What's New in CISO Assistant — Week 36, 2026 (v3.21.4 – v4.0.1)

Two releases this week: the v3.21.4 patch on September 1, and v4.0.1 on September 5 — a major version bump.

The version number is the news, but read the notice that ships with it rather than the digit: the team states there are no expected breaking changes, while still recommending you back up your data and note your current version before switching. The one change that genuinely alters a contract is the pagination work, and it affects API consumers rather than the UI. More on that below.

Findings and Third-Party Risk

The largest single change in v4.0.1 is an epic spanning findings management and TPRM (PR #4689, thanks to @ab-smith). The shape of it:

• Findings — “Findings follow-up” is now the findings binder, surfaced on the navbar in its own right. Binders became optional: findings can live directly in a folder and be reorganised later. Findings can be raised straight from a requirement assessment, with the binder wired to the compliance assessment automatically, and the findings table gained batch actions. The binder’s action plan grew a section for tasks, and both findings and binders carry extra fields.
• Commitments — A feature-flagged commitments workflow, attached to a task or to applied controls, with state transitions, dates, notes, history, and breach and slip indicators.
• Third-party workspaces — The internal “enclave” concept was consolidated into one and renamed to something users can actually reason about: a third-party workspace. Perimeters are now fully optional for entity management.
• Campaigns — Campaigns run over third-party entities, with basic analytics, healing capabilities, and a report when no assignees are available for internal or external campaigns. Entity assessments can be cloned, which is how assessment cycles get managed.
• Assignments that survive contact with reality — Third-party assignments now transition even when the mailer fails; the back-and-forth over items to process is tracked with red and green flags; representatives are discoverable through entity assignment and auto-assigned when they were declared and then forgotten; and vendors carry a default communication language.
• Legibility — TPRM cards and the assessments table now show completion progress and review progress as the two distinct things they are, with shortcuts straight into review mode, so nobody has to route through the assignment menu. Entities support custom scores for external ratings, and both entities and entity assessments gained batch actions.

Identity & Access

• JIT provisioning on first SSO login — Accounts can be created automatically the first time a user signs in through the identity provider, with configurable default groups for newly provisioned accounts, IdP group-claim mapping and ongoing group synchronisation. IdP group management shows whether a group is SSO- or SCIM-managed. The whole thing sits behind a feature flag, manually managed memberships survive SCIM sync, and the guard against disabling SSO for managed accounts with no local login was tightened (PR #4673). Thanks to @tchoumi313.

Tasks & Evidence

• A pass over the whole module — Excel reporting fixed; navigation between previous and next tasks made workable; the importer extended to daily granularity and taught to auto-create or link evidence; expected evidence creatable on the fly; an evidence-definitions importer; an analytics page for all tasks or for a filtered subset straight from the table; task templates gaining enable/disable filtering plus import and export; evidence revisions carrying observations, links and attachments, with the internal revision version no longer editable; markdown field rendering glitches cleaned up; and a round of N+1 elimination on tasks (PR #4753). Thanks to @ab-smith.

Breaking Change — API Pagination

• Pagination limits are now enforced — Pagination was outright broken for lists past 5,000 elements. The fix hardens the contract on both sides. The default page size is 50, with a hard ceiling of 200 per request — larger ?limit= values are clamped, and legacy behaviour can be pinned with PAGINATE_BY=5000. Invalid limit/offset values, including limit=0, which never meant “unlimited”, now fail with a 400 instead of silently falling back to the default. Every ordering carries a unique primary-key tiebreaker, so offset paging can no longer skip or duplicate rows on tied sort keys.

  On the frontend, roughly 50 loaders that were reading only the first page now fetch complete collections, and every model exposes a lightweight autocomplete action so selects stay lazy: 50 options or fewer behave as before, larger datasets switch to server-side search.

  If you script against the API, this is the item to read before upgrading: consumers must follow next links or page by offset, a single request will never return more than 200 rows, and malformed paging parameters now fail loudly. There is a new documentation page covering the envelope, the environment variables and the client rules (PR #4531). Thanks to @eric-intuitem.

New Features

• URL custom fields — A url type joins text, number, date, boolean, choice and multi-choice. It gets a dedicated input on the form and renders as a clickable link wherever the field is displayed, on assets, applied controls, perimeters and security exceptions (PR #4744). Thanks to @Spaghetto784.
• Reopening a submitted assignment — Reviewers can reopen an assignment from Submitted, Changes requested, In progress or Closed; a closed assignment can be reopened either for review or for editing. Reopening returns it to draft — the only status in which an assignment can be edited or deleted — clears the reviewer’s observation, and notifies the relevant recipients when reopening from In progress or Changes requested (PR #4485). Thanks to @martinzerty.
• Workflow enablers and a sample catalog — Workflows gained their own navigation entry and feature-flag control, plus builder support for paginated loops, configurable limits, object creation, reference selection and evidence attachments from text or URLs. A set of workflow libraries ships covering compliance, risk, privacy, operations, assessments, notifications and reporting. Credential-bearing outbound requests over plain HTTP are now blocked (PR #4721). Thanks to @ab-smith.
• Category prefixes in control autocompletes — Control pickers show the category prefix, which matters as soon as two controls share a name (PR #4729). Thanks to @nas-tabchiche.
• Library builder moved under Catalog — It graduated out of the Experimental page into the Catalog sidebar, for users holding the library-creation permission. Experimental now holds batch creation alone (PR #4760). Thanks to @ab-smith.
• Multiple journeys on one domain — Presets can be applied more than once to the same folder, producing separately numbered journeys and objects. Journey upgrades preserve previously tracked objects and renamed journeys, and “Create objects” and “Apply feature flags” are now unchecked by default when applying a preset (PR #4713). Thanks to @ab-smith.

