What's New in CISO Assistant — Week 44, 2026 (v4.1.2)

This post covers v4.1.2, published on October 16. The privacy module gets the most attention, with DPIA screening and assessment and a processor register. Metrics can now be computed from other metrics, business impact analyses gain a dependency view, and all outbound mail goes through one service. There is no breaking change in this release, and six people make their first contribution.

Privacy: DPIA and the Processor Register

• DPIA screening and assessment — processing records now carry a DPIA workflow. A screening form decides whether an assessment is needed, and the assessment form rates the risks. Both forms are bilingual and come with their scales and the facts of the processing. Decisions keep a review history, and a manual override needs a note. A new DPIA overview tracks every assessment by status, with search, filters and links to the forms (PR #5069).
• Quick forms gain what the DPIA needed: rating outcomes and subject facts shown on the form, configurable scales and rating rules, and an Always review setting. Questions and choices that saved responses still use can no longer be deleted.
• Processor register — a processing record now has a role: controller, joint controller or data processor, with the related controller where it applies. Quick filters switch between the controller and processor registers, the form adapts to the role (processors don’t get DPIA fields), and imports and exports carry the role, the controller and the security measures (PR #5072).

Thanks to @ab-smith.

Computed Metrics

Metrics no longer have to be typed in (PR #5021).

• New computed metric on the metric instances list, or Compute from selection on selected rows: pick the instances to combine, write a CEL formula and name it. The result is a number or a level, and a live preview shows the latest result, recent periods and a trend.
• Saving creates an ordinary, reusable definition and an instance pinned to the instances you picked, in the lowest domain that holds them all.
• Edit formula opens a drawer that charts the edited formula against the current results before you save.
• Metrics on applied controls — applied controls and metric instances can now be linked both ways, filtered by each other, and merges carry the links (PR #5067).

Thanks to @nas-tabchiche and @ab-smith.

Business Impact Analysis

• Dependency analysis — each BIA gets flow, domain-map and gap-register views of its asset dependencies. Select an asset or a domain cell to see its status, objective gaps, causes and impacts. Graphs only show assets the viewer can see (PR #5089).
• Timeline — one row per qualification, grouping by asset or qualification, the asset’s full folder path, and faster rendering (PR #5081).

Thanks to @ab-smith.

Mail and Log Forwarding

• One mail service — password resets, invitations, notifications and workflow emails now all go through one service that tries the configured mailers in order. The EMAIL_* variables are unchanged and the _RESCUE set becomes the second mailer, which now applies to every message. Failover happens only when a server cannot be reached, so nothing is sent twice. This prepares OAuth over SMTP for Microsoft 365 and Google Workspace (PR #4879). Thanks to @nas-tabchiche.
• OAuth for audit-log forwarding (beta) — HTTP sinks support OAuth 2.0 client credentials with token renewal, and can send events as a JSON array. A new guide covers forwarding to Microsoft Sentinel and Log Analytics (PR #5085). Thanks to @ab-smith.

MCP: Incidents and Evidence

• Incidents — create_incident and update_incident, plus create_timeline_entry for detection, mitigation and observation entries (PR #5058). Incidents can be linked to task templates, which also fixes name lookups in the existing task-template tools (PR #5080).
• Evidence — create_evidence creates an evidence and uploads a local file to it, with the same file types as the API and a size limit set by CA_MCP_MAX_UPLOAD_MB (PR #5061).
• get_risk_scenario now shows existing applied controls (PR #5056).

Thanks to @JohnGanem.

AI, Search and Demo Data

• AI layer — the chat can look up exact requirement references and mappings between frameworks, limited to what you can access, and answers include linked assessments, findings, scenarios, controls and assets (PR #5091).
• Search covers document containers, projects, organisational objectives and issues, and metric instances, with better ranking. Document results open in the reader (PR #5097).
• Demo data — a much larger demo dataset covering governance, compliance, risk, privacy, resilience, suppliers, documents and automation, loadable by module (PR #5041). It includes sample pipeline posture from Plumber scans.

