Scrut Automation

No entries match these filters. Clear filters

1. docs update Oct 9, 2026 · issue 098

   Scrut launches an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://mcp.us.scrut.io/mcp with OAuth, enabling AI-client integrations via Claude and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Connect the Scrut MCP server to Claude CLI so AI workflows can query Scrut data over HTTP with OAuth.
   copy

   $ claude mcp add --transport http scrut https://mcp.us.scrut.io/mcp --client-id <your-client-id> --callback-port <port>

   Register and authenticate the Scrut MCP server using the generic MCP CLI, then verify the connection is live.
   copy

   $ mcp add scrut --url https://mcp.us.scrut.io/mcp --oauth-client-id <your-client-id>
   mcp login scrut
   mcp get scrut

   • Adds a Scrut MCP server endpoint at https://mcp.us.scrut.io/mcp supporting HTTP transport and OAuth, connectable via mcp add scrut --url https://mcp.us.scrut.io/mcp --oauth-client-id <id>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Claude CLI integration with claude mcp add --transport http scrut https://mcp.us.scrut.io/mcp --client-id <id> --callback-port <port> and config keys experimental_use_rmcp_client=true and mcp_oauth_callback_port=<port>.
   • Provides mcp login scrut to authenticate and mcp get scrut to verify the MCP connection after setup.

   3 details in Everything

2. docs update Oct 9, 2026 · issue 098
   • New compliance framework Framework overview documentation page listing 70+ supported compliance frameworks
3. docs update Oct 6, 2026 · issue 096
   • New integration CrowdStrike XDR integration
4. docs update Oct 5, 2026 · issue 095

   Scrut Automation adds a structured three-step employee offboarding workflow with bulk completion and HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records./IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sync support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Bulk-close offboarding for a departing cohort of employees at quarter-end without manually completing each profile.
   📍In Scrut, go to People → Employees → All Employees. Select the checkboxes next to each employee in Offboarding Needed status. Click Edit at the top of the table, then choose Mark as Offboarded from the dropdown. Review the confirmation dialog (it shows how many selected employees still have pending tasks), then click Confirm.
   Manually terminate an employee who is not synced from an HRIS/IDP and begin their offboarding workflow.
   📍In Scrut, go to People → Employees, open the employee's profile, click the three-dot menu, select Terminate Employee, set the Exit Date to the employee's official last day, and click Save. The employee's status will automatically change to Offboarding Needed.
   • Adds a three-step employee offboarding workflow in People → Employees covering termination, document upload, and completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports bulk offboarding via People → Employees → All Employees — select multiple employees, click Edit, and choose Mark as Offboarded to finalize several records at once.
   • Integrates with HRIS/IDP systems so that employees terminated in an external HRIS/IDP automatically surface with Offboarding Needed status in Scrut without manual intervention.
   • Enables manual termination of non-synced employees by setting an Exit Date via the three-dot menu on the employee profile and clicking Terminate Employee.
   • Archives offboarded employee records — status changes to Offboarded, the ex-employee label is applied, and records remain accessible for compliance and reporting.

   +1 more show less

   • Provides Reset Employee Offboarding to reverse a completed offboarding action when needed.

   6 details in Everything

5. docs update Oct 5, 2026 · issue 095

   Scrut adds CSV/XLSX bulk import for vendor questionnaire templates, including conditional follow-up question hierarchies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Import an existing vendor questionnaire spreadsheet into Scrut to avoid rebuilding a large template from scratch.
   📍1. Sign in to Scrut and go to Risk → Vendors using the left navigation panel. 2. Click the Settings icon (top right). 3. In the Templates tab, click Add Template → Import (CSV/XLSX). 4. Enter a name for the template. 5. Download the Scrut import file, paste your questionnaire into it, then drag-and-drop the completed CSV/XLSX into the upload area. 6. Click Upload. Fix any flagged formatting errors and re-upload if needed. 7. Find your template under Vendor Settings → Templates.
   Structure conditional follow-up questions in the import file so that a follow-up only appears when a specific parent answer is selected.
   📍Question number | Condition for follow-up question | Question Type | ... Q1 | (blank) | Objective (Single Select) | Do you have a security policy? Q1.1 | Yes | Subjective | Please describe your security policy. Q1.1.1 | (blank for sub-follow-up trigger) | Subjective | When was it last reviewed? Q2 | (blank) | Subjective | List your data retention practices.
   • Adds Import (CSV/XLSX) option under Risk → Vendors → Settings → Templates → Add Template to bulk-import vendor questionnaire templates from a spreadsheet instead of building from scratch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports conditional follow-up questions in the import file via Question number (e.g., Q1, Q1.1, Q1.1.1) and Condition for follow-up question columns, with up to two levels of nesting.
   • Defaults the Question Type column to Subjective when left blank; supports Objective (Single Select) and Objective (Multi Select) types with answer options and risk scores in the import file.
   • Imported templates are available immediately under Vendor Settings → Templates after upload, with inline error reporting for formatting issues.

   4 details in Everything

6. docs update Oct 4, 2026 · issue 094

   Scrut adds an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at mcp.us.scrut.io with OAuth support for Claude and Codex clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Register Scrut as an MCP server in Claude Desktop over HTTP with OAuth so Claude can query Scrut controls and evidence directly.
   copy

   $ claude mcp add --transport http scrut https://mcp.us.scrut.io/mcp --client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U --callback-port <port>

   Enable the experimental remote MCP client and set the OAuth callback port in Claude Desktop config to use Scrut MCP.
   ini copy

   experimental_use_rmcp_client=true
   mcp_oauth_callback_port=<port>

   Register and authenticate Scrut as an MCP server in Codex, then verify the connection is live.
   copy

   $ mcp add scrut --url https://mcp.us.scrut.io/mcp --oauth-client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U
   mcp login scrut
   mcp get scrut

   • Connects Claude Desktop to Scrut via claude mcp add --transport http scrut https://mcp.us.scrut.io/mcp with OAuth using client ID vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports experimental_use_rmcp_client=true and mcp_oauth_callback_port config keys for the Claude Desktop MCP integration.
   • Supports Codex MCP integration via mcp add scrut --url https://mcp.us.scrut.io/mcp --oauth-client-id with mcp login scrut for authentication.
   • Exposes a new MCP endpoint at https://mcp.us.scrut.io/mcp for programmatic access to Scrut from AI coding agents.

   4 details in Everything

7. docs update Oct 4, 2026 · issue 094

   Scrut Automation adds AI-powered Questionnaire Autofill with Answer Library, configurable autofill sources, and a Chrome Extension for portal questionnaires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Configure which document sources Scrut Teammates reads before running autofill on a new security questionnaire.
   📍In the Scrut platform, go to Trust → Questionnaire, click Autofill Sources, then click Change Permission next to Policies, Trust Vault, or Vault. For each source, enable the AI Readability toggle to grant Teammates access. Confirm only published policies and AI-readable Vault documents are included before clicking Autofill with Scrut AI.
   Bulk-import previously answered questionnaire Q&A pairs into the Answer Library to seed boilerplate responses.
   📍In the Scrut platform, go to Trust → Questionnaire → Answer Library, click Import Answers, download the import template, fill in your questions and answers (do not remove the header row; every question must have an answer), then drag and drop the completed file into the File field and click Upload. Review each pair and click Add, Edit, or Discard, then click Import Answers to save accepted pairs.
   Use the Chrome Extension to autofill a vendor portal questionnaire in-browser without downloading or reformatting any files.
   📍Install the Scrut Automation extension from the Chrome Web Store, then open the vendor portal questionnaire in Chrome. Click the Scrut Automation extension icon, click Scan Page for Questions to extract all questions, then click Autofill with Scrut AI and select All Questions or Unanswered. Click Export to push all generated responses directly into the portal fields at once.
   • Adds Autofill Sources configuration under Trust → Questionnaire → Autofill Sources to control which sources — Policies, Trust Vault, and Vault — Scrut Teammates draws on when generating questionnaire responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports AI-readability toggling per source: enable the AI Readability toggle on the All Policies page for published policies, or per-section for Trust Vault, or per-document for Vault; accepted file formats include .txt, .png, .md, .yaml, .yml, .doc, .docx, .pdf, .html, .csv, and .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with..
   • Adds Trust → Questionnaire → Answer Library for managing a curated set of verbatim Q&A pairs; supports bulk import via a downloadable template, manual Add Answer entry with AI-draft via Autofill with Scrut AI, and duplicate detection.
   • Adds Add Questionnaire → Create in Scrut under Trust → Questionnaire to upload XLSX-format security questionnaires, with field mapping, question selection, and autofill generation via Autofill with Scrut AI.
   • Adds a Scrut Automation Chrome Extension that scans vendor portal pages for questions via Scan Page for Questions, generates AI responses in-browser, supports direct export to portal fields via Export, and optionally saves questionnaires back to Trust → Questionnaire with Chrome Extension listed as the source.

   5 details in Everything

8. docs update Oct 4, 2026 · issue 094

   Scrut adds AI-assisted and upload-based System Description creation for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. audit packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Generate a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description draft with AI when starting a new audit and no existing document is on hand.
   📍1. Sign in to Scrut and go to Frameworks → SOC2 Framework → System Description. 2. Select Generate with AI. 3. In the Setup section, fill in audit context, organization type, trust services criteria, and company details. 4. Click Generate with AI and wait a few minutes for Scrut Teammates to produce the draft. 5. Review and edit each auto-populated section, then click Publish to include it in the audit package.
   Publish a pre-existing System Description document into a SOC 2 audit package without regenerating it from scratch.
   📍1. Sign in to Scrut and go to Frameworks → SOC2 Framework → System Description. 2. Select Upload Existing. 3. Upload your file and select the corresponding audit. 4. Choose an assignee. 5. Click Publish to include the document in the audit package.
   • Adds a Generate with AI workflow under Frameworks → SOC2 Framework → System Description that uses Scrut Teammates to draft a SOC 2 System Description from existing organization data, with fully editable sections and auto-saved progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an Upload Existing workflow that lets users upload a pre-existing System Description document, assign it to an audit, and publish it directly into the audit package.

   2 details in Everything

9. docs update Sep 24, 2026 · issue 084

   Scrut Automation adds a Compliance Overview tab to the Control Details page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Review compliance status for a specific control without leaving the Control Details page.
   📍In the Scrut console, navigate to a control's Detail page and select the Compliance Overview tab to see aggregated compliance status.
10. docs update Sep 15, 2026 · issue 075

    Scrut adds a platform-wide search bar with Cmd+K/Ctrl+K shortcut to find documents and navigate modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Quickly locate a specific compliance document or jump to a module without leaving your current screen.
    📍1. From anywhere in Scrut, press Cmd+K (Mac) or Ctrl+K (Windows/Linux) to open the search bar. 2. Type your search terms (e.g., a policy name or module keyword). 3. Click a result to navigate directly to the document or module. 4. Press Enter to send the query to Scrut Teammates for an AI-assisted answer.
    • Search results are permission-filtered, ensuring users only see documents and modules they are authorized to access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

11. docs update Sep 15, 2026 · issue 075

    Scrut Automation adds a Continuous Compliance tab in Task Center for year-round compliance tracking across all modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Surface all overdue or unassigned tasks for a specific team member during a weekly compliance check-in.
    📍In the Scrut console, go to Task Center › Continuous Compliance tab, enable the Show Only Pending toggle, then use the Assignee / Approver filter to select the relevant team member to see all open tasks awaiting their action.
    • Adds a Continuous Compliance tab under Task Center in the left navigation panel, providing a single view to track open tasks across compliance modules including Policy Tasks, Evidence Tasks, Failing Tests, Risk Management, Corrective Actions, Audit Center, Vulnerabilities, Vendor Management, and Answer Questionnaires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Show Only Pending toggle to filter the Continuous Compliance tab to open tasks only across all modules.
    • Adds an Assignee / Approver filter to surface tasks assigned to or awaiting approval from a specific team member across all compliance modules.
    • Adds a search bar to find tasks by name across all compliance modules simultaneously.

    4 details in Everything

12. docs update Sep 15, 2026 · issue 075

    Scrut adds an Audit Prep tab in Task Center to centralize and track compliance readiness tasks across frameworks (closed beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Quickly surface all unclaimed audit prep tasks across every module so you can assign owners before an audit begins.
    📍In the Scrut console, go to Task Center › Audit Prep. Select your target framework (e.g. SOC 2) from the framework selector, then open the Assignee / Approver dropdown and choose Unassigned to list every task with no owner. Assign each to the appropriate team member.
    Focus a daily stand-up on what is still blocking audit readiness by hiding already-completed work.
    📍In the Scrut console, go to Task Center › Audit Prep. Enable the Show Pending Items toggle to filter out completed tasks, then review the Progress Bar and per-module donut charts to identify the modules with the most remaining work.
    • Adds the Audit Prep tab inside Task Center providing a centralized view of audit preparation tasks across policy, evidence, test, and audit-request modules, with per-module progress indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a framework/entity selector at the top of the Audit Prep tab so teams working toward multiple frameworks (SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., etc.) or multiple entities can track separate progress, audit schedules, assessment reports, and timelines for each combination.
    • Adds a Progress Bar showing control-completion-based audit readiness percentage, with milestone-gated actions: scheduling an Internal Audit becomes available at 90% and an External Audit becomes available at 100% (after the internal audit is complete).
    • Adds an Assignee / Approver filter dropdown to surface tasks by responsible person, including an Unassigned option to identify and assign unclaimed tasks.
    • Adds a timeline view within Audit Prep tracking key milestones: Start Date, Internal Audit Date, External Audit Date, and Assessment Report generation.

    5 details in Everything

13. docs update Sep 15, 2026 · issue 075

    Scrut adds a Notification Center with priority-ordered, role-scoped alerts and direct module CTAs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Check for critical billing or downtime alerts without scrolling through all notifications.
    📍1. Click the bell icon in the top-right corner next to your profile name. 2. Enable the Show Only Unread toggle to filter to new items. 3. Critical notifications (billing, downtime) appear at the top — click the CTA to go directly to the relevant module. 4. Click the circle to the right of a notification to mark it as read once actioned.
    • Adds a Notification Center accessible via the bell icon in the top-right corner, surfacing billing updates, platform maintenance, integration updates, and product announcements in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Each notification includes a CTA that navigates directly to the relevant module in Scrut.
    • Provides a Show Only Unread toggle to filter the notification list to new items only.
    • Notifications are scoped to the logged-in user's account and role, so each user sees only relevant alerts.

    4 details in Everything

14. docs update Sep 15, 2026 · issue 075

    Scrut adds NEN 7510NEN 7510A Dutch national standard for information security in healthcare, maintained by NEN, specifying controls organizations must implement to protect patient data — tools use it as a compliance framework for Dutch health-sector deployments., AI gap analysis on policies and evidence, Aikido Security integration, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. exports, and GitHub issue creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Speed up Trust Portal deal cycles by whitelisting known customer domains so their access requests are approved automatically without manual review.
    📍In Scrut, go to Trust Portal › Settings › Configure auto-approval for requests from trusted domains, add the customer domain to the whitelist, and save.
    Scope a security questionnaire to only pull from Vault documents tagged infosec so answers cite the right policies rather than unrelated trust documents.
    📍In Scrut, open or create a questionnaire, go to Managing Tags in the Vault, assign the relevant tag (e.g. infosec) to the appropriate documents, then in questionnaire setup select that tag as the source filter.
    • Adds JSON Lines (JSONL) export format for Automated Tests, including metadata and authenticity signals so auditors can verify pass/fail outcomes from integration and internal sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds native Aikido Security integration so Aikido findings flow directly into Scrut's vulnerability management workflow.
    • Adds NEN 7510 framework to the Frameworks module, fully translated and mapped including healthcare-specific controls for patient data access, logging, and confidentiality.
    • Adds AI-powered policy gap analysis chart to the Policy dashboard via Scrut Teammates, flagging gaps in uploaded policies and review status.
    • Adds an Evidence Gaps chart to the Evidence dashboard showing how many evidence items have gaps detected, no gaps, or have not yet been evaluated, with bulk-publish when no gaps are found.

    +12 more show less

    • Adds AI-assisted cloud misconfiguration fixes in Terraform, AWS CLI, or CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. formats, each with a confidence score, plus one-click Jira ticket creation from the finding.
    • Adds a dedicated resources view for third-party scan findings so teams can prioritize remediation by affected asset concentration.
    • Adds auto-approval for Trust Portal access requests from whitelisted domains, granting full document access without manual review.
    • Adds tag-based source scoping for questionnaire answers in Vault, letting teams select one or more tags so only documents carrying those tags are used as sources.
    • Adds GitHub issue creation from evidence, tests, policies, audits, and vulnerabilities directly within Scrut.
    • Adds API endpoint transparency to Scrut Monitor reports, showing the exact endpoints used to fetch data alongside documentation links for auditor verification.
    • Adds six new HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records., BGV, and related integrations supporting access review workflows: Darwinbox, AlexisHR, Breathe HR, HR Works, Sage HR, and Zinc Work.
    • Adds sync error visibility for Microsoft Intune, Jamf Pro, JumpCloud, Fleet MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., NinjaOne, SharePoint, and Jira integrations, with audit logs of source error codes and failed API calls.
    • Adds last-checked and next-scan timestamps to Automated Tests so outdated or failing tests surface earlier.
    • Adds linked risks display on Control details pages so teams can trace control execution to related risk workflows without switching modules.
    • Expands ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 22301:2019 BCMS coverage from 56 to 73 distinct requirements with refined control mappings, new Business Continuity and Disaster Recovery policy templates, and tighter evidence suggestions.
    • Improves third-party scan findings with standardized severity labels and fuller visibility into affected resources within the vulnerability workflow.
    • Adds JSON Lines (JSONL) export format for Automated Tests, including metadata and authenticity signals so auditors can verify pass/fail outcomes from integration and internal sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds native Aikido Security integration so Aikido findings flow directly into Scrut's vulnerability management workflow.
    • Adds NEN 7510 framework to the Frameworks module, fully translated and mapped including healthcare-specific controls for patient data access, logging, and confidentiality.
    • Adds AI-powered policy gap analysis chart to the Policy dashboard via Scrut Teammates, flagging gaps in uploaded policies and review status.
    • Adds an Evidence Gaps chart to the Evidence dashboard showing how many evidence items have gaps detected, no gaps, or have not yet been evaluated, with bulk-publish when no gaps are found.

