Risk Ledger

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 104

   Risk Ledger adds client-managed supplier documents, peer review sharing with permission controls, and network map density tuning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When a supplier is slow to engage, upload their documents to the supplier profile so evidence stays centrally accessible and you receive an expiry reminder before certificates lapse.
   📍In the supplier profile, go to the new Documents section › Upload document › set an expiry date to receive reminders 30 days before and on the day it expires.
   When your network map has grown large and is slowing down, reduce clutter by limiting nth-party depth and disabling animations.
   📍In the network map view, open the display controls › set Adjust network map density to your desired nth-party depth › disable Show animations › enable Hide the wider Risk Ledger network to focus on your own supply chain.
   When a central security team wants to share completed supplier reviews with member organisations in a community, without exposing raw evidence or supplier answers.
   📍In the Community Review Sharing permission framework, select the community › choose which data points to share with peers › set access to approve on request so peers can see that a review exists and receive only approved data points.
   • Adds a dedicated document storage space within any supplier profile, visible only to your organisation, so desk-research files and supplier-sent packs are kept alongside the rest of your supplier records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds expiry-date tracking on uploaded documents, triggering reminders 30 days before and on the day a document expires.
   • Adds a permission framework for Community Review Sharing, letting federated organisations and selected communities control which data points are shared and with which peers.
   • Adds the ability to share reviews and review signals with peers in a community, so a central team can review suppliers on behalf of members.
   • Adds network map density controls — choose how many nth parties to display, hide the wider Risk Ledger network, and toggle node animations on or off to keep large maps fast and focused.

   +1 more show less

   • Adds a Suggest a contact option on the supplier Overview page under Last sign in for suppliers inactive for a year or more, so you can nominate someone to take over a dormant profile.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The previous community signals feature has been retired and replaced by Community Review Sharing.
2. August 2026: More flexible assessments, clearer reviews Aug 1, 2026 · release notes

   Risk Ledger August 2026 adds Flexible Framework for per-supplier controls and Supplier Review Statuses with explicit outcomes

   • Flexible Framework lets you select which assessment controls (question sets) apply to each supplier based on assigned policies and tags, enabling dynamic control updates as supplier relationships change.

   1 detail in Everything

3. July 2026: Stronger frameworks and a clearer view of supplier risk Jul 1, 2026 · release notes

   Adds Supplier Summaries with Summarise profile button, OT Add-on, and policy CSV export/import

   └──▷ HOW TO FIND IT
   Generate and download an AI summary of a supplier's risk posture from their profile page.
   📍Click Summarise profile on the Supplier Profile, then copy or download the generated summary.
   Export a policy to CSV for backup or sharing with other teams.
   📍Navigate to Policy settings and select Download as CSV.
   Import a previously exported policy CSV into another Risk Ledger account.
   📍Navigate to Policy settings and select Import from CSV.
   • Adds a Summarise profile action on the Supplier Profile to generate an AI-generated summary of risk posture, compliance details, and suggested next steps.
   • Adds support for downloading supplier policies as CSV files.
   • Adds the ability to import policies from a CSV file into another account.
   • Adds a new Operational Technology (OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments.) Add-on domain to cover security practices and controls for OT and Industrial Control Systems.
   • Allows federated parent organisations to switch into their sub-entities without separate logins.

   5 details in Everything

4. June 2026: Faster reviews when you have the right context Jun 1, 2026 · release notes

   Resizables review panels with pinned context and new Supplier Pipeline status tracking in Risk Ledger June 2026 update

   └──▷ HOW TO FIND IT
   When reviewing a supplier's control response, use the resizable drawer to keep their answer and evidence visible while checking other tabs.
   📍In the assessment view, drag the edge of the review drawer to resize it, then verify your notes and evidence remain pinned at the top.
   Filter your supplier list to identify those currently in the tender phase for targeted outreach or initial security checks.
   📍Navigate to the suppliers table, apply a filter where Pipeline status is In Tender.
   Tag a newly connected supplier with their current commercial stage to inform future review types.
   📍When connecting to a new supplier, select Pre-Contract for the Pipeline status field.
   • Resizable review panel that persists per device across all drawers in Risk Ledger
   • Supplier answer, notes and evidence pinned at the top of the assessment review drawer to maintain context
   • Pipeline status field allowing you to tag suppliers as In Tender, Pre-Contract, In Contract or Other

   3 details in Everything

5. May 2026: Better network navigation for deeper insights May 1, 2026 · release notes

   New network map navigation features and expanded risk report exports

   └──▷ HOW TO FIND IT
   Export a comprehensive risk report that retains historical context and attribution for every finding.
   📍Download the Risk Report from the Risks page; check the new Notes column to see who created each note.
   • Adds click-through navigation to supplier profiles directly from the network map
   • Enables opening risks for any supplier in the supply chain via the network map
   • Includes Note content and author name in Risk Report exports

