· intuitem · News  · 4 min read

What's New in CISO Assistant — Week 27, 2026 (v3.19.0 – v3.19.1)

A packed minor release plus a same-week patch: SCIM provisioning with IdP groups mapping, offline-ready AI with pre-baked models, managed portals, admin-driven MFA reset, import improvements, and a long list of UX, i18n, and bug fixes.

A packed minor release plus a same-week patch: SCIM provisioning with IdP groups mapping, offline-ready AI with pre-baked models, managed portals, admin-driven MFA reset, import improvements, and a long list of UX, i18n, and bug fixes.

The v3.19.0 minor landed on June 29 with a big slate of features headlined by SCIM provisioning, offline-ready AI, and managed portals — plus a deep round of fixes across TPRM, OIDC, exports, and translations. A day later, the v3.19.1 patch followed with import improvements, a new selectable column, and a handful of UX and correctness fixes.

Headline Features

  • SCIM provisioning & IdP groups mapping — CISO Assistant now supports SCIM, automatically provisioning users from your identity provider and mapping IdP groups to roles. This brings true directory-driven access management to the platform (PR #4393, with follow-ups #4415 and #4425). Thanks to @tchoumi313.
  • Offline-ready AI (breaking) — Embedding and reranker models are now pre-baked into the image so the AI assistant works fully offline. Expect a larger image size as a result (PR #4404). Thanks to @Mohamed-Hacene.
  • Managed portals — A new managed portals capability for delivering scoped, externally-facing experiences (PR #4386). Thanks to @ab-smith.

Security & Access

  • Admin MFA reset — Administrators can now reset another user’s MFA, smoothing recovery when someone loses access to their authenticator (PR #4270). Thanks to @tchoumi313.
  • Stronger OIDC state & nonce — Increased the length of the OIDC state and nonce values for better protection against replay and CSRF-style attacks (PR #4411). Thanks to @tchoumi313.

New Features

  • Manual implementation groups on dynamic frameworks — Implementation groups can now be set manually on dynamic frameworks (PR #4391). Thanks to @Mohamed-Hacene.
  • Disable the “partially compliant” option — Admins can now turn off the partially-compliant assessment result for stricter scoring (PR #4421). Thanks to @ab-smith.
  • Optional collection creation for PMBOK projects — Collection creation is now optional when starting new projects, alongside a collection-code refactor (PR #4413). Thanks to @ab-smith.
  • Applied control progress as a column (v3.19.1) — Applied control progress can now be surfaced as a selectable column in list views (PR #4428). Thanks to @ab-smith.

Integrations & Exports

  • Import improvements (v3.19.1) — Multiple improvements to the import flow for smoother data onboarding (PR #4434). Thanks to @ab-smith.
  • Richer audit/framework Excel exports — Excel exports now include typical evidence and annotations (PR #4414). Thanks to @Mohamed-Hacene.
  • CSV export encoding — Fixed encoding issues in CSV exports (PR #4410). Thanks to @Mohamed-Hacene.
  • FORCE_CREATE_ADMIN with existing user — FORCE_CREATE_ADMIN now works even if the user is already defined (PR #4376). Thanks to @eric-intuitem.

Performance

  • Faster mapping list — Resolved slowness when loading the mapping list (PR #4380). Thanks to @Axxiar.

Internationalization & Accessibility

  • Czech localization — A complete update of the Czech translation (PR #4389). Thanks to @zdenek-pergl.
  • Italian to 100% — Italian translation completed to full coverage (PR #4403). Thanks to @pnatale.
  • Accessibility tags recovered — Restored missing tags for accessibility (PR #4398). Thanks to @ab-smith.
  • Library converter translations — Fixed missing question translations in convert_library_v2.py (PR #4412). Thanks to @tarkadia.
  • Audit framework-name translation — Corrected a wrong Framework Name translation in the Audit Summary and Audit List (PR #4416). Thanks to @tarkadia.
  • Recovered missing translations (v3.19.1) — Restored additional missing translation strings (PR #4439). Thanks to @ab-smith.