    +7 more show less

    • Adds AI-assisted cloud misconfiguration fixes in Terraform, AWS CLI, or CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. formats, each with a confidence score, plus one-click Jira ticket creation from the finding.
    • Adds a dedicated resources view for third-party scan findings so teams can prioritize remediation by affected asset concentration.
    • Adds auto-approval for Trust Portal access requests from whitelisted domains, granting full document access without manual review.
    • Adds tag-based source scoping for questionnaire answers in Vault, letting teams select one or more tags so only documents carrying those tags are used as sources.
    • Adds GitHub issue creation from evidence, tests, policies, audits, and vulnerabilities directly within Scrut.
    • Adds API endpoint transparency to Scrut Monitor reports, showing the exact endpoints used to fetch data alongside documentation links for auditor verification.
    • Adds six new HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records., BGV, and related integrations supporting access review workflows: Darwinbox, AlexisHR, Breathe HR, HR Works, Sage HR, and Zinc Work.

    5 more in Everything

15. docs update Sep 15, 2026 · issue 075

    Scrut Automation adds ISO/IEC 27701:2025ISO/IEC 27701:2025An international standard extending ISO/IEC 27001 to cover privacy information management, giving organizations a certifiable framework for demonstrating GDPR and broader privacy-law compliance. as a stand-alone privacy management framework for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. controllers and processors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

16. docs update Sep 15, 2026 · issue 075

    Scrut Automation adds FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. and ISO/IEC 27018:2025ISO/IEC 27018:2025An ISO/IEC standard specifying privacy controls for public cloud providers that process personal data, giving cyber tools a recognized compliance baseline for handling PII in cloud environments. to the Frameworks module with pre-configured templates and automated evidence mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

17. docs update Sep 15, 2026 · issue 075

    Scrut Automation adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration and a new Critical risk tier above High.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Scrut MCP to connect live compliance data to MCP-compatible apps including Claude Code, Cursor, and ChatGPT Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

18. docs update Sep 15, 2026 · issue 075

    Scrut adds SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. system description generation, CRA and Indonesia PDPL frameworks, per-framework gap visibility, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. workspace switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Verify your Scrut MCP connection to Claude or Cursor is working with the correct regional config after setting it up from the Task Center.
    📍Navigate to Task Center › select your tool (Claude, Cursor, or Codex) › copy the region-correct MCP configuration › paste it into your tool › run the provided sample prompt to confirm the connection.
    Review an ambiguous security questionnaire question to pick the interpretation that best matches what the customer is actually asking.
    📍Open a questionnaire in Scrut Teammates › locate a flagged ambiguous question › review the match score on the consolidated answer › click View Interpretations to open the side panel › select the interpretation and answer that fits your situation.
    • Adds EU Cyber Resilience Act (CRA) as a framework in Scrut, with requirements pre-mapped to Scrut's control library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Indonesia PDPL as a framework in Scrut, with requirements pre-mapped to the control library.
    • Adds AI-generated SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description built from existing framework, control, and organization data in the workspace, with a step-by-step template and direct download for the report package.
    • Adds per-framework compliance status on each control so practitioners can see exactly which frameworks a control satisfies and which still have gaps.
    • Scrut Teammates now flags ambiguous security questionnaire questions, drafts a consolidated answer covering all plausible interpretations, and shows a match score; a View Interpretations side panel lets you choose the best-fit answer.

    +5 more show less

    • Adds workspace switching within a single MCP session so auditors can pull evidence across multiple clients without reconnecting.
    • Adds MCP connection setup directly from the Task Center, providing region-correct configuration and a sample prompt to verify the setup for Claude, Cursor, and Codex.
    • Adds one-click export generation and attachment on linked automated tests, eliminating the manual download-and-upload step for evidence tasks.
    • Bulk vendor questionnaire import now supports two-level conditional follow-up questions.
    • Adds bulk offboarding-completed action for multiple employees, with a confirmation dialog that flags ineligible employees and pending offboarding tasks.
    • Adds EU Cyber Resilience Act (CRA) as a framework in Scrut, with requirements pre-mapped to Scrut's control library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Indonesia PDPL as a framework in Scrut, with requirements pre-mapped to the control library.
    • Adds AI-generated SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description built from existing framework, control, and organization data in the workspace, with a step-by-step template and direct download for the report package.
    • Adds per-framework compliance status on each control so practitioners can see exactly which frameworks a control satisfies and which still have gaps.
    • Adds workspace switching within a single MCP session so auditors can pull evidence across multiple clients without reconnecting.

    +2 more show less

    • Adds MCP connection setup directly from the Task Center, providing region-correct configuration and a sample prompt to verify the setup for Claude, Cursor, and Codex.
    • Adds bulk offboarding-completed action for multiple employees, with a confirmation dialog that flags ineligible employees and pending offboarding tasks.

    3 more in Everything

19. docs update Sep 8, 2026 · issue 068

    Scrut adds native ClickUp integration, letting teams push compliance tasks directly to ClickUp from Policies, Evidence, Risk, and Audit modules.

    └──▷ HOW TO FIND IT
    Connect ClickUp to Scrut so compliance tasks can be pushed directly to a ClickUp workspace.
    📍In Scrut, go to Integrations › Integrations Library › Categories › Project Management Platforms › ClickUp › Integrate. Paste the Client ID and Secret from ClickUp API Settings, click Submit, select your workspace, then click Connect Workspace.
    Push a compliance finding directly to ClickUp as a tracked task without leaving Scrut.
    📍Navigate to Audit Center › Findings, open the relevant finding, click the three-dots icon at the top-right, select Create ClickUp Task, fill in Workspace, Space, Folder, List, Task Name, and Description, then click Create.
    • Adds ClickUp as a supported Project Management Platform integration, accessible via Integrations Library > Project Management Platforms > ClickUp tile in Scrut.
    • Supports region-specific OAuth redirect URLs for India (https://app.scrut.io/settings/integration/clickup), US (https://app.us.scrut.io/settings/integration/clickup), EU (https://app.eu.scrut.io/settings/integration/clickup), and Australia (https://app.au.scrut.io/settings/integration/clickup).
    • Enables Create ClickUp Task from any of the following Scrut modules: Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center (Requests, Findings, and Corrective Actions).
    • Tasks are pushed from Scrut to ClickUp in real time on creation, with Scrut auto-filling task name and description from the compliance item; fields include Workspace, Space, Folder, List, Task Name, and Description.
    • Adds an Audit Log tab on the ClickUp integration page in Scrut for monitoring task creation errors.

    5 details in Everything

20. docs update Sep 8, 2026 · issue 068

    Scrut Automation adds Shortcut Story creation directly from Policies, Evidence Tasks, Tests, Cloud, Risk, and Audit Center artifacts.

    └──▷ HOW TO FIND IT
    Push a failing cloud test directly into Shortcut as a tracked story without leaving Scrut.
    📍1. Log in to app.scrut.io. 2. In the left navigation panel, expand the compliance menu. 3. Go to Cloud › Tests and open the test you want to track. 4. Click the three vertical dots button in the top-right corner. 5. Click Create Shortcut Story. 6. Fill in the story fields configured during the Shortcut integration, then click Create.
21. docs update Sep 8, 2026 · issue 068

    Scrut Automation adds Linear issue creation directly from Policies, Tests, Risks, Audit findings, and more

    └──▷ HOW TO FIND IT
    Turn a failing compliance test into a tracked Linear issue without leaving Scrut, so engineering teams can act on audit findings in their existing workflow.
    📍1. Navigate to the relevant artifact (e.g., Tests, Findings, or Risk Management). 2. Click the three-dots icon at the top-right of the page. 3. Select Create Linear Issue. 4. Review the auto-filled task name and description (sourced from the compliance item); edit as needed. 5. Select Team, Priority, Status, Assignee, and Labels. 6. Click Create — the issue appears in Linear immediately.
22. docs update Sep 8, 2026 · issue 068

    Scrut Automation: Adds a Create Asana Task action (via the three-dots menu) on Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center artifacts (Requests, Findings, Corrective Actions) to create Asana tasks directly from Scrut.

    └──▷ HOW TO FIND IT
    Escalate a failing Test to your engineering team by creating a tracked Asana task without leaving Scrut.
    📍1. In Scrut, navigate to the failing Test. 2. Click the three-dots icon (top-right) and select Create Asana Task. 3. Fill in Workspace, Project, Task Name, Assignee, and optional Due Date/Tags. 4. Click Create and confirm the Asana Task Created Successfully notification. 5. View the created task under the Tickets (Asana) tab on the Test artifact.
    Tie an already-open Asana remediation ticket to a Scrut Risk so status changes sync back automatically.
    📍1. In Scrut, open the Risk artifact you want to connect. 2. Scroll to the Tickets (Asana) tab. 3. Click Create and select Link Existing Tickets. 4. Paste the URL of the existing Asana task and click Link.
    • Adds a Tickets (Asana) tab on each artifact, showing Asana ID, Title, Assignee, Status, Created On, and Action for all linked tasks.
    • Supports linking existing Asana tickets to Scrut artifacts via Link Existing Tickets using a pasted Asana task URL.
    • Bidirectional real-time sync keeps Asana task changes (including completion status) reflected automatically in Scrut.
    • Automatically adds a default Scrut tag to tasks created from Scrut, aiding identification in the Asana dashboard.
    • Logs Asana task creation details in the Comments and Audit Logs sections of each Scrut artifact.

    5 details in Everything

23. docs update Sep 8, 2026 · issue 068

    Scrut Automation adds Azure DevOps integration for creating and managing compliance work items directly from the platform.

    └──▷ HOW TO FIND IT
    Create an Azure DevOps work item directly from a Scrut compliance finding to track remediation in your team's backlog.
    📍In Scrut, navigate to Audit Center › Findings, open the relevant finding, click the three-dots icon at the top-right of the page, and select Create Azure DevOps work item. Fill in Team, Priority, Status, Assignee, and Labels, then click Create.
    • Adds Azure DevOps integration under the Project Management Platforms section of the Integrations Library, enabling creation of work items from Scrut compliance artifacts (Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center Requests, Findings, and Corrective Actions).
    • Supports OAuth-based authorization with Azure DevOps using scopes vso.graph, vso.project, and vso.work_write to read users/groups, read projects/teams, and create or update work items.
    • Provides a Configure Additional Fields option on the Azure DevOps integration page to select extra fields included when creating work items from Scrut.
    • Exposes integration activity via an Audit Log tab on the Azure DevOps integration settings page in Scrut.

    4 details in Everything

24. docs update Sep 8, 2026 · issue 068

    Scrut MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connects compliance data to Claude, ChatGPT, Cursor, Claude Code, and Codex via the MCP standard

    └──▷ HOW TO FIND IT
    Connect Scrut MCP to Claude for individual users so you can query compliance data — such as unmapped SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. controls — directly in a Claude conversation.
    📍In Claude, go to Customize → Connectors → Add. Set Name to Scrut MCP, paste your region's MCP Server URL (e.g. the India URL for India-hosted tenants), set Authentication to Always Required, and enter OAuth Client ID: vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U. Leave OAuth Client Secret blank, then save and authenticate.
    Connect Scrut MCP to ChatGPT so your team can ask compliance questions — such as 'How many frameworks do I have in Scrut?' — and get answers sourced from live Scrut data.
    📍In ChatGPT, go to Settings → Plugins and enable Developer Mode. Click Plugins in the left nav, then '+' to add a new plugin. Set Connection to Server URL and paste your region's MCP URL. Set Authentication to OAuth, expand Advanced OAuth settings, select User-Defined OAuth Client, and enter Client ID: vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U. Leave Client Secret blank, accept the custom MCP notice, click Create, then Sign in with Scrut MCP.
    Connect Scrut MCP to Cursor IDE to surface compliance data from within your development environment.
    📍In Cursor, go to Cursor Settings → Integrations & MCP → Add New MCP Server. Set the Name to Scrut MCP, paste your region's MCP Server URL, and enter Client ID: vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U. Save, return to Cursor Settings → Integrations & MCP, click Connect, and complete OAuth authentication.
    • Adds Scrut MCP server integration for Claude (Desktop and Claude.ai Web), using OAuth Client ID vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U and region-specific MCP server URLs (India, US, EU, Australia) configured under Customize → Connectors → Add.
    • Adds Scrut MCP server integration for ChatGPT via Developer Mode (Settings → Plugins), using OAuth with User-Defined OAuth Client registration and the same Client ID vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U.
    • Adds Scrut MCP server integration for Cursor IDE, configured under Cursor Settings → Integrations & MCP → Add New MCP Server with region-specific MCP server URLs and OAuth.
    • Adds Scrut MCP integration for Claude Code CLI, enabling compliance data access directly from terminal sessions via a CLI command with a region-specific MCP server URL.
    • Adds Scrut MCP integration for Codex CLI, enabling compliance data access from Codex sessions via a region-specific MCP server URL.

    +2 more show less

    • Supports any MCP-compatible AI tool beyond the five documented ones; additional tools can be allowlisted by contacting support@scrut.io with the tool name to add its OAuth callback URL.
    • Scrut MCP respects existing Scrut role-based access (Admin, Contributor, Auditor) — the AI tool inherits only what the authenticated user can already view or act on in Scrut.

    7 details in Everything

25. docs update Sep 8, 2026 · issue 068

    Scrut adds Zinc Work and HiBob integrations, plus a Risk Management quick-start guide.

    • Adds integration with Zinc Work, enabling practitioners to connect their Zinc Work account to Scrut.
    • Adds integration with HiBob to securely sync employee data, configure read-only permissions, automate People directory updates, and support onboarding and offboarding workflows.
    • Adds a Quick Start Guide for Risk Management to help practitioners manage risks in Scrut.

    3 details in Everything

26. docs update Aug 31, 2026 · issue 060

    Scrut Automation adds a HiBob integration to sync employee directory data into the People module for compliance workflows.

    └──▷ HOW TO FIND IT
    Set up the HiBob integration in Scrut to start syncing employee directory data into the People module.
    📍1. In HiBob, go to Service Users and create a new service user with read-only access to: Employee basic info, Work, Employment, and Lifecycle categories only. Do NOT grant access to Identification, Financial, Payroll, Personal/home, or Address. 2. Copy the service user ID and token. 3. In Scrut, click Integrations in the left nav › Integrations Library tab › Human Resource Information Systems category › HiBob tile › Integrate. 4. Click Connect (top right), enter the HiBob Service User ID and Token, optionally select the HiBob environment, then click Submit. 5. After setup, go to People › Employees › All Employees to review synced records.
    • New HiBob integration syncs employee and group data from HiBob into Scrut's People module, supporting onboarding, offboarding, and personnel compliance workflows.
    • Syncs fields including employee name, work email, employment start/end dates, employment status, department, manager email, and approved leave dates from HiBob into Scrut.
    • Calls HiBob's People Search API during sync; HiBob returns only fields the service user is permissioned to access, enabling data minimization by restricting service user permissions in HiBob.
    • Data syncs automatically every 24 hours, on initial connection, and on demand via the Sync Now button on the HiBob integration page.
    • Audit Log on the HiBob integration page shows sync status for troubleshooting failed or incomplete syncs.

    +1 more show less

    • Scrut never stores sensitive HiBob categories — financial, payroll, government identification, private contact, or family data — even if HiBob returns them during sync.

    6 details in Everything

27. docs update Aug 31, 2026 · issue 060

    Scrut adds Shadow AI governance, HiBob integration, AI-assisted SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. descriptions, and vendor questionnaire import via CSV/XLSX

    └──▷ HOW TO FIND IT
    When bulk-importing an existing vendor questionnaire to avoid manual re-entry, prepare a CSV or XLSX file with question text, answer options, risk scores, and conditional follow-up questions, then import it into Scrut.
    📍In Scrut, go to Vendor Questionnaires › Import Template, upload your CSV or XLSX file formatted with question, answer options, risk scores, and conditional logic columns, then resolve any flagged import errors.
    • New HiBob integration syncs employee data with read-only permissions, automates People directory updates, and supports onboarding and offboarding workflows.
    • New AI-assisted SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description creation lets users generate, review, edit, and publish a System Description directly into the SOC 2 audit package, or upload an existing document.
    • New vendor questionnaire import supports CSV and XLSX files with question formatting, answer options, risk scores, and conditional follow-up questions.
    • New evidence review cycle management supports setting recurrence and review dates on individual or bulk evidence tasks, with manual date overrides and status tracking.
    • New employee offboarding workflow covers status updates, offboarding document uploads, bulk completion, record archiving, and compliance tracking.

