--- agentTools: projectIndex: https://regscale.readme.io/llms.txt --- # RegScale 6.33.2.0 # \[6.33.2.0] 08-20-2026 ## Enhancements ### FedRAMP and Compliance * **FedRAMP Deployment Provider Gating** Added provider gating for FedRAMP in-boundary deployments to help ensure that government and dedicated environments use supported and compliant service providers. * **POA\&M Status Board Enhancements** Enhanced the POA\&M Status Board with interactive charts and tables, allowing users to select dashboard metrics and drill into the underlying POA\&M records. * **POA\&M Date Filtering** Added improved date filtering capabilities to the POA\&M Status Board for more targeted analysis of POA\&M activity. * **POA\&M Workflow Status Filtering** Added workflow status values and corresponding Status Board filters to make it easier to track POA\&M progress. * **POA\&M Deviation Request Filtering** Added the ability to filter POA\&Ms based on whether a deviation request is required. * **FedRAMP POA\&M Export Improvements** Improved POA\&M exports to support long asset-identifier lists without exceeding Excel cell-size limitations. * **FedRAMP Inventory Export Reliability** Improved background processing and error handling for FedRAMP Inventory exports. * **OSCAL/XCCDF File Support** Added to supported file formats, enabling users to upload XCCDF-formatted content. ### Security and Access Control * **Authentication and JWT Hardening** Strengthened authentication and JWT handling to improve platform security. * **Service Account Token Rotation** Added a service-account token rotation capability to support recovery when signing keys change. * **Improved Service Account Security** Improved application scoping for service-account operations to ensure users only interact with accounts available within their authorized application context. * **Enhanced Access Control Filtering** Improved user and group selection controls and filtering to provide more efficient and appropriately scoped access-management experiences. * **View-Only Evidence Protection** Strengthened access controls to prevent view-only tenant users from accessing raw evidence payloads outside their authorized capabilities. * **Assessor Authorization Improvements** Added additional tenant and engagement validation when recording assessor determinations. * **Cross-Tenant Data Protection** Strengthened tenant isolation across questionnaire, vulnerability, GraphQL, and other API operations. ### Audit and Governance * **Evidence Access Auditing** Expanded auditing for evidence access so activity is captured on the application paths most commonly used by tenant members. * **Validation Mapping Audit Visibility** Improved audit information for validation mappings, including visibility into who confirmed a mapping and when. * **KSI Revision Chain Auditing** Improved revision-chain auditing to preserve the actor associated with KSI assertions. * **System Document Version History** Improved system document lifecycle management by adding version-history support and safer handling of deleted documents. * **Evidence Ingest Monitoring** Improved automated evidence ingestion visibility so rejected evidence and validation failures can be surfaced rather than silently disappearing. ### App Builder and Administration * **Search and Replace Utility** Added a Search and Replace utility to simplify bulk updates to applicable platform content. * **Security Profile Management** Improved installation, display, and management of RegScale security profiles. * **Color Theme Administration** Improved tenant validation and error handling when configuring color themes. * **Categorization Engine Configuration** Improved the categorization-engine workflow so users can continue configuring questions immediately after creating an engine. * **Security Plan Wizard** Expanded access to the Security Plan Wizard from applicable Security Plan creation workflows. * **Access Control User Pickers** Modernized user and group selectors for improved performance and usability. ### Questionnaires and Workflow * **Questionnaire Scoring Improvements** Improved questionnaire scoring behavior, including checkbox-based scoring and maximum-score calculations. * **Questionnaire Assignment and Notification Improvements** Improved questionnaire assignment, feedback, and submission notification workflows. * **Questionnaire Rules Engine Experience** Improved the Rules Engine interface to provide a clearer and more consistent save experience. * **Workflow Approval Experience** Improved approval workflow panels, comments, rejection routing, and handling of deleted records associated with approval workflows. ### Reporting and Dashboards * **Report Builder Improvements** Improved report generation and handling of vulnerability-related report modules. * **Dashboard Drill-Down Improvements** Improved dashboard drill-down behavior to ensure users receive appropriately filtered results. * **Compliance Explorer Improvements** Improved cross-framework coverage calculations so partial coverage is accurately represented. * **Security Plan Export Improvements** Improved exports so objective-row control mappings are correctly represented. * **MAC Address Validation** Standardized MAC address formatting and validation across supported interfaces and backend services. ### Performance and Reliability * **Vulnerability Processing Performance** Improved vulnerability batch processing by reducing unnecessary database queries and duplicate operations. * **Background Job Reliability** Improved background-job status handling so unsuccessful operations are no longer incorrectly reported as completed. * **Artifact Lifecycle Management** Improved artifact expiration processing to ensure expired artifacts are