[6.44.5] - 2026-09-03

Fixed

• JCAM interconnection import now correctly detects VPN connections and pulls authorization type from JCAM data instead of a fixed value
• Axonius asset count now sends a valid request body instead of always failing
• Microsoft Defender for Cloud resource sync now targets the correct Azure Government Cloud endpoint instead of falling back to the commercial one

[6.44.0] - 2026-09-02

Added

• JCAM: jcam check_config now checks the jcamAgencyDefinedDataItems mappings against what
  JCAM actually carries, naming entries configured for attributes JCAM does not have -- each of
  which demands a custom field for nothing -- and attributes JCAM does have that are mapped
  nowhere. These names are matched exactly, so a single character apart means the item silently
  does not import.
• JCAM: Business Identifiable Information now imports without any tenant configuration. It is on
  the mapping sheet, but the sheet named an endpoint that does not carry it, so until its real
  source was confirmed it could only be mapped by hand in jcamAgencyDefinedDataItems. The
  recommended profile now carries it alongside the other attributes that endpoint feeds.
• SARIF import accepts --regscale_ssp_id and --component_id to choose the record that receives the findings
• jcam list_fields now also reports each field's type and, for a select, the values it accepts. That is what decides whether a value can be written at all, and it was the missing half of the picture when diagnosing a rejected import.
• jcam list_fields reports every form field a tenant has, per module and tab, with each field's id, system name, and whether it is native or custom. check_config says what the mapping profile cannot find; this says what is there to point a jcamFieldMapping override at, which previously meant reading the Form Builder in a browser one tab at a time.

Changed

• JCAM: jcam check_custom_fields is now jcam check_config, and jcam test_jcam is now
  jcam test_connection, matching the name eight other integrations already use. The old names
  still work. check_config answers the whole readiness question rather than the part its old
  name described: it now also names the mapping profile in use and why it was chosen, says
  whether a control catalogue can be resolved, and lists the system roles a plan will need for
  JCAM's points of contact to import. The sections that need JCAM say so when they cannot reach
  it, rather than failing the rest of the report.
• JCAM: a tab the tenant does not have is now reported with what to do about it -- a tab of a
  similar name if one exists, and where the fields the profile wants there actually are.
  Previously each absent tab was listed bare, so a tenant that had rearranged or renamed its
  forms saw a list of separate problems rather than one cause.
• SARIF import requires the asset to link findings to, instead of guessing one from the file
• SARIF import prompts for the asset when it is not supplied, instead of failing after the fact
• Assessment results that no configured status label matches now resolve to the least-compliant available status instead of whichever label is listed first

