongs on trackingId, so a plan whose front matter pass then failed was left with no trackingId -- invisible to the next run's plan lookup, and created a second time.
• Missing pytz dependency that caused commands to fail on a fresh install
• Axonius README now documents the sync_assets --schema option and its two field mappings
• QRadar event sync no longer duplicates findings on every run, compliance assessment now credits the event categories and log sources QRadar actually reports, and query_events no longer crashes when a plan lacks one of the mapped controls, rejects query values that could alter the search, labels POA&Ms and evidence with the field and time window that were queried, and exits with an error when a query-mode run fails
• Slow scanner imports caused by repeated asset and issue lookups, and issues that failed to link to assets created during the same run
• Vulnerability imports no longer slow to a crawl when the tenant lookup fails
• Axonius v2 asset sync no longer fails with a bad request error
• • The CLI no longer clears the root logger's handlers when used as a library, so host applications and test harnesses keep receiving log records
• • Qualys VMDR report re-imports now close stale vulnerabilities that no longer appear in the latest report
• eMASS workbook imports no longer erase stored data when a tenant disables a form field. A disabled column is now left at whatever the server already holds rather than being written back empty, across the hardware and software inventory, POA&M, SLCM, security categorization, control test results and eMASS baseline imports. An import that fails because the security plan is not visible, or because the workbook does not match the target plan, reports one error line instead of a Python stack trace, and a column the server refuses is now counted as an error rather than reported as a clean run. The software In Service Data column reaches its field instead of a retired one, the hardware inventory reports IP address values it discards rather than dropping them silently, a dry run no longer contacts the instance, and the Test Result import prefers a real data sheet over a boilerplate Template tab.
• Defender sync_cloud_resources now creates virtual network assets whose Azure address space is a list of prefixes, instead of failing with an asset validation error
• Connector syncs, including GCP, Wiz and Jira, now stop with an error naming the missing security plan or component when pointed at one that does not exist, instead of writing records that no plan can reach

ROH 6.34.2.1 Release

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.34.2.1

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release removes database connection details from the Orchestration Hub startup logs.

What's Fixed

• Startup logs no longer show database connection details. At startup, Orchestration Hub wrote the beginning of its database connection details. At the default log level, Orchestration Hub now writes no database connection details. With debug logging turned on, it records only the database host.

Deployment Notes

This release has the same platform requirement as 6.34.2.0: RegScale 6.34.2.0 or newer.

No configuration change is required.

ROH 6.34.2.0 Release

Release Overview

Release Name: ROH Beta Maintenance Release

Release Type: Maintenance

Release Number: 6.34.2.0

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This maintenance release delivers reliability, security, and supportability improvements for early adopters, summarized below.

What's Fixed

• Single sign-on now returns you to Orchestration Hub. After signing in with SAML, the browser was left on the linked RegScale instance instead of being returned to Orchestration Hub, so the Orchestration Hub session was never established. RegScale now records the address the sign-in started from and returns the browser there. This requires RegScale 6.34.2.0 or newer and the setting described under Deployment Notes.
• Orchestration Hub now starts on hosts with FIPS mode enforced. The database driver previously carried its own bundled cryptography library rather than using the host's approved one, which stopped the service from starting on a FIPS-enforcing host. Database connections now use the system cryptography provider.
• Amazon S3 sources accept temporary credentials. A source configured with a session token, as used for temporary or federated AWS access, now works for scheduled jobs and not only for the connection test.
• Log timestamps state their time zone explicitly. Every timestamp is recorded in UTC and labelled as such, so logs gathered from different hosts can be compared and correlated reliably.
• The scheduler no longer restarts repeatedly on a fresh Kubernetes install. The Helm chart's health check for the scheduler component relied on a utility that is not present in the shipped image, which caused the scheduler to be restarted continuously.

Maintenance and Updates

• Reduced operating-system vulnerabilities in the shipped container images. Components that were not required at run time have been removed from the published images, lowering the number of reported operating-system vulnerabilities.
• Updated bundled dependencies. Third-party libraries have been advanced to current versions, including security fixes for the asynchronous networking and HTML-parsing libraries and an update to the database driver.
• Expanded self-hosted deployment documentation. Guidance for Helm-based installation and for Kubernetes deployment and maintenance has been extended.