   3 details in Everything

6. April 2026: Faster reviews with greater confidence Apr 1, 2026 · release notes

   Risk Ledger April 2026 adds control/domain reviewer assignments, IAF certificate discovery, and a redesigned assessment UI

   └──▷ HOW TO FIND IT
   Assign an IT lead to technical controls and see their pending tasks in the Action Centre.
   📍In the assessment view, assign a user to specific controls and domains via the new UI panel; review tasks appear in the Action Centre.
   • Reviewers can now be assigned to specific controls and domains, with tasks surfaced in the Action Centre.
   • Certificate Discovery integrates with the International Accreditation Forum (IAF) to surface supplier ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. certification data.
   • Assessment view redesign places controls in a right-hand panel, domains in a left sidebar, and filters at the top.
   • Improved organisation search adds flexible matching, infinite scroll, and a unified discovery modal.

   4 details in Everything

7. March 2026: Your redesigned Action Centre Mar 1, 2026 · release notes

   Redesigned Action Centre consolidates supplier invites, status updates, and remediation management into a single UI view.

   └──▷ HOW TO FIND IT
   Resend a failed connection invite directly from the Action Centre without searching through email logs.
   📍In the Action Centre, locate the supplier with the Failed status and click the Resend invite button.
   Monitor supplier connection health by reviewing bounced emails directly in the Action Centre.
   📍Open the Action Centre and check the Notifications section for alerts regarding bounced invites or failed connections.
   • Action Centre now centralizes all supplier connection activity (invites, requests, status updates) with direct contact detail editing.
   • System automatically notifies users when invited emails bounce or fail, preventing lost connections.
   • Users can now resend invites or connection requests directly from the Action Centre interface without leaving the view.
   • Supplier-facing Remediation and Merge request tabs are redesigned for clarity, with improved page load speeds.

   4 details in Everything

8. January 2026: Deeper security insights, without extra work Jan 1, 2026 · release notes

   Automated supplier asset discovery for External Monitoring and January 2026 framework updates

   • Adds automatic asset discovery to External Monitoring, surfacing security signals across a supplier's full digital footprint without manual input.
   • Updates the Standardised Assessment Framework (January 2026) with refreshed controls for domains D (IT Operations), E (Software Development), F (Network & Cloud Security), and K (Artificial Intelligence).
   • Adds Data Protection controls to the Small Framework.

   3 details in Everything

9. December 2025: See more of your supply chain, sooner Dec 1, 2025 · release notes

   Risk Ledger adds direct search and multi-party path tracing on network maps with External Monitoring for unaccepted connections.

   └──▷ HOW TO FIND IT
   Filter the visual network map to isolate high-risk suppliers based on their data handling characteristics.
   📍In the network map, use the filter dropdowns to select Criticality: High and PII: Yes.
   View the external security posture of a supplier who has not yet accepted your connection request.
   📍Go to Basic Connections and select an Unclaimed Profile to view available scan findings for public domains.
   Trace upstream dependencies to identify concentration risk in your fourth-party suppliers.
   📍Click on a fourth-party node in the map and select Trace path back to visualize the connection to your organisation.
   • Adds the ability to search for specific organisations directly from the network map.
   • Enables tracing the path from any nth-party back to your organisation within the visualisation.
   • Introduces filtering options for Criticality, Confidentiality, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., custom Labels, and network depth on both own and community maps.
   • Allows viewing scan findings for publicly available domains on Unclaimed Profiles and Basic Connections before a supplier accepts a connection request.
   • Sends notifications with supplier details and instructions when connection request emails bounce.

   5 details in Everything

10. November 2025: Improvements to connection flows Nov 1, 2025 · release notes

    Risk Ledger adds contact email field for unclaimed supplier connections to boost invite acceptance

    • Adds the ability for Clients to specify a contact email when initiating a connection to an unclaimed supplier profile, enabling immediate invite delivery.
    • Upgrades the underlying email delivery system across the platform to improve deliverability of invites and reminders.

    2 details in Everything

11. October 2025: Clarity with compliance scores Oct 1, 2025 · release notes

    New control-level visibility for compliance scores, granular emerging threats permissions, and enhanced connection request workflow

    • Adds control-level visibility to each assessment control showing required policies and compliance status
    • Enhances supplier profiles with hover tooltips on compliance scores and policy application reasons
    • Updates domain compliance score colors and network visualization scores to a green-to-red scale
    • Introduces granular view emerging threats permissions for clients and suppliers in custom roles
    • Adds contact choice (with or without details) when sending manual connection requests

    5 details in Everything

12. September 2025: Introducing Light and Dark Mode Sep 1, 2025 · release notes

    Risk Ledger adds Light and Dark Mode options in Settings > Appearance.