    5 details in Everything

28. docs update Aug 30, 2026 · issue 059

    Scrut adds DPDPA 2023 framework, Google Drive policy import, Freshservice evidence monitoring, and audit cloning

    └──▷ HOW TO FIND IT
    Clone a completed annual audit to kick off next year's cycle without rebuilding scope from scratch.
    📍In Scrut, go to Audit Center, open the completed audit, select Clone Audit, then update the name, start date, end date, and any cycle-specific details before saving.
    Import a Google Drive policy document into Scrut to start control mapping without a local download.
    📍In Scrut, go to Policies, select Import Policy, choose Google Drive as the source, browse to the target .docx or .pdf file, and confirm to open it in the Scrut policy editor.
    • Scrut Monitor now supports Freshservice: fetch, filter by tag, and export tickets as CSV evidence with fields including subject, category, requester ID, responder ID, priority, status, and timestamps.
    • Import .doc, .docx, and .pdf policy files directly from Google Drive into the Scrut policy editor or as attachments; spreadsheets, decks, and images can be added as non-editable policy attachments.
    • Adds DPDPA 2023 (with DPDP Rules 2025) as an integrated framework in the Compliance → Frameworks module, with cross-framework mapping auto-populating up to 65% of requirements from existing ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2022 and EU GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. evidence.
    • Audits can now be cloned from the Audit Center, carrying forward framework, team, audit type, entities, and controls so recurring cycles only require updating name, dates, and cycle-specific details.
    • Exported policy PDFs now support configurable headers and footers.

    +9 more show less

    • Custom fields are now available for vulnerability findings and resources to support local triage metadata.
    • Automated tests can be linked or unlinked to evidence tasks when mappings need correction.
    • The aggregated audit log in the Audit Center captures activity across findings, requests, and corrective actions, while module-specific logs record module-level activity.
    • Access reviews support bulk assignment of non-personnel or external contractors.
    • Short-lived cloud resources are automatically ignored in the asset registry to reduce ephemeral clutter.
    • Trust Portal public sections can be reordered and sorted per section so the most relevant proof appears first.
    • Vendor assessment progress is now presented as a guided timeline from discovery to completion, with Scrut Teammates surfacing the next required step.
    • Answer Library matching algorithm updated so Scrut Teammates surfaces saved answers more consistently during security questionnaire autofill.
    • Setup Wizard work items now appear alongside the Task Center so onboarding and ongoing work share one surface.

    14 details in Everything

29. docs update Aug 30, 2026 · issue 059

    Scrut adds ISO/IEC 27701:2025ISO/IEC 27701:2025An international standard extending ISO/IEC 27001 to cover privacy information management, giving organizations a certifiable framework for demonstrating GDPR and broader privacy-law compliance. support, AI policy/evidence gap detection, Trust Portal subscriptions, multi-zone Cloudflare, and a unified My Tasks view.

    └──▷ HOW TO FIND IT
    Enable Trust Portal subscriptions so customers and prospects receive email notifications when you publish updates.
    📍In the Scrut console, go to Trust Vault → Settings → Additional Settings and enable the Trust Portal Subscriptions option. Viewers can then sign up on the portal to receive email notifications for new updates.
    • Enables Trust Portal subscriptions via Trust Vault → Settings → Additional Settings, so viewers can opt in to email notifications when certifications, documents, or security updates are published.
    • Adds Cloudflare multi-zone support to the Cloudflare integration, collecting evidence per selected zone and surfacing failing zones as separate resource rows.
    • Introduces a My Tasks tab in the Task Center that consolidates tasks from Policies, Evidence, Vulnerabilities, Vendors, and audit requests, with filtering by module, assigned date, or task name.
    • Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27701:2025 (stand-alone PIMS standard for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. controllers and processors) to the Frameworks module, enabling privacy control mapping, evidence suggestions, and readiness reports.
    • Scrut Teammates now automatically suggests control mappings (standard and custom controls) when a policy is uploaded, with reviewers able to accept, reject, or adjust each suggestion before saving.

    +13 more show less

    • Scrut Teammates automatically runs evidence gap analysis when evidence is uploaded or updated for the current audit period, flagging missing requirements, partial coverage, and inconsistencies.
    • Scrut Teammates evaluates policy alignment against mapped controls and the current audit period, surfacing gaps and recommended next steps before an auditor review.
    • Supports importing existing policies in PDF, DOCX, and other formats directly into the inline editor, keeping policies editable after import.
    • Adds editable policy revision history inside the inline editor, allowing owners to add, edit, or remove version entries without maintaining a manual table.
    • Introduces a streamlined approval workflow for risk mitigation tasks: assignees submit with attachments, approvers approve or request revision, defaulting the approver to the risk assignee or task creator.
    • Auto-collects trust documents from known vendors during onboarding by linking the compliance URL on the vendor Documents tab and pulling directly from vendors' public Scrut Trust Portals.
    • Adds flexible risk register import in three steps — upload file, map column headers to Scrut fields, preview — without requiring the Scrut template format.
    • Allows questionnaire attachment fields to be marked mandatory, preventing vendor submission without required uploads such as policies, certifications, or reports.
    • Adds explicit column mapping during Questionnaire Import so teams can designate which columns are questions and which are answers, including multi-field selections.
    • Automatically hides empty sections in live Trust Portals, rendering sections only when they contain published data.
    • Allows integration-synced vendors to be archived (but not deleted), preventing them from reappearing after the next sync.
    • Adds editable evidence templates, letting teams modify templates directly within Scrut to match organizational requirements.
    • Adds a Notifications Center for viewing all pending tasks and notifications in one place instead of browsing module by module.

    18 details in Everything

30. docs update Aug 30, 2026 · issue 059

    Scrut adds manual link/unlink of automated tests to evidence tasks, plus on-demand test export attachment for compliance frameworks.

    └──▷ HOW TO FIND IT
    Manually attach a test result as evidence when you need a current snapshot for an active compliance review period.
    📍In Scrut, go to Compliance → Evidence Tasks, open the target task, scroll to Automation Sources, and click the Export icon next to the linked test. Scrut exports the result in the background and attaches it to the current evidence period.
    • Adds ability to manually link any automated test to an evidence task via Compliance → Evidence Tasks → Automation Sources → Add Automation Sources, independent of Scrut's automatic mappings — available for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. frameworks.
    • Adds Export icon in the Automation Sources section to trigger on-demand export of a linked test's results and attach them to the current evidence period.
    • Adds unlink icon in the Automation Sources section to remove a previously linked automated test from an evidence task.

    3 details in Everything

31. docs update Aug 30, 2026 · issue 059

    Scrut Automation adds bulk offboarding: complete offboarding for multiple employees in a single action.

    └──▷ HOW TO FIND IT
    Offboard a cohort of departing employees at once instead of one by one.
    📍In the Employees module, go to the employee list, select all employees in Offboarding Needed status, then choose Complete Offboarding to process them in a single action.
    • Enables bulk offboarding — complete offboarding for multiple employees simultaneously, available when every selected employee is in Offboarding Needed status.
    • Enforces that only employees with Active status can be added as Scrut users.

    2 details in Everything

32. docs update Aug 30, 2026 · issue 059

    Scrut adds Shadow AI governance, automated test linking to evidence, and AI-assisted SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. System Description authoring.

    └──▷ HOW TO FIND IT
    When onboarding to Shadow AI governance, navigate to the AI Apps review screen to categorize newly discovered apps surfaced from your SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integrations.
    📍In Scrut, go to Shadow AI Governance › AI Applications, review discovered apps, and set a category and risk disposition for each.
    Bulk-import a vendor questionnaire template to save time when onboarding a new vendor assessment program.
    📍In Scrut, go to Vendor Questionnaires › Import Template, upload your CSV or XLSX file with questions, answer options, risk scores, and any conditional follow-up questions, then resolve any flagged import errors.
    • New Shadow AI Governance module discovers AI applications through SSO integrations, lets teams review and categorize them, and runs automated compliance tests to identify AI-related risks.
    • Adds ability to link and unlink automated tests to evidence tasks, attaching test results directly as evidence.
    • Adds AI-assisted SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 System Description creation, with options to upload an existing document, review, edit, and publish for inclusion in the audit package.
    • Adds recurrence and review date management for evidence tasks, supporting individual and bulk scheduling with manual date override and status tracking.
    • Adds vendor questionnaire template import via CSV or XLSX, supporting answer options, risk scores, and conditional follow-up questions.

    5 details in Everything

33. announced seen Aug 28, 2026 · issue 058

    Scrut adds Shadow AI Governance to discover, classify, and continuously verify AI tool usage across an organization

    • New Shadow AI Governance module discovers AI applications employees are using via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integrations (Google Workspace, Microsoft Entra) and desktop sources (supported MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integrations or the Scrut Agent).
    • Automatically classifies discovered tools as AI Apps (tools where employees input organizational data) or AI Builders (tools that connect to technical environments such as repositories and APIs), surfacing distinct review questions for each.
    • Assigns each discovered application an explicit governance status — Managed, Ignored, or Restricted — with Restricted decisions requiring a recorded justification to create an auditable trail.
    • When an application is Restricted, identifies affected employees and notifies them with removal instructions, including third-party access revocation for SSO-discovered apps and uninstall guidance for desktop apps.
    • Provides a shared AI footprint view for security, IT, and GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. teams — separate from an approved software inventory — showing which employees are associated with each discovered application.

    5 details in Everything

34. docs update Aug 22, 2026 · issue 053

    Scrut MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. exposes 13 tools for AI-driven compliance queries, evidence upload, and document management via natural-language prompts.

    └──▷ HOW TO FIND IT
    Upload a freshly generated quarterly access review and immediately attach it to the correct evidence item in one chained prompt.
    📍Upload this access review and attach it to the access-review evidence, dated today, with a note that it was generated from the quarterly review.
    Surface all currently failing SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. cloud tests so you can prioritize remediation work.
    📍Which SOC 2 cloud tests are currently failing, and which ones should I prioritize?
    • Adds scrut_list_frameworks MCP tool to list enabled compliance frameworks (SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., etc.) along with each one's next audit date.
    • Adds scrut_list_controls MCP tool to list framework controls — including code, domain, owner, and status — filterable by framework or product.
    • Adds scrut_get_control MCP tool to retrieve full details for a single control by control code.
    • Adds scrut_list_policies MCP tool to list compliance policies with status, owner, and review date, filterable by framework, product, or status.
    • Adds scrut_get_policy MCP tool to retrieve full details for a single policy including owners, approvers, mapped frameworks and controls, and the current policy document.

    +9 more show less

    • Adds scrut_list_evidence MCP tool to list evidence items with status, assignee, and review date, filterable by framework, product, or status.
    • Adds scrut_get_evidence MCP tool to retrieve full details for a single evidence item including status, owner, mapped controls, and currently uploaded documents.
    • Adds scrut_list_tests MCP tool to list automated cloud tests including cloud provider and pass/fail status.
    • Adds scrut_get_test MCP tool to retrieve full details for a single continuous test including cloud provider, test level, and mapped controls.
    • Adds scrut_answer_question MCP tool to return synthesized, sourced answers drawn from published policies, Trust Vault, and Vault documents — flagging gaps rather than guessing when confidence is low.
    • Adds scrut_get_document_content MCP tool to retrieve the full text of a specific policy or evidence document.
    • Adds scrut_search_documents MCP tool to find a document by name across policies, evidence, and Trust Vault without requiring an exact ID or category.
    • Adds scrut_upload_file MCP tool to upload a file and return a document object for subsequent attachment.
    • Adds scrut_attach_evidence_document MCP tool to attach an uploaded document or external link to an evidence item, with an optional date and note.

    14 details in Everything

35. docs update Aug 22, 2026 · issue 053

    Scrut MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Skills package multi-step GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. jobs into single-prompt tasks for Claude, Cursor, and other MCP-compatible AI tools.

    • Introduces Scrut MCP Skills — self-contained SKILL.md folders that sequence Scrut MCP tool calls for a full GRC job, triggerable with a single prompt from any MCP-compatible AI agent (Claude Code, Claude Desktop, Cursor, Codex, ChatGPT, Microsoft Copilot).
    • New scrut-upload-evidence skill uploads a file or attaches a link to the correct evidence item, with a note — prompt: 'File this access review as evidence.'
    • New scrut-compliance-digest skill summarizes framework, control, policy, evidence, and test state in a format suited for leadership — prompt: 'Give me a compliance digest for the board.'
    • New scrut-answer-questionnaire skill drafts questionnaire answers from your documented posture with citations and flags gaps it cannot answer confidently — prompt: 'Answer this vendor security questionnaire.'
    • New scrut-fix-test skill finds a failing cloud test, pulls remediation guidance, and helps fix the underlying infrastructure-as-code — prompt: 'Fix our failing S3 public-access test.'

    +4 more show less

    • Skills install into Claude Code or Claude Desktop by copying the skill folder into ~/.claude/skills/<skill-name>/ and restarting the client; no build or compile step required.
    • Skill definitions are versioned inside each SKILL.md file with a changelog; folder names remain stable across updates so existing installs and references continue working.
    • Skills degrade gracefully — if a required Scrut MCP tool is unavailable on an older connection, the skill reports the gap instead of failing silently.
    • The Scrut MCP GRC Skills repository is public and open for community contributions via pull request.

    9 details in Everything

36. docs update Aug 22, 2026 · issue 053

    Scrut July 2026 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration for AI apps, Shadow IT governance, audit snapshots, Tenable import, and SoA enhancements.

    • Adds Shadow IT application governance under People → Access Reviews → Applications, with Managed, Discovered, and Restricted views; supports bulk actions (ignore, restrict) and owner assignment for both SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and desktop apps.
    • Adds Compliance → Frameworks implementation details field to SoA exports, alongside a new Document Reference column auto-fetched from linked policies, for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. framework Statement of Applicability downloads.
    • Supports importing Tenable (formerly Nessus) vulnerability scan findings into the Scrut vulnerability workflow via a new Tenable integration, enabling triage alongside existing vulnerability work.
    • Introduces Scrut MCP, connecting live compliance data to MCP-compatible AI apps (Claude Code, Cursor, ChatGPT Codex) for plain-language queries, questionnaire drafting, evidence filing, and remediation context — all scoped to the user's existing Scrut role.
    • Adds one-click clone for policies and evidence tasks, preserving all control and requirement mappings on the copy.

    +12 more show less

    • Preserves a point-in-time completion snapshot when an audit is marked Complete, locking dashboards and percentages to reflect the state at that moment.
    • Scrut Teammates now auto-fetches vendor compliance documents (Privacy Policy, Trust Center, security page, subprocessor list) within the Vendor → Documents tab during vendor assessment workflows.
    • Evidence Automation — allowing automated tests as automation sources on an evidence task — is now available for eligible accounts.
    • Adds a new Critical tier above High to Vendor inherent and residual risk ratings, creating a four-tier classification.
    • Supports linking an existing Monday item by ID or URL to a Scrut task, with attachment sync and ticket recreation alignment on status changes.
    • Enables bulk policy approval via Compliance → Policies → All Policies → Policy Actions → Approve.
    • Allows attaching audit scope and audit plan documents to the audit summary.
    • Adds customizable Risk Register table layout with configurable column order and default column visibility.
    • Adds configurability to the Add Risk form, allowing selection of which default and custom fields appear and which are mandatory.
    • Trust Vault now positions the organization as Consent Manager under DPDPA, requiring visitors to accept ToS and privacy policy when sending access requests or subscribing to updates.
    • Teammates Chat now references the Answer Library and Trust Vault in addition to policies and Vault documents.
    • Updates Essential Eight Maturity Model Level 2 mapping to the Australian Cyber Security Center November 2023 release, including fuller Application Control requirements.

    17 details in Everything

37. docs update Aug 22, 2026 · issue 053

    Scrut Automation launches MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server integration, connecting compliance data to Claude, Cursor, ChatGPT, and Codex via OAuth.

    └──▷ TRY IT
    Connect Scrut MCP to Claude Code for a US-region tenant so you can query compliance gaps directly from the terminal.
    copy

    $ claude mcp add --transport http scrut https://mcp.us.scrut.io/mcp \
      --client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U \
      --callback-port 8787

    Enable Scrut MCP in Codex on a machine that also runs Claude Code, using a separate callback port to avoid conflicts.
    ~/.codex/config.toml copy

    [features]
    experimental_use_rmcp_client = true
    mcp_oauth_callback_port = 8788

    Add and authenticate the Scrut MCP server in Codex for a US-region tenant, then verify the connection before launching a session.
    copy

    $ codex mcp add scrut --url https://mcp.us.scrut.io/mcp \
      --oauth-client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U \
      --oauth-resource https://mcp.us.scrut.io/mcp
    codex mcp login scrut
    codex mcp get scrut

    • Adds Scrut MCP server with region-specific endpoints — https://mcp.scrut.io/mcp (India), https://mcp.us.scrut.io/mcp (US), https://mcp.eu.scrut.io/mcp (EU), https://mcp.au.scrut.io/mcp (Australia) — exposing Scrut compliance data to any MCP-compatible AI tool.
    • Supports connecting Scrut MCP to Claude Code CLI via claude mcp add --transport http scrut <region-url> --client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U --callback-port 8787.
    • Supports connecting Scrut MCP to Codex CLI via codex mcp add scrut --url <region-url> --oauth-client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U --oauth-resource <region-url>, with mcp_oauth_callback_port = 8788 and experimental_use_rmcp_client = true set in ~/.codex/config.toml.
    • Supports connecting Scrut MCP to Cursor IDE via Settings → Tools & MCP → + New MCP Server, accepting the region MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. URL and Client ID.
    • Supports connecting Scrut MCP to ChatGPT (Business, Enterprise, or Edu plans) via Settings → Apps & Connectors → Advanced Settings with Developer Mode enabled, using OAuth authentication.

