What's New in CISO Assistant — Week 46, 2026 (v4.2.0 – v4.2.1)

This post covers v4.2.0 and v4.2.1, both published on November 1. v4.2.0 is a minor release: the frontend moves to SvelteKit 3, notifications cover assignments, approvals and reviews, Pro audit reports can use a custom PDF template, and the libraries gain a SOC maturity model, PIPEDA, the Czech decree and two NCA frameworks. v4.2.1 is a container build fix. Four people make their first contribution.

Breaking Changes

• SvelteKit 3 — the frontend (and the Enterprise frontend) moves to SvelteKit 3.1, adapter-node 6, TypeScript 6 and superforms 3. Existing deployments need no change: ORIGIN keeps working through a small shim, and the HOST_HEADER/PROTOCOL_HEADER setups (docker-compose, config builder, Helm) are unaffected. It matters if you maintain frontend code on top of CISO Assistant: $lib imports become #lib/….js, and deprecated APIs such as invalidateAll are replaced (PR #5179).
• Libraries move to Catalog — the Libraries entry leaves the Governance menu for Catalog. Permissions don’t change (PR #5207).
• Mapping inference — results inferred from framework mappings no longer depend on the order of the links. Only equal or superset links can make a target compliant, subset and intersect links give at most partially compliant, and when links contradict each other the most restrictive wins, so a gap is never hidden. Stored audits don’t change, but new inferences (baseline creation, map-from, mapping options) can differ, never for the worse (PR #5177). Thanks to @eric-intuitem.

Notifications

The notification centre now covers assignments, approvals and reviews, in the app and by email, in English, French, German and Dutch (PR #5168):

• risk acceptances submitted to their approver, and the decision sent to the owners of the covered scenarios;
• evidence approved or rejected, sent to its owners;
• new audit reviewers and new incident owners;
• being added as owner or assignee of an asset, evidence, finding, solution, contract, metric instance, processing, data breach and more, or as author or reviewer of a risk assessment, EBIOS RM study, BIA, entity assessment or technical posture;
• document revisions submitted for review, and the review outcome sent to the author. Documents gain a reviewers field.

It also fixes a case where a validation request email went to the previous approver instead of the current one.

Reports

• Typst templates for PDF audit reports (Pro) — the posture and attestation PDF reports can now use your own Typst template, next to the existing Word templates. The default templates can be downloaded from the settings as a starting point, and an invalid or unavailable template falls back to the default (PR #5184).
• The maximum score is now the same in Word and PDF audit reports (PR #5200).

Third-Party Risk

• Vendor posture views — vendors can be shown as a list, in lanes or in a quadrant, by compliance or by score, grouped by tier, with missing results marked. A tier can set a compliance target from 0% to 100%, and analytics gets posture and assessment tabs (PR #5169).
• Custom fields and labels on entity assessments, with list columns, filters, bulk add and remove, and labels in the CSV/Excel export (PR #4986).
• Required evidence in questionnaires — framework authors can flag a requirement as needing evidence. An assignment can’t be submitted while a visible flagged requirement has no file or link, and respondents see the obligation before submitting (PR #5181).

Thanks to @Mohamed-Hacene.

Portals and Documents

The portals editor can now add document destinations, link to specific documents and filter document lists by type. Tiles only show actions and documents the current user can open, and can be moved between sections. Users with access to published documents can read published revisions and their attachments, while drafts stay hidden (PR #5165).

More Features

• Vulnerabilities gain an observation field, links to applied controls and quantitative risk scenarios, and a feature flag to turn off SLAs (PR #5174).
• EBIOS RM Excel export now reaches workshop 5: risk assessments, risk scenarios and security measures are exported and imported, linked to their operational scenarios, and limited to what the viewer can see (PR #5194).
• Collections can hold applied controls, document containers and business impact analyses, and records can be filtered by collection (PR #5201).
• Domains can be looked up by exact reference ID: GET /api/folders/?ref_id=DOM.IT (PR #5162). Thanks to @nas-tabchiche.
• AI chat labels and docs now cover hosted OpenAI-compatible gateways (PR #4720). Welcome to @martinzudergaming-a11y, a first-time contributor.
• A workflows cheat sheet joins the documentation (PR #5198).

Security

• Word report templates — rendering of uploaded templates now uses an allowlist: a template can only read plain data, and any other object is opaque. Before, a template could call public methods of objects in its context (PR #5185). Thanks to @Claquetteuuuh.
• IAM — RACI activities and actors are checked against the risk matrix’s domain (PR #5163).

Framework & Library Updates

• SOC-CMM 2.4.2 (Basic) — the SOC capability maturity model across its five domains, with 946 assessable requirements in English and French (PR #4552, thanks to @Qnadia), plus a question-driven version (PR #5210).
• PIPEDA — Schedule 1 of Canada’s privacy law in its official text (PR #4319). Welcome to @abbousaad, a first-time contributor.
• Czech Decree 409/2025 — official v1 of the framework for regulated service providers under the new Cybersecurity Act, with the ZoKB 4×4 risk matrix (PR #4972). Thanks to @zdenek-pergl.
• NCA DCC-1:2022 (Data Cybersecurity Controls) and NCA CSCC-1:2019 (Critical Systems Cybersecurity Controls) from Saudi Arabia (PRs #4379, #4384). Thanks to @smakarim.
• OWASP Top 10 Web 2025, and an update of the 2021 edition (PR #5192). Thanks to @tarkadia.
• ANSSI MonServiceSécurisé V2 — five new reference controls and a mapping to ReCyF. The reference controls library moves to version 9 (PR #5206).
• ISO/IEC 27001 — the 15 operational capabilities of ISO/IEC 27002:2022 are available as implementation groups, so audits can be filtered by capability (PR #5190). Thanks to @ImanABS.

Bug Fixes

• Enforced MFA on Enterprise — a local user without MFA got a redirect loop on first login (PR #5188).
• TOTP reauthentication page no longer crashes (PR #5183), thanks to @tchoumi313, who also fixes the audit-log CSV export (PR #5166).
• Integrations — a rotated token can be tested again (PR #5118).
• Smaller fixes: implementation groups translated in audit payloads (PR #5121), custom role labels in Pro (PR #5199), and the API docs pinned to Redoc v2 (PR #5196).
• v4.2.1 fixes the container build by using Docker Hardened Images’ renamed gcc runtime builds (PR #5215).

Localisation

• Norwegian Bokmål is a new language, with forms, tables and shared strings translated (PRs #5186, #5197). Welcome to @bjafl, a first-time contributor.
• Turkish is complete (PR #5211). Welcome to @MustafaEroztekin, a first-time contributor.
• Italian covers the vendor evaluation quick forms and the DPIA (PRs #5171, #5195). Thanks to @LoZio.

For full details, see the v4.2.0 and v4.2.1 release notes on GitHub.