Deployment Notes

This release requires RegScale 6.34.2.0 or newer for all customers. Confirm the platform version before rolling out Orchestration Hub 6.34.2.0.

Customers using SAML single sign-on must set one additional value. Configure the ROH_PUBLIC_URL environment variable to the full URL and hostname at which Orchestration Hub is reached — for example https://servicename-oh.example.tld, resolved to the customer's own endpoint. RegScale uses this value to return the browser to the Orchestration Hub instance after sign-in; without it, the browser is left on the RegScale instance and the Orchestration Hub session is not established.

No other configuration change is required. Existing integration, source, and single sign-on settings are otherwise unaffected.

[6.34.2.0] 09-21-2026

AI and automation

Improved

• RegScale provisions and renews the platform service account that AI harvesting requires. It does this at every application start, for each app of a tenant with RegML enabled. AI SSP Author and Response Automation report a clear message that names what to create when that account is absent or expired.

API

Improved

• A control implementation AI audit result reports how many control parameters are unpopulated and which ones. The security plan and component AI audit status endpoints return that evaluation with each control result.
• The batch create or update endpoint for issues applies the required fields your tenant configures on the Issues form, matching the single create endpoint. An issue that fails validation is reported in the rejected list with the field that is missing, and no record is written. Automated imports that must accept incomplete records set the skipCustomFieldValidation request option to true.
• The form field definition API reports each field's minimum and maximum length, so a client can check a value before saving it. Saving custom field values returns an error for each rejected field and names that field, so a client can correct only the failing value.

Fixed

• Users who hold Read permission on Security Plans can run an App Builder templated export for a security plan through the API. The Administrator role is not required.
• The API reference documents an authorization denial as 403 and reserves 401 for a caller that presents no valid credential. Each description states the cause of the denial, so a generated client treats a permission problem as a permission problem.
• The bulk control inheritance API rejects a request whose references cannot be resolved. It returns a 400 response instead of a success response reporting zero links. Rejected cases include an unrecognized provider module, a consumer security plan that does not exist, and a provider that holds no control implementations. Callers that treated the all-zero success response as valid must handle the error response.
• The group activation endpoint answers with a not-found result when the group does not exist in that endpoint's identifier space. The response names the group identifier, so a caller can tell an unknown group from a server fault.
• Creating an issue through the second version of the issues API returns a bad-request response that names the missing required fields. A client can tell its own invalid input from a server fault.
• Creating a compliance setting without field groups returns a clear message that names the required field groups. Omitting the collection and sending it empty give the same message.
• The newsfeed most-recent-post endpoint answers 204 No Content with an empty body when a tenant has no posts. The API reference and the integrator breaking-change notice both state that status. Treat 204 from this endpoint as nothing to show, not as a failure.
• The custom field query API endpoints match values that Form Builder stores, for every module that offers custom fields. Text, number, whole number, currency, checkbox, date and select field types all match. A value captured before a tenant moved to Form Builder is carried over at startup, so it keeps matching. Each tenant sees only its own values.
• The streaming endpoints that map issues to assets and record vulnerability mappings count one error for each failed item. The total error count is accurate at any batch size, so a caller can reconcile and retry the items that actually failed.
• The directory sync account endpoint reports a failure when it cannot create an account. The response states the real outcome, so a sync that creates nothing is visible to the operator instead of reading as a success.

Administration

New

• Each job row on the Admin Jobs tab has a History panel. Open a row to see that job's recent runs with start time, duration, status, trigger scope, and counts or error. The cross-job History tab is unchanged.

Improved

• Security audit events write their failure reason and details to the console log in every deployment. Administrators can read why an event was recorded when they investigate an incident. The bracket prefix that log collectors read is unchanged.

