Changelog
Back to All

RegScale 6.34.2.0

September 22nd, 2026

[6.34.2.0] 09-21-2026

AI and automation

Improved

  • RegScale provisions and renews the platform service account that AI harvesting requires. It does this at every application start, for each app of a tenant with RegML enabled. AI SSP Author and Response Automation report a clear message that names what to create when that account is absent or expired.

API

Improved

  • A control implementation AI audit result reports how many control parameters are unpopulated and which ones. The security plan and component AI audit status endpoints return that evaluation with each control result.
  • The batch create or update endpoint for issues applies the required fields your tenant configures on the Issues form, matching the single create endpoint. An issue that fails validation is reported in the rejected list with the field that is missing, and no record is written. Automated imports that must accept incomplete records set the skipCustomFieldValidation request option to true.
  • The form field definition API reports each field's minimum and maximum length, so a client can check a value before saving it. Saving custom field values returns an error for each rejected field and names that field, so a client can correct only the failing value.

Fixed

  • Users who hold Read permission on Security Plans can run an App Builder templated export for a security plan through the API. The Administrator role is not required.
  • The API reference documents an authorization denial as 403 and reserves 401 for a caller that presents no valid credential. Each description states the cause of the denial, so a generated client treats a permission problem as a permission problem.
  • The bulk control inheritance API rejects a request whose references cannot be resolved. It returns a 400 response instead of a success response reporting zero links. Rejected cases include an unrecognized provider module, a consumer security plan that does not exist, and a provider that holds no control implementations. Callers that treated the all-zero success response as valid must handle the error response.
  • The group activation endpoint answers with a not-found result when the group does not exist in that endpoint's identifier space. The response names the group identifier, so a caller can tell an unknown group from a server fault.
  • Creating an issue through the second version of the issues API returns a bad-request response that names the missing required fields. A client can tell its own invalid input from a server fault.
  • Creating a compliance setting without field groups returns a clear message that names the required field groups. Omitting the collection and sending it empty give the same message.
  • The newsfeed most-recent-post endpoint answers 204 No Content with an empty body when a tenant has no posts. The API reference and the integrator breaking-change notice both state that status. Treat 204 from this endpoint as nothing to show, not as a failure.
  • The custom field query API endpoints match values that Form Builder stores, for every module that offers custom fields. Text, number, whole number, currency, checkbox, date and select field types all match. A value captured before a tenant moved to Form Builder is carried over at startup, so it keeps matching. Each tenant sees only its own values.
  • The streaming endpoints that map issues to assets and record vulnerability mappings count one error for each failed item. The total error count is accurate at any batch size, so a caller can reconcile and retry the items that actually failed.
  • The directory sync account endpoint reports a failure when it cannot create an account. The response states the real outcome, so a sync that creates nothing is visible to the operator instead of reading as a success.

Administration

New

  • Each job row on the Admin Jobs tab has a History panel. Open a row to see that job's recent runs with start time, duration, status, trigger scope, and counts or error. The cross-job History tab is unchanged.

Improved

  • Security audit events write their failure reason and details to the console log in every deployment. Administrators can read why an event was recorded when they investigate an incident. The bracket prefix that log collectors read is unchanged.