    └──▷ HOW TO FIND IT
    Switch the platform UI to a white background for better visibility in bright environments.
    📍In the console, go to Settings › Appearance and select Light mode.
    Enable dark mode for the entire platform, including Network Visualisation.
    📍In the console, go to Settings › Appearance and select Dark mode.
    • Adds Light mode to change the entire platform to a white background, including Network Visualisation
    • Adds Dark mode to enable dark mode throughout the platform
    • Adds Sync with system option to automatically match device display settings in Settings > Appearance

    3 details in Everything

13. August 2025: Deeper supply chain visibility and streamlined collaboration Aug 1, 2025 · release notes

    Risk Ledger introduces Fourth Parties visibility, AI Policy control K1, and supplier collaboration tools

    • Adds Fourth Parties visibility to map critical dependencies beyond direct suppliers in the Network Visualisation tool.
    • Introduces Informational filter in the External Monitoring Findings table.
    • Adds a date stamp to all PDF exports for audit evidence snapshots.

    3 details in Everything

14. Framework update August 2025 Aug 1, 2025 · release notes

    Framework update adds AI Policy control (K1), updates ISO27001/PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. evidence requirements and endpoint scope for endpoints.

    └──▷ HOW TO FIND IT
    Suppliers can now define an AI policy during profile completion via the new K1 control.
    📍Complete the new K1 AI Policy question in your Risk Ledger supplier profile.
    Ensure MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. controls cover customer-facing apps as per updated D6 requirements.
    📍Review and update your MFA documentation to explicitly include customer-facing applications for control D6.
    • Adds a new control question (K1) about AI Policy to assess AI risk governance standards.
    • Updates MFA control question (D6) to include customer-facing applications.
    • Expands controls D23-27 from laptops to all endpoints including BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on..

    3 details in Everything

15. July 2025: Expanding External Monitoring (Beta) Jul 1, 2025 · release notes

    Risk Ledger beta adds port scanning, Monitoring Dashboard, and enhanced findings navigation for supplier risk assessment.

    └──▷ HOW TO FIND IT
    Monitor the latest scan summary for all suppliers via the centralised view.
    📍In the UI, go to Supplier Overview › Monitoring Dashboard
    Review specific findings across a supplier's assets directly in the new tab.
    📍In the UI, go to External Monitoring › [Supplier Name] › Findings
    • port_scanning capability in External Monitoring (Beta) to automatically check suppliers' digital assets for open ports across remote access, databases, web services, file sharing, and infrastructure
    • Monitoring Dashboard providing a centralised view on the Supplier Overview displaying a summary of latest scan results
    • New Findings tab in External Monitoring alongside existing Scans and Assets sections, allowing clients to review across an entire supplier’s assets

    3 details in Everything

16. June 2025: Faster and smoother Network Visualisation Jun 1, 2025 · release notes

    June 2025 update adds direct navigation to Network Visualization from Supplier Profiles and enhanced node clarity for supply chain mapping.

    • Adds ability to jump directly to the network visualisation from any Supplier Profile
    • Enhances usability with improved supplier identification via hover and click interactions on nodes
    • Displays compliance score visibility on nodes, using green for completed assessments and white for unclaimed or incomplete profiles

    3 details in Everything

17. May 2025: Introducing Product Level Answers May 1, 2025 · release notes

    Product-level answers allow suppliers to set organisational baselines and highlight product-specific control variations for clients.

    • Suppliers can now set organisational-level answers as a baseline for their entire portfolio
    • Suppliers can highlight differences where security controls vary by product without duplicating information

    2 details in Everything

18. October 2024: Framework Sizes, Add-ons, and Content Update Oct 1, 2024 · release notes

    Risk Ledger adds a standard framework size with 44 controls for smaller suppliers alongside the existing full 192-control option.

    • Adds a standard framework size with 44 control questions across security domains, providing a lighter assessment for less critical suppliers.
    • Allows adjusting the scope of assessment questions based on supplier risk profiles or organizational risk appetite.

    2 details in Everything

19. February 2024: Insights Reporting, User Permissions & Smarter Email Notifications Feb 1, 2024 · release notes

    Risk Ledger February 2024 introduces Insights Reporting with customisable supplier filters and saved queries

    • Adds Insights Reporting to identify suppliers meeting specific compliance or certification criteria
    • Enables creation of Customisable Reports based on user-defined questions for team-wide access
    • Allows users to Save Reports by bookmarking and naming key queries for regular use

    3 details in Everything