Fixed

• The introductory instructions on the Security Policies page read as a complete sentence, with no stray empty parentheses.
• The Instance Security screen shows each readiness check with its own result: pass, warning, or failure. The blocked banner counts the checks that must still pass. Where monitoring has never been turned on, the screen shows the monitoring alert instead of an incomplete sentence.
• The form builder's Reset to Factory Default dialog now offers an "Also reset custom fields" choice, in both the new and the legacy interface. Leave it off and custom fields, custom sections and their data are kept, which stays the default. Check it and the module is cleared back to its out of box configuration, with stored values archived first. The dialog now states which of the two happens. Fields and tabs created by a configuration template are custom fields. Check the box to fully clear a previous template before you import a new one.
• Activating or deactivating a user in the new interface now tells you when the operation fails. If the server explains the refusal, that explanation appears. An administrator learns that the account is the last one able to sign in, and what to do first. Any other failure shows a general message instead of nothing. The same applies to changing a status from a user profile and to removing an administrator from a tenant.
• The Configure Tenant form shows an identifier only after the tenant is saved. Creating a new tenant shows no identifier at all.
• In the legacy interface, the application administrator list now shows each administrator's own profile picture. It previously showed the picture of whoever added them. The Added By name still reads from the user who granted the role. A profile picture also refreshes on screen when it changes.
• Clearing directory accounts now reports how many administrators remain. The count includes administrators who sign in with a local password, not only those who sign in through a directory or identity provider. The response also reports how many identity provider administrators remain, as a separate figure. The lockout warning appears only when no administrator can actually sign in, so it no longer fires on a tenant that still has administrators available.
• In Wayfinder Builder, the link editor names each subsystem tab the way a record names it. The tab that holds a record's actions takes its name from the configured display name for that module. A renamed module is reflected in both places.
• In the Rule Builder, changing a rule action's type keeps the action's target field. The Allow External Value toggle reappears when you set the action back to Disable, and the rule keeps the target you chose.

Alerts

Fixed

• Assistive technology announces the side rail Alerts panel as Alerts, matching its visible heading and the button that opens it. Screen reader users and sighted users hear and read the same name for the panel.
• The Alerts button on the side rail shows the unread indicator and the unread count from sign-in. A user learns that alerts are waiting without opening the panel first.

Assessments

Fixed

• On an assessment line of inquiry, the Issues Identified field is marked required as soon as you select Issues Fixed During Assessment. The required marker now matches the rule that blocks the save, so you can see which field to complete before you submit.
• Saving a control test result now checks the parent test, parent assessment and asset before it writes anything. If a parent record is missing or is not one you can access, the save is refused and the message names the value at fault. Editing a control test result applies the same checks, and an edit that omits the parent records keeps the stored ones.

Assets

Improved

• An asset's Hardware Info tab has three separate fields for operating system data: OS/IOS, OS/IOS Version and FW Version. The single combined field is retired. Existing combined text moves into OS/IOS Version without being split. Re-key the operating system and firmware values into their own fields. The original combined text is retained, and the eMASS hardware and software export cell content is unchanged.

Fixed

• Retiring assets during a batch import records an audit event for every asset retired, so the change appears in the asset audit history.
• A value that a form rule sets takes effect even when you cleared the same field without saving. On a tenant with a preset configuration template package, an asset form stays responsive when you set Virtual Asset to Yes after clearing Serial Number.

Catalogs

Fixed

• Catalogs accepts a valid Unified Compliance Framework API key when you save it, and Unified Compliance Framework catalog imports complete. The save check reads the subscription expiration date from the provider response.
• A catalog update keeps any security control that has an implementation or a requirement. Controls tied to your compliance work stay in place when the installed catalog is reconciled.
• The Catalogs library refuses an archive and replace while a security profile still maps live controls from that catalog. The message names the dependent profiles, so you can repoint them first. A security plan keeps a profile that resolves against a live catalog, and catalog control sync keeps reconciling it.

Change tracking

Fixed

• On a tenant with the ITIL change feature turned on, Change Type is editable while a new change is at Draft. It becomes read only after the change advances. You can complete and save a new change from the form.