Fixed

  • The introductory instructions on the Security Policies page read as a complete sentence, with no stray empty parentheses.
  • The Instance Security screen shows each readiness check with its own result: pass, warning, or failure. The blocked banner counts the checks that must still pass. Where monitoring has never been turned on, the screen shows the monitoring alert instead of an incomplete sentence.
  • The form builder's Reset to Factory Default dialog now offers an "Also reset custom fields" choice, in both the new and the legacy interface. Leave it off and custom fields, custom sections and their data are kept, which stays the default. Check it and the module is cleared back to its out of box configuration, with stored values archived first. The dialog now states which of the two happens. Fields and tabs created by a configuration template are custom fields. Check the box to fully clear a previous template before you import a new one.
  • Activating or deactivating a user in the new interface now tells you when the operation fails. If the server explains the refusal, that explanation appears. An administrator learns that the account is the last one able to sign in, and what to do first. Any other failure shows a general message instead of nothing. The same applies to changing a status from a user profile and to removing an administrator from a tenant.
  • The Configure Tenant form shows an identifier only after the tenant is saved. Creating a new tenant shows no identifier at all.
  • In the legacy interface, the application administrator list now shows each administrator's own profile picture. It previously showed the picture of whoever added them. The Added By name still reads from the user who granted the role. A profile picture also refreshes on screen when it changes.
  • Clearing directory accounts now reports how many administrators remain. The count includes administrators who sign in with a local password, not only those who sign in through a directory or identity provider. The response also reports how many identity provider administrators remain, as a separate figure. The lockout warning appears only when no administrator can actually sign in, so it no longer fires on a tenant that still has administrators available.
  • In Wayfinder Builder, the link editor names each subsystem tab the way a record names it. The tab that holds a record's actions takes its name from the configured display name for that module. A renamed module is reflected in both places.
  • In the Rule Builder, changing a rule action's type keeps the action's target field. The Allow External Value toggle reappears when you set the action back to Disable, and the rule keeps the target you chose.

Alerts

Fixed

  • Assistive technology announces the side rail Alerts panel as Alerts, matching its visible heading and the button that opens it. Screen reader users and sighted users hear and read the same name for the panel.
  • The Alerts button on the side rail shows the unread indicator and the unread count from sign-in. A user learns that alerts are waiting without opening the panel first.

Assessments

Fixed

  • On an assessment line of inquiry, the Issues Identified field is marked required as soon as you select Issues Fixed During Assessment. The required marker now matches the rule that blocks the save, so you can see which field to complete before you submit.
  • Saving a control test result now checks the parent test, parent assessment and asset before it writes anything. If a parent record is missing or is not one you can access, the save is refused and the message names the value at fault. Editing a control test result applies the same checks, and an edit that omits the parent records keeps the stored ones.

Assets

Improved

  • An asset's Hardware Info tab has three separate fields for operating system data: OS/IOS, OS/IOS Version and FW Version. The single combined field is retired. Existing combined text moves into OS/IOS Version without being split. Re-key the operating system and firmware values into their own fields. The original combined text is retained, and the eMASS hardware and software export cell content is unchanged.

Fixed

  • Retiring assets during a batch import records an audit event for every asset retired, so the change appears in the asset audit history.
  • A value that a form rule sets takes effect even when you cleared the same field without saving. On a tenant with a preset configuration template package, an asset form stays responsive when you set Virtual Asset to Yes after clearing Serial Number.

Catalogs

Fixed

  • Catalogs accepts a valid Unified Compliance Framework API key when you save it, and Unified Compliance Framework catalog imports complete. The save check reads the subscription expiration date from the provider response.
  • A catalog update keeps any security control that has an implementation or a requirement. Controls tied to your compliance work stay in place when the installed catalog is reconciled.
  • The Catalogs library refuses an archive and replace while a security profile still maps live controls from that catalog. The message names the dependent profiles, so you can repoint them first. A security plan keeps a profile that resolves against a live catalog, and catalog control sync keeps reconciling it.

Change tracking

Fixed

  • On a tenant with the ITIL change feature turned on, Change Type is editable while a new change is at Draft. It becomes read only after the change advances. You can complete and save a new change from the form.

Compliance Explorer

Fixed

  • Compliance Explorer fills the bridge control and bridge mapping columns on every row of the Mapping Explorer. The Network Visualization view renders the bridge control node without an error. The projection coverage verdict is now available to the view.

Compliance Settings

Fixed

  • Deleting a compliance setting that security plans or components still reference returns a conflict response. The message tells you to move those records to another compliance setting first. When the referencing records are already deleted, the deletion succeeds, detaches those references, and writes the deletion to the audit trail.
  • The Active column on the Compliance Settings list matches the Active checkbox on each setting's own page. An administrator can tell from the list which compliance setting is in force.

Components

Improved

  • Component Type reads in title case wherever it is displayed. This covers the Components list, the asset and security plan mapping grids, and the evidence mapper. It also covers the plan creation wizard, the Components status board, the print and email report, and the dashboard record grids. The stored value stays lowercase, so exported system security plans keep their required format.