Fixed

• JCAM: the shipped configuration template no longer causes import commands to fail with a
  traceback. Unconfigured settings now read as empty rather than as nothing at all, so a tenant
  that has no agency-defined data items, no artifact types or no framework catalogue gets a
  clear result instead of an AttributeError; jcamArtifactTypes accepts a list or a
  space-separated string as well as a mapping; and an instance with only one control catalogue
  loaded no longer takes the other one down with it.
• JCAM: a configuration value left as a placeholder by an older version of the CLI is treated as
  unconfigured rather than as a deliberate setting, so it no longer shadows the pre-rename key it
  was meant to replace. Where an upgrade adds a settings key that differs only in capitalisation
  from one already present, the CLI now says which pair to reconcile instead of silently
  preferring the new one.
• JCAM: the framework catalogue setting is spelled the same way in the configuration template as
  in the code that reads it. Previously 800-53R5 was written into init.yaml while 800-53r5
  was read, so filling in the placeholder as instructed had no effect.
• JCAM: a tenant that rearranges its Security Plan forms no longer breaks the import. Native
  fields are found by their internal id, which RegScale keeps unique across a module, rather
  than by the tab the mapping profile expects them on -- writing one is an attribute assignment
  that does not care which tab displays it. Custom fields still require the tab, because a
  custom field is addressed by a name its owner chose and the same name on another tab is a
  different field. Previously, moving stock fields to a different tab made every native
  destination unresolvable, and an incomplete resolution refuses to import.
• SARIF findings with the same rule in different files are now kept as separate vulnerabilities
• Scanner imports no longer fail with a missing-directory error when the configured artifacts directory does not yet exist
• SARIF findings are now titled with the rule description instead of repeating the rule or CVE identifier
• Large scanner batches no longer run four times over when the server reports success in its streaming format
• SARIF sync now reports when it can only run the compliance phase instead of skipping the import silently
• SARIF import now records vulnerabilities against the security plan or component instead of duplicating them per asset
• Vulnerability and other scanner imports no longer fall back to slow per-item processing when the server deduplicates records within a batch
• FedRAMP import_interconnects and import_cryptography commands are now available in the CLI
• Implementation statuses written by Wiz, CrowdStrike and compliance assessments now respect the status picklist configured on a plan's compliance settings
• Wiz compliance sync no longer skips updating control status for controls that have no objectives
• Compliance imports no longer fail to save control implementations that are set Not Applicable
• Databricks query failures now report the actual database error instead of an unrelated internal error
• JCAM no longer sends a custom field value the field cannot hold. A field's type and choice list belong to the tenant, so the profile cannot know them, and nothing was checking: free text could go to a Select and a value to a section heading, with the only objection arriving from the platform as an HTTP 500 naming neither the field nor the reason. Values outside a declared choice list, and values bound for a field type that holds no data, are now reported by field name and skipped rather than sent -- one bad value used to fail the whole batch and cost every other value on the record.

[6.33.3.1] 08-31-2026

Fixes

Tabs Missing from Security Plans

Resolved an issue where specific tabs are not being displayed on Security Plans. Security Plans lost Vulnerabilities, Issues/POAMs and Inventory Scorecard. Components lost Vulnerabilities and Inventory Scorecard.

ROH 6.33.0.0 Release

Release Overview

Release Name: ROH Beta Minor Release

Release Type: Minor

Release Number: 6.33.0.0

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What's Included

• ROH container images are now published to Docker Hub. The application and worker images are available publicly as regscale/orchestration-hub-app and regscale/orchestration-hub-worker.
• Updated bundled RegScale user interface. The user interface updates include multiple cosmetic enhancements and bug fixes identified below.

What's Fixed

• Microsoft Defender jobs that import nothing now report failure. A Defender synchronization that retrieved records but could not process any of them previously logged the errors, reported success, and exited normally while creating nothing in RegScale — so a scheduled job could report green every night while landing no data. Such a run now fails, making it visible for investigation. A run that processes only some of what it retrieved warns and still creates the rest, and a run that legitimately finds nothing to retrieve still succeeds.
• Credentials are now listed for Defender, Entra and Tenable jobs. When creating a job for any of 20 Microsoft Defender, Entra, Tenable.io or Tenable SC commands, the job form listed no credentials at all, so it could not prompt for the values those jobs need and gave no indication anything was missing before the job failed at authentication. Those commands now list their credentials on the job form.
• Scheduled job times displayed in the wrong timezone. Job and execution times appeared several hours in the future for users outside UTC — a job scheduled for 01:35 UTC displayed as 05:35 to a viewer at UTC-4. The jobs themselves always ran at the correct time; only the display was wrong. Times returned by ROH now carry an explicit UTC designator so they render correctly in the viewer's local timezone, across the Jobs, Executions, Analytics, Secrets and Monitoring screens.
• Screens failing to load after an upgrade. After ROH was upgraded, a browser still holding the previous version could fail to open individual screens with a module loading error until the user performed a hard refresh. The application entry point is no longer cached, so an upgraded ROH loads correctly on a normal page load.
• Job splitting removed from Entra evidence collection. The entra collect_evidence command previously offered job splitting, but the option never took effect — every run processed the evidence set as a whole regardless. The option has been removed to reflect what the command actually does. Evidence collection itself is unaffected and still produces one complete evidence package, and no action is needed for existing jobs.