Compliance Explorer

Fixed

• Compliance Explorer fills the bridge control and bridge mapping columns on every row of the Mapping Explorer. The Network Visualization view renders the bridge control node without an error. The projection coverage verdict is now available to the view.

Compliance Settings

Fixed

• Deleting a compliance setting that security plans or components still reference returns a conflict response. The message tells you to move those records to another compliance setting first. When the referencing records are already deleted, the deletion succeeds, detaches those references, and writes the deletion to the audit trail.
• The Active column on the Compliance Settings list matches the Active checkbox on each setting's own page. An administrator can tell from the list which compliance setting is in force.

Components

Improved

• Component Type reads in title case wherever it is displayed. This covers the Components list, the asset and security plan mapping grids, and the evidence mapper. It also covers the plan creation wizard, the Components status board, the print and email report, and the dashboard record grids. The stored value stays lowercase, so exported system security plans keep their required format.

Fixed

• Deleting a component also deletes the assets parented to that component. Your asset inventory no longer keeps records whose parent component is gone.

Dashboards and status boards

Improved

• The Policy, Project, Component, Security Plan and Supply Chain status boards use one shared card layout. The chart key sits beside the chart, status and progress read as pills below the title, and the card footer names what it reports. Tabs on the card read as segmented buttons.

Fixed

• The Vendor Dependency tiles on POA&M Analytics and Deviation Analytics count records whose Vendor Dependency field is set to Yes. The drilldown lists the same records the tile counts.
• The Organization Activity list on the News Feed now reads "1 action" when a user has a single action. Counts above one still read "actions".
• A Report Builder pie, bar or line report added to a dashboard renders the same grouped data that View Report shows. Each bucket appears with its count. Switching application context rebuilds the widget with the correct report.
• Grouping the Security Plans dashboard by a custom field buckets each plan on the value its record shows. Grouping also works for a field whose name contains a space, a hyphen, or a period. Breaking change for API callers: the Security Plan graph endpoint returns Name and Count for custom field grouping. These are the same keys it returns for standard property grouping. A caller that reads the lowercase keys must update.

Deviations

Fixed

• A False Positive deviation requires evidence, including when the operator clears a rich-text field so that only formatting markup remains. The save is refused, the workbook import skips such a row with a warning, and the FedRAMP deviation request form carries the evidence columns.

Evidence

Fixed

• The Audit Info dialog under Record Operations opens sized to its content. Audit fields read as a compact list, and an empty field takes no extra space. This applies to Evidence and to every other module that offers Audit Info.

Exports

Improved

• A queued export that is never picked up is marked failed within minutes when the background system is idle. The person who requested it is notified. You learn that an export was lost close to the time the confirmation message promised, instead of waiting for the long orphan timeout.

Fixed

• A FedRAMP Appendix A export that cannot be saved now fails the job instead of reporting success. An export reported as complete is retrievable from Files, and the job log records completion only after the file is stored.
• The FedRAMP plan of action and milestones export now fills the Remediation Plan column from the Recommended Actions field on the issue. When Recommended Actions is empty, the column falls back to the Remediation Description. The export template is also available in Export Builder, where you can check how this field is mapped.

Imports

Fixed

• The Threat Model Importer shows its information notes in the same warning style the other importers use. The note label and its icon line up with the note text.
• A bulk issue import now creates every issue you submit, whatever batch size you request. Issues that carry no unique identifier are each created instead of collapsing into one record per batch. An item the import cannot create is reported in the error total and named in the response, rather than dropped while the import claims success. The same correction applies to the standard bulk issue import, the eMASS plan of action workbook import, scan file import and the issue import API.

Issues

Fixed

• Issues created directly through the API now take their Known Exploited Vulnerabilities value from the platform's own CISA catalog. The value reflects current catalog membership rather than a snapshot shipped with a client tool.
• Issues created or updated through the batch API apply the same due date order as a single issue. With no due date supplied, RegScale uses the CISA Known Exploited Vulnerabilities catalog date first. It then uses the plan or tenant patching service level agreement, then the configured default table. A supplied due date is kept, and a batch update with no due date keeps the stored date. Computed due dates carry a UTC designator.
• You can clear the Deviation Request Required flag on a POA&M and save the record. The POA&M Status Board then counts that record among POA&Ms without a deviation request, in its cards, charts and metrics. Clearing the flag deletes the deviation request details on the record.
• An issue created or updated without a due date takes its due date from your tenant's configured patching service level agreement. This applies when POA&M milestone automation is on. The single create, single update and batch paths all read the same tenant setting.
• An Issue's Related Assets tab shows the asset IPv6 address in its own column. An asset that holds only an IPv6 address shows that value instead of an empty cell.

