What's New in CISO Assistant — Week 37, 2026 (v4.0.2 – v4.0.3)

Two patches close out the first full week on the 4.x line: v4.0.2 on September 12 and v4.0.3 on September 13. Patch numbers understate them — v4.0.2 carries an epic, a rebuilt audit view and a report-engine consolidation, and v4.0.3 follows one day later with a performance pass aimed squarely at the pages users complained about.

Requests Management with Quick Forms

The headline of v4.0.2 is a new epic: quick forms — simple forms that are deliberately not compliance assessments (PR #4771). It ships behind the quick_forms feature flag, off by default.

The authoring side is a multi-page builder with conditional question visibility, scoring, outcomes, required questions, file uploads and references to existing objects. The consumption side is a full intake loop: a requester portal, a My Requests view, reviewer queues, links from a response to the objects it produced, and email notifications along the way. Responses have a lifecycle — start, answer, submit, reopen — and the whole thing is importable and exportable like other content, with workflow triggers and supervised actions wired in, including security-exception automation. Warnings now surface for unknown workflow keys and incomplete portal tiles. Thanks to @nas-tabchiche.

The practical effect: the recurring “someone needs to ask the GRC team for something” pattern — an exception request, an onboarding questionnaire, a review request — no longer has to be modelled as an audit.

One Engine for Every PDF Report

All PDF exports now share a single layout and run on the new rendering engine (PR #4748). That covers the audit report, audit and TPRM attestations, the action plan for both audits and risk assessments, the incident report, the findings report and the risk analysis. The export window replaces the old dropdown.

New alongside it: audit posture and audit attestation exports with profile-specific content — charts, compliance detail, commitments, tasks and signatures — with posture exports made available to third-party viewers under role-based visibility. Entity address and assessment expiry date join the forms and the data exports, Word reports now embed the generated audit charts, and hidden assessment results correctly hide their derived scores and charts. Rendering was fixed for localised result statuses, long observations and requirement assessments that spill across pages.

This is flagged as a breaking change in the release: if you have tooling or internal documentation pinned to the old export layout, budget time to look at the new output. Thanks to @ab-smith.

The Audit Table-Mode, Rebuilt

Compliance audit table-mode was reworked end to end (PR #4635). The assessment/questionnaire toggle is no longer tied to third parties — it is now an auditor comfort switch: assessment shows everything with questionnaire answers read-only, while questionnaire (“focus”) shows only the questions plus the computed result and score.

A collapsible table of contents keeps section context on scroll, and its result filter now filters the list as well as the rows. The header gained shortcuts to edit the audit, open the action plan and reach evidences, and its scores refresh live after a score edit rather than waiting for a reload. Editing respects reader-versus-editor permissions — a user without change rights sees every control disabled and no create/select — and honours the focus-mode domain filter when picking evidence or measures. Requirement cards got segmented controls for status and result, score sliders with progress rings and score descriptions, and proper empty states. The page is also simply lighter: no per-requirement superForms and no full reload on each field edit. Thanks to @Mohamed-Hacene.

Workflows Learn to Call the AI

Workflows gained AI steps for structured extraction and text generation, with configurable prompts, inputs, output fields, schemas, retries and word limits, plus editor support for AI actions and schema fields (PR #4800). A sample AI-assisted finding triage workflow ships with it, setting severity, priority, review flags and notes.

The guardrails came in the same change: unavailable providers, invalid or oversized outputs and excessive input are all handled explicitly, and workflow outputs can no longer overwrite reserved engine variables. Deletion previews and cleanup for branching workflows were fixed along the way. Thanks to @ab-smith.