    +2 more show less

    • Supports connecting Scrut MCP to Claude Desktop and Claude.ai Web (individual or Team/Enterprise) via Settings → Connectors → Add custom connector, with the OAuth Client ID entered under Advanced settings and OAuth Client Secret left blank.
    • Uses OAuth via Auth0 — the AI assistant operates under the authenticated user's existing Scrut role (Admin, Contributor, or Auditor), granting no additional access beyond what the user already has.

    7 details in Everything

38. docs update Aug 22, 2026 · issue 053

    Scrut Automation adds a Supabase integration

39. docs update Aug 14, 2026 · issue 045

    Scrut replaces the Setup Wizard with Task Center, a unified compliance hub with My Tasks, Audit Prep, and Continuous Compliance tabs.

    • Introduces Task Center, a centralized hub replacing the Setup Wizard, surfacing tasks from policies, evidence, risk, vendors, audits, and employee workflows in a single view without requiring module-by-module navigation.
    • Adds a My Tasks tab showing every compliance task assigned to the current user across all modules, with next actions and progress counters.
    • Adds an Audit Prep tab for tracking audit-related tasks team-wide; supports selecting a framework (SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., etc.) to see exactly what is pending before an internal or external audit — internal audits can be scheduled directly from this tab once compliance reaches 90%.
    • Adds a Continuous Compliance tab providing a high-level overview of ongoing compliance work including recurring evidence collection, failing tests, risks to reassess, and vendors to re-evaluate across all active modules.
    • Role-based visibility: Admins see all tasks with assignee and status across all modules; Contributors see only their assigned tasks.

    +1 more show less

    • Previously completed Setup Wizard steps are automatically migrated to the relevant modules with no data loss; any remaining mandatory steps surface as tasks in My Tasks.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Setup Wizard module is being fully retired; workspaces without incomplete Setup Wizard steps already have it replaced by Task Center.
40. docs update Aug 14, 2026 · issue 045

    Scrut adds FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. and ISO/IEC 27018:2025ISO/IEC 27018:2025An ISO/IEC standard specifying privacy controls for public cloud providers that process personal data, giving cyber tools a recognized compliance baseline for handling PII in cloud environments. frameworks, approver workflows, and expanded AI evidence checking

    • Adds Send for Approval button inside Access Reviews so reviewers can submit each application independently; every send, approve, decline, and comment is logged for traceability.
    • Adds entity scoping across Vault files and Questionnaire Automation — assign Vault files to specific entities and select entities when creating or editing a questionnaire so Autofill uses only entity-matched documents and policies; existing content defaults to organization-wide scope; includes an AI Readability toggle to control policy ingestion during Autofill.
    • Adds Risk Department multi-select so a single risk can be assigned to multiple departments (mitigation-task Department remains single-select).
    • Supports FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate baseline in the Frameworks module with pre-configured policy templates and automated evidence mapping against the NIST SP 800-53 control set.
    • Supports ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27018:2025 cloud privacy framework in the Frameworks module with evidence and policy suggestions alongside related ISO programs.

    +11 more show less

    • Extends AI Evidence Checker (powered by Scrut Teammates) to every manually updated evidence item via Check with Scrut Teammates, including evidence supplied as a Google Doc link; previously limited to a subset of evidence types.
    • Introduces an approval workflow for corrective actions in the Audit Center — an approver is assigned at creation, owners submit evidence to trigger a Needs Review status, and approvers can approve/close or request a revision with a written reason.
    • Adds a risk timeline that enforces treatment sequencing (cannot add mitigation after residual risk is recorded; cannot add residual risk while mitigation tasks remain open) and lets owners schedule reassessment as annually, biannually, quarterly, monthly, a one-time custom date, or never; when the review date arrives the risk moves to a monitor state and Review Risk unlocks assessment fields.
    • Adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings PDF report generation from the Findings tab for a selected application target, including an executive summary with overall risk rating and an engagement overview with scope, approach, and methodology.
    • Enriches third-party scan finding detail pages with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score, last scanned date, a complete treatment plan, and the full list of affected resources.
    • Autofills Jira ticket remediation steps via Scrut Teammates when creating a ticket from Cloud → Failed Tests → Create Jira Ticket.
    • Allows multiple assignees on Findings, requests, and corrective actions in the Audit module, with one designated primary owner.
    • Trust Vault now attaches only published policies as PDF and prompts users to preview and sync when a new version is published.
    • Recurring policy or evidence tasks move to Needs Review at the start of each recurrence period (monthly, quarterly, bi-annually, or annually), regardless of when the prior period's evidence was uploaded.
    • Cloud Test Resources support bulk actions for faster remediation and ownership updates.
    • Trust Vault module gains an enhanced dashboard showing portal views over time with clickable metrics for visitor data, access requests, top-engaged documents, and most active accounts or users.

    16 details in Everything

41. docs update Aug 12, 2026 · issue 043

    Scrut Automation adds an in-platform Policy Editor with rich formatting, collaboration, revision history, and offline autosave.

    • New in-platform Policy Editor accessible via Compliance → Policies lets users create, edit, and format policy documents without leaving Scrut.
    • Toolbar includes Import from Word to upload and edit existing MS Word documents directly in the editor.
    • Built-in Find and Replace with advanced options including Match case and Whole words only for searching within policy documents.
    • Revision History tracks all changes with timestamps and authorship, supports version comparison and one-click restore of previous versions.
    • Enable Policy Version Details toggle in Settings on the Policy page automatically appends a version table (version name, created by, date) to every downloaded policy.

    +6 more show less

    • Policy Editor autosaves continuously; a manual Save Now button is available as a fallback, including support for offline edits that sync on reconnect.
    • Preview button and PDF Download button allow practitioners to review and export the formatted policy document at any time.
    • Cover pages are automatically generated with the organization logo, account name, and policy name pulled from Settings → Organization Info.
    • Pre-populated sample policy templates are available for standard policies (not available for custom policies, which start blank).
    • Table tool supports insert, merge/split cells, header rows/columns, and configurable border, background, dimensions, and alignment via a Table properties dialog.
    • Grammarly Chrome extension is compatible with the Policy Editor.

    11 details in Everything

42. docs update Aug 12, 2026 · issue 043

    Scrut Automation adds a configurable multilevel Policy Approval Workflow with a toggleable approval gate before policy publishing.

    • New Policy Approval Workflow toggle (found under Compliance → Policies → Settings → Configurations) lets admins require one or more approvers to sign off before a policy can be published.
    • Supports multilevel approval chains, allowing designated assignees or admins to add multiple approvers (e.g., QA Lead, CTO, CISO) even after a policy is created.
    • When approval workflow is disabled, policies can be published by admins without requiring approver sign-off, preserving the prior lightweight flow.

    3 details in Everything

43. docs update Aug 12, 2026 · issue 043

    Scrut adds 21 CFR Part 11, Hexnode MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. sync, flexible CSV/XLSX asset import, OpenProject integration, and Jira attachment sync

    └──▷ HOW TO FIND IT
    Import a raw device inventory export into Scrut asset management without reformatting the file first.
    📍In the Scrut console, go to Asset Management → Add Asset → Import via CSV/XLSX, upload your CSV or Excel file as-is, then use the column mapping wizard to match your columns to Scrut fields.
    • New asset import wizard at Asset Management → Add Asset → Import via CSV/XLSX accepts CSV or Excel files without a predefined template, letting users map columns to Scrut fields on upload.
    • Adds 21 CFR Part 11 to the Frameworks module with validation status tracking, control owner assignment, centralized evidence repository, and readiness reporting for life sciences teams.
    • New Hexnode MDM integration syncs device inventory into Scrut for audit-ready asset visibility without manual exports.
    • Vendors can now reupload or replace attachments mid-review on a submitted questionnaire without restarting the questionnaire, while the question remains under review.
    • New OpenProject integration lets users create and view OpenProject tickets directly from Scrut for remediation and compliance work tracking.

    +3 more show less

    • Scrut can now sync Jira attachments — including inline images in descriptions and comments — to linked evidence tasks.
    • All module notifications consolidate into a single Notification Center, replacing scattered per-module alerts and emails.
    • Teammates Chat now surfaces clickable, context-aware follow-up questions under AI responses.

    8 details in Everything

44. docs update Aug 12, 2026 · issue 043

    Scrut Automation adds a Supabase integration for Access Reviews and automated compliance checks

    └──▷ HOW TO FIND IT
    Connect Supabase to Scrut to pull user access data for a compliance Access Review cycle.
    📍In Scrut, go to Integrations › Integrations Library, find the Supabase card, click Integrate, paste your Supabase Personal Access Token into the PAT Token field, and click Submit. Once Connected, navigate to People › Access Reviews to review synced user names, emails, and roles.
    Verify the Supabase integration is syncing correctly and troubleshoot failed syncs.
    📍In Scrut, go to Integrations › Supabase integration page and open the Audit Log tab. Confirm entries show Integration successful; if sync entries show failures, trigger a manual sync from the integration settings page or regenerate the PAT in Supabase and resubmit.
    • New Supabase integration syncs user names, emails, and roles into Scrut's People → Access Reviews module for access review workflows.
    • Automated compliance tests for Supabase projects are available under Tests → Automated Tests, continuously checking for security misconfigurations against applicable compliance frameworks.
    • Integration is configured by pasting a Supabase Personal Access Token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) into the PAT Token field on the Supabase integration page under Integrations Library.
    • Supabase user and role data syncs automatically every 24 hours; manual syncs can be triggered from the integration settings page.
    • An Audit Log tab on the Supabase integration page provides visibility into sync status and connection health.

    +1 more show less

    • Legacy Supabase access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. are supported and require read permissions scoped to Organizations, Organization settings, and Organization members.

    6 details in Everything

45. docs update Aug 12, 2026 · issue 043

    Scrut adds Supabase integration for access reviews and email notification configuration for compliance alerts.

    • New Supabase integration syncs user access data into Scrut for Access Reviews and runs automated security and compliance tests against applicable frameworks.
    • New email notification configuration supports email digests and individual alerts to keep teams informed about compliance tasks, assignments, and deadlines.

    2 details in Everything

46. Consistent approval workflows, conflict warnings, and chart behavior across modules Jun 12, 2026 · release notes

    Scrut adds conflict warnings for assignee/approver collisions and syncs charts with filtered tables across all modules.

    └──▷ HOW TO FIND IT
    Catch an assignee/approver conflict before submitting a task for approval, ensuring independent review is enforced.
    📍In Risk -> Risk Management (or any approval-enabled module), open a task and set the same user as both assignee and approver. A warning modal will appear — reassign one role to a different user, then select Submit for Approval.
    • Adds a warning modal when the same user is set as both assignee and approver on a task, prompting reassignment to ensure independent review.
    • Charts and tables in policies, evidence, risk, vulnerabilities, people, training, and access reviews now update together when filters are applied or cleared.
    • Approval workflows across Risk, Vendors, Access Reviews, Policies, Evidence Tasks, and Vulnerabilities now share common CTAs, modal behavior, and risk rules.

    3 details in Everything

47. Retain table sort preferences throughout your session Jun 12, 2026 · release notes

    UI tables retain manual sort order throughout the browsing session

    └──▷ HOW TO FIND IT
    Retain a custom column sort during the session; returning to the module preserves it where session memory is supported.
    📍Navigate to any table in any module. Apply a manual sort on any column.
    • Tables now exhibit consistent default ordering and sticky manual sort

    1 detail in Everything

48. Save accurate organization names that match legal records Jun 12, 2026 · release notes

    Scrut allows standard punctuation in organization and legal name fields via Settings.

    • Enables use of periods, commas, apostrophes, ampersands, parentheses, slashes, hyphens, and underscores when entering the Organization Name or Legal Name field

    1 detail in Everything

49. Deleted comments are now captured in audit logs Jun 11, 2026 · release notes

    Scrut now logs deleted comments in audit trails across all modules.

    • Audit logs now capture comment deletion events across tests, policies, evidence, cloud tests, vendor questionnaires, mitigation work, risk, and vulnerability findings.

    1 detail in Everything

50. Navigate tables faster with first and last page jumps Jun 11, 2026 · release notes

    Scrut adds First and Last page jump controls to table pagination across the platform.

51. Capture more context by adding custom fields for vulnerability findings and resources Jun 10, 2026 · release notes

    Scrut Automation adds custom fields for vulnerability findings and resources to capture bespoke severity, ownership, and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. metadata.

52. Setup wizard is now part of the Task Center Jun 10, 2026 · release notes

    Scrut's Task Center unifies the Setup Wizard and ongoing compliance tasks into one hub with three dedicated tabs.

    └──▷ HOW TO FIND IT
    Track what stands between you and your next SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. or ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 audit without jumping between modules.
    📍In Scrut, click Task Center in the left sidebar, then select the Audit Prep tab to see framework-specific readiness for SOC 2, ISO 27001, GDPR, and other frameworks, along with remaining items before your next audit.
    Keep recurring compliance work visible after achieving audit readiness — evidence collection, failing tests, and vendor re-evaluations in one view.
    📍In Scrut, click Task Center in the left sidebar, then select the Continuous Compliance tab to review evidence collection tasks, failing tests, risks to reassess, and vendors to re-evaluate.
    • Adds a unified Task Center replacing the standalone Setup Wizard, consolidating onboarding and ongoing compliance tasks in one place accessible from the left sidebar.
    • Introduces a My Tasks tab in the Task Center showing every task assigned to the current user across modules, with next actions and progress counters.
    • Introduces an Audit Prep tab for tracking framework-specific readiness (SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, ISO 27001, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., and others) and surfacing outstanding items before internal or external audits.
    • Introduces a Continuous Compliance tab for managing recurring post-audit work including evidence collection, failing tests, risks to reassess, and vendors to re-evaluate.

    4 details in Everything

53. Speed up access reviews by bulk assigning account identities Jun 10, 2026 · release notes

    Scrut Automation access reviews gain bulk identity assignment, letting you categorize multiple accounts in a single action.

    └──▷ HOW TO FIND IT
    Categorize all service/bot accounts and external contractors at once during an access review instead of updating each account one by one.
    📍In Access Reviews, select all target accounts using the row checkboxes, open the Bulk Actions menu, choose Update Identity, and set the identity to Non-personnel or External contractor, then confirm.
54. Debug integration sync issues across modules with clear, actionable error messag Jun 9, 2026 · release notes

    Scrut improves integration sync error visibility with actionable guidance.

    • Surfaces specific, actionable error messages when an integration encounters a sync issue instead of generic failure notices.
    • Displays visible error indicators in affected modules (People, Tests) when data is stale or unavailable to quickly identify impacted areas.

    2 details in Everything

55. Configure Scrut Monitors to automatically fetch Freshservice tickets as complian Jun 9, 2026 · release notes

    Configure Scrut Monitors to automatically fetch Freshservice tickets as compliance evidence

    • Adds Freshservice integration for Scrut Monitors to automatically fetch ticket data
    • Enables tag-based filtering of Freshservice tickets within the monitor configuration
    • Exports fetched Freshservice ticket records as a consolidated CSV evidence report

    3 details in Everything

56. Start the next audit cycle faster by cloning an existing audit Jun 8, 2026 · release notes

    Cloning an existing audit from the Audit Center to reuse framework, team, and control selections for new cycles.

    • Adds Clone Audit option in the Audit Center UI to create a copy of an existing audit, preserving framework, type, team, entities, and controls.

    1 detail in Everything

57. Track key audit activities with the unified Audit Log Jun 8, 2026 · release notes

    Scrut adds a unified Audit Log tab in the Audit Center to consolidate activity across findings, requests, and corrective actions.

    • Adds an Audit Logs tab within the Audit Center that aggregates activity from findings, requests, and corrective actions into a single stream.
    • Enables filtering of audit log entries by Performed By (team member) and date range in the unified Audit Logs view.
    • Starts recording comment deletions across findings, requests, and corrective actions in both section-level logs and the unified audit stream.

    3 details in Everything

58. Change the layout and content order of your public Trust Portal in just a few cl Jun 8, 2026 · release notes

    Customizable layout and sorting order for the public Trust Portal via Settings

    • The Portal Layout tab under Trust -> Trust Vault > Settings supports rearranging eligible public portal sections.
    • Sort options vary by section and include newest first, alphabetical, or manual ordering where applicable; Updates stays Newest First and cannot be reordered.
    • Compliance section now supports custom display order for frameworks.

    3 details in Everything

59. Upload policy content from Google Drive and edit it directly in Scrut Jun 5, 2026 · release notes

    Import .doc/.docx/.pdf policies from Google Drive and open in Scrut's inline editor

    • Adds direct Google Drive integration to sync policy files into Scrut without local download

    1 detail in Everything

60. New framework: DPDPA (2025 Act rules) now available in Scrut Jun 5, 2026 · release notes

    New DPDPA (2025 Act rules) framework with cross-framework evidence mapping.

    └──▷ HOW TO FIND IT
    Add the new DPDPA framework to your workspace to begin tracking posture.
    📍Navigate to Compliance -> Frameworks and locate DPDPA (2025 Act rules)
    • Adds DPDPA (2025 Act rules) framework to the Frameworks Library under Compliance -> Frameworks
    • Enables automatic cross-framework mapping from ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2022 and EU GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., auto-populating up to 65% of requirements

    2 details in Everything

61. Brand your policies with custom headers and footers Jun 4, 2026 · release notes

    Scrut adds configurable headers and footers to policy PDF exports via Policy Settings.

    • Adds Header & Footer tab in Compliance -> Policies > Policy Settings for configuring custom branding elements on exported policy PDFs.