Module Forms

Fixed

• Fields that an administrator moved to a different form tab before upgrading are editable again on saved records. The startup seed restores each system field's include-in-form setting from the module definition, for every tenant.
• Percent sliders fill the whole track at 100 percent and show no fill at 0 percent. This covers the percent complete, mitigation effectiveness, risk exposure and minimum relevance score sliders.

Navigation

Improved

• The left navigation rail has updated icons, spacing, and active and hover states, so your current location is easier to see. Notifications is now named Alerts.
• Page headers now follow one standard across the app. Each page carries a single top-level heading in a consistent size, weight and position, with a breadcrumb trail above it where one applies. A record count appears beside the title only when the page supplies one, and counts above 999 read in a short form such as 13.6k. A long title or a long breadcrumb entry shortens with an ellipsis and shows its full text on hover and on keyboard focus. The header works in both the light and dark themes.
• Server errors now produce a clear message anywhere in the new interface, instead of depending on each screen. A refused request explains what to do. It asks you to check your input, or to refresh after a conflict. It asks you to wait and retry when the service is busy, or to try again later during maintenance. A request that times out says the operation may still be running, so check before you retry. A connection failure says to check your network. A server fault shows one consistent message that asks you to retry or contact support.
• Popover panels across the app now carry an accessible name, so a screen reader announces what each one is. The footer version panel announces as "Version details" and the app switcher announces as "Switch app". The name stays correct when a panel is closed and opened again. This closes an accessibility finding rated serious against WCAG 2.1.

Fixed

• Application titles are visible again on the Browse Applications tiles. A user who has no application access can read each application name before requesting access.
• Wayfinder smart activities apply their configured filters. An activity is evaluated against only the records that match its filters, so its completion result reflects the intended subset.
• The status board guided tour anchors every step to the control it describes, keeps the selected time period, and ends with a Finish step.
• The app switcher shows its notification count on a solid red badge that reads clearly in app mode and in report mode. The badge is larger. The same badge style applies to the kanban overdue count and to the private record lock icon.
• A Wayfinder smart activity whose filters cannot be built is treated as not evaluable. It is never evaluated against every record in the module, so an unsupported filter field cannot produce a misleading result.
• In dark mode, the left navigation rail uses a neutral dark background that matches the rest of the dark interface. In light mode the rail keeps its dark navy background, which is the intended design of the navigation system.
• The Home button at the top of the navigation rail shows the current app's App Banner image. An organization then sees its own branding on every screen. An app with no banner shows the app initials. A configured tenant logo appears when no app owns the button, and cross-app reporting shows a reporting mark.

Notifications

Fixed

• A comment alert in the notification list opens the record's Comments tab and highlights the comment it reports. The comment is scrolled into view and labeled, so you can find it in a long thread.

POA&M and status boards

New

• The POA&M Status Board filter bar has a Vendor Dependency filter. Set it to Yes or No to filter POA&M Analytics and Deviation Analytics by vendor dependency.

Improved

• The Status Distribution chart on the POA&M Analytics tab groups records by issue status, such as Draft, Pending, Compliance Review and Closed. Clicking a segment opens the matching records, so the chart agrees with the statuses used elsewhere in the application.

Fixed

• Filters applied at the top of the POA&M Status Board carry into a drill-down. Clicking a chart segment, a metric card or a vulnerability card combines two filters. The result lists only records matching the board filter and the part you clicked. The drill-down shows the inherited filter as a chip.
• On the POA&M Analytics tab, clicking a severity tile or card whose count is zero opens an empty list that keeps the severity filter. The drill-down count matches the count on the element that was clicked.

