What's New in CISO Assistant — Week 47, 2026 (v4.2.2)

This post covers v4.2.2, published on November 8. It is a patch release with no breaking change, but a large one: incident follow-up for NIS2 and GDPR, new scoring models for maturity frameworks, asset lifecycle, a rework of metrics, and a security hardening pass.

Incidents, NIS2 and the Belgian Market

A set of additions built around CyFun and Belgian obligations, useful well beyond Belgium (PR #5241):

• NIS2 incident follow-up — incidents get a significance flag, the 24-hour, 72-hour and one-month report timestamps, a CCB reference and a root cause, shown in a regulatory follow-up panel on the incident page.
• Incidents and data breaches are linked, with a breaches tab on the incident, the GDPR 72-hour authority deadline and an overdue badge.
• Notification worksheets in PDF (English, French, Dutch) for the NIS2 report to the CCB and the breach report to the APD.
• Reminders in the inbox and by email for NIS2 and GDPR deadlines, data-subject request due dates, expiring contracts and gaps in the record of processing (missing purpose, DPIA, retention or transfer mechanism). Data-subject requests are now due one month after the request date by default.
• Validation requests can target requirement assessments and risk scenarios.
• Statement of Applicability export to Excel, in English, French, Dutch and German.
• CyFun 2023 tool import through the Data Wizard, with the level detected from the filled sheets, and implementation-group analytics that show the lowest score and target per group, checked against the official CCB tool.

Maturity Scoring

• Cumulative maturity levels — frameworks can define a staircase of maturity levels, where reaching a level requires every level below it. Audits show the level reached, the progress and the requirements blocking the next level, and choosing a level automatically includes the lower ones. The Essential Eight framework now uses this model (PR #5218).
• Weakest-link scoring — a framework outcome can rate requirements at a chosen depth by their weakest result, optionally per top-level section, with links to the non-compliant requirements that drive the rating. It comes with the new ASD Essentials for enterprise IT (October 2026) framework and its transition mapping from the Essential Eight (PR #5239).

Assets and Metrics

• Asset lifecycle — assets get an optional lifecycle stage: Planned, Implementing, Active, Phasing out, Retired or Archived. Stages can be set in forms and in bulk, filtered and shown as a column, and they travel through imports and exports, custom stages included (PR #5240).
• Metrics in fewer steps (PR #5234):
  • one form creates the metric and its definition, and suggests an existing definition with a similar name;
  • the direction has three options: higher is better, lower is better, or none, the new default, which shows no good/bad colouring and makes the target optional;
  • each definition sets how many decimals are displayed, so formulas no longer need round();
  • a value can be recorded for a calendar period from a new inline strip on the metric page, and a second value for the same period replaces the first;
  • widget titles link to their source, the widget form shows a live preview, and duplicate definitions from two domains can be merged.

Thanks to @nas-tabchiche.

Audits and Reports

• Per-role field access — field visibility on audits becomes edit, read or hidden, set separately for the auditor and the respondent, so an audit can say “the respondent writes, the auditor reads” or the reverse. Impossible combinations are blocked in the editor, and read-only access for the auditor is now enforced by the API (PR #5049). Thanks to @Axxiar.
• Report time zone — a new setting (Settings → Date format, UTC by default) makes the six PDF reports and the incident and findings Markdown exports print every time with its UTC offset and state the zone on the cover. Custom Word templates using {{ generated_at }} now get the format … (UTC+02:00) instead of … UTC (PR #5176).
• Audit HTML report — the index.html in the audit archive gains a table of contents with each requirement’s result, one table per requirement linking each applied control to its own evidence, flags for missing evidence, and Markdown rendering (PR #5230). Thanks to @Claquetteuuuh for both.
• Turkish PDF reports — the six Typst report templates are now available in Turkish (PR #5212). Thanks to @MustafaEroztekin.
• Question annotations are shown on question cards, in the user’s language when a translation exists (PR #5231).

EBIOS RM, Workflows and MCP

• Duplicate an EBIOS RM study, with all its objects, while keeping links to shared objects such as assets. A study can be duplicated into another domain within the user’s permissions (PR #5205). Thanks to @martinzerty.
• Workflows can read requirement assignments, and a new template adds the users behind the assigned actors to the Respondent group of the audit’s domain, for the frameworks you list (PR #5209). Thanks to @Mohamed-Hacene.
• MCP gains tools to create findings assessments and to create and update findings, so an agent importing a pentest or scan report no longer needs its own HTTP client. Evidence can be created in review and linked to its binder in one call (PR #5225). Thanks to @JohnGanem.

Security

• Hardening pass — tighter access checks on assessment data, chat search, analytics, workflows and cross-folder updates; SCIM tokens can no longer be used for session authentication; login tokens are revoked after a password change or reset; social sign-in is refused when the provider marks the email as unverified; risk-matrix and control suggestions only use accessible data; and portals can’t reference content the user can’t access (PR #5229).
• EBIOS RM Excel export now escapes values that would otherwise run as formulas when the file is opened, like every other Excel export already did, and restores them on import (PR #5232). Thanks to @melinoix.

Framework & Library Updates

• ASD ISM (September 2026) — the Australian Information Security Manual, with PRINCIPLE and CONTROL implementation groups to assess only the part you need (PR #5235).
• Swift CSCF v2026 and v2027, and an update of v2025 with implementation groups for architecture types and advisory controls (PR #5204). Thanks to @tarkadia for both.
• SAMA BCM — the Saudi Central Bank’s Business Continuity Management Framework, 75 controls across 13 subdomains, next to the existing SAMA CSF (PR #4385). Thanks to @smakarim.
• German NIS-2 Implementation Act — the legal text of the BSI Act (§§ 28–55) as amended in December 2025, in German (PR #4928). Thanks to @tobmay.
• Mappings — a better ISO 27001 ↔ NIST CSF 2.0 mapping (PR #5221), and a revised SOC 2 ↔ SCF mapping, with Processing Integrity references corrected from PP to PI (PR #5244).

Localisation

• Norwegian Bokmål grows from 4,439 to 5,343 translated strings, including the privacy (GDPR) libraries, checked against the official Norwegian GDPR text (PR #5219). Thanks to @bjafl.
• German is complete again, with 559 missing messages added, and the seven shipped quick forms (DPIA, pre-DPIA screening, vendor and solution tiering, and more) are translated (PRs #5227, #5226). Thanks to @hlederhaas.

For full details, see the v4.2.2 release notes on GitHub.