    1 detail in Everything

62. Streamline your TPRM workflow: Introducing guided, step-by-step vendor assessmen Jun 4, 2026 · release notes

    Adds a guided vendor assessment timeline on the vendor detail page with manual control over risk review and final assessment stages.

63. Trace sync errors faster across integrations and tests Apr 21, 2026 · release notes

    Scrut adds sync error status and detailed logs for select integrations.

    └──▷ HOW TO FIND IT
    Jump from a failing test directly to the problematic integration
    📍Click the sync error indicator on an affected test to go directly to the integration causing the issue
    • Adds visible Sync Error status for MS Intune, Jamf Pro, JumpCloud, Fleet MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., NinjaOne, SharePoint and Jira integrations.
    • Provides detailed source error codes and messages in audit logs for these supported integrations.
    • Displays sync error indicators on automated tests affected by these integrations.

    3 details in Everything

64. Create and sync GitHub Issues directly from Scrut Apr 21, 2026 · release notes

    Scrut adds direct GitHub Issue creation from evidence, tests, policies, audits, and vulnerabilities

    • Adds the ability to create and sync GitHub Issues directly from Scrut artifacts (evidence, tests, policies, audits, vulnerabilities)
    • Adds a new UI option in the three-dots menu on artifact views to initiate GitHub issue creation

    2 details in Everything

65. Now available: API endpoint visibility in Scrut Monitor reports Apr 20, 2026 · release notes

    Scrut Monitor reports now include the exact API endpoints and documentation links used to fetch data for each report.

    └──▷ HOW TO FIND IT
    Verify data origin for an auditor by viewing the source endpoint in the downloaded report.
    📍Navigate to Compliance -> Evidence Tasks and open any evidence to download a Scrut Monitor report
    • Adds API endpoint visibility in Scrut Monitor reports

    1 detail in Everything

66. Use Vault tags to accurately scope the autofill sources for questionnaires Apr 19, 2026 · release notes

    Scrut allows tagging Vault documents to scope questionnaire autofill sources

    • Enables selecting tags during questionnaire setup to limit autofill document sources.

    1 detail in Everything

67. Expanded integration support: Connect more HR and BGV tools to Scrut Apr 19, 2026 · release notes

    Seven new HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. and BGV integrations added to the Integrations Library.

    • Adds Darwinbox integration for HR data sync via the Integrations Library.
    • Adds Alexis integration for HR data sync via the Integrations Library.
    • Adds BreatheHR integration for HR data sync via the Integrations Library.
    • Adds HRworks integration for HR data sync via the Integrations Library.
    • Adds Sage Intacct integration for background verification workflows via the Integrations Library.

    +2 more show less

    • Adds Postman integration for background verification workflows via the Integrations Library.
    • Adds ZincWork integration for background verification workflows via the Integrations Library.

    7 details in Everything

68. Auto-Approve Trust Portal access requests from trusted domains Apr 16, 2026 · release notes

    Adds Trust Vault auto-approval for access requests from whitelisted domains in Trust Portal

    • Adds a domain icon visual indicator on approved requests in the Access Requests view to distinguish auto-approved entries from manual reviews.
    • Adds an Approval Type filter option Auto-approved via whitelisted domain in the Access Requests view to isolate and audit domain-matched approvals.

    2 details in Everything

69. Gain complete traceability into vendor actions with audit logs in the Vendor Por Apr 16, 2026 · release notes

    Adds Settings -> Audit Log and Questionnaire > Audit Log tabs in the Vendor Portal for vendor action traceability.

    • Adds a new Settings -> Audit Log tab in the Vendor Portal to track user management actions such as adding/removing users and editing details.
    • Adds a new Audit Log tab on individual questionnaires in the Vendor Portal to record assessment activity including received/submitted status, and attachment changes.

    2 details in Everything

70. Connect Aikido Security to Scrut for automatic vulnerability sync Apr 15, 2026 · release notes

    New native integration with Aikido Security for automatic vulnerability sync in Scrut

    • Adds Aikido connector in Integrations > Integrations Library > Vulnerability Scanners using OAuth (Client ID and Client Secret)
    • Displays imported findings in Vulnerabilities > Third Party Scans with filter Source: Aikido

    2 details in Everything

71. Remediate vulnerabilities quicker with enriched third-party scan details Apr 15, 2026 · release notes

    Third-party scan findings in Vulnerability Management gain enriched detail pages.

72. Spot stale tests faster with scan timestamps and schedules Apr 14, 2026 · release notes

    Tests module adds last checked, next scan time, and staleness warnings for scheduled tests

    • Tests -> Automated Tests page now shows last checked and next scan time for all scheduled tests.
    • Real-time tests are labeled Continuous monitoring for clarity.
    • Tests not updated in more than 24 hours are flagged with a warning including the reason (e.g., sync or integration error).
    • Test details page provides quick access to the last successful scan details.

    4 details in Everything

73. Use Questionnaire Autofill sources with better control and clearer guidance Apr 14, 2026 · release notes

    Consolidated Questionnaire Autofill Sources control and Answer Library guidance limits

    └──▷ HOW TO FIND IT
    Manage which data sources feed into AI autofill suggestions via the new consolidated UI section.
    📍Navigate to Trust → Questionnaire → Autofill Sources
    • Trust → Questionnaire → Autofill Sources section consolidates toggles for different autofill sources in one location
    • Answer Library displays a banner when it exceeds 15 entries, guiding users to the Vault or Chrome extension import
    • Prominent recommendation to use the Chrome extension for importing existing questionnaires appears when clicking Add new questionnaire

    3 details in Everything

74. Identify gaps in your policies automatically with Scrut Teammates Apr 13, 2026 · release notes

    Scrut Teammates adds automated policy gap analysis dashboard with Mark as done, Ignore, and manual refresh actions

    • Adds a Policy module dashboard showing gap analysis status and summary counts across your entire policy library.
    • Enables marking individual detected gaps as done or ignoring non-applicable ones directly from the UI.
    • Adds a manual refresh option to re-trigger gap analysis for specific policies.

    3 details in Everything

75. Teammates now alerts you on evidence gaps right in the Task Center Apr 13, 2026 · release notes

    Teammates evidence gap analysis and bulk publish surfaced in Task Center with notifications.

    • Evidence gap analysis from Teammates now appears as tasks in the Task Center in a dedicated AI findings section
    • Bulk publish option for all passing evidence with no gaps is available in the Task Center
    • Filter on the main evidence table to isolate only evidence with identified gaps
    • Real-time notifications alert users when a gap is found in newly reviewed evidence
    • Admins receive a weekly email summary with breakdown of gap-free versus gap-detected evidence

    5 details in Everything

76. Trace risks to controls directly from the Controls module Apr 13, 2026 · release notes

    New Risk tab in Control details page links risks directly without module switching

77. ISO 22301:2019 updated with expanded coverage and new policy templates Apr 12, 2026 · release notes

    ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 22301:2019 framework expanded to 73 requirements with new customizable policy templates and refined control mappings

    • Expands the ISO 22301:2019 framework in the Frameworks module from 56 to 73 distinct requirements
    • Adds new, customizable policy templates for Business Continuity and Disaster Recovery
    • Introduces refined control mappings and updated evidence suggestions focused on high-value documentation

    3 details in Everything

78. New framework: NEN 7510 for Dutch healthcare now available in Scrut Apr 12, 2026 · release notes

    Adds NEN 7510NEN 7510A Dutch national standard for information security in healthcare, maintained by NEN, specifying controls organizations must implement to protect patient data — tools use it as a compliance framework for Dutch health-sector deployments. framework for Dutch healthcare compliance management

    • Supports the NEN 7510 framework, the premier Dutch standard for information security within the healthcare sector
    • Allows mapping of specialized controls for patient data protection, access logging, and confidentiality to policies and evidence

    2 details in Everything

79. Updated NIS 2 mapping for Essential and Important entities Apr 12, 2026 · release notes

    Updated NIS 2 framework mapping removes broad provisions, streamlining scope for Essential and Important entities with refined controls.

80. Eliminate compliance noise with automated device exclusion Mar 19, 2026 · release notes

    Automated device exclusion from compliance evaluation based on employee checklist scope

    • Devices from integrations not required by an employee’s applicable checklist are hidden from employee technical details and excluded from compliance evaluation, task generation, and evidence automation.
    • Compliance status, evidence automation, and task generation are now scoped strictly to in-scope integrations defined by the employee's checklist.
    • Device visibility and compliance recalculation are automatically triggered on the next sync when an employee's checklist changes.

    3 details in Everything

81. UI improvements to the Employee Portal for a modern, user experience Mar 19, 2026 · release notes

    UI improvements to the Employee Portal for a modern user experience

    • Security Checklist clearly communicates that items are completed automatically.
    • Quiz navigation updates remove clickable number cards and set accurate expectations about answer submission.
    • Trainings tab is hidden when it is the only navigation option.
    • Instructional screenshots display an Example watermark to distinguish them from interactive UI elements.

    4 details in Everything

82. Track audit preparation and continuous compliance tasks effortlessly from the Ta Mar 18, 2026 · release notes

    Task Center adds Audit Prep and Continuous Compliance tabs in closed beta; contact your CSM to enable them.

    • In closed beta, the Audit Prep tab centralizes audit tasks, pending status, assignees and completion percentage; contact your CSM to enable access.

    1 detail in Everything

83. View all your assigned compliance tasks (across Scrut) in one place Mar 18, 2026 · release notes

    Adds My Tasks tab in Task Center to view all assigned compliance items in one place.

    • Adds My Tasks tab inside Task Center that aggregates compliance tasks (Policies, Evidence, Vulnerabilities, Vendors, Audit Requests, and Findings) across Scrut for a specific user.

    1 detail in Everything

84. Import your risk register faster with a simplified 3-step upload Mar 17, 2026 · release notes

    Simplified 3-step risk register import with in-app column mapping and preview.

    • Adds Risk -> Risk Management > Add Risk -> Import via CSV/XLSX flow allowing direct upload of unformatted CSV or XLSX files
    • Adds interactive column mapping step to match source file headers to Scrut fields without pre-formatting templates
    • Adds data preview and error highlighting during import with downloadable error report before final save

    3 details in Everything

85. Add an approval step to every risk mitigation task before closing it Mar 17, 2026 · release notes

    Adds mandatory approval workflow for mitigation tasks in Scrut

    • Adds a formal review-and-approval step to every mitigation task before it can be closed.
    • Allows assignees to select an approver when creating a mitigation task, defaulting to the risk assignee or task creator.

    2 details in Everything

86. Mark attachments mandatory for specific questions in vendor assessments Mar 16, 2026 · release notes

    Adds mandatory attachment enforcement per question and CSV column in vendor assessments

    • Enforces attachment uploads as a required step for specific questions in Vendor Assessment questionnaires, preventing submission until all are provided.
    • Adds an Attachment Required (Yes/No) column to support bulk configuration of mandatory attachments via CSV import.

    2 details in Everything

87. Improvements to Vendors synced from your Integrations Mar 16, 2026 · release notes

    Integration-synced vendors are now archiveable with a visible Source column and Audit Logs in Vendor Onboarding.

    • Adds Source column to the default Vendor Table view
    • Enables archiving (instead of deleting) for integration-synced vendors
    • Adds an Audit Logs sub-tab under Risk -> Vendors -> Onboarding

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Integration-synced vendors can no longer be deleted directly; use archive instead to prevent re-creation after sync
88. Import security questionnaires seamlessly with smart field selection Mar 15, 2026 · release notes

    New field selection step in Questionnaire Import UI enables mapping Questions/Answers for complex formats.

89. Confirm completion before closing an audit Mar 15, 2026 · release notes

    Adds confirmation modal for closing audits in Scrut

90. Hide empty Trust Portal sections to give visitors a cleaner view Mar 15, 2026 · release notes

    Trust Portal automatically hides empty sections and shows a message if nothing is published

    └──▷ HOW TO FIND IT
    Share the Trust Portal during setup; visitors see only published sections or an informative message if none are published.
    📍Share your Trust Portal URL with customers, prospects, and other stakeholders at any time during the creation process.
    • Hides Trust Portal sections that contain no published data (Compliance, Controls, Subprocessors, FAQs, Updates) from visitor view
    • Displays a clear informative message to visitors when no data has been published in any section

    2 details in Everything

91. Upload evidence and let Scrut Teammates flag gaps automatically Mar 12, 2026 · release notes

    With Scrut AI enabled, Scrut Teammates automatically surfaces evidence gaps on upload.

    • With Scrut AI enabled for the account, proactively surfaces evidence gaps at artifact upload without a manual trigger.
    • Adds Refresh button to re-run gap analysis on demand after changes
    • Adds thumbs-up/thumbs-down feedback option for each gap analysis result

    3 details in Everything

92. Auto-notify customers and stakeholders about your Trust Portal updates Mar 12, 2026 · release notes

    Adds Trust Portal subscription management and auto-notify subscribers to Trust Vault settings

    • Trust Portal Subscription setting added to Trust Vault Additional Settings for enabling subscriber notifications
    • Subscribe to Updates option added to Trust Portal overview for viewer self-service subscriptions
    • Notify Subscribers toggle added when adding or editing updates in the trust portal overview

    3 details in Everything

93. Map controls to policies faster with AI-suggested mappings Mar 11, 2026 · release notes

    With Scrut Teammates enabled, Scrut suggests control mappings for uploaded policies.

    • With Scrut Teammates (Scrut AI) enabled for the account, suggests control mappings for policy documents uploaded through the Policy module.
    • Enables triggering AI suggestions from the existing policy mapping view

    2 details in Everything

94. Personalize evidence templates to match your organizational requirements Mar 11, 2026 · release notes

    Scrut adds in-product rich-text editing for evidence templates with bold, headings and lists

    • Enables inline formatting (bold, italic, headings, bullet/numbered lists, links) on evidence templates via the rich-text editor

    1 detail in Everything

95. Import an existing policy file and edit it directly in Scrut Mar 10, 2026 · release notes

    Import existing policy files into the inline editor; a notification confirms when processing is complete and editing is ready.

    • Adds ability to import existing policy files (including PDF) directly into the inline editor during policy creation, enabling direct editing rather than just attaching them.

    1 detail in Everything

96. New framework: ISO/IEC 27701:2025 now available in Scrut Mar 10, 2026 · release notes

    Scrut adds ISO/IEC 27701:2025ISO/IEC 27701:2025An international standard extending ISO/IEC 27001 to cover privacy information management, giving organizations a certifiable framework for demonstrating GDPR and broader privacy-law compliance. framework support in the Frameworks module

    • Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27701:2025 to the Frameworks module for privacy control integration with ISO 27001.
    • Provides integrated controls mapping to link existing ISO 27001 controls to PIMS-specific privacy requirements.
    • Includes a default Statement of Applicability (SOA) for ISO 27018 with pre-suggested in-scope controls and out-of-scope justifications.

    3 details in Everything

97. Customize your exports with flexible column selection Feb 23, 2026 · release notes

    New export modal enables column-level selection for supported tables

    • Adds an export column picker for supported tables; required default columns remain included and cannot be removed.
    • Adds Select all and Deselect all options to adjust selectable export columns, while required default columns stay included.

    2 details in Everything

98. Explicit Access Review sign-off with app-by-app approvals Feb 22, 2026 · release notes

    Adds explicit Send for Approval, Approve/Decline actions and audit logging for Access Reviews.

    • Reviewers can now trigger the Send for Approval action on individual application reviews to create a clear handoff to Approvers
    • Approvers gain new UI options to Approve or Decline pending access reviews, requiring a reason if declined
    • All access review actions and comments are now audit-logged for compliance traceability

    3 details in Everything

99. Workflow improvements for more consistent approvals and actions Feb 22, 2026 · release notes

    UI layout changes improve workflow consistency for approvals and actions across Policy and Evidence modules.

100. Ensure environment separation across your entire cloud stack Feb 19, 2026 · release notes

     CAT test now evaluates environment separation across compute, containers, databases, storage, VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules., serverless, and monitoring assets

     • Expands the Separate Environments Exist for Development, Test, and Production CAT test to evaluate environment separation across all relevant cloud asset categories—not just compute instances.
     • CAT test now supports six additional asset categories: Container platforms, Databases, Storage, Virtual networks, Serverless functions, and Monitoring and logging resources.

     2 details in Everything

101. Review dates for evidence tasks and policies now align with recurrence Feb 19, 2026 · release notes

     Evidence task and policy review dates now align with recurrence periods regardless of upload timing.

     • Evidence Tasks and Policies now transition to Needs Review at the start of each new recurrence period (monthly, quarterly, bi-annually, or annually) regardless of when evidence for the prior period was uploaded.

     1 detail in Everything

102. Access-focused CATs are now easier to investigate and fix Feb 19, 2026 · release notes

     Access Deprovision and User Association tests now redirect to filtered Access Overview pages

     • Adds clickable resources in Access Deprovision Test and User Association Test findings that redirect to the Access Overview page with pre-applied filters for the specific user or access involved
     • Expands test descriptions and remediation steps for Access Deprovision Test and User Association Test with more detailed, practical guidance

     2 details in Everything

103. Introducing approval workflow for corrective actions Feb 18, 2026 · release notes

     Scrut adds a formal approval workflow for corrective actions with approver assignment and status tracking

     • Adds Submit for Review, Approve and Close, and Request Revision actions within the corrective actions module to enforce oversight
     • Allows assigning an approver when creating a corrective action (defaulting to finding or corrective action creator)

     2 details in Everything

104. Collaborate faster with multiple assignees for audit tasks Feb 18, 2026 · release notes

     Adds CSV import support and multi-select UI for assigning multiple assignees to audit items

     • CSV import now supports multiple assignees for bulk operations on findings, requests, or corrective actions
     • Multi-select dropdown added to Assignees field for findings, requests, or corrective actions

     2 details in Everything

105. Assign a risk to multiple departments to reflect cross-functional ownership Feb 17, 2026 · release notes

     Multi-select Department field in Risk Management for cross-functional risk ownership.