Questionnaires

Fixed

• Anonymous users can self-assign a questionnaire that its owner has published for public self-assignment. The request creates a questionnaire instance and sends the assignment email. A questionnaire that is not published for public self-assignment stays unavailable to anonymous callers.
• A questionnaire instance created through anonymous self assignment is scoped to the owning application, whichever version of the endpoint the caller uses. Tenant administrators can read, manage and delete these instances. Existing instances that carry no application are corrected on upgrade.

Reporting

Improved

• Report pages use consistent spacing between the summary cards, the filter fields, the Run button, and the expanded row actions. The screens are easier to read.

Fixed

• Report date filters list readable options. The Date Field and Relative Date dropdowns on the report views show their option names.
• On a report, clicking a card row expands or collapses that group. The expand and collapse buttons keep working as well.
• The Components Evidence Completion report and the Security Plans Evidence Completion report list control implementations as soon as you select a record. No extra click is needed.
• On the NIST SP 800-171 Self Assessment with Objectives report, the Level to Report list shows the name of each option. The selected option's name also appears. You can see which level the report covers before you change it.

Risks

Fixed

• The Risk Assessment wizard re-scores the Current Risk when you change Current Risk Consequence or Current Risk Probability on the Status Update step. The tile and the saved record carry the score the risk model computes for the pair on screen.
• Every risk wizard tells you up front when you cannot create risks. If a scenario fails when you click Finish, you can retry without duplicating the risks already created.

Security Controls

Improved

• In the Link Existing Requirement wizard on a security control, a requirement already mapped to that control now shows a lock instead of a checkbox. The row is tinted and cannot be selected, and hovering it explains why. This matches the requirement to control wizard, and it removes the case where a row looked selected although nothing was queued. Rows you can select now carry a name that a screen reader announces.

Security Plans

Fixed

• The FedRAMP Test Case Procedures workbook now contains only the controls linked to the security plan you export. The workbook reflects the plan under assessment instead of the whole baseline.
• The System Security Plan document includes only interconnections whose status is Approved. Connections in any other status stay out of the generated plan.
• The FedRAMP SSP Appendix A export lists each control's parameters in FedRAMP document order. Sub parts that reach two digits sort after the single digit entries, and lettered parts follow the base statement parameters.
• A custom field value shows an ampersand, angle bracket or quotation mark as the character itself. A security plan's Environment Type set to RDT&E (Zone B) reads correctly after you save and reload the page.
• The Security Plan scorecard header and the Audit Info dialog show the same calendar day as the record's own date fields. This holds in every browser time zone.
• The Leveraged Authorization form shows the server's validation message on the form and in the notification. You can see which field to correct instead of a generic retry message.
• Catalog control sync keeps the organization-defined parameter values that a person entered on a security plan. The sync change log records each parameter value it declines to overwrite. A run that only declines writes reports no changes to the record.
• Adding a control that is already on a security plan creates only the child records the control implementation is missing. Implementation objectives are not duplicated when a control is missing its parameters.
• A Security Plan that carries no FedRAMP identifier saves with more than one cloud deployment option selected. The single option rule applies only to plans that carry a FedRAMP identifier.
• Creating a security plan with the Blank Security Plan option now opens the Compliance Setting list on its placeholder, with nothing selected. The list previously showed a zero that matched no option and passed the required field check. The required field check now prompts you if you leave the setting blank, so a plan cannot be saved with an invalid compliance setting.
• The FedRAMP Appendix A export labels every parameter row with one convention. All rows in a single document read the same way, whether or not the parameter is mapped. Parameter order and values are unchanged.
• Chart view on the Security Plans list draws a chart for each custom dropdown field. A tenant that populates such a field on its security plans sees the values charted.

Sign-in

Improved

• RegScale writes a durable audit record when a single sign-on response returns a different account than the one the sign-in requested. Administrators can review these records in the security audit history and attribute each one to a time, a tenant and a source.
• RegScale writes a security audit record when a single sign-on session handoff is refused. Each record distinguishes the reason for the refusal, so an operator can tell an expired or already used handoff from one that was never valid. No handoff or session value is recorded.