Known Limitations

• Required and optional credentials are not distinguished on the job form. The Secret Requirements panel lists the credentials a command uses and shows which are present in the selected secret set, but it does not indicate which of those are mandatory and which are optional alternatives. The AWS commands, for example, accept either a named profile or an access key pair, and the panel presents both the same way. Customers configuring a job cannot yet tell from this panel alone which credentials they must supply.

Maintenance and Updates

• Routine dependency and security updates across backend components.
• Expanded automated end-to-end and regression test coverage.

Deployment Notes

The Orchestration Hub 6.33.0.0 Release requires RegScale 6.33.3.0 or newer.

[6.43.0] - 2026-08-31

Added

• JCAM: jcam dry_run now follows POA&Ms to their milestones, so the milestone mapping can be
  checked before an import rather than only by importing and looking. It samples a few POA&Ms
  per system by default, since a dry run proves the mapping rather than enumerating the data;
  --limit 0 follows every one. When the sampled POA&Ms carry no milestones it says so, rather
  than leaving an empty result that reads the same as a mapping which produced nothing.
• Configurable JCAM field mapping. Where each JCAM value lands in RegScale is expressed as a mapping profile rather than hard-coded, so a tenant whose custom fields are named or arranged differently is served by configuration instead of a release. Two profiles ship: legacy reproduces the previous behaviour for existing tenants, and modern is the recommended layout for new ones. A new jcam dry_run command shows what an import would write, without writing it
• Interactive terminal GUI in beta (regscale gui / regscale tui) for browsing, configuring, and running CLI commands with searchable autocomplete pickers for RegScale records, live console output, and run history

Changed

• JCAM: jcam dry_run --verbose now states, for each destination it would write, whether the
  field is custom or native, which of its names matched, and the label a user sees for it in
  the UI. A field name on its own could not answer "did this land in the right field", since
  RegScale carries three names per field and calls two of them the same thing.
• Legacy Azure AD sync commands sync_admins, sync_general, and sync_readonly replaced by sync_app and sync_tenant_admins, with removal stubs that name the replacement command and warn where it is not a drop-in and requires App and AppGroup setup first
• Legacy Azure AD ad* configuration keys are deprecated in favor of azureEntraClientId, azureEntraSecret, and azureEntraTenantId but are still applied for one release cycle, so an existing init.yaml keeps working while a warning names the rename each command needs
• Azure AD/Entra synchronization redesigned for App Management IAM model with per-App and tenant-admin sync commands

Fixed

• JCAM: jcam check_custom_fields now also reports what the configured mapping profile cannot
  resolve against the tenant. It previously checked only the field lists the importers name,
  so a tenant could be told it was fully configured and still have its import refused for a
  field the profile needs but no importer constant mentions.
• JCAM: a value the profile refuses to translate now fails that record and is recorded in the
  run report, instead of ending the whole import with a traceback. It was raised as a plain
  RuntimeError, which none of the per-record handlers caught.
• JCAM: a mapping profile that cannot resolve, or configuration naming something that does not
  exist, now reports its message and exits non-zero instead of ending the command with a
  traceback. The message was already actionable; the stack around it was not.
• JCAM: a jcamValueMapping override on a source translated by a mapper is now refused rather
  than silently replacing the mapper with a static dictionary, which lost a lookup that
  consults the tenant and turned every unlisted value into a failed import. A sparse override
  on a plain source now leaves values it does not name alone rather than treating them as
  errors, and everything an override produces is validated the way the shipped profiles are.
• JCAM interconnection descriptions are saved. They were passed to a field name the model does not have, and unknown fields are ignored rather than rejected, so every interconnection imported from JCAM was created without a description
• JCAM points of contact whose position name carries surrounding whitespace now reach their RegScale role or custom field instead of being silently discarded
• JCAM import no longer fails when a cloud attribute has no value, and milestone notes preserve an absent value instead of recording the text "None"
• Azure AD sync reports and lock files now honor the configured artifacts directory instead of always writing to a relative artifacts folder
• Tag filtering no longer silently drops matching AWS networking resources for Direct Connect, Transit Gateway, VPN, Global Accelerator, Network Firewall, and Route53 Resolver