New Features

• Date filters across list views — Dates and date-times are now filterable everywhere lists are: ranges, comparisons, a specific date, unset dates, and quick presets. The coverage spans assessments, accreditations, contracts, privacy records, security advisories, issues and more. Filters also handle custom query parameters and keep their state sanely when values change or the filter is reset (PR #4799). Thanks to @ab-smith.
• Admins can force a date format — A configurable default date format that an authorised administrator can apply to every user at once, behind a confirmation prompt, with new users inheriting it. Invalid values are rejected with clear feedback, and a warning fires if you try to apply settings you have not saved (PR #4804). Thanks to @ab-smith.
• Findings import carries controls and owners — The findings importer knew name, description, severity, status, labels, dates, priority, observation, vulnerabilities and asset, but had no way to bring in the assigned users or linked applied controls, so both were set by hand after every import. Two columns now resolve: applied_controls, matched by ref_id then name within the domain folder and auto-created when missing, and owner, taking semicolon-separated user emails and team names. Unresolved entries warn instead of blocking, an empty owner column correctly clears existing owners on update, and because both paths share the same consumer this works in the manual data wizard and the AI chat file import alike (PR #4769). Thanks to @Spaghetto784.
• Descendant visibility moves to the folder — The is_published mechanism decided access per object rather than per domain, and its behaviour had drifted apart across object types. It is now a folder-level setting — whether supported content is visible from descendant domains — which is both simpler to reason about and consistent with how the rest of IAM works. The same change adds manual score overrides on requirement assessments, preserved through recalculation and copying (PR #4672). Thanks to @monsieurswag.
• Enclaves travel in domain export/import — Back in week 31 the TPRM ecosystem joined domain export, with enclaves explicitly left out. That gap is now closed: enclave folders and their scoped audits, assessments, evidence, findings and task templates travel with the dump, so a vendor’s questionnaire, evidence and tasks come back into their workspace. Foreign-domain binders are blocked from riding in through enclave-linked audits, and legacy exports still import (PR #4742). Thanks to @Mohamed-Hacene.
• Metric samples from the context menu — Right-clicking a metric instance in the list now offers Add new custom metric sample directly, instead of requiring a trip to the instance page. The same change broadens table filters, columns and batch actions across commitments, findings, campaigns, assessments, entities and scores (PR #4728). Thanks to @Axxiar.
• Filter and sort audits by author — Risk assessments, compliance assessments and findings are filterable and sortable by author, with author search covering users, teams and entities. Domain managers can now create third-party representatives, while analysts can no longer change or delete them, and compliance analytics cards and framework headers link through to their detail pages (PR #4809). Thanks to @ab-smith.

Performance

v4.0.3 is largely a performance release.

• Fewer intensive API calls — Filter dropdown options load on demand rather than upfront, related-content tabs load when first visited and keep what they loaded, and user, settings and feature-flag data load asynchronously. Invalid pagination values fall back safely to the first page instead of firing redundant requests (PR #4807, thanks to @ab-smith, with a follow-up deferring filter controls until the popover is first opened in PR #4808, thanks to @eric-intuitem).
• A usable kanban board — The board could take more than ten seconds to render. Sections now fold, cards load on demand as swimlanes open, large result sets get a progressive load button, and per-folder and per-status counts stay accurate — updating immediately on a status change and correcting themselves if the update fails. Tested against 7,000+ controls (PR #4810). Thanks to @eric-intuitem.
• An N+1 benchmark command — A management command that measures query growth across list endpoints, reporting query counts per object, sorted to put the worst offenders first, printable as JSON or written to a file. It prepares its own representative data and skips endpoints whose configuration is unavailable (PR #4778). Thanks to @monsieurswag. Rather than fixing N+1 queries one report at a time, the team now has a way to find them.

Identity & Access

• One policy for custom roles managing users — Custom roles handled user management inconsistently. The change applies a single documented policy — written up in documentation/user-account-security-policy.md — strengthening safeguards around administrator accounts, privilege changes, group membership and email updates, and around SCIM-managed users. The last active administrator can no longer be deactivated or deleted, including through batch actions or expiry-based deactivation. User detail pages now show whether an account is SCIM-managed or JIT-provisioned, and updating SSO settings requires a complete configuration (PR #4759). Thanks to @eric-intuitem.
• Classification pages stop offering what they can’t do — The object-classification detail page was hand-built and never checked permissions, so domain admins and view-only users saw enabled Add/Edit/Delete/reorder controls that returned a 403 on click. The standard permission check now hides them. Backend behaviour is unchanged — it was already rejecting the writes (PR #4755). Thanks to @melinoix.
• Logout no longer depends on API reachability — On deployments where the API is not reachable from the browser — SaaS IP allowlists, filtered reverse proxies — SSO users logging out landed on a blocked page instead of the login screen, and single logout never reached the identity provider. The logout route now resolves the provider’s logout URL server-side and redirects the browser straight to the IdP, with any failure falling back to /login, so logout cannot dead-end. Access tokens are revoked during logout and a timeout guards against stalled sign-outs. Worth noting for production hardening: /api/iam/sso/logout/ no longer needs to be publicly reachable, but the SAML sls endpoint still does when SAML single logout is enabled, since the IdP must deliver its signed LogoutResponse there (PR #4774). Thanks to @Mohamed-Hacene.