Fixed

• Single sign-on now reports a clear, actionable error when the tenant it is asked for has no single sign-on configuration. Both starting a sign-on and returning from the identity provider give the same specific message instead of a generic failure. The tenant involved is recorded for administrators in the application log and in the security audit record.
• Single sign-on logins that start at the identity provider complete and issue a session. A login started from the identity provider portal arrives in RegScale signed in. This works in both the classic interface and the new interface.
• A single sign-on logout request that carries no single sign-on session returns a client error that states what is missing, instead of a server error.

Upgrades and deployment

Improved

• An upgrade now builds the record permission index once instead of twice. The application is offline while that index builds, so an upgrade of a large instance completes sooner and the startup outage is shorter. Instances that need the permission view brought up to date still receive that update, applied by its own step.

Users and Roles

Improved

• Clearing a tenant's directory-sourced users reports the effect on administrator accounts. The result names how many accounts were cleared, how many of them were administrators, and how many administrators remain. When none remain, the result appears as a warning.

Fixed

• An inactivity run notifies an account holder only after the deactivation is saved. The run total and the administrator summary email count only the accounts that were actually deactivated. A tenant whose batch save fails sends no deactivation notices.
• A tenant administrator can grant the module roles again, including the roles for risks, issues, policies, vulnerabilities, threats, incidents, changes, programs, projects and reporting. Three roles stay reserved for a global administrator, and the grant call states the boundary as those three refusals.

Workflows

New

• Step Assignee Type in the Workflow Designer offers User Field on every deployment, with no configuration change. A workflow designer can route an approval step to the person named in a record property, such as Issue Owner or Risk Owner. A deployment that turns the option off still hides it.

Fixed

• The evidence approver assigned to an evidence approval step can now approve or reject that step. A delegate of that approver can act on it too. This matches how group, manager and functional role steps already behave, where the assigned person acts on the step. Administrators can still approve evidence steps as before.
• On the Workflow Designer canvas, a step routed by a record's user field shows that field on its own line below the action type. The step name, the action type, and the target field all stay readable.
• In Workflow Designer, a Form step's Use step routing option describes every assignee type the step offers, including User Field. The description is built from the assignee type list, so the two always agree.
• In the Workflow Designer, the Workflow Steps tab names a User Field step's target property with the same label the picker uses. Issue Owner is one example. The tab and the visual designer now describe a step in the same words.
• A workflow step routed by a record's user property treats a deactivated account as naming nobody. The step hands to the workflow owner and records that it fell back, and reactivating the account restores the original assignee.
• Where a workflow step is assigned to several people, semicolons separate the names. Because each name reads surname first, the separator stays distinct from the comma inside a name. This applies to the running step panel, the progress tooltip, step details, and the step permission message.

Security

Improved

• The Workflows module applies its step permissions consistently. A step that waits for an assignee selection requires that selection before anyone approves or rejects it. A deactivated account cannot approve a step, and the step falls back to the workflow owner for assignment and notification. A running step's routing and state stay with the workflow engine and the template designer, which alone set a step's assignment, status, and step type. Editing a step's name, order, or execution type works as before.
• The leveraged authorization API rejects an incomplete submission with a 400 response that names every required field it is missing. References in a submission must resolve within the caller's tenant.
• The control implementation list for a security plan returns control owners as a list of user ids and a list of usernames. The batch update response carries no owner details, and owner assignments save as before. Update any integration that reads owner information from these responses.
• The catalog comparison CSV export writes numbers and dates in one fixed format on every host. Rows stay aligned when the host uses a comma as its decimal separator. Values are written as text, so a spreadsheet displays them instead of evaluating them.
• The Risk Models API clears a risk model's matrix through a delete operation. The earlier route for the same action stays available, is marked deprecated in the API documentation, and returns a deprecation warning in its response headers. Both routes record the risk model and the number of entries removed. Update integrations to call the delete operation, because the deprecated route will be removed in a future release.
• Single sign-on returns the browser to the RegScale origin that the login started from, so a login begun in the Orchestration Hub finishes there. An administrator must set the permitted return origin parent domain in the single sign-on configuration for a cross origin return to take effect. Without that setting, the login returns to the RegScale application.
• Only a global administrator can grant instance wide administrator authority. A tenant administrator grants the roles that apply within its own tenant, and cannot change its own roles. A refused grant returns an error and writes an audit record.
• The RegScale container image carries updated platform runtime components that resolve published vulnerabilities. The image build pins a minimum runtime version, so a later rebuild keeps the update.