Fixed

  • Deleting a component also deletes the assets parented to that component. Your asset inventory no longer keeps records whose parent component is gone.

Dashboards and status boards

Improved

  • The Policy, Project, Component, Security Plan and Supply Chain status boards use one shared card layout. The chart key sits beside the chart, status and progress read as pills below the title, and the card footer names what it reports. Tabs on the card read as segmented buttons.

Fixed

  • The Vendor Dependency tiles on POA&M Analytics and Deviation Analytics count records whose Vendor Dependency field is set to Yes. The drilldown lists the same records the tile counts.
  • The Organization Activity list on the News Feed now reads "1 action" when a user has a single action. Counts above one still read "actions".
  • A Report Builder pie, bar or line report added to a dashboard renders the same grouped data that View Report shows. Each bucket appears with its count. Switching application context rebuilds the widget with the correct report.
  • Grouping the Security Plans dashboard by a custom field buckets each plan on the value its record shows. Grouping also works for a field whose name contains a space, a hyphen, or a period. Breaking change for API callers: the Security Plan graph endpoint returns Name and Count for custom field grouping. These are the same keys it returns for standard property grouping. A caller that reads the lowercase keys must update.

Deviations

Fixed

  • A False Positive deviation requires evidence, including when the operator clears a rich-text field so that only formatting markup remains. The save is refused, the workbook import skips such a row with a warning, and the FedRAMP deviation request form carries the evidence columns.

Evidence

Fixed

  • The Audit Info dialog under Record Operations opens sized to its content. Audit fields read as a compact list, and an empty field takes no extra space. This applies to Evidence and to every other module that offers Audit Info.

Exports

Improved

  • A queued export that is never picked up is marked failed within minutes when the background system is idle. The person who requested it is notified. You learn that an export was lost close to the time the confirmation message promised, instead of waiting for the long orphan timeout.

Fixed

  • A FedRAMP Appendix A export that cannot be saved now fails the job instead of reporting success. An export reported as complete is retrievable from Files, and the job log records completion only after the file is stored.
  • The FedRAMP plan of action and milestones export now fills the Remediation Plan column from the Recommended Actions field on the issue. When Recommended Actions is empty, the column falls back to the Remediation Description. The export template is also available in Export Builder, where you can check how this field is mapped.

Imports

Fixed

  • The Threat Model Importer shows its information notes in the same warning style the other importers use. The note label and its icon line up with the note text.
  • A bulk issue import now creates every issue you submit, whatever batch size you request. Issues that carry no unique identifier are each created instead of collapsing into one record per batch. An item the import cannot create is reported in the error total and named in the response, rather than dropped while the import claims success. The same correction applies to the standard bulk issue import, the eMASS plan of action workbook import, scan file import and the issue import API.

Issues

Fixed

  • Issues created directly through the API now take their Known Exploited Vulnerabilities value from the platform's own CISA catalog. The value reflects current catalog membership rather than a snapshot shipped with a client tool.
  • Issues created or updated through the batch API apply the same due date order as a single issue. With no due date supplied, RegScale uses the CISA Known Exploited Vulnerabilities catalog date first. It then uses the plan or tenant patching service level agreement, then the configured default table. A supplied due date is kept, and a batch update with no due date keeps the stored date. Computed due dates carry a UTC designator.
  • You can clear the Deviation Request Required flag on a POA&M and save the record. The POA&M Status Board then counts that record among POA&Ms without a deviation request, in its cards, charts and metrics. Clearing the flag deletes the deviation request details on the record.
  • An issue created or updated without a due date takes its due date from your tenant's configured patching service level agreement. This applies when POA&M milestone automation is on. The single create, single update and batch paths all read the same tenant setting.
  • An Issue's Related Assets tab shows the asset IPv6 address in its own column. An asset that holds only an IPv6 address shows that value instead of an empty cell.

