[6.29.1.1] - 2026-03-09

Fixes

• Control Implementation

  • Fixed an issue where the More Tools → New Assessment option was missing.
  • Resolved a problem where the Create New button did not function for non-tenant administrators.

• Export Builder

  • Corrected an issue in the Seeded Labs export where certain tables contained missing or misaligned data.

• FedRAMP SSP Export

  • Fixed a failure preventing FedRAMP SSP exports from completing successfully.

Known Limitations and Issues

This is for everyone to be aware on any updates for SSO that involve our government customers.

With the .NET 10 upgrade that was part of our 6.29.X release there is no leniency in the verification of the login URL for SSO. There are now two Azure urls. Previously either could be used, they both return the same data indicating the .com url. If the customer is not GCC high, their validation is actually in the commercial (.com) not the government endpoint (.us).

Symptoms: The Console in the browser shows an “Issue mismatch”.

Resolution: If OAuth from Azure Entra fails after upgrading a customer to 6.29.X and their Authority url contains login.microsoftonline.us change it to login.microsoftonline.com.

[6.29.26.1] - 2026-03-09

Fixed

• Key value pairs being overridden from the default template when running in Automation Manager jobs

[6.29.26.0] - 2026-03-09

Added

• Wiz compliance_report command:
  • creation of evidence records in RegScale: uploads the CSV compliance report, maps it to the SSP, and maps it to each control that has compliance data via the control lookup cache
  • flags (enabled by default) which follows the same pattern as GCP SCC compliance evidence attachment

[6.29.25.0] - 2026-03-06

Added

• ISO 27001:2013-to-2022 cross-edition control mapping for AWS Audit Manager compliance sync (REG-20509)
• Evidence record creation for SSM () and CloudTrail () integrations, matching the Audit Manager pattern

Changed

• BREAKING CHANGE: All AWS integrations now default to creating Evidence records instead of SSP-level file attachments. This makes evidence visible in the RegScale Evidence module. To restore the previous behavior, pass (for SSM, CloudTrail, CloudWatch, S3) or (for GuardDuty, IAM, KMS, Org, Config).

Fixed

• Microsoft Defender crash on when member objects have inconsistent list field types (e.g. empty vs populated )
• AWS Config compliance evidence upload: CLI now builds ConfigEvidenceConfig/ConfigFilterConfig objects instead of passing individual kwargs that were silently discarded
• Evidence file upload: cast parent_id to str in multipart form data to prevent httpx encoding failures, and surface the actual exception instead of a generic "File upload failed" message
• Issue asset-identifier updates: truncate assetIdentifier to 500 chars to avoid API rejections when findings reference many resources
• Incorrect domain being set when running in Automation Manager
• Compliance reports with multiple controls not mapping to Control Implementations during command

[6.29.1.0] - 2026-03-04

Overview

This release represents a major evolution of Export Builder, including:

• Full Excel export framework
• Sub-templating architecture
• Advanced filtering capabilities
• Large-scale FedRAMP and program conversions
• Significant service refactoring and architectural alignment
• Expanded test coverage and stability improvements

New Functionality

Excel (.XLSX / .XLSM) Export Support

• Added support for .XLSX and .XLSM export types in Export Builder..
• Added Formula preservation for statistical and computed fields.
• Added Support for Excel text-based date formats.
• Added worksheet switching in XLSX mapping tab with autosave.
• Added data filtering for:
  • Repeating Excel rows
  • Repeating table row elements

DOCX Enhancements

• Support for RTF data type field mapping.
• Added sub-template document generation support.
• Added autosave when switching between mapping pages.
• Added export capability for data filters when exporting field mappings.
• Added ability to insert multiple images in template via file store tagging.
• Improved style preservation in source template.
• Improved TOC generation reliability.
• Added ability to "clone" standard OOTB templates for customization.

Extended Export Builder Data Services

• Refactored ExportBuilderService into logical alignments with RegScale architecture.
• Added Deviations data to Export Builder data service.
• Added Linked/Mapped Component data for Security Plans.
• Extended data services to return linked control components.
• Added export/import support for field mappings (JSON).

FedRAMP, DOE, CMMC, and Program Conversions

Converted the following exports to the new Export Builder framework:

• FedRAMP SSP (Rev 5)
• FedRAMP SAP
• FedRAMP SAR
• FedRAMP CIS/CRM Workbook
• FedRAMP Appendix Q (Cryptography)
• FedrAMP Separation of Duties Matrix (SOD)
• DOE SSP
• BNL SAP
• BNL SAR
• CMMC SSP Report
• Labs SSP
• Tailored SSP

Additional enhancements:

• Support for Master Assessment selection when generating SAP/SAR

Changes

• Removed the word “Template” from Export Builder titles and output file names.
• Improved automapping accuracy and speed in field tagging.
• Added export capability for data filters in field mapping exports.
• Improved filtering behavior in data services.