[6.48.0] - 2026-09-21

Added

• JCAM import commands accept a repeatable plan id so a run can be narrowed without editing the configured filter
• Wiz issue sync now brings over issue notes, the affected resource's cloud console link, project business impact, policy type, and linked service tickets
• Wiz issues are now synced in every status, and an issue rejected in Wiz as a false positive, accepted exception or won't-fix carries that adjudication into the RegScale issue's deviation fields
• Splunk verify-forwarding command to check whether the RegScale platform can reach its configured log-forwarding destinations
• JCAM imports can name the compliance setting new security plans are created on, instead of always using the platform default
• GitHub and GitLab commands that route each repository to the security plan named by one of its topics
• Microsoft Sentinel standalone alert sync for alerts that never became an incident
• Azure Government support for the Microsoft Sentinel integration
• Microsoft Sentinel workspace content sync for analytics rules, automation rules, data connectors, connector health, bookmarks, hunting queries, watchlists, and threat intelligence
• Microsoft Sentinel KQL query command for reading a workspace's Log Analytics tables
• Multi-workspace Microsoft Sentinel sync with per-workspace incremental checkpoints
• Opt-in Microsoft Sentinel status write-back that closes incidents behind resolved RegScale issues
• Microsoft Sentinel integration that syncs incidents and their affected hosts, IPs, and Azure resources into RegScale

Changed

• Custom field values are written one request per record instead of one per value, with a refused record retried a value at a time
• The first Wiz issue sync after upgrading will import previously excluded resolved and rejected issues as closed RegScale issues
• Reduced install size and startup overhead by dropping the pandas dependency
• Microsoft Sentinel entities now map to the record type that fits them, with accounts, mailboxes, cloud applications, and security groups inventoried as assets and files, hashes, URLs, and processes carried as finding evidence

Fixed

• JCAM import reports when two milestones or interconnections share a name instead of silently keeping one
• JCAM import no longer loses a POA&M or milestone when JCAM sends no date or a negative effort figure
• JCAM assessment import now updates control implementation status and last-assessed date instead of failing on every control
• Wiz issue synchronization no longer fails when a Wiz source rule returns no security subcategories
• Custom field values are no longer lost when the platform refuses one value in the same save
• Wiz network exposures now record their public or internal classification in a field the platform stores, instead of one it discarded
• Wiz network exposures reported on both an ephemeral workload and its stable representative now produce a single ports and protocols record
• Wiz vulnerability sync now completes for service accounts without permission to read Wiz comments, skipping only the comment data
• JCAM artifact import downloads and uploads one file at a time, so a full disk no longer loses the whole run
• JCAM assessment import now recognises Not Applicable results instead of silently dropping those controls
• JCAM assessment import counts controls rather than security plans in its run summary, reports why controls produced no assessment, and recognises both spellings of the no-date value JCAM sends
• Cloud assets with multiple network addresses now record a single IP address, so they match scanner findings correctly
• File upload failures now report the server status code and message instead of a generic empty-response warning
• Raw SBOM documents from GitLab and GitHub are now attached to the security plan when the platform refuses to store them on the SBOM record
• SBOM records now store a consistent CycloneDX standard value regardless of how the source document spells it
• Updated bundled dependencies to pick up upstream security fixes
• JCAM control import records an inherited control as implemented, keeping the inheritance in the control origination field
• GitLab and GitHub SBOM syncs now store the original SBOM document so package comparison and SBOM download work correctly
• GitLab and GitHub SBOM records now appear on the repository asset instead of the security plan