What's New in CISO Assistant — Week 48, 2026 (v4.2.3 – v4.3.0)

This post covers v4.2.3 (November 11) and v4.3.0 (November 14). v4.3.0 is a minor release: AI apps can now sign in to the MCP server with OAuth, evidence gets a review queue, and the home page becomes a briefing. There is no breaking change, but a few permission changes are worth reading before you upgrade. Three people make their first contribution.

Worth Knowing Before Upgrading

User details need a new permission — view_user now only covers what pickers and owner fields need (name, email, groups, active and third-party flags). Sign-in and administration details (superuser flag, MFA status, expiry, local login, SCIM/JIT provisioning) need the new View full user record permission (view_user_full). Administrator and Reader get it. A migration gives it to every custom role that has view_user, except Global’s default role, so domain members no longer see these details (PR #5222). Thanks to @nas-tabchiche.
Linking needs view rights — linking an object now requires view rights on it, for every field that links objects. The API answers 403 otherwise. Unlinking needs nothing, even on an object you can’t see, and edit forms keep hidden links as “N hidden links” with a button to remove them (PRs #5256, #5261). Thanks to @eric-intuitem.
Compliance Summary is now limited to auditor-side roles (view_compliance_assessment_full): auditees and third-party respondents no longer see it (PR #5260).

MCP and AI

OAuth sign-in for MCP — AI apps such as Claude Code, Copilot Studio or MCP Inspector can connect to <your instance>/mcp with an OAuth sign-in, instead of each user running the MCP server with a personal access token. On the consent page, the user picks a profile that sets which tools the app may use. Users see and revoke their connected apps in their security settings, and administrators can review and revoke connections under Organization > Connected apps. Connecting is enabled per user (“Can connect AI apps”) and needs the MCP feature flags; with more than one backend worker, it needs memcached (see below) (PR #5242). Thanks to @tchoumi313.
Evidence review tools — MCP agents can list evidence by review status, read its revision history and approve or reject the latest revision. Reading evidence files is off unless enabled, files over 5 MB are not read, and the documentation spells out the risk of sending evidence contents to a model provider (PR #5289).

Evidence Review

A new review queue lists evidence to review, with search, status filters, revision history and attachment previews. Reviewers approve or reject, a rejection needs a comment, and a decision can be undone for a short time. An optional four-eyes setting stops uploaders from reviewing their own evidence. Changing reviewed evidence resets it to review, and review details are hidden from third parties. The queue opens from evidence and audit pages (PR #5263).

Home Page and Reports

A briefing on the home page — instead of a wall of counters, the landing page shows headline metrics with trends, what needs attention now (overdue tasks, expired evidence, open incidents and findings), audit results and the high risk scenarios. Trends come from a daily snapshot. After creating an audit, risk assessment, EBIOS RM study, BIA or incident, you now land on its page, and notifications move to the bottom right (PR #5276).
Framework report — reached from Compliance > Summary, which opens on a new By framework tab. The report can be filtered by domain at any depth, label, author, implementation group and ETA or due-date window, shows verdicts per audit and per domain, and exports to Excel or as a zip of the evidence for any set of requirements and audits, limited to what you may see (PR #5260). Thanks to @Mohamed-Hacene. Framework Insights now score each audit the way its own page does and show documentation and maturity scores when the audit uses them (PR #5250).
Scenario selection — filter a risk assessment’s scenarios once (tolerance, treatment, current and residual level, owner, threats, assets, labels…) and the selection applies to the scenario table, the matrices, the action plan and the PDF, CSV and Excel exports. It lives in the URL, so a filtered view can be shared, and it is remembered per assessment. Exporting only the scenarios outside tolerance, with their measures, is now one filter away (PR #5264).
Exports — the audit action plan gains Observation and Tasks columns, the risk assessment PDF shows scenario owners and control statuses, objectives can be exported to CSV and Excel, and dashboards get an Export PDF button (PR #5262).