Fixes

• Fixed “No mappings” message not spanning full UI width.
• Fixed export field mapper paging issue after service refactor.
• Fixed filter options not copying in export configurations.
• Fixed various UI issues in Export Builder.
• Fixed importing export mappings causing field loss.
• Fixed automapping incorrect tag associations.
• Fixed filter tag replacement bug
• Fixed repeating data sets failing in sub-templates.
• Fixed repeating template tables duplicating first row.
• Fixed filtering of References data not persisting.
• Fixed sub-template repeating datasets malfunction.
• Fixed exception on empty DOCX template upload.
• Fixed exceptions during export template upload.
• Fixed 500 error when selecting Security Plan module.
• Fixed Export Builder seeding failure during post-startup.
• Fixed Export Builder SOD output file generation failure.
• Fixed list of Table of Figures causing TOC generation failure.
• Fixed incorrect image replacement during generation.
• Fixed SafelyUpdateParagraphText generation errors.
• Fixed Export Builder not handling documents without tags.
• Fixed inconsistent TOC generation.
• Fixed PersonExportModel (Lead Assessor) not populating.
• Fixed DILs not populating in SSP export.
• Fixed POCs not populating in SSP export.
• Fixed duplicate SOD figure header in SSP Rev 5.
• Removed incorrect content from SSP Rev5 and FedRAMP SAR.
• Fixed parameter replacement in Tailored SSP requirements.
• Fixed no connection between Ports/Protocols and Cryptography data.
• Fixed FR SSP multi-document tagging diagram issue.

[6.29.0.3] - 2026-03-03

Fixes

• Fixed questionnaire ResponseScore persistence bug where manual scores were not cleared when answers changed, causing stale scores to
  persist.
• Resolved progress bar rendering issues in RegML SSP Generator.
• Fixed questionnaire instances not appearing on the SSP Generator.
• Fixed missing blended labor rate causing NaN display on cost savings in SSP Author.
• Fixed dashboard reports with report configurations failing due to unnecessary permission checks.
• Fixed service accounts and DAGs loading prematurely before their tabs were active, causing incorrect app ID associations.
• Fixed Form Builder rule actions and conditions losing correct field/tab references after cross-tenant imports by resolving IDs from
  RegScaleId.
• Fixed custom field values not saving correctly for new records and updates.
• Added server-side validation for required custom fields.
• Fixed RBAC propagation to properly clean up access records when setting records to public.

Changes

• Added confirmation popups for role and app-related administrative actions (role assignment, app configuration, tenant settings).
• Enabled select RegML tools (SSP Author, Control Author) for read-only users.
• Added missing integration logos for Axonius, Grype, Prisma, SentinelOne, Snyk, Tanium, and Trivy on the Automation Manager page.
• Added handling for propagating public visibility to child records.
• Added automation section to App Setup.
• Form Builder now preserves field and tab ordering by sequence when loading modules.
• Improved Automation Manager DAG modal layout and integrations UI.

[6.29.24.0] - 2026-03-02

Added

• Tanium Cloud API Gateway (GraphQL) support for asset, vulnerability, and compliance synchronization
• Automatic detection of Tanium Cloud vs on-premises deployment with configuration option
• Thread-safe httpx client management with automatic domain change detection
• Shared domain normalization utility for consistent URL handling
• Class method for creating clients from Application config

Changed

• is now a property that returns the current Application singleton instead of a stored instance; test mocks using are unaffected, but direct attribute assignments like on real Api instances will raise
• Domain resolution in HttpClientConfig now uses shared utility for consistency with Application logic
• YAML config parsing in Airflow remote fetch now includes error handling for malformed responses
• Nessus import now logs per-file progress (file X/Y: filename) for better visibility during large batch imports

Fixed

• SyntaxWarning noise from nessus_file_reader package when running Nessus commands on Python 3.12+
• Nessus import crashing with out-of-memory on large scan files by using direct file parsing and streaming fallback
• Nessus asset updates failing with 500 errors when hosts have many MAC addresses by using only the first MAC
• CloudWatch evidence upload (REG-20294): File upload to RegScale now works for sync_cloudwatch_ex and sync_cloudwatch_aws by using dict format for multipart (required by httpx; requests accepts it too)
• Wiz Inventory command not fetching Assets from Wiz

Added

• Job to Automation Manager to import snyk files from an S3 bucket

Changed

• Expand config sourcing for AWS creds across all commands

Fixed

• AWS auth login to resolve credentials from init.yaml
• CloudWatch evidence upload (httpx multipart files format)
• Missing wiz integration compliance report
• HTTPX client using the wrong domain

Removed

• OpenText flat file job in Automation Manager since it was creating import errors in Automation Manager

[6.29.22.1] - 2026-02-25

Fixed

• cicd builds

[6.29.22.0] - 2026-02-25

Added

• Tenable WAS (Web Application Scanning) integration with sync_findings and sync_apps commands
• Old CMMC v1 catalog control pattern support (e.g., AC.L1-3.1.1) in the control matcher framework