Module Forms

Fixed

  • Fields that an administrator moved to a different form tab before upgrading are editable again on saved records. The startup seed restores each system field's include-in-form setting from the module definition, for every tenant.
  • Percent sliders fill the whole track at 100 percent and show no fill at 0 percent. This covers the percent complete, mitigation effectiveness, risk exposure and minimum relevance score sliders.

Navigation

Improved

  • The left navigation rail has updated icons, spacing, and active and hover states, so your current location is easier to see. Notifications is now named Alerts.
  • Page headers now follow one standard across the app. Each page carries a single top-level heading in a consistent size, weight and position, with a breadcrumb trail above it where one applies. A record count appears beside the title only when the page supplies one, and counts above 999 read in a short form such as 13.6k. A long title or a long breadcrumb entry shortens with an ellipsis and shows its full text on hover and on keyboard focus. The header works in both the light and dark themes.
  • Server errors now produce a clear message anywhere in the new interface, instead of depending on each screen. A refused request explains what to do. It asks you to check your input, or to refresh after a conflict. It asks you to wait and retry when the service is busy, or to try again later during maintenance. A request that times out says the operation may still be running, so check before you retry. A connection failure says to check your network. A server fault shows one consistent message that asks you to retry or contact support.
  • Popover panels across the app now carry an accessible name, so a screen reader announces what each one is. The footer version panel announces as "Version details" and the app switcher announces as "Switch app". The name stays correct when a panel is closed and opened again. This closes an accessibility finding rated serious against WCAG 2.1.

Fixed

  • Application titles are visible again on the Browse Applications tiles. A user who has no application access can read each application name before requesting access.
  • Wayfinder smart activities apply their configured filters. An activity is evaluated against only the records that match its filters, so its completion result reflects the intended subset.
  • The status board guided tour anchors every step to the control it describes, keeps the selected time period, and ends with a Finish step.
  • The app switcher shows its notification count on a solid red badge that reads clearly in app mode and in report mode. The badge is larger. The same badge style applies to the kanban overdue count and to the private record lock icon.
  • A Wayfinder smart activity whose filters cannot be built is treated as not evaluable. It is never evaluated against every record in the module, so an unsupported filter field cannot produce a misleading result.
  • In dark mode, the left navigation rail uses a neutral dark background that matches the rest of the dark interface. In light mode the rail keeps its dark navy background, which is the intended design of the navigation system.
  • The Home button at the top of the navigation rail shows the current app's App Banner image. An organization then sees its own branding on every screen. An app with no banner shows the app initials. A configured tenant logo appears when no app owns the button, and cross-app reporting shows a reporting mark.

Notifications

Fixed

  • A comment alert in the notification list opens the record's Comments tab and highlights the comment it reports. The comment is scrolled into view and labeled, so you can find it in a long thread.

POA&M and status boards

New

  • The POA&M Status Board filter bar has a Vendor Dependency filter. Set it to Yes or No to filter POA&M Analytics and Deviation Analytics by vendor dependency.

Improved

  • The Status Distribution chart on the POA&M Analytics tab groups records by issue status, such as Draft, Pending, Compliance Review and Closed. Clicking a segment opens the matching records, so the chart agrees with the statuses used elsewhere in the application.

Fixed

  • Filters applied at the top of the POA&M Status Board carry into a drill-down. Clicking a chart segment, a metric card or a vulnerability card combines two filters. The result lists only records matching the board filter and the part you clicked. The drill-down shows the inherited filter as a chip.
  • On the POA&M Analytics tab, clicking a severity tile or card whose count is zero opens an empty list that keeps the severity filter. The drill-down count matches the count on the element that was clicked.

Questionnaires

Fixed

  • Anonymous users can self-assign a questionnaire that its owner has published for public self-assignment. The request creates a questionnaire instance and sends the assignment email. A questionnaire that is not published for public self-assignment stays unavailable to anonymous callers.
  • A questionnaire instance created through anonymous self assignment is scoped to the owning application, whichever version of the endpoint the caller uses. Tenant administrators can read, manage and delete these instances. Existing instances that carry no application are corrected on upgrade.

Reporting

Improved

  • Report pages use consistent spacing between the summary cards, the filter fields, the Run button, and the expanded row actions. The screens are easier to read.