Bug Fixes

  • TPRM respondent permissions — Third-party respondents can no longer edit evidence status (PR #4420). Thanks to @tchoumi313.
  • DORA evaluation labels — Fixed DORA evaluation fields showing raw codes in the solution detail view (PR #4409). Thanks to @Axxiar.
  • Qualitative metrics choices — Restored the missing display of choice definitions in qualitative metrics definitions (PR #4402). Thanks to @Axxiar.
  • User expiry editing — Allowed the expiring date to be in the past when editing a user, and fixed expiration to fall on the next day (PRs #4401, #4374). Thanks to @Axxiar and @eric-intuitem.
  • Broken links in tables and findings — Prevented undefined links in modelTable cells (PR #4400) and fixed broken /undefined/<id> links on the finding detail page (PR #4424). Thanks to @tarkadia and @tpujolalan.
  • Subcontractor chain in dark mode (v3.19.1) — Fixed the subcontractor chain colors so they render correctly in dark mode (PR #4432). Thanks to @Mohamed-Hacene.
  • Comment re-homing (v3.19.1) — Prevented comments from being re-homed to objects in other folders (PR #4435). Thanks to @tchoumi313.
  • URL normalization on default ports (v3.19.1) — Normalized URLs to avoid comparison issues on default ports (PR #4427). Thanks to @ab-smith.
  • Dynamic labels creation (v3.19.1) — Fixed the creation of dynamic labels (PR #4440). Thanks to @ab-smith.

Welcome to new contributors @pnatale and @tpujolalan, who made their first contributions in this release. For full details, check out the v3.19.0 and v3.19.1 release notes on GitHub.

Share:
Back to Blog

Related Posts

View All Posts »
What's New in CISO Assistant — Week 44, 2026 (v4.1.2)

What's New in CISO Assistant — Week 44, 2026 (v4.1.2)

v4.1.2 brings DPIA screening and assessment for GDPR, a processor register, computed metrics built from metric instances, a dependency analysis for business impact analyses, a single mail service with failover, OAuth for audit-log forwarding to Microsoft Sentinel, Plumber imports into technical postures, MCP tools for incidents and evidence, and new libraries: Hungarian NIS2, Costa Rica BCCR-SINPE NT-RCS and a question-based NCSC CAF.

What's New in CISO Assistant — Week 43, 2026 (v4.1.1)

What's New in CISO Assistant — Week 43, 2026 (v4.1.1)

v4.1.1 adds vendor tiering backed by scored criticality forms, outcome rules on frameworks that check the CyFun 2025 conformity criteria, an export to the official CCB CyFun tools, paginated external APIs and bulk writes in workflows, an experimental domain compliance tree, more MCP coverage (advanced EBIOS RM, assets, teams), and new libraries: China PIPL, OWASP SAMM v2.2, ISO 27001 ↔ HDS and IEC 62443 ↔ ANSSI mappings.

What's New in CISO Assistant — Week 42, 2026 (v4.1.0)

What's New in CISO Assistant — Week 42, 2026 (v4.1.0)

v4.1.0 brings a large rework of the EBIOS RM module (study framing, RO/TO radar, standard and advanced likelihood methods on kill-chain steps), arithmetic in workflows with a CEL compute action, MCP write tools for a full risk review, a delegated user-creator role, entity-assessment exports, the BSI C5:2026 framework, German email templates, and a breaking change to the current-user API.

What's New in CISO Assistant — Week 41, 2026 (v4.0.8 – v4.0.9)

What's New in CISO Assistant — Week 41, 2026 (v4.0.8 – v4.0.9)

v4.0.8 and v4.0.9 let you set a custom score scale on an audit without cloning its framework, bring the SCF 2026.3 framework and a proper ASD Essential Eight (November 2023) model, make every linked-object tab on applied controls able to link existing objects, load long autocomplete lists in batches, and fix a seat-count regression that made readers count as editors.