UX

• The whole requirement row is clickable — On the compliance-assessment page, status and result badges were rendered in a sibling element to the title, each wrapped in its own link, leaving a dead click zone between them. Badges are now inside the same anchor, so text, gap and badges are a single link (PR #4738). Thanks to @Claquetteuuuh.
• Framework preview restored — The respondent preview vanished when the framework builder moved under the library builder, taking the toolbar’s Preview button with it. It is back, and requirement cards now show which implementation groups a node belongs to, resolved to display names and translated with the preview language. The implementation-group bar is labelled as a filter and matches audit semantics: with a filter active, requirements with no implementation groups are excluded, which is a visible change from the previous behaviour. Splash screens are exempt, as in flash mode (PR #4688). Thanks to @nas-tabchiche.

Performance

• N+1 queries chased down — Requirement assessments load related reference controls, threats and parent requirements efficiently, which shows on large deployments (PR #4732, thanks to @eric-intuitem). Data breaches went from 121 SQL queries to 22 on a 15-row page (PR #4734), and evidence revisions from 21 to 11, along with filtering labels, findings, incidents, task templates and privacy processing records (PR #4736). Thanks to @melinoix.
• Faster library loading — YAML libraries parse through the C loader (PR #4714). Thanks to @ab-smith.

Bug Fixes

• Audit exports round-trip questions and answers — Questions were usable in only two of the export formats, and the XLSX round-trip lost data: the CSV dropped questions entirely, while the XLSX matched on translated question text and split answer blocks on newlines. A multi-line free-text answer lost everything after its first line, a workbook exported in one language would not re-import under another, and anything unmatched vanished silently. Answer lines now carry the question URN, blocks are delimited by that URN, choices match against every translation, and skipped lines surface as warnings. Questions hidden by an unsatisfied dependency are no longer exported as unanswered gaps, and the HTML report orders questions properly. Two behaviour changes worth noting: the CSV gains an answers column, which is breaking for anything scripted against that export, and an answer cell emptied by hand now clears the stored answer instead of being ignored. Workbooks exported before this change still import (PR #4724). Thanks to @nas-tabchiche.
• PATCH on requirement nodes — Every PATCH ran full model validation across the whole instance, not just the submitted fields, so any node with an untouched nullable-but-not-blank field — implementation_groups, order_id, the inherited name — was rejected with “This field cannot be blank”. Since most stock framework nodes ship with null implementation groups, entire frameworks were un-PATCHable. Validation is now limited to the fields a request actually sends, while the cross-field score-override checks still run against the full instance (PR #4722). Thanks to @AmirF194.
• Library preview tables render their rows — Library detail pages render preview tables from the library payload, deliberately passing no URL model since these objects have no list endpoint. The table built its endpoint anyway, requested /undefined, took the 404 error path and replaced the rows the caller had already supplied — so the table showed empty while its section header announced the real count. It affected 28 stored libraries plus the loaded-library pages. The core fix came in with the findings epic; this change applies the same flag to the two places still missing it, where local tables were colliding in the global handler store and persisting filters as if they were standalone list pages (PR #4750). Thanks to @Claquetteuuuh.
• Presets refresh when their library updates — Updating a loaded library changed its version but left the live preset on the old version with its original steps, so new journeys copied stale content (PR #4695). Thanks to @tchoumi313.
• Implementation group names in BIO2 and AirCyber — Wrong implementation-group names corrected in both libraries (PR #4718). Thanks to @eric-intuitem.
• Also fixed: task export to Excel (PR #4749), duplicate actions made consistent with the create path (PR #4733), more EBIOS RM template variants accepted by the data wizard (PR #4740), href generation for some foreign keys in detail views (PR #4741), a clearer CLI error when .clica.env is missing (PR #4735), validation on metric samples (PR #4676) and a regression that prevented adding one (PR #4762), workflow set_variables nodes whose value sat in the output mapping (PR #4756), and a batch of smaller frontend issues (PR #4726).

Internationalization

• Dutch translations updated (PR #4719). Thanks to @ReViCo-be.

Documentation & Build

• Workflow documentation — The three thin workflow pages were replaced with a full set scoped to what the UI exposes: a concepts page, a first-workflow tutorial with a screenshot at every step, and a builder section covering triggers, steps, expressions, variables and secrets, runs, sharing, the template catalog, permissions and security, troubleshooting, the action reference and the publish checks — 26 screenshots in all (PRs #4757 and #4758). Thanks to @nas-tabchiche.
• The ADR template gained a security considerations section (PR #4737), the frontend moved to hardened container images (PR #4716), and backend dependencies were upgraded (PR #4739).

Welcome to new contributors @Spaghetto784, @Claquetteuuuh and @AmirF194, who all made their first contributions in v4.0.1. For full details, check out the v3.21.4 and v4.0.1 release notes on GitHub.