Fixed

  • Report date filters list readable options. The Date Field and Relative Date dropdowns on the report views show their option names.
  • On a report, clicking a card row expands or collapses that group. The expand and collapse buttons keep working as well.
  • The Components Evidence Completion report and the Security Plans Evidence Completion report list control implementations as soon as you select a record. No extra click is needed.
  • On the NIST SP 800-171 Self Assessment with Objectives report, the Level to Report list shows the name of each option. The selected option's name also appears. You can see which level the report covers before you change it.

Risks

Fixed

  • The Risk Assessment wizard re-scores the Current Risk when you change Current Risk Consequence or Current Risk Probability on the Status Update step. The tile and the saved record carry the score the risk model computes for the pair on screen.
  • Every risk wizard tells you up front when you cannot create risks. If a scenario fails when you click Finish, you can retry without duplicating the risks already created.

Security Controls

Improved

  • In the Link Existing Requirement wizard on a security control, a requirement already mapped to that control now shows a lock instead of a checkbox. The row is tinted and cannot be selected, and hovering it explains why. This matches the requirement to control wizard, and it removes the case where a row looked selected although nothing was queued. Rows you can select now carry a name that a screen reader announces.

Security Plans

Fixed

  • The FedRAMP Test Case Procedures workbook now contains only the controls linked to the security plan you export. The workbook reflects the plan under assessment instead of the whole baseline.
  • The System Security Plan document includes only interconnections whose status is Approved. Connections in any other status stay out of the generated plan.
  • The FedRAMP SSP Appendix A export lists each control's parameters in FedRAMP document order. Sub parts that reach two digits sort after the single digit entries, and lettered parts follow the base statement parameters.
  • A custom field value shows an ampersand, angle bracket or quotation mark as the character itself. A security plan's Environment Type set to RDT&E (Zone B) reads correctly after you save and reload the page.
  • The Security Plan scorecard header and the Audit Info dialog show the same calendar day as the record's own date fields. This holds in every browser time zone.
  • The Leveraged Authorization form shows the server's validation message on the form and in the notification. You can see which field to correct instead of a generic retry message.
  • Catalog control sync keeps the organization-defined parameter values that a person entered on a security plan. The sync change log records each parameter value it declines to overwrite. A run that only declines writes reports no changes to the record.
  • Adding a control that is already on a security plan creates only the child records the control implementation is missing. Implementation objectives are not duplicated when a control is missing its parameters.
  • A Security Plan that carries no FedRAMP identifier saves with more than one cloud deployment option selected. The single option rule applies only to plans that carry a FedRAMP identifier.
  • Creating a security plan with the Blank Security Plan option now opens the Compliance Setting list on its placeholder, with nothing selected. The list previously showed a zero that matched no option and passed the required field check. The required field check now prompts you if you leave the setting blank, so a plan cannot be saved with an invalid compliance setting.
  • The FedRAMP Appendix A export labels every parameter row with one convention. All rows in a single document read the same way, whether or not the parameter is mapped. Parameter order and values are unchanged.
  • Chart view on the Security Plans list draws a chart for each custom dropdown field. A tenant that populates such a field on its security plans sees the values charted.

Sign-in

Improved

  • RegScale writes a durable audit record when a single sign-on response returns a different account than the one the sign-in requested. Administrators can review these records in the security audit history and attribute each one to a time, a tenant and a source.
  • RegScale writes a security audit record when a single sign-on session handoff is refused. Each record distinguishes the reason for the refusal, so an operator can tell an expired or already used handoff from one that was never valid. No handoff or session value is recorded.

Fixed

  • Single sign-on now reports a clear, actionable error when the tenant it is asked for has no single sign-on configuration. Both starting a sign-on and returning from the identity provider give the same specific message instead of a generic failure. The tenant involved is recorded for administrators in the application log and in the security audit record.
  • Single sign-on logins that start at the identity provider complete and issue a session. A login started from the identity provider portal arrives in RegScale signed in. This works in both the classic interface and the new interface.
  • A single sign-on logout request that carries no single sign-on session returns a client error that states what is missing, instead of a server error.