     • Department field in Risk Management now supports multiple selections

     1 detail in Everything

106. Clearer audit logs for vendor questionnaires Feb 17, 2026 · release notes

     Audit logs for vendor questionnaires now include the respondent's name and email ID.

     • Adds vendor user name and email ID to questionnaire submission audit logs
     • Displays questionnaire-related audit logs directly within the questionnaire's Audit Logs tab

     2 details in Everything

107. Showcase your security posture with professional DAST reports Feb 16, 2026 · release notes

     Scrut adds PDF report generation for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings via Vulnerabilities or Reports modules

     • Adds the ability to generate comprehensive professional PDF reports for DAST findings directly from the platform

     1 detail in Everything

108. Remediate vulnerabilities faster with enriched third-party scan findings Feb 16, 2026 · release notes

     Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores and treatment plans to third-party scan findings; the enhanced experience requires enablement through the CSM.

109. Track risk lifecycle precisely with a visual timeline & built-in review cycles Feb 16, 2026 · release notes

     Scrut adds a visual risk lifecycle timeline and built-in review schedules for treated risks

     • Adds a guided visual timeline on the Risk Detail page to move risks from open to Treated status
     • Adds built-in review schedule options (Monthly, Quarterly, Biannually, Annually, Custom, or Never) for monitored risks

     2 details in Everything

110. Get more accurate questionnaire autofill responses with entity-based scoping Feb 15, 2026 · release notes

     The multi-entity add-on scopes Vault content and questionnaire autofill to the selected entity.

     • With the multi-entity add-on, scopes Vault content and Questionnaire Automation by entity so autofill uses only matching documents and policies.
     • With the multi-entity add-on, adds a bulk action to assign entities to Vault files.
     • Adds Organization-wide as the default scope for existing content when multi-entity support is enabled.

     3 details in Everything

111. Teammates Evidence Checker is now available for all manual evidences Feb 15, 2026 · release notes

     With Scrut Teammates enabled, Evidence Checker expands AI quality assessment to all manually uploaded evidence.

     • With Scrut Teammates enabled, adds a Check with Scrut Teammates option to every manually uploaded evidence for AI-powered quality assessment.
     • With Scrut Teammates enabled, generates quality reports covering strengths, gaps, and improvement suggestions for all manual evidence instead of a limited subset.

     2 details in Everything

112. Track real-time user engagement with the revamped Trust Portal dashboard Feb 15, 2026 · release notes

     New Trust Vault Insights dashboard with engagement metrics and time filtering in the Trust Portal.

     • Adds Trust Vault > Dashboard for real-time trust portal engagement visibility
     • Adds time period filters (last 7/30/90 days, since account creation) to the Trust Vault Insights dashboard
     • Adds Trust Portal Views metric with total views and daily/weekly/monthly trends
     • Adds Access Requests Processed breakdown (pending, auto-approved, manual, declined)
     • Adds Top Engaged Documents list showing most viewed/downloaded files

     +1 more show less

     • Adds Most Active Accounts or Users view to identify high-engagement actors

     6 details in Everything

113. One-click export from the Chrome Extension to your questionnaire webpage Feb 12, 2026 · release notes

     The Questionnaire Automation add-on adds one-click Chrome Extension export into questionnaire webpages.

     • As part of the Questionnaire Automation add-on, adds a one-click Export button in the Chrome Extension to push generated answers into live questionnaire form fields.
     • Within the Questionnaire Automation add-on, tags autofilled responses and user-edited content distinctly.

     2 details in Everything

114. Get the complete picture on vendor risks with streamlined suggestions from Teamm Feb 12, 2026 · release notes

     Unified vendor risk management actions and automatic detection from questionnaire attachments

     • Shows clear risk sources indicating whether a risk originated from a questionnaire, specific question, or attachment.

     1 detail in Everything

115. Fix cloud tests faster with AI-powered remediation steps added to Jira tickets Feb 12, 2026 · release notes

     Cloud-module Jira tickets use AI remediation steps when Teammates AI is enabled and an AI fix exists; otherwise they use manual remediation steps.

116. New Partner Portal to manage multiple customer accounts with workspaces Feb 11, 2026 · release notes

     New Partner Portal in Scrut adds workspace-based multi-customer management and role assignment via the console interface.

     • Adds a new Partner Portal at console.scrut.io for managing multiple customer accounts using workspaces instead of impersonation.
     • Adds Add workspace workflow to onboard customers by entering workspace name, legal organization name, and hosting region (e.g., US).
     • Adds Users tab within a workspace to assign workspace-specific roles (Admin, Contributor) and customize module-level access.
     • Adds Request framework action inside a workspace to request HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., etc., notifying the CSM automatically.

     4 details in Everything

117. New framework: Scrut now supports FedRAMP Moderate Feb 11, 2026 · release notes

     Scrut adds FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. framework support with 300+ NIST SP 800-53 controls and pre-configured policies.

     • Adds FedRAMP Moderate framework option in the Frameworks module
     • Provides pre-configured policy templates aligned to NIST SP 800-53 for the Moderate baseline

     2 details in Everything

118. New framework: ISO/IEC 27018:2025 is now available in Scrut Feb 11, 2026 · release notes

     Scrut adds ISO/IEC 27018:2025ISO/IEC 27018:2025An ISO/IEC standard specifying privacy controls for public cloud providers that process personal data, giving cyber tools a recognized compliance baseline for handling PII in cloud environments. framework support for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. compliance.

     • Adds ISO/IEC 27018:2025 to the Frameworks module, enabling automated Statement of Applicability (SOA) generation with in-scope control suggestions and pre-filled justifications for out-of-scope controls.

     1 detail in Everything

119. New integrations: Hexnode and OpenProject Jan 11, 2026 · release notes

     Adds Hexnode and OpenProject integrations via new Integrations menu paths for device and project tracking sync.

     • Adds Hexnode integration accessible via Integrations -> Mobile Device Management to sync mobile device managementmobile device managementMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. data into Scrut.

     1 detail in Everything

120. Skip templates and import assets with guided field mapping Jan 11, 2026 · release notes

     Guided field mapping for asset import via CSV/XLSX without templates

121. Capture the full picture: Sync inline images and attachments from Jira Jan 11, 2026 · release notes

     Jira Evidence Tasks can sync inline images and embedded attachments when the include-attachments option is enabled.

122. Teammates Chat now suggests clickable follow-up questions for better context Jan 8, 2026 · release notes

     Teammates Chat UI now surfaces clickable follow-up question suggestions.

123. Stay on top of what matters with the improved notifications center Jan 8, 2026 · release notes

     Enhanced Notification Center consolidates over 100 notifications across core workflows.

     • Expands the existing Notification Center, accessible through the top-right bell icon, with more than 100 notifications across artifacts, comments, tasks, reviews, exports, assessments, and user-access workflows.

     1 detail in Everything

124. New framework: 21 CFR Part 11 now available in Scrut Jan 7, 2026 · release notes

     Scrut adds a new 21 CFR Part 11 framework for FDA compliance management in the Frameworks module

125. Boost your compliance coverage with new integrations, tests, and monitors Dec 14, 2025 · release notes

     Scrut adds Phished, Bitbucket, Kolide, Linear, MongoDB, Fivetran, Freshdesk, Paycom HR integrations plus AWS/MongoDB firewall monitors.

     • Adds support for eight new integration sources: Phished, Bitbucket, Kolide, Linear, MongoDB, Fivetran, Freshdesk, and Paycom HR.
     • Adds two auto-created compliance tests for every app in Access Overview to monitor provisioning and deprovisioning workflows.

     2 details in Everything

126. Gain full visibility into Groups and Checklists changes with expanded audit logs Dec 14, 2025 · release notes

     Expanded audit logs capture creation, update, and deletion events for Groups and Checklists.

     └──▷ HOW TO FIND IT
     Access the new Groups and Checklists change history via the UI.
     📍Navigate to People -> Employees -> Settings -> Audit Logs
     • Track all changes to Groups and Checklists with comprehensive audit logging
     • Navigate to People -> Employees -> Settings -> Audit Logs to access the complete audit history

     2 details in Everything

127. Scrut Agent now offers automated diagnostics for faster troubleshooting Dec 14, 2025 · release notes

     Scrut Agent adds automated diagnostics for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., firewall and connectivity checks with enhanced logging

     • Adds diagnostics that automatically check VPN configuration, firewall settings and internet connectivity on install and every 3 days.
     • Enables on-demand diagnostic triggers via the UI Run Diagnostics Again button.

     2 details in Everything

128. Configure your GitHub integration by Topics for smarter, scalable repo managemen Dec 11, 2025 · release notes

     Adds GitHub integration scoping by Topics and auto-include for new repos matching selected topics

     • Enables selection of GitHub Topics (e.g., "backend," infra) to scope the Scrut integration instead of individual repositories
     • Adds Auto-include future repos matching selected topics option to automatically ingest newly created repos tagged with those Topics

     2 details in Everything

129. Submit and manage VAPT target details directly in Scrut Dec 11, 2025 · release notes

     Adds Manage VAPT settings section with guided forms for web, mobile, API, network, and source code targets

     • Adds Manage VAPT section under Settings for submitting and managing VAPT target details
     • Enables submission of target details via purpose-built forms for web, mobile, API, network, and source code targets
     • Sends automatic notifications to CSM, VAPT team, and selected POCs when VAPT targets are added or updated

     3 details in Everything

130. Get complete visibility into the resources covered by each vulnerability scan Dec 11, 2025 · release notes

     New vulnerability scans show the count and list of scanned resources; scans completed before this release do not have this data.

     • Adds scanned-resource counts and lists to Vulnerabilities > Targets > Target Details for scans completed after this feature release; older scans do not have this data.

     1 detail in Everything

131. Mark vendors under evaluation as Prospective for easy identification Dec 10, 2025 · release notes

     Adds Prospective vendor status for tracking vendors under evaluation

     • New Prospective and Active vendor status options when adding or managing vendors
     • Distinct icon display for prospective vendors in the UI
     • Vendor status filter to view prospective, active, or archived vendors
     • Ability to switch vendors between prospective and active status via the three-dot menu

     4 details in Everything

132. New accounts have Scrut pre-populated as a vendor for faster assessments Dec 10, 2025 · release notes

     New accounts now have Scrut Automation pre-populated as a default vendor with risk attributes and Trust Vault docs

133. Flexible policy editing: Choose when to save your changes with manual save Dec 10, 2025 · release notes

     Adds optional manual policy saving with a Save button; manual mode allows one editor at a time.

     • Adds a Policy Autosave toggle in Policy Settings to disable automatic saving
     • In manual mode, adds a Save button to create revision entries explicitly; editing is restricted to one user at a time.

     2 details in Everything

134. Prioritize work faster with Effort Estimates on tests, policies, and evidence Dec 9, 2025 · release notes

     Adds effort estimates (High/Medium/Low) to tests, policies, and evidence tasks for prioritization

     • Displays effort estimates for tests, policies, and evidence; default tags currently cover select frameworks such as ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against..
     • Users can sort or filter tasks by the new effort tags (High, Medium, Low).
     • Individual effort estimates can be adjusted by clicking into an artifact and editing the Effort Estimate field.
     • Bulk editing of effort estimates is now supported for multiple selected items simultaneously.
     • New evidence or policies created by users can include an effort estimate upon creation.

     5 details in Everything

135. Enable Policy IDs for automatic, sequential numbering of your policies Dec 9, 2025 · release notes

     Scrut adds automatic sequential Policy IDs with custom prefixes for audit traceability

     • Enables automatic, sequential numbering of policies via a toggle in Policy Settings, allowing a custom prefix (up to 10 alphanumeric characters) before the system-assigned sequence.
     • Displays assigned Policy IDs in a new mandatory column in the policy table and on policy detail pages.
     • Does not reuse IDs from deleted policies while Policy IDs are enabled; disabling the feature permanently removes all assigned Policy IDs.

     3 details in Everything

136. Export questionnaires with attachments in a single ZIP file Dec 8, 2025 · release notes

     Export questionnaires with attachments in a single ZIP file from the Trust module

137. Scrut Teammates is now available in Slack for instant compliance answers Dec 8, 2025 · release notes

     Scrut Teammates Slack integration enables in-channel compliance Q&A with source citations.

     • Adds Slackbot integration for Scrut Teammates to answer compliance questions directly within Slack workspaces

     1 detail in Everything

138. New framework: TISAX v6.0.3 is now available on Scrut Dec 7, 2025 · release notes

     Adds support for TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. v6.0.3 framework with controls for Prototype Protection, Data Protection, and High Protection

     • New framework: TISAX v6.0.3 is now available on Scrut

     1 detail in Everything

139. New framework: HITRUST CSF e1 is now available on Scrut Dec 7, 2025 · release notes

     Scrut introduces HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. e1 framework support, enabling organizations to assess foundational security and privacy controls with a 1-year review cycle. Users can now manage controls, assign owners, and generate readiness reports directly within the Frameworks module.

140. New Framework: HITRUST i1 is now available on Scrut Dec 7, 2025 · release notes

     Scrut adds support for the HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. i1 framework

141. Manage files effortlessly in the Vault module with bulk download and deletion Nov 16, 2025 · release notes

     Scrut Vault module adds bulk download and delete actions for files and folders

     • Adds bulk download capability in the Vault module, allowing selection of multiple files or folders to be sent as a .zip file link via email.
     • Adds bulk delete capability in the Vault module, enabling selection of multiple items for removal.

     2 details in Everything

142. Tag assets by environment (Dev, Test, Prod) for clearer inventories Nov 13, 2025 · release notes

     Adds environment tagging (Dev/Test/Prod) and filtering for assets in the Asset Management module.

     • Adds an Environment column across all asset tables to display asset categorization.
     • Enables filtering assets by Environment values: Development, Test, or Production.
     • Adds bulk environment assignment capability to update multiple assets' environments in a single step.

     3 details in Everything

143. Get instant, contextual answers with Teammates on Trust Portal Nov 13, 2025 · release notes

     Adds Teammates chat on Trust Portal with configurable access control via UI settings

     • When enabled in Trust Portal settings, Teammates answers visitor questions using portal content and documents while respecting existing RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions.
     • Adds Trust Portal settings configuration to control Teammates access (signed-in only or anonymous+signed-in)

     2 details in Everything

144. Easier campaign setup with auto-filtered, framework-specific trainings Nov 13, 2025 · release notes

     Auto-filtering of training modules in campaign setup to show only framework-specific content.

     • When creating or editing employee training campaigns, the UI now automatically filters out irrelevant training options and displays only modules linked to purchased frameworks.

     1 detail in Everything

145. Streamline onboarding with Scrut-suggested policies in employee checklist Nov 13, 2025 · release notes

     New UI section streamlining policy assignment during employee onboarding.

146. Trust Vault UI updated for streamlined navigation & a more intuitive experience Nov 13, 2025 · release notes

     Trust Vault UI refreshed with streamlined navigation and intuitive layout updates

     └──▷ HOW TO FIND IT
     Quickly preview a compliance document directly from the Controls list.
     📍Click any document name to open the preview
     • Removes scroll bars from description text fields in favor of a View More button.
     • Displays missing fields as '--' in Admin view and hides them in Portal view.
     • Defaults Controls section to show three documents with View More for additional files.
     • Enables direct document preview by clicking the document name, removing the previous Eye icon.

     4 details in Everything

147. Stay on top of updates with the new Notifications Center Nov 13, 2025 · release notes

     Scrut adds a Notifications Center accessible via the top-bar bell icon for billing and platform alerts.

     └──▷ HOW TO FIND IT
     Check for critical billing issues or platform downtime alerts without leaving your current workflow.
     📍Click the bell icon in the top bar
     • Adds a new Notifications Centre UI module consolidating billing, downtime, integration, and announcement updates in one place
     • Introduces a bell icon in the top bar with an unread count badge to access the Notifications Centre
     • Adds a Show Only Unread toggle within the Notifications Centre to filter for new items

     3 details in Everything

148. Import and export spreadsheet questionnaires in any format with Teammates Nov 12, 2025 · release notes

     Teammates now imports and exports any spreadsheet questionnaire format with AI autofill

     • Adds support for importing spreadsheet questionnaires in any format to Teammates

     1 detail in Everything

149. Bulk import questions via the Teammates Chrome extension Nov 12, 2025 · release notes

     Teammates Chrome extension gains bulk question import from vendor portals

150. Set up granular resource scoping for multi-environment AWS accounts Nov 12, 2025 · release notes

     Scrut adds granular AWS resource scoping via tags, regions, and types per Role ARN in the UI

     • Adds tag-based rules (Key, Operator, Value combinations) to filter AWS resources within a connected account

     1 detail in Everything

151. Enhanced SOC 2 Framework with 2022 Revised Points of Focus Nov 12, 2025 · release notes

     Scrut SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. framework updated to 2022 Revised Points of Focus with refined control mappings

     • Updated SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 framework requirements to align with the 2022 Revised Points of Focus and 2017 Trust Services Criteria terminology.
     • Refined control mappings in the SOC 2 framework for enhanced clarity between control descriptions and required outcomes.
     • Optimized evidence suggestions in the SOC 2 framework by removing irrelevant or poorly described items to reduce compliance overhead.