[6.42.32] - 2026-08-27

Added

• FedRAMP SSP interconnect and cryptographic module import commands, and an optional SSP ID on FedRAMP docx import so an existing plan is updated instead of duplicated

Fixed

• Bulk scan import no longer crashes when routing Prisma Cloud files
• OCSF and SBOM import command groups are now reachable from the CLI
• GCP sync asset-type, label, severity, source, and evidence options now change sync behavior instead of being silently ignored
• SAP Concur SysDig imports now honor the supplied scan date and the SysDig and Tenable subcommands are always registered
• Multi-collection GraphQL queries such as reminder lookups now paginate each collection independently instead of silently skipping records past the first page
• Cleanup bulk-delete commands now remove every matching record instead of silently stopping after the first page
• CVE cleanup discovery now finds issues with multiple CVEs instead of silently returning nothing
• eMASS control export retrieves every control with assessments for plans with more than 50 controls
• eMASS SLCM import no longer deletes control implementations missing from the workbook unless explicitly requested, and semi-annual review frequencies now calculate as 182 days
• eMASS POA&M pushes now carry issue details such as severity, comments, and completion dates instead of silently empty fields, and file-based DoD PKI client certificates can be configured
• Connector syncs from different vendors into the same security plan no longer close each other's findings
• Tanium Cloud compliance sync now passes through control mappings when available and alerts loudly instead of silently dropping every finding
• Dependabot sync now retrieves every alert page, fetches GitHub data once per run, and no longer creates duplicate issues on repeat runs
• GitLab issue sync now retrieves every page of issues and tracks them under a GitLab-specific identifier
• OpenSCAP compliance sync now ships its CCE mapping file and fails loudly when a configured mapping override is missing instead of silently resolving no controls
• STIG mapper now evaluates each asset against its own existing mappings so assets after the first receive complete STIG mappings
• File-based scan imports quarantine unparseable records with clear warnings instead of creating placeholder assets and findings
• Active Directory sync now aborts safely when the mapped role is missing instead of proceeding into the role-removal and deactivation flow
• Intune device sync compares versions numerically and correctly classifies macOS devices
• FedRAMP Rev 5 POAM export is now read-only by default with an opt-in flag for comment write-back, and comment templates and POAM ID prefixes are configurable
• Removed unreachable FedRAMP compatibility aliases and duplicate DRF import command that could never be invoked
• Veracode imports now assign correct severities instead of collapsing every finding to Low
• Wiz rollup and asset-identifier behaviors are now protected by contract tests to prevent silent regressions
• Model editor no longer carries one model's field layout into the next when processing multiple models in a single run
• Login failures now exit with a clear error message instead of crashing with an internal variable error
• Okta bearer tokens are no longer written to log output during authentication
• STIG checklist file parsing is hardened against XML external entity attacks
• Microsoft Defender API error handling no longer relies on assertions that disappear in optimized builds
• Salesforce sync no longer carries results across repeated runs and handles missing API responses without crashing
• Burp scan imports now accept export timestamps with or without a timezone

[6.33.3.0] 08-28-2026

Enhancements

Dashboard Consolidation

The dashboard experience has been consolidated to provide a more consistent and streamlined way to access and review organizational metrics.

Key Risk Indicator (KRI) System

Introduced a Key Risk Indicator system to help organizations monitor important risk metrics, identify threshold breaches, and track risk conditions over time.

FedRAMP POA&M Export Updates

The FedRAMP POA&M export has been updated to align with the current Rev. 5 format and now uses the Export Builder framework for improved consistency and maintainability.

Army Test Results and POA&M Exports

Added support for Army-specific Test Results and POA&M export requirements.