Control Plan and Tasks

The control plan becomes a dense table with a resizable task pane, a column picker, sortable headers and grouping by domain, frequency or assignee. Periods can be a rolling window, this year or last year, by month, quarter or semester; overdue occurrences are flagged and an “Outstanding” filter shows what is left. The domain filter is a tree with an “Include sub-domains” option. A task occurrence page shows the task’s history with Previous and Next buttons (PR #5273). Thanks to @eric-intuitem.

Third-Party Risk

A dedicated space for third parties — third-party representatives get a simpler app shell with their dashboard, now called “My questionnaires”, plus language, theme and profile settings. Other pages send them back to it, and questionnaire and evidence forms only show the fields they can use (PR #5255).
Tasks on third-party audits — a task raised from a requirement of a third-party audit now goes into the third party’s workspace by default, so the respondent can see it and its commitment (PR #5266). Thanks to @Axxiar.
Entities and solutions can be filtered and bulk-edited by active status, which also appears in their CSV exports (PR #5282).

Identity, Roles and Deployment

Federated service accounts (Pro) — a service account can authenticate with a token issued by an external OIDC provider such as Keycloak, so no secret is stored in CISO Assistant. Administrators register providers from the organization menu (PR #5148). Thanks to @tchoumi313, who also makes failed SSO logins log their real reason (PR #5287).
Custom roles can now hold the permissions of the built-in roles: about fifty permissions from newer modules were missing from the catalog. Permission pickers show the technical names and can be searched by them (PR #5259). Thanks to @Claquetteuuuh.
Memcached — an optional memcached container (Docker Compose and Helm, ENABLE_MEMCACHED=True) gives all workers a shared cache and makes rate limiting consistent. Audit-log details now show the client IP (PR #5237). Thanks to @monsieurswag.
The Docker Compose health checks no longer use curl, and the installation FAQ explains how to start older generated Compose files (PR #5268).
A guide for SAML SSO with AD FS joins the documentation (PR #5247). Thanks to @tarkadia.

More Improvements

Framework scoring defaults — framework authors can set the calculation method, a target score and whether “not applicable” counts toward the target (PR #5243).
Security exception emails link straight to the exception and include its observation and key details, in English, French, German and Dutch (PR #5258).
UI consistency pass — one style for actions, one colour map (“Not applicable” is the same slate everywhere), clearer table placeholders, loading and error states, and detail pages that open on the first tab with content (PRs #5253, #5252).

Security

Hardening — chart tooltips escape user-provided labels, the calendar endpoint is capped to a one-year range (PR #5256), and bulk actions check permissions on every record: batch creation of personal data needs add rights in the folder, and vulnerability due-date refreshes only touch records you can change (PR #5286).

Bug Fixes

Sensitive personal data — a processing stayed flagged as holding sensitive personal data after that data was deleted or unticked. The flag is now computed from the processing’s data; the API still returns it, read-only (PR #5238).
Findings can be filtered by due-date year and month (PR #5272). Welcome to @Fguarien, a first-time contributor.
Batch actions work on incidents again (PR #5279), and the metric form only offers to create a definition to users allowed to add one (PR #5288).

Framework & Library Updates

ITSP.10.033 — the Canadian Centre for Cyber Security’s catalogue of security and privacy controls, in English and French, with the medium impact profile (ITSP.10.033-01) as an implementation group, and a two-way mapping to NIST SP 800-53 rev5 covering 1,007 controls (PR #5265).
ISO 14001:2015 outline — environmental management systems, clauses 4 to 10, in English and French (PRs #5284, #5290). Thanks to @Qnadia.
LYSS — the draft Lyaazale Switch Security specification for managed network switches, with three cumulative levels and a mapping to ISO/IEC 27001:2022 (PR #5246). Welcome to @MouadLyaazale, a first-time contributor.
Hungarian NIS2 preset — a 13-step journey for essential and important entities supervised by SZTFH, with the MK Decree 7/2024 risk matrix (PR #5249). Thanks to @aafeher.
NIS2 Implementing Regulation 2024/2690 — 379 requirements that only showed their reference ID now have a name, and section 10.2 is correctly named “Verification of background” (PR #5277). Welcome to @Staffan-L, a first-time contributor.

For full details, see the v4.2.3 and v4.3.0 release notes on GitHub.