     3 details in Everything

152. Capture key findings in vendor reviews with the new Assessment Summary Nov 12, 2025 · release notes

     Adds Assessment Summary field to vendor questionnaires and PDF export filtering

     └──▷ HOW TO FIND IT
     Control comment visibility in exported vendor risk assessment PDFs.
     📍When exporting the report as PDF, choose whether to include or exclude comments for each question.
     • Adds an Assessment Summary field to vendor questionnaires for recording key insights.
     • Enables downloading PDF reports for all vendors, including those without an associated questionnaire
     • Adds control over including or excluding comments per question when exporting vendor reports as PDF

     3 details in Everything

153. Get complete user access visibility across apps with Access Matrix Nov 12, 2025 · release notes

     The Access Matrix page offers a comprehensive view of user roles across applications.

154. Manage multiple business entities from a single, unified Trust Portal Nov 12, 2025 · release notes

     Adds multi-entity support in Trust Vault for entity-specific content segregation and management via Settings.

     • Enables managing multiple business entities from a single unified Trust Portal with entity-specific content sharing
     • Adds Settings → Manage Entities navigation to add new entities, assign names, and designate owners
     • Adds Settings → Multi Entity toggle in the Trust Vault module to enable multi-entity support
     • Allows selecting which entities to display and choosing a default entity for the public trust portal
     • Enables tagging trust content (frameworks, controls, sub-processors, FAQs, updates) to specific entities or org-wide

     +2 more show less

     • Provides a dropdown at the top corner of the page for visitors to switch between different entities
     • Applies access controls per entity and shows which entity the requester is viewing when approving access requests

     7 details in Everything

155. New framework: UAE Personal Data Protection Law (PDPL) Nov 12, 2025 · release notes

     Adds UAE PDPL compliance framework with control tracking and reporting

     • Adds UAE Personal Data Protection Law (PDPL) as a selectable framework in the Frameworks module
     • Enables mapping of PDPL requirements to internal policies and risk management processes
     • Adds control owner assignment and implementation status tracking for PDPL controls
     • Generates compliance readiness reports for the UAE PDPL framework

     4 details in Everything

156. Access Review now supports 90+ applications Nov 12, 2025 · release notes

     Access Review now supports 94 applications including AWS, Azure, Salesforce, and GitHub for centralized access management

     • Expands Access Review to support 94 popular applications across Design, Productivity, HR, Sales, Finance, Engineering, Security, and Support categories

     1 detail in Everything

157. Experience a cleaner, more intuitive Frameworks Dashboard page Oct 9, 2025 · release notes

     UI refresh improves navigation and consistency across Frameworks Dashboard and Detail Pages.

158. Easily distinguish between upcoming and in-progress audits Oct 8, 2025 · release notes

     Scrut adds an Upcoming audit status to distinguish future audits from in-progress ones

     • Adds an Upcoming status for audits with future start dates that have no findings or requests yet
     • Automatically transitions an Upcoming audit to In Progress when findings or requests are added or the start date arrives

     2 details in Everything

159. Clarify remediation steps with new corrective and preventive action fields Oct 8, 2025 · release notes

     Scrut adds Corrective Action Name, Description and Preventive Action fields to Audit Center

160. Expand compliance coverage with 5 new automated tests Oct 8, 2025 · release notes

     Adds 5 new automated compliance tests for AWS DocumentDB, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. backups, risk register, capacity monitoring, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS.

     • New DocumentDB Cluster Encrypted test verifies AWS DocumentDB clusters are encrypted at rest
     • New EC2 Backups Enabled test checks whether Amazon EC2 instances have backup mechanisms enabled
     • New No Risks Are in Open State test ensures all risks logged in Scrut’s Risk Register are mitigated, accepted, or closed
     • New Third-party Tool Used for Capacity Monitoring test validates the use of a recognized third-party monitoring tool for capacity monitoring
     • New Data in Transit is Encrypted test enables adding web platform domains as resources and runs automated SSL/TLS scans to verify minimum A-grade encryption

     5 details in Everything

161. 4 new automated evidence types added in Scrut Monitor Oct 7, 2025 · release notes

     Scrut Monitor adds automated evidence collection for AWS CloudWatch, GCP Firewall, Azure NSG, and Access Reviews

     • Adds AWS CloudWatch Alarms automated evidence type to collect capacity and availability monitoring proof in CSV format.
     • Adds Scrut Access Review Reports evidence: the first run pulls completed reports from the past 365 days, and later runs pull only new reports.
     • Adds GCP Firewall Rules automated evidence type to list network traffic restrictions across selected GCP projects in CSV format.
     • Adds Azure NSG Rules automated evidence type to collect firewall/NSG rules across Azure subscriptions in CSV format.

     4 details in Everything

162. Automate Jira evidence collection with Scrut Monitor Oct 7, 2025 · release notes

     Scrut Monitor adds automated Jira evidence collection via JQL and scheduled CSV/PDF exports.

     • Adds automated Jira evidence collection to Scrut Monitor using custom JQL queries.
     • Supports scheduling monitors at daily, weekly, or monthly cadences to auto-generate timestamped CSV and PDF files.
     • Adds UI navigation path to add a monitor: navigate to an evidence item and click the Add/Upload Attachment button.

     3 details in Everything

163. Azure DevOps integration upgraded to Microsoft Entra ID OAuth for enhanced secur Oct 7, 2025 · release notes

     Azure DevOps integration now uses Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. OAuth with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support; existing accounts must reconnect to continue using it.

     └──▷ HOW TO FIND IT
     Reconnect Azure DevOps account using new Entra ID auth to restore integration.
     📍Navigate to Integrations → Azure DevOps in Scrut and follow the prompts to reconnect using Microsoft Entra ID OAuth.
164. Bulk actions for efficient risk management Oct 6, 2025 · release notes

     Adds bulk editing, status changes, and deletion of multiple risks from the Risk Register UI

     • Adds multi-select capability in the Risk Register allowing users to select multiple risks via checkboxes for subsequent bulk operations.
     • Adds Edit button in the Risk Register toolbar to update common fields (assignee, department category, custom fields) across all selected risks simultaneously.
     • Adds bulk status transition actions (monitoring, reset, close) for selected risks in the Risk Register.
     • Adds bulk deletion capability with confirmation prompt for removing multiple risks from the Risk Register.

     4 details in Everything

165. New framework: EU AI Act now available on Scrut Oct 6, 2025 · release notes

     Scrut adds EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. framework support in the Frameworks module for compliance management.

166. Saudi Arabia PDPL mapping updated for accurate compliance Oct 6, 2025 · release notes

     Scrut updated Saudi Arabia PDPL control mapping and evidence requirements for compliance.

     • Updated Saudi Arabia PDPL mapping with comprehensive verification against official articles
     • Refined existing control mappings for clarity and consistency
     • Optimized evidence requirements by removing irrelevant suggestions

     3 details in Everything

167. Smarter training management: Bulk quiz uploads, restore defaults, and better Tra Sep 9, 2025 · release notes

     Adds bulk quiz uploads and default training restoration to the Training Campaigns module

     • Enables bulk upload of quiz questions via a downloadable sample template in the People → Training Campaigns module
     • Adds Custom and Default tags to quickly identify training types
     • Adds zoom-in/out and full-screen mode support for document and video content in the Training Portal

     3 details in Everything

168. View framework requirements and controls in one unified interface Sep 9, 2025 · release notes

     New unified Controls & Requirements view across Frameworks, Policies, Evidence, Tests, Risks, Audits, and Audit Findings modules.

     • Enables linking and unlinking at either the requirement level or specific control level within the unified view

     1 detail in Everything

169. Enrich your vendor data with our updated import template Sep 8, 2025 · release notes

     The vendor import template adds service descriptions and assessment fields for bulk onboarding.

     • Enhances the vendor import template with service description, assessment status and justification, last assessment date and assessor, recurrence, and next assessment date.
     • Adds Service Description field to the import template
     • Adds Assessment Status field with options: Not Assessed, In Progress, Assessed, Needs Reassessment
     • Adds Assessment Justification field to the import template
     • Adds Last Assessment Date field to the import template

     +3 more show less

     • Adds Last Assessed By field to the import template
     • Adds Recurrence field with options: Annually, Biannually, Quarterly, Monthly, Never, Custom
     • Adds Next Assessment Date field to the import template

     8 details in Everything

170. Enhanced mitigation task visibility with department organization Sep 8, 2025 · release notes

     Adds department assignment and filtering for mitigation tasks in Scrut

     • Enhanced mitigation task pages now display risk entity and treatment strategy details.
     • Mitigation task creation allows assigning departments via the risk assessment modal or creation form (defaulting to the linked risk's department).
     • The dashboard mitigation task donut chart now supports filtering by department alongside existing assignee filters.

     3 details in Everything

171. Scrut Teammates can now read and summarize documents in your Trust Vault Sep 7, 2025 · release notes

     Scrut adds AI Readability toggle in Trust Vault to let Teammates read and summarize documents

172. Add context to vendor records with the new 'Service Description' field Sep 7, 2025 · release notes

     New Service Description field on Vendor Details page for documenting vendor services.

173. Boost your compliance posture with 9 new automated tests and 64 new Kolide check Sep 4, 2025 · release notes

     Adds 9 new automated compliance tests and syncs 64 new Kolide checks for continuous monitoring

     • Adds 9 new automated tests that surface findings into evidence tasks, tests, dashboards, and reports.

     1 detail in Everything

174. Teammates chat is now available for contributors Sep 4, 2025 · release notes

     Contributors with the required RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions can access Teammates AI chat through the bottom-right chat icon.

175. Import employee data automatically from JumpCloud Sep 4, 2025 · release notes

     Scrut Automation now supports automatic employee data import from JumpCloud via a new integration toggle and group selection.

     • Enables JumpCloud IDP toggle in the Integrations -> JumpCloud page to allow employee data import directly into Scrut
     • Adds Groups dropdown on the JumpCloud integration page to select which JumpCloud groups contribute employees

     2 details in Everything

176. New framework: CMMC Level 3 now available on Scrut Sep 3, 2025 · release notes

     Scrut adds CMMC Level 3 framework support with pre-mapped controls and cross-framework mappings.

     • Adds CMMC Level 3 to the Frameworks module for compliance tracking

     1 detail in Everything

177. Support for 16 new integrations in Access Reviews Sep 3, 2025 · release notes

     Access Reviews module adds support for 16 new application integrations

     • Adds Active Campaign, Anthropic Claude, Cal.com, Databricks, Fireflies, Hive, NetSuite, Oracle Cloud HCM, Oracle Sales & Fusion Service, PandaDoc, SendGrid, Sentry, Snowflake, Stripe, Sumo Logic, and Tableau as supported applications in Access Reviews
     • Expands total supported integrations for Access Reviews to over 108

     2 details in Everything

178. Mapping updated for ISO 20000-1:2018 for accuracy Sep 3, 2025 · release notes

     Improved ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 20000-1:2018 compliance mapping with comprehensive requirements and corrected control mappings.

     • Updated ISO 20000-1:2018 framework mapping to include all previously missing requirements
     • Remapped evidence and policies for a more intuitive compliance process

     2 details in Everything

179. Focus your risk insights with entity-based filters in Dashboard and Reports Sep 2, 2025 · release notes

     Entity-based filters added to Dashboard and Reports for focused risk views

     • Adds entity filtering to Risk Management Dashboard status metrics, risk heatmaps, treatment strategies, and assignee breakdowns; the Risk Trend graph remains organization-wide.
     • Adds entity filter option in the report export modal to generate PDF reports containing only risks for the selected entity

     2 details in Everything

180. Manage your Scrut Team with ease: Introducing user deactivation and reactivation Sep 2, 2025 · release notes

     Admins gain user deactivation, reactivation, task reassignment, and permanent deletion workflows in Manage Users.

     • Adds a Deactivate button in Manage Users so admins can disable user account access.
     • Allows admins to reassign all tasks from a deactivated user to a new assignee.
     • Allows admins to reactivate users, restoring their access and non-reassigned tasks.
     • Allows admins to permanently delete users with double confirmation.
     • Adds a Deactivated Users filter in task views to identify tasks assigned to inactive accounts

     5 details in Everything

181. Improved folder and file management in Vault Sep 2, 2025 · release notes

     Adds bulk folder and multi-file move capabilities within the Vault UI for faster documentation reorganization.

     └──▷ HOW TO FIND IT
     Select multiple non-contiguous files for bulk moving.
     📍Click the first file, hold Command (Mac) or Control (Windows), and click additional files
     • Adds the ability to move entire folders with nested files and subfolders in one action via the Vault UI
     • Enables selecting file ranges by clicking the first file, holding Shift, and clicking the last file
     • Allows bulk selection of specific non-contiguous files by holding Command (Mac) or Control (Windows) while clicking

     3 details in Everything

182. Streamline policy approvals with a more intuitive workflow Aug 20, 2025 · release notes

     New Send for Approval button, targeted notifications with 24h cooldown, and redesigned approval timeline in policy editor.

     • Adds a Send for Approval primary action on Policy Detail, Preview, and Editor pages when a policy is in Draft status or reverts to draft.
     • Introduces a new Approval Timeline on the Policy Detail layout to display approval progress and workflow status clearly.

     2 details in Everything

183. View linked risks directly from relevant modules Aug 20, 2025 · release notes

     Adds a Risk tab and Risks Associated column in Tests and Asset Management modules to view linked risks without switching contexts

     • Adds a new Risk tab on Test detail pages (Tests and Cloud Tests) and Asset detail pages that lists all linked risks with columns for Risk ID, name, status, department, assignee, source, and created date
     • Adds a Risks Associated column to the Asset Management table showing the count of risks per asset; clicking the count navigates directly to the associated risk list

     2 details in Everything

184. Improved email notifications: No more broken pages when linked sources are delet Aug 19, 2025 · release notes

     Email notification links for deleted resources now redirect to a Resource Not Found page instead of failing.

185. Introducing policy variables in the setup wizard Aug 19, 2025 · release notes

     New Policy Variables step in Setup Wizard for configuring policy templates

     • Adds a new Policy Variables section to the Setup Wizard to streamline policy template configuration.

     1 detail in Everything

186. Change the access review owner to ensure continuity Aug 19, 2025 · release notes

     Admins can reassign an unfinished Access Review to an active Scrut user assigned to at least one application in that review.

     • Admins can change the owner of Draft, Upcoming, Active, or Overdue reviews through the detail-page edit icon; the new owner must be active and assigned to at least one included application.

     1 detail in Everything

187. Stay on track: Receive automated reminders before mitigation task due dates Aug 18, 2025 · release notes

     Automated mitigation task reminders sent to risk assignees 15 and 7 days before due dates

188. New checklist item: OS patch compliance checks Aug 18, 2025 · release notes

     Scrut adds OS patch compliance checks for NinjaOne-managed devices in the People module.

     • Adds an Install Device Security Patches checklist item for NinjaOne-managed employee devices in the People module.
     • Enables filtering and sorting NinjaOne-managed devices by patch compliance on the Employee List Page.
     • Includes NinjaOne device patch compliance status in Employee Export reports.
     • Sends email and Slack/MS Teams reminders to employees with non-compliant NinjaOne-managed devices.

     4 details in Everything

189. Ask questions directly to Scrut Teammates on Slack Aug 17, 2025 · release notes

     New Slack integration allowing users to query Scrut Teammates directly from their workspace via tags and feedback loops.

     • Enables asking compliance and security questions to Scrut Teammates within a Slack workspace by tagging them in messages.

     1 detail in Everything

190. Share links to specific Trust Vault items Aug 17, 2025 · release notes

     Trust Vault items (Documents, Controls, etc.) now have direct Copy Link URLs for sharing

191. Review manual evidences with Scrut Teammates Aug 17, 2025 · release notes

     Adds Check with Scrut Teammates for select manual evidence tasks; other tasks redirect to Integrations.

192. Choose which Azure Subscriptions to connect with Scrut Aug 14, 2025 · release notes

     Azure integration adds subscription scoping and nicknames; existing integrations must be reconfigured to select their scope.

     • Lets users choose monitored Azure subscriptions and requires existing integrations to be reconfigured; removing a subscription hides its resources and cancels scheduled scans, while re-adding triggers fresh discovery.
     • Enables adding nicknames to identify environments (e.g., production or staging) during Azure tenant connection

     2 details in Everything

193. Reduce manual efforts with 20+ new automated tests Aug 14, 2025 · release notes

     Scrut adds 20+ new automated tests for employee devices and cloud providers to reduce manual effort.

     • Adds automated tests for Employee devices & account checks to the integration library
     • Adds automated tests for Cloud provider checks to the integration library

     2 details in Everything

194. Automate internal reporting with Scrut Monitor Aug 14, 2025 · release notes

     Scrut Monitor automates internal compliance report generation with configurable cadence and attachment to evidence tasks.

     • Adds Scrut Monitor tab on the Evidence detail page for configuring automated internal reporting workflows
     • Supports scheduled Employee Directory, Risk Register, and Vendor Compliance reports; unchanged reports are not reattached, and vendor reports export only when all vendors are compliant or reviewed.
     • Allows enabling Auto-publish evidence task checkbox to automatically publish generated evidence in the workflow

     3 details in Everything

195. Track compliance tasks with ManageEngine ServiceDesk Plus integration Aug 13, 2025 · release notes

     Adds ManageEngine ServiceDesk Plus integration to track compliance tickets.

     • Integrates ManageEngine ServiceDesk Plus (SDP On Demand) with Scrut for seamless ticket tracking.