Army Framework Import Profile

Added a profile to support Army framework imports and simplify configuration for Army compliance requirements.

Crosswalk Importer and Converter

Added support for manually importing and converting crosswalk information from supported compliance sources.

RAG Embedding Backfill

Added support for automatically backfilling embeddings for SSPs, Control Implementations, Policies, Evidence, and Components when Retrieval-Augmented Generation (RAG) capabilities are enabled.

SSP Re-Approval for Substantive Changes

Security Plans can now be routed through the appropriate re-approval process when substantive modifications are made.

SSP Approval History

Approval history is now recorded for Security Plans when approval workflows are initiated by triggers, including configurations where the SSP Approval Workflow feature is disabled.

Evidence File Version Management

Improved Evidence file version management, including support for renumbering cycle versions to provide clearer version history.

Security Plan Bulk Editor

Improved the Security Plan Bulk Editor experience, including more consistent placement of drag handles in accordance with application UI conventions.

Catalog Navigation

Improved catalog navigation by selecting the Catalog module by default when appropriate.

Categorization Override

Added support for overriding categorization values where applicable.

AI SSP Author Selection

Improved file selection controls in AI SSP Author, including more reliable Select All and Deselect All functionality.

RegML Author Filtering

Improved bulk selection in RegML Author so that Select All respects the currently active control-family filter.

Accessibility Improvements

Improved accessibility across several areas of the application, including command palette controls, dashboard controls, theme colors, target sizes, and permission-related messaging.

GitHub and Jira Release Documentation

Added documentation describing how GitHub releases correlate with Jira release versions to improve release tracking and traceability.

Fixes

Tasks Navigation and Terminology

Corrected Tasks terminology and navigation across the main Actions module and its record-level subsystem.

File Versioning

Resolved an issue where file version increments could occur unpredictably and unrelated files could incorrectly be marked as superseded.

External Service Status

Resolved an issue preventing External Service entries from being changed to Cancelled status.

Planned Implementation Date

Fixed issues that prevented the Planned Implementation Date from being saved or persisted for controls, including Control Builder v2.

Inheritance Fields

Removed obsolete Inherited and Remote Inheritance Instance fields.

Related Policy Linking

Fixed an issue where a Related Policy selection did not correctly display or link to the associated policy in the Policy module.

Questionnaire Completion

Improved questionnaire completion calculations to provide more reliable completion status and a clear path to submission.

Component and Security Plan Associations

Resolved issues that prevented some Components from being attached to Security Plans.

Control Implementation Display

Fixed the Control Implementation list so that the associated Security Plan title is displayed correctly.

Export Builder and DOCX Templates

Resolved several export-related issues, including:

• Diagram field placeholders not being replaced correctly in DOCX templates.
• Export names incorrectly displaying "template."
• FedRAMP POA&M exports returning errors.
• Incorrect formatting of the FedRAMP POA&M export dialog.
• Raw template tokens appearing in FedRAMP Rev. 5 SSP DOCX exports.
• eMASS SSP exports failing for larger Security Plans.
• Incorrect MIME type being used for Excel downloads.

Compliance Hygiene Dashboard

Corrected the ISO 27001 catalog information displayed in the Compliance Hygiene Dashboard.

RegML Auditor

Fixed chart scaling that could display values outside the expected 0–100 range.

Evidence and Files

Resolved issues affecting the Evidence and Files experience, including:

• Incorrect Evidence badge counts.
• Evidence cycle toggle alignment.
• Evidence upload styling.
• Evidence file version numbering.
• Hard-deleted Evidence records continuing to appear in module lists.

SSP Inventory Workspace

Fixed the SSP Inventory Workspace so vulnerability and issue counts display correctly.

POA&M Status Board

Resolved issues affecting POA&M Status Board record pages and dashboard analytics, including secondary Baseball Cards that could not be selected for drill-down.

Report Builder

Fixed filtering and time-bucketing issues that could cause errors, incorrect filter behavior, or unexpected handling of dates.