handled as expected. * **Application Logging Improvements** Improved application logging and monitoring integration to provide better visibility into application activity and failures. * **Event and Webhook Management** Improved webhook administration and event-management interfaces, including better responsive behavior and accessibility. * **Responsive Dashboard Experience** Improved dashboard layouts for narrower screen sizes to prevent horizontal overflow. *** ## Fixes ### Compliance and FedRAMP * Fixed an issue where SSP Control Implementations were sorted correctly in the middle panel but not in the left navigation panel. * Fixed mismatches between Control Implementation fields exposed through the UI and API. * Fixed an issue preventing Security settings from being cleared on child records when using **Apply to Child Records**. * Fixed an issue where CIS/CRM imports did not advance the last-updated timestamp for control parts. * Fixed SSP Author processing that caused the entire plan to be processed regardless of accepted mappings. * Fixed assessment-generated POA\&Ms receiving identical or non-descriptive titles. * Fixed automatic POA\&M creation when a failed test references a missing parent test. * Fixed several FedRAMP import services that failed to populate audit timestamps on imported records. * Fixed FedRAMP Inventory exports that could report completion without generating an output file. * Fixed inventory exports that could fail because of memory limitations. * Fixed an issue where the FedRAMP Inventory export background process could fail and prevent subsequent exports. * Fixed Security Plan exports where objective-row control mappings were displayed incorrectly. * Fixed an issue where Not-Applicable KSIs were incorrectly included in provider compliance percentages. * Fixed Compliance Explorer reporting that incorrectly represented partial cross-framework coverage as full coverage. ### Evidence and Files * Fixed the **Upload Multiple Files** functionality. * Fixed file uploads being rejected because the extension was not included in permitted file extensions. * Fixed replaced and deleted file uploads remaining in cloud storage. * Improved evidence-file lifecycle handling during version-to-cycle transitions. * Fixed Evidence & Files behavior within the SSP Subsystem workflow. * Fixed an issue where rejected evidence from automated ingestion was not surfaced to users. * Fixed an issue where evidence validation could stop without providing an indication that processing had failed. ### Security and Tenant Isolation * Fixed tenant-isolation issues involving questionnaire instances accessed without the appropriate tenant scope. * Fixed GraphQL vulnerability-mapping queries that could bypass tenant and application filtering. * Fixed a security issue where RegML could retrieve implementation statements from another application or the default application. * Fixed an issue where assessor determinations did not adequately validate the associated engagement and tenant. * Fixed an issue where view-only tenant users could access raw evidence payloads. * Fixed service-account operations that were inconsistently scoped between listing and individual account operations. * Fixed application and tenant validation issues affecting color-theme endpoints. * Fixed an issue where administrators could receive incorrect authorization responses from GraphQL parameter queries. ### Authentication and Identity * Fixed Entra SAML thin provisioning so newly provisioned users receive their email address, first name, and last name. * Fixed AD/LDAP synchronization from the AD/SYNC Preview page. * Fixed authentication failures affecting the Harvester following security updates to the platform. * Fixed an issue where valid lockout duration values of were rejected. * Fixed Swagger-generated API commands that omitted the required API-version header for v1 and v2 calls. * Fixed several API authorization responses that incorrectly returned HTTP 500 instead of HTTP 403. ### Questionnaires * Fixed questionnaire assignment and submission notifications that were not consistently generated. * Fixed the **Send Feedback** workflow routing respondents to My Workbench instead of the questionnaire. * Fixed question-level feedback emails that were not being sent to external respondents. * Fixed questionnaire checkbox scoring that could report a maximum score lower than the actual possible score. * Fixed questionnaire score calculations that could exceed 100%. * Fixed questionnaire rule-builder behavior involving assignment-month calculations and boolean/zero-valued responses. * Fixed confusing Rules Engine behavior caused by multiple Save buttons. * Fixed questionnaire view-model handling. ### Workflows * Fixed approval workflows and notifications that remained after the associated record was deleted. * Fixed workflow-template loading failures caused by invalid auto-save submissions. * Fixed workflow instances incorrectly returning HTTP 403 when an authorized user had no visible workflow steps. * Fixed workflow approval comments and rejection-routing behavior. * Fixed background workflow processing where unsuccessful results could incorrectly be reported as completed. ### Reporting and Dashboards * Fixed unexpected data appearing in Report Builder columns. * Fixed the **Issue by Security Plan and Deviation Status** report drill-down link. * Fixed vulnerability report generation failures caused by unsupported module handling. * Fixed dashboard drill-down queries that could load unfiltered data. * Fixed issues-by-status-and-owner components that could fail when API responses were not returned as arrays. * Fixed Issues by Status and Owner reports to correctly process paginated API responses. * Fixed Manage Risks drill-down pagination alignment. * Fixed ScoreCard Issues, Milestones, and Tasks tabs appearing empty for certain record types. * Fixed Gantt views incorrectly capping displayed issues and reporting the page size as the total. * Fixed AI-generated narrative citations being calculated but not displayed to reviewers. ### Export Builder * Fixed Export Builder mappings that displayed **Select...