     1 detail in Everything

196. Archive inactive vendors Aug 12, 2025 · release notes

     New UI actions and filters for archiving inactive vendors in Scrut

     • Adds Archive Vendor with required justification; archiving removes any associated Trust Vault sub-processor, disables vendor edits and new documents/questionnaires, and revokes recipient questionnaire access.
     • Adds vendor status filter to switch between active and archived vendors
     • Adds Unarchive Vendor action on vendor details page with retention choice for last assessment status

     3 details in Everything

197. Improved version history for policies Aug 12, 2025 · release notes

     Enhanced policy version history with attachment preview, dedicated editing panel, and final review screen.

     • Adds inline attachment preview in the policy version history table
     • Adds dedicated version history panel on the right side of the policy editor
     • Adds a final review screen before publishing policy changes

     3 details in Everything

198. New framework added: UK GDPR Aug 11, 2025 · release notes

     Adds the UK GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. framework with pre-mapped controls and cross-framework mappings.

     • Adds UK GDPR to the available compliance frameworks library
     • Adds pre-mapped controls linking UK GDPR requirements to internal policies and evidence
     • Adds cross-framework mappings between UK GDPR and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST, and EU GDPR

     3 details in Everything

199. New framework added: PCI-DSS Version 4.0.1 Aug 11, 2025 · release notes

     Adds PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. Version 4.0.1 to the Frameworks module.

200. New framework added: NIST 800-171 Revision 3 Aug 11, 2025 · release notes

     Adds NIST 800-171 Revision 3 framework to the Frameworks module with pre-configured controls and mappings.

     • Supports NIST 800-171 Revision 3 as part of the compliance frameworks library.

     1 detail in Everything

201. Gain better compliance insights with upgraded Dashboards and Charts Jul 22, 2025 · release notes

     Upgraded dashboards with interactive charts (tooltips, titles, drag-to-zoom) and enhanced filters for compliance insights.

     • Adds tooltips, titles, and drag-to-zoom functionality to all dashboard charts for interactive data exploration
     • Enhances filter settings on dashboards for more relevant data viewing

     2 details in Everything

202. Edits to policy variables now auto-save and auto-trigger status changes Jul 15, 2025 · release notes

     Policy variable edits in Scrut Automation now auto-save and trigger immediate status changes.

     • Removes the manual Submit button for policy variables, saving progress automatically as values are defined.
     • Automatically transitions a policy's status from Not Uploaded to Draft once all variables are answered.
     • Reverts policy status back to Draft if any previously answered variable is edited, with an immediate warning alert.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The manual submission step for policy variables is removed; changes are now auto-saved without explicit user action.
203. Improved risk report charts for better insights Jul 14, 2025 · release notes

     Improved risk report charts for better insights

     • Rearranges Treatment Strategy and Mitigation Tasks donut charts side by side
     • Redesigns Risk Status breakdown to show statuses and their definitions together

     2 details in Everything

204. Track timely training completions with SLA-enabled campaigns Jul 13, 2025 · release notes

     Track timely training completions with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.-enabled campaigns

     • Adds the ability to define an SLA in days when creating a training campaign to track and enforce on-time completion
     • Introduces new completion statuses: Due, Overdue, Completed, and Completed Late for monitoring employee training progress

     2 details in Everything

205. Customize your view to see more rows per page in tables and modals Jul 13, 2025 · release notes

     New Show rows per page dropdown lets users view 10, 20, 50, or 100 rows in tables and modals

206. Expand your compliance coverage with new automated tests Jul 13, 2025 · release notes

     Scrut adds automated compliance tests for AWS, Azure, DO, Vercel, AZDO, GitLab, Bitbucket, OneLogin, Auth0

     • Adds new set of automated compliance tests that run automatically when integrations are connected, surfacing findings in the Tests → Automated Tests module.
     • Adds automated test coverage for connected AWS, Azure, DigitalOcean, Vercel, Azure DevOps, GitLab, Bitbucket, OneLogin, and Auth0 integrations.

     2 details in Everything

207. Never miss a payment with the new Billing section Jul 10, 2025 · release notes

     New Billing section with invoice history, overdue alerts, and auto-deactivation logic added to Settings.

     • Adds a Settings → Billing section for viewing outstanding invoices and payment history
     • Introduces configurable overdue alerts: banner at 1 day past due, pop-ups at 45+ days, recurring pop-ups at 55+ days, with export restrictions at 1 day and auto-deactivation at 60+ days

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Accounts already 60+ days overdue will be auto-deactivated once the feature is rolled out
208. Improved file previews in the vendor portal Jul 10, 2025 · release notes

     Vendor Portal now supports in-file previews for spreadsheets, documents, PDFs, images, videos, and email attachments with zoom, fullscreen, and search.

     • Adds direct file preview support in the Vendor Portal modal for .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv, .doc, .docx, .ppt, .pptx, .pdf, .jpg, .jpeg, .pmg, .mp4, and .eml files.
     • Adds zoom controls, full-screen mode, and Cmd + F / Ctrl + F search within the Vendor Portal file preview modal.
     • Enables direct download of files from the Vendor Portal preview modal without leaving the interface.

     3 details in Everything

209. Bulk import multiple framework requirements for faster custom framework setup Jul 10, 2025 · release notes

     Adds bulk import of framework requirements via CSV/XLSX and expands requirement name limits to 500 characters in the UI.

     └──▷ HOW TO FIND IT
     Bulk import multiple framework requirements using the CSV/XLSX template instead of adding them individually.
     📍Frameworks module → select any framework → click Add Requirement → choose Import as CSV or XLSX
     • Adds Import as CSV or XLSX option to the Frameworks module Add Requirement dropdown for bulk importing multiple framework requirements
     • Expands manual requirement name character limit to 500 characters and converts it to a multi-text field in the UI

     2 details in Everything

210. Create dynamic vendor questionnaires with conditional follow-up questions Jul 9, 2025 · release notes

     Adds conditional follow-up questions to vendor questionnaires.

     • Dynamic questionnaires allow follow-up questions based on vendor responses.
     • Supports up to two levels of follow-up questions, with conditions based on single-select objective answers.

     2 details in Everything

211. Jira ticket creation is now available in more modules Jul 9, 2025 · release notes

     Extends two-way Jira integration to Cloud, Corrective Actions, Audit Findings, and Risk Management modules.

     • Adds Jira ticket creation for items in the Cloud module
     • Enables Jira issue creation and tracking on Corrective Actions
     • Allows raising Jira tickets for Audit Findings and Requests post-creation with inline updates
     • Supports creating or linking Jira issues to risks in Risk Management requiring external remediation
     • Adds optional auto-ticket creation when tests, evidence, or cloud items change to Needs Attention

     5 details in Everything

212. Add detailed risk treatment notes with the expanded 10,000-character limit Jul 9, 2025 · release notes

     Scrut expands risk treatment note field to 10,000 characters for comprehensive documentation.

213. Bulk assign approvers and review dates for faster policy management Jul 8, 2025 · release notes

     Bulk assign approvers and review dates for multiple policies in the Policy module UI

     • Adds bulk assignment of approvers to multiple non-published policies via the Policy module
     • Adds bulk update of next review dates for multiple policies (published or pending review) via the Policy module

     2 details in Everything

214. Customize the default VSA template to create tailored vendor questionnaires Jul 8, 2025 · release notes

     Enables customization of the default Vendor Security Questionnaire (VSA) template.

     • Adds the ability to view and edit questions in the Default VSA template under Vendor Settings → Templates.
     • Allows creating tailored vendor questionnaires by adding, editing, or removing questions from the default VSA template.

     2 details in Everything

215. Introducing: Advanced risk scoring formulas Jul 8, 2025 · release notes

     Adds four risk score calculation methods (Max, Min, Conditional, Custom) via Risk Management settings

     • Adds Maximum risk score calculation method that assigns the highest value among all selected risk factors
     • Adds Minimum risk score calculation method that assigns the lowest value among all selected risk factors
     • Adds Conditional risk score calculation method using IF-ELSE conditional rules
     • Adds Custom risk score calculation method allowing formulas with factors, scores, constants, and basic math operators
     • Redesigns the risk score configuration process to be more intuitive

     5 details in Everything

216. Add and manage sub-processors efficiently Jul 8, 2025 · release notes

     Streamlines Trust Vault sub-processor management with vendor linking, detail editing and bulk addition.

     • Adds linked/not linked filter to the vendor table to identify vendors connected as sub-processors
     • Allows selecting multiple vendors when adding sub-processors and adding a vendor to Trust Vault directly from the Vendor module.

     2 details in Everything

217. Enhanced Policy Editor to save edits securely Jul 2, 2025 · release notes

     Scrut Policy Editor gains concurrent locking and manual Save Now fallback for reliability

     • Manual Save Now button appears when auto-save fails, with offline edits stored locally for later saving.

     1 detail in Everything

218. Easily identify and search controls via unified descriptions across modules Jul 2, 2025 · release notes

     Adds unified control descriptions displayed in tables/modals and searchable via description keywords

     • Control descriptions now display consistently next to control names across all major tables and modals
     • Search for controls using description keywords across all of the above tables and modals

     2 details in Everything

219. Access Review now supports Calendly, Figma, Apollo.io integrations Jul 1, 2025 · release notes

     Access Review supports Calendly, Figma, and Apollo.io integrations

220. Scrut now supports Microsoft Teams integration Jul 1, 2025 · release notes

     Scrut adds Microsoft Teams integration for real-time compliance and security notifications in channels or DMs.

     • Adds Microsoft Teams integration to receive real-time notifications and alerts directly in your organization's Teams workspace
     • Enables configuration of which alerts to receive and allows routing them by user or group via the Settings → Notifications interface
     • Supports delivery of Task reminders (Personal, Employee), Security report ready status, Sample data availability, Test status changes, Scrut Monitor health changes, Integration failures, and Vendor-related alerts to assigned Teams channels or DMs

     3 details in Everything

221. ISO 27001:2022 mapping updated for enhanced accuracy Jul 1, 2025 · release notes

     ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001:2022 mapping updated for enhanced accuracy with new ISMS Policy Statement template.

     • Remaps 12 ISO controls for better Unified Control Framework alignment.
     • Links 4 previously unmapped ISO controls to relevant controls.
     • Adds guidance suggestions and removes redundant evidence suggestions.
     • Creates a new ISMS Policy Statement template and reviews existing policy templates.

     4 details in Everything

222. Download Statement of Applicability (SoA) for ISO certifications Jul 1, 2025 · release notes

     Adds UI-generated, auditor-ready Statement of Applicability (SoA) downloads for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001/27017/27018/27701/42001

     • UI navigation to generate and download an SoA in the Compliance -> Frameworks UI
     • Generation of auditor-ready SoA documents listing in-scope, out-of-scope controls and applicability status
     • Automatic email delivery of the generated SoA document

     3 details in Everything

223. Multi-select objective questions to capture accurate vendor responses Jul 1, 2025 · release notes

     Adds multi-select objective questions for vendor questionnaires to capture multiple responses and assess risk via maximum score.

     • Allows admins to define multi-select objective questions in questionnaire templates and vendor intake forms, alongside single-select questions.

     1 detail in Everything

224. Assign employees to groups directly via CSV Import Jun 30, 2025 · release notes

     Adds Group column support in CSV import for automatic employee-to-group assignment.

     • When the auto-create-and-assign import option is selected, creates missing groups from the Group column with a default checklist; the alternative single-group option ignores that column.

     1 detail in Everything

225. Scrut now supports Sophos Central (MDM) integration Jun 30, 2025 · release notes

     Scrut adds Sophos Central (MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.) integration for automatic device sync and compliance testing

226. New framework added: Gramm-Leach-Bliley Act (GLBA) Jun 29, 2025 · release notes

     Scrut adds GLBA compliance framework with ready-to-use controls and automated mapping

     • Adds Gramm-Leach-Bliley Act (GLBA) compliance framework to support U.S. financial institution requirements
     • Enables automatic mapping of policies, controls, and evidence to GLBA requirements
     • Provides centralized evidence collection for Safeguards and Privacy Rule audits

     3 details in Everything

227. New framework added: Botswana Data Protection Act (2024) Jun 29, 2025 · release notes

     Adds Botswana Data Protection Act (2024) framework to Scrut's compliance library

228. Access a library of pre-populated risks via the Risk Discovery tab Jun 26, 2025 · release notes

     New Risk Discovery tab in Risk Register with filters, manual entry, and bulk import capabilities

     • Adds Risk Discovery tab to the Risk Register for spotting pre-populated risks
     • Enables filtering or searching Scrut-identified risks directly from the Risk Discovery tab
     • Allows scoping selected risks to one or more org entities before saving
     • Supports manual risk creation via +New Risk → Add Manually with fields for name, assignees, department, and impacted assets
     • Enables bulk import of risks using a template via +New Risk → Import File

     5 details in Everything

229. New framework added: Cyber Essentials v3.2 Jun 26, 2025 · release notes

     Scrut adds Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. v3.2 framework with full control mapping for UK compliance.

     • Adds Cyber Essentials v3.2 to the Frameworks module as a new supported framework
     • Enables viewing mapped controls and linking them to existing policies and evidence
     • Allows assigning control owners and tracking compliance in real time
     • Supports cross-mappings with ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. frameworks
     • Provides export of detailed readiness reports for certification or internal audits

     5 details in Everything

230. Policy Variables for scalable policy management Jun 26, 2025 · release notes

     In Limited Beta for select customers, adds reusable Policy Variables; contact your CSM for access.

     • In Limited Beta, Policy Variables settings define reusable placeholders such as {{organization_name}} for policy templates.
     • Updates propagate to policies using the variable, with impact visibility and preview/download; after initial submission, variables can only be edited from an existing policy file.

     2 details in Everything

231. Customize the Trust Vault to reflect your branding Jun 25, 2025 · release notes

     Adds branding customization tab in Vault settings for logo, colors, fonts, and favicon.

     • Adds Trust Vault → Settings → Branding UI tab with real-time preview panel and Save Changes button to customize vault appearance
     • Enables uploading company logo (160x160 px PNG/JPEG) and favicon (30x30 px ICO) via the new branding settings

     2 details in Everything

232. Enhanced product-wide search with CMD+K Jun 25, 2025 · release notes

     In limited release, global search adds policy-document text and vault-document text search.

     • In limited release, CMD+K / CTRL+K searches policy-document names and text, with policy text support for PDF, DOCX and DOC.
     • Search covers test, people, risk, policy and evidence names, evidence-document names and vault-document text.

     2 details in Everything

233. Integrate NinjaOne for richer device insights and smarter access reviews Jun 23, 2025 · release notes

     Adds NinjaOne integration for automatic device insights and user-device mapping in Access Reviews.

     • Adds NinjaOne under Mobile Device Management Tools in the Integrations Library to import OS version, encryption, antivirus status, and last activity.

     1 detail in Everything

234. Automate required software checks in the People module Jun 23, 2025 · release notes

     Automates software compliance checks in the People module by integrating MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. device data into checklists.

     • Adds Install Required Software checklist item.
     • Supports Scrut Agent and NinjaOne monitoring agents.
     • Allows any version or specific version selection for OS-targeted software.

     3 details in Everything

235. Two-way sync and access reviews now available for Asana integration Jun 22, 2025 · release notes

     Two-way task sync and access reviews now available for Asana integration in Scrut

     • Adds two-way task sync between Scrut and Asana so tasks completed in Asana update their status automatically in Scrut.
     • Adds Access Reviews for Asana allowing users to evaluate user access, roles, inactive accounts, and overprivileged accounts across Asana workspaces directly within the Scrut platform.

     2 details in Everything

236. Reduce manual work with 30+ new automated tests Jun 22, 2025 · release notes

     Scrut adds 30+ new automated compliance tests for GitHub, Entra, Cloudflare and more

237. Pass antivirus tests with Qualys AV detection support via Scrut Agent Jun 22, 2025 · release notes

     Scrut Agent adds automatic detection of Qualys Antivirus (AV) for compliance checks

238. Easily spot the source text of autofilled questionnaire answers Jun 20, 2025 · release notes

     Scrut adds highlighted source text for autofilled questionnaire answers in supported files

     • Clicking a source link to an autofilled answer now opens the document with the relevant text automatically highlighted
     • Support for highlighting in .doc and .pdf file formats for source verification

     2 details in Everything

239. Enhanced Sentinel One integration for auto-syncing access and threat data Jun 19, 2025 · release notes

     Enhances the SentinelOne integration with access-review data and endpoint threat syncing.

     • Enhances SentinelOne integration to sync user names, emails, roles and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. status into Access Reviews.
     • Syncs SentinelOne threats into Vulnerability Management with threat name, status and severity; owner email is matched through HRMS where available.

     2 details in Everything

240. Automate device-level evidence collection from Microsoft Intune — with Scrut Mon Jun 19, 2025 · release notes

     Scrut Monitor adds Microsoft Intune integration for automated device evidence collection

     • Integrates with Microsoft Intune to automatically fetch device metadata (ID, name, AV status, encryption status, OS, etc.) and attach it to Evidence Tasks

     1 detail in Everything

241. Automatically track ThreatCop training completion with new CAT Jun 19, 2025 · release notes

     Scrut adds automatic CAT for ThreatCop training completion tracking.

     • Adds continuous automated test (CAT) capability for ThreatCop training campaigns
     • Integrates automated daily verification of ThreatCop module completion into existing campaigns

     2 details in Everything

242. Easily find and share documents with the Trust Vault's 'Documents' section Jun 18, 2025 · release notes

     New Documents section in Trust Vault for centralized compliance document management

     • Adds a dedicated Documents tab inside the Trust Vault UI to organize and share compliance documents
     • Enables keyword search (e.g., Compliance, Control) and filtering by visibility (All, Public, Private) within the Documents section

     2 