Upgrades and deployment

Improved

  • An upgrade now builds the record permission index once instead of twice. The application is offline while that index builds, so an upgrade of a large instance completes sooner and the startup outage is shorter. Instances that need the permission view brought up to date still receive that update, applied by its own step.

Users and Roles

Improved

  • Clearing a tenant's directory-sourced users reports the effect on administrator accounts. The result names how many accounts were cleared, how many of them were administrators, and how many administrators remain. When none remain, the result appears as a warning.

Fixed

  • An inactivity run notifies an account holder only after the deactivation is saved. The run total and the administrator summary email count only the accounts that were actually deactivated. A tenant whose batch save fails sends no deactivation notices.
  • A tenant administrator can grant the module roles again, including the roles for risks, issues, policies, vulnerabilities, threats, incidents, changes, programs, projects and reporting. Three roles stay reserved for a global administrator, and the grant call states the boundary as those three refusals.

Workflows

New

  • Step Assignee Type in the Workflow Designer offers User Field on every deployment, with no configuration change. A workflow designer can route an approval step to the person named in a record property, such as Issue Owner or Risk Owner. A deployment that turns the option off still hides it.

Fixed

  • The evidence approver assigned to an evidence approval step can now approve or reject that step. A delegate of that approver can act on it too. This matches how group, manager and functional role steps already behave, where the assigned person acts on the step. Administrators can still approve evidence steps as before.
  • On the Workflow Designer canvas, a step routed by a record's user field shows that field on its own line below the action type. The step name, the action type, and the target field all stay readable.
  • In Workflow Designer, a Form step's Use step routing option describes every assignee type the step offers, including User Field. The description is built from the assignee type list, so the two always agree.
  • In the Workflow Designer, the Workflow Steps tab names a User Field step's target property with the same label the picker uses. Issue Owner is one example. The tab and the visual designer now describe a step in the same words.
  • A workflow step routed by a record's user property treats a deactivated account as naming nobody. The step hands to the workflow owner and records that it fell back, and reactivating the account restores the original assignee.
  • Where a workflow step is assigned to several people, semicolons separate the names. Because each name reads surname first, the separator stays distinct from the comma inside a name. This applies to the running step panel, the progress tooltip, step details, and the step permission message.

Security

Improved

  • The Workflows module applies its step permissions consistently. A step that waits for an assignee selection requires that selection before anyone approves or rejects it. A deactivated account cannot approve a step, and the step falls back to the workflow owner for assignment and notification. A running step's routing and state stay with the workflow engine and the template designer, which alone set a step's assignment, status, and step type. Editing a step's name, order, or execution type works as before.
  • The leveraged authorization API rejects an incomplete submission with a 400 response that names every required field it is missing. References in a submission must resolve within the caller's tenant.
  • The control implementation list for a security plan returns control owners as a list of user ids and a list of usernames. The batch update response carries no owner details, and owner assignments save as before. Update any integration that reads owner information from these responses.
  • The catalog comparison CSV export writes numbers and dates in one fixed format on every host. Rows stay aligned when the host uses a comma as its decimal separator. Values are written as text, so a spreadsheet displays them instead of evaluating them.
  • The Risk Models API clears a risk model's matrix through a delete operation. The earlier route for the same action stays available, is marked deprecated in the API documentation, and returns a deprecation warning in its response headers. Both routes record the risk model and the number of entries removed. Update integrations to call the delete operation, because the deprecated route will be removed in a future release.
  • Single sign-on returns the browser to the RegScale origin that the login started from, so a login begun in the Orchestration Hub finishes there. An administrator must set the permitted return origin parent domain in the single sign-on configuration for a cross origin return to take effect. Without that setting, the login returns to the RegScale application.
  • Only a global administrator can grant instance wide administrator authority. A tenant administrator grants the roles that apply within its own tenant, and cannot change its own roles. A refused grant returns an error and writes an audit record.
  • The RegScale container image carries updated platform runtime components that resolve published vulnerabilities. The image build pins a minimum runtime version, so a later rebuild keeps the update.