Thanks to @ab-smith.

Technical Posture, Domains and UX

• Plumber imports — OCSF results from Plumber can be imported into technical postures, with control-based matching. Partial imports now keep the other results of the current posture (PR #5092). Thanks to @ab-smith.
• Domain ref_id — domains get an optional ref_id, unique across all domains, in the form, list, exports, data wizard and domain backups (PR #5077). Thanks to @nas-tabchiche.
• Saved table sorting — each table remembers its sort in the browser, and resetting filters restores the default sort (PR #5068).
• Evidence on applied controls — evidence is now one of the linked fields of an applied control (PR #5066), and the data wizard re-imports extended_result from audit exports (PR #5084). Thanks to @monsieurswag.
• Domain filters load lazily (PR #5045), and the workflow editor’s bottom panes are collapsible (PR #5065).

Framework & Library Updates

• Hungarian NIS2 — the 7/2024 MK rendelet catalogue of protection measures (914 measures, 7 implementation groups), its threat catalogue, and the 1/2025 SZTFH rendelet elementary requirements for NIS2 audits, as three separate libraries (PRs #5039, #5076). Welcome to @aafeher, who makes their first contribution with these libraries and the Hungarian localisation.
• Costa Rica BCCR-SINPE NT-RCS edition 7 — bilingual Spanish/English frameworks for categories 1 and 2, with Cumple / No cumple questions and the procedural checklist (PR #5032). Welcome to @ARG-INNOVA, a first-time contributor.
• NCSC CAF 4.0 — a question-based version with compliance inferred per tier: every applicable statement in a tier must be met. Frameworks can now choose this tiered aggregation (PR #4876).
• ReCyf ↔ ANSSI hygiene guide — mappings to the variant of the ANSSI hygiene guide (PR #5070).
• Plumber framework upgraded (PR #5046), ENISA SME CRA maturity in German by @hlederhaas (PR #5053), and ITIL 4 management practices in Spanish (PR #5095) — welcome to @GIOSDQ, a first-time contributor.
• Excel and YAML library pairs are aligned and inconsistent libraries regenerated (PR #4905). Thanks to @tarkadia.

Bug Fixes

• Question weights — in SUM-scored questionnaires, weights multiplied the answers but not the maximum, so a weighted requirement saturated at its top score. The weighted sum is now projected onto the requirement’s scale. Existing audits keep their stored score until recompute_assessment_results runs (PR #4840).
• Outcomes with hidden requirements — as soon as a visibility expression hid one requirement, outcomes that read answers stopped firing. They now work, and hiding a section also hides its contents (PR #5035). Thanks to @eric-intuitem.
• OIDC-only login — with OIDC settings and no SAML section, the login page failed to load, password login included (PR #4992). Thanks to @theluckystrike.
• Deleted questions in the framework builder are now removed on publish, along with their audit answers (PR #5063).
• Currency — after changing the global currency, new applied controls were still created in € (PR #5071). Thanks to @melinoix.
• Asset API — security objectives and capabilities sent as arrays, the format GET returns, are now accepted on write (PR #4643). Welcome to @ChickenisLegit, a first-time contributor.
• Smaller fixes: hidden classification levels no longer offered when creating a document (PR #5043, thanks to @mvanhorn), a distinct label for the per-requirement review flag in TPRM (PR #5082, thanks to @Axxiar), and the Markdown table component (PR #5044).

Localisation

• Hungarian is complete (PR #5073), thanks to @aafeher.
• Brazilian Portuguese is complete (PR #5074). Welcome to @tarcisiommota, a first-time contributor.
• Ukrainian is complete with fixed terminology, and observation labels are no longer hardcoded (PRs #5051, #5052). Welcome to @troshab, a first-time contributor.
• German catches up with recent features and reminder emails are localised (PRs #5026, #4985), thanks to @hlederhaas. Polish is updated by @amrutadotorg (PR #4971), and duplicated strings are fixed by @Claquetteuuuh (PR #4933).

For full details, see the v4.1.2 release notes on GitHub.