Bug Fixes

• Saving a requirement wiped its scores when the result was hidden — On audits that hide the result field, saving a requirement cleared its score, documentation score and result. The edit form posted back every field including the hidden respondent alignment, which came back empty, and the backend read that as the respondent clearing their answer. It now only resets when an alignment was actually set, and the form no longer posts fields the audit hides. Explicitly deselecting an alignment still clears the associated values (PR #4794). Thanks to @Mohamed-Hacene.
• Stale custom fields from another domain blocked object creation — Creating an object failed with an opaque custom_fields error whenever the selected domain was not the one holding the field definitions. Three things combined: the create modal loads definitions before a domain is picked and so receives every definition for the model, rendering a choice field writes a null placeholder into the payload, and switching domain hid the fields but kept the keys, which the API rejected as unknown. The payload now only carries keys of currently rendered definitions, resolved against the selected folder. Two behaviour changes: moving an object to another folder discards stored values whose definition no longer applies there — previously they lingered invisibly while still matching cf__ filters — and the destination folder’s required custom fields are enforced on the move (PR #4731). Thanks to @nas-tabchiche.
• Empty names and truncated observations in the findings PDF — The findings assessment report printed blank Authors, Reviewers and Owners lines because the template read .email on Actor objects, which have no such attribute, and Django renders that as an empty string. Actors now render through str(), matching the markdown export. The summary table also cut observations at 100 characters; that truncation is gone. Reported by a customer (PR #4768). Thanks to @nas-tabchiche.
• Deleting a folder with a kill-chain reference returned a 500 — Deleting a folder that cascaded into an ElementaryAction still referenced by a KillChain raised an uncaught ProtectedError and surfaced as a raw 500. It now returns a structured 409 naming the visible items blocking the deletion, and indicating when further blockers are hidden (PR #4751). Thanks to @Spaghetto784.
• Supporting assets saved capabilities as objectives — Creating an asset of type supporting stored its security and recovery capabilities as security and recovery objectives, which belong to primary assets. Inputs are now recreated when the type changes, so the right values reach the backend (PR #4787). Thanks to @Axxiar.
• Document validation flows — Approvers are now shown in document history and PDF metadata, non-authored documents can be approved, approval is disabled rather than silently rejected when the user lacks the rights, lifecycle and deletion controls carry explanatory tooltips, delete failures surface the backend’s reason, and duplicate frontend errors are gone (PR #4795). Thanks to @ab-smith.
• Accessible findings chart — The finding assessment chart’s palette was adapted for colour blindness (PR #4767). Thanks to @melinoix.
• Framework resolution in the CLI — CLICA resolved frameworks through /frameworks/ids/, an endpoint frameworks do not expose. It now uses /frameworks, follows every next link so audit imports can select a framework returned on a later page, and — since framework names are not unique — reports an explicit ambiguity error instead of uploading an arbitrary X-Framework-Id (PR #4746). Thanks to @JohnGanem.
• Matrix fixes — The matrix editor honours the instance matrix settings: axis swapping, vertical flipping, row ordering, directional arrows, and the configured probability and impact labels in the selected language instead of fixed terminology (PR #4803). Matrix headers in dark mode render black text on light cells, and unconfigured axis header cells no longer show an unintended white background (PR #4802). Thanks to @ab-smith.
• ISO 42001:2023 external reporting direction — The library wording described provider-to-user external reporting when the requirement runs user-to-provider (PR #4790). Thanks to @kriss-b.
• Also fixed: an autocomplete dropdown rendering beneath the table header (PR #4770, thanks to @martinzerty), colon-separated table values being cut short, campaign framework filtering using the wrong API field, and non-paginated tables sending an unnecessary limit (PR #4798).

Internationalization

• German, properly — The German frontend messages are now complete against the current English set, with terminology corrected through menus, forms and help text: Kontext (ISO) for organisational issues, Feststellungen for findings, Prüfmappen for findings binders, Drittparteiprüfung for third-party assessments, Nachweisversion for evidence revisions, and a clear separation between the Organisation section, the generic Entität model and the Drittparteien navigation group. Validated across 18,369 render checks over 6,123 messages (PR #4773).
• German NIS2 / ENISA guidance — 441 translation blocks covering all 439 requirement nodes of the NIS2 Annex / ENISA Technical Implementation Guidance library, with 438 requirement headings and texts taken from the official German text of Implementing Regulation (EU) 2024/2690. The supplemental ENISA guidance and evidence examples were machine-translated with terminology correction and spot checks, and are explicitly not an official ENISA German translation (PR #4772).

Both thanks to @hlederhaas.

Documentation & Build

• Docs catch up with 4.0 — Vocabulary aligned across the product docs — “Findings assessments” and “Follow-ups” are now “Findings binders” throughout — with new sections for commitments, campaigns, tasks analytics, item-level assignment review, findings binders and third-party workspace management, plus clarifications on external ratings, DORA settings, custom URL fields, task commitments and third-party assessment revisions. Library Builder navigation now points at Catalog, and the feature-flag documentation was expanded (PR #4764). Thanks to @ab-smith.
• WeasyPrint was upgraded to accept the 70.x range along with minor backend dependency bumps, and document generation no longer aborts the whole render when an external resource is blocked or rejected (PR #4793); maplibre is pinned (PR #4781).

For full details, check out the v4.0.2 and v4.0.3 release notes on GitHub.