** instead of the saved field name when reopened. * Fixed Sub Template mapping dropdowns that displayed **Select** rather than the mapped field name. * Fixed Export Builder service and worksheet-related contract issues. * Fixed export-template validation messages to provide more specific guidance. * Fixed seeded export names and descriptions being unintentionally reset to their defaults. * Fixed FedRAMP inventory and POA\&M export reliability issues. ### App Builder and UI * Fixed the **Duplicate** hover state in App Builder App Management appearing continuously. * Fixed the Security Profile installation page displaying raw catalog UUIDs instead of readable profile names. * Fixed the Security Profile deletion workflow. * Fixed the Profile Importer page title being overwritten by an embedded registry component. * Fixed the SSP Wizard Finish button displaying an incorrect toast message. * Fixed builder-wizard completion behavior when no profile was selected. * Fixed Form Builder factory-reset operations that displayed an error toast despite the operation completing. * Fixed required-field validation appearing during **Summarize Control Parts** instead of at the appropriate Save operation. * Fixed validation errors displayed when summarizing controls. * Fixed the per-data-type C/I/A override behavior to ensure an override applies only to its intended information type. * Fixed inherited and remotely inherited controls displaying duplicate entries per control part in Control Builder. * Fixed Status Board title issues. * Fixed filter controls that were visually misaligned with their associated filter rows. * Fixed Webhook administration dialogs where action buttons could be inaccessible at the bottom of the viewport. * Fixed My Dashboard layouts overflowing horizontally on narrow screens. * Fixed dark-mode rendering issues for Control Details in Lightning assessments within Third Party Risk. ### Issues and Risk Management * Fixed a 405 error encountered when navigating to vulnerabilities. * Fixed deletion workflows to account for VulnerabilityMapping dependencies before removing records. * Fixed issue batch processing where affected controls and asset identifiers were not included in batch requests. * Fixed risk dashboard drill-down behavior and stale list-view reuse. * Fixed validation errors that could occur when saving or updating requirements. * Fixed cleanup failures that could leave orphaned subsystem records after security controls were deleted. * Fixed risk records being incorrectly categorized under an unspecified bucket. ### Data Integrity and Reliability * Fixed seeding-lock database errors. * Fixed application changes endpoints returning errors for authenticated users. * Fixed Control Implementation API requests returning incorrect responses. * Fixed pagination behavior that could duplicate or omit records during paged reads. * Fixed migration circuit-breaker logic that could fail to activate because failure timestamps could not be parsed. * Fixed application logging issues that prevented logs from reaching Application Insights. * Fixed silent subsystem-cleanup failures. * Fixed error-log date filtering so the end date includes the complete day. * Fixed constraint violations being exposed as technical errors instead of user-friendly messages. * Fixed API behavior for non-existent Security Plan identifiers so requests return an appropriate not-found response instead of HTTP 500. ### Security Profiles and System Management * Fixed RegScale Profiles installation when default profiles were not displayed. * Fixed profile prerequisite messages that exposed raw catalog UUIDs rather than readable names. * Fixed issues preventing Security Profiles from being deleted. * Fixed Trust Center behavior so the **New System** button is hidden when an applicable FedRAMP system already exists. * Added a Trust Center notification identifying when a system is non-production. ### KSI and Validation * Fixed KSI revision history so the actor associated with assertion creation is retained. * Fixed the Public KSI page displaying literal Boolean values instead of user-friendly status information. * Fixed the Public KSI page so the last validation date is displayed. * Fixed KSI compliance calculations so Not-Applicable KSIs are not incorrectly included. * Improved validation audit visibility and historical accountability. ### User Experience and Notifications * Fixed drill-down modals that could not be closed. * Fixed Save buttons and dialogs that could become inaccessible due to viewport positioning. * Fixed workflow and release notification failures. * Fixed Slack and Teams background-process notifications when the associated tenant could not be resolved. * Fixed questionnaire notification inconsistencies. * Fixed an issue where service-account token exceptions could unnecessarily appear in logs. * Improved user-facing validation and error messages throughout the platform. ### Security Hardening * Strengthened SaaS configuration-secret handling, including Key Vault reference resolution and validation of JWT signing keys. * Fixed authorization and tenant-scoping gaps across questionnaire, evidence, vulnerability, service-account, and assessment workflows. * Improved audit coverage for evidence access and validation activity. * Improved handling of sensitive authentication and service-account operations.