XCCDF and STIG Imports

Improved XCCDF import processing to correctly handle valid Boolean values and resolved issues where imported benchmarks could not subsequently be accessed.

Questionnaire Authorization

Corrected authorization controls for Questionnaire endpoints to ensure appropriate permission checks are applied.

API Authorization and Tenant Isolation

Strengthened authorization and tenant-isolation protections across several API operations to prevent unauthorized access to data across application or tenant boundaries.

HTTP Authorization Responses

Corrected API responses so permission failures return the appropriate 403 Forbidden response instead of 401 Unauthorized.

Issue Management

Resolved several issues affecting Issues, including:

• Facility fields appearing when they should be inactive.
• Deviation Summary appearing when configured as inactive.
• Issues becoming unsavable after automation populated Date First Detected.
• Due Dates being unexpectedly replaced by SLA dates.
• Blank Date First Detected values being incorrectly populated with the current date and time.

Authorization Boundary Diagrams

Fixed an issue preventing authorization boundary diagrams from being attached or linked within the system authorization boundary description.

Workflow Designer

Resolved an issue where the workflow template designer could fail to load due to invalid automatically saved steps.

Workflow Assignments and History

Fixed workflow tooltips and history displays that incorrectly showed Assigned to: None for Manager-type workflow steps.

Policy Workflows

Resolved an issue where starting a Policy custom workflow could incorrectly activate the Evidence workflow.

Scheduled Audits

Fixed the Lightning Assessment action in Scheduled Audits so that it opens within the appropriate audit context instead of navigating away.

Third-Party Risk Assessments

Corrected the display of control descriptions in Lightning Assessments so that raw HTML is no longer displayed.

Policy Requirement Assessments

Resolved an issue preventing multiple Requirement Assessments from being created from the Assess Requirements workspace.

Security Plan Creation and Naming

Fixed intermittent errors that could occur when creating or renaming Security Plans.

Breadcrumb Navigation

Fixed an issue where Controls did not refresh correctly when navigating from a Component to its parent Security Plan using breadcrumbs.

Implementation Statements

Corrected Control behavior requiring an Implementation Statement when the Control is configured as Fully Inherited.

Form Builder

Fixed an issue where duplicating a field did not create the corresponding custom form field.

Hard Delete Processing

Resolved issues affecting deletion and record cleanup, including records remaining visible after deletion and problems with changes and interconnect deletion workflows.

Catalog Import

Fixed catalog import failures that could occur when users did not have a workspace or application in scope.

Catalog and External Mapping Updates

Improved catalog synchronization and external mapping updates to ensure changes are correctly tracked and existing mapping data is preserved.

Dashboard Drill-Down

Fixed an issue where dashboard drill-down operations could continue retrying indefinitely when underlying module data failed to load.

Application Hierarchy

Resolved concurrency issues that could cause application deletion or creation operations to become blocked or take several minutes to complete.

My Dashboard Accessibility

Improved dashboard control sizing to meet accessibility requirements for interactive target sizes.

Command Palette Accessibility

Restored appropriate accessibility semantics for the command palette and its decorative elements.

Security Plan Creation Stability

Resolved intermittent errors during Security Plan creation when newly created records could not immediately be retrieved within the request scope.

Migration Reliability

Improved migration resilience so migration circuit-breaker state persists across container restarts.

Paging and Sorting

Fixed paging behavior that could cause records to be duplicated or omitted when queries did not have consistent ordering.

KRI Grid

Resolved an issue preventing the KRI grid Save control from displaying correctly.

KRI Breach Processing

Fixed an issue where subsequent KRI threshold breaches could create duplicate Issues instead of updating the existing open Issue.

Request Logging

Corrected request logging so the logged response status accurately reflects the status returned to the client.

Token and Application Context

Resolved an issue where requests without an application identifier could receive an invalid application context, causing subsequent operations to fail.

Cascade Delete Processing

Improved cascade-delete processing to prevent database deadlocks when multiple test suites or delete operations execute concurrently.

Production Container Security

Removed unnecessary build tooling from the production application image to reduce the deployed runtime footprint.

Removed Legacy Automation Credentials

Removed an obsolete plaintext-token service account purpose associated with the retired Automation Manager functionality.

Risk Display

Fixed an issue where risks associated with a Control Implementation were not displayed correctly.

Compliance and Security

Additional security and reliability improvements were made across the platform, including stronger tenant isolation, authorization enforcement, audit handling, error responses, and protection against unintended information disclosure.

[6.42.0] - 2026-08-26

Added

• jcam position-to-role name mapping override, and a dry run that reports positions whose people would not be imported at all
• Splunk evidence owner and approver settings, and a splunkSids setting for offline evidence backfill runs
• Opt-in Wiz incremental pulls that fetch only the inventory, issues, and vulnerabilities changed since the last successful sync
• New jcam preview_poc_roles command reports which points of contact would import as system roles, how many people would be assigned as users versus held as stakeholders, and which positions have no matching role, without writing anything
• JCAM points of contact are imported into RegScale system roles of the same name where one exists, alongside the existing custom fields, so repeated approver and reviewer positions no longer need a custom field each
• New jcam check_custom_fields command reports every custom field the import needs that a tenant is missing, grouped by module and tab, in one pass instead of one failed import at a time
• Prisma Cloud CSPM asset and vulnerability sync
• Palo Alto Networks SCM Compliance Center integration with control assessments, control tests, evidence collection, and POA&M creation
• FIPS-validated cryptographic modules in FedRAMP OSCAL SSPs are now imported into the RegScale Cryptography module

Changed

• Splunk evidence ingestion now refreshes the owner, approver and description on evidence it reuses across runs
• Scheduled automation guidance now covers CRON and Kubernetes CronJobs in place of Airflow DAGs
• Retired Airflow support: the Airflow container image, DAGs, and the airflow install extras are no longer published
• Stakeholder and system role external assignment records are no longer duplicated when an import is re-run

Fixed

• AWS ECR evidence collection now scopes Inspector V2 vulnerability findings by account ID and tags
• AWS findings evidence generation and OCSF export runs now honor account ID and tag filters instead of ingesting every finding in the region
• AWS findings runs scoped by account ID or tags no longer close existing issues that belong to accounts or tags outside the requested scope
• AWS Security Hub findings sync now honors account ID and tag scoping instead of returning findings for the entire region
• JCAM import now reports how many points of contact were imported and skipped instead of dropping unmatched people silently, and fails with an actionable message when required custom fields are missing
• QRadar event sync now scopes queries to the configured lookback window, which previously failed against the QRadar API
• FedRAMP OSCAL import now reads component types and property values from Rev4-era (OSCAL 1.0-Milestone2) documents in addition to Rev5
• FedRAMP SSP import now creates interconnection records and preserves connection security, data direction, information transmitted, and external point of contact details

[6.33.2.2] 08-24-2026

Fixes

Resolved an issue preventing users from logging in after a version upgrade

Fixed an issue where users could be unable to log in after a RegScale version upgrade if they did not click the Refresh option in the version update notification before it disappeared. This issue was related to browser caching and could also affect users who were signed out due to inactivity and subsequently attempted to sign in.

Users can now access the application normally after an upgrade without being blocked by a missed refresh notification.

ROH 6.32.0.5 Release

Release Overview

Release Name: ROH Beta Hotfix Release

Release Type: Hotfix

Release Number: 6.32.0.5

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What’s Fixed

• Single sign-on “no configuration found for tenant” bug: customers that use single sign-on with users previously encountering this error will now be able to log into their Orchestration Hub and RegScale instance after fixes to the single sign-on processor.

Deployment Notes

The Orchestration Hub 6.32.0.5 Release requires RegScale 6.33.2.0 or newer for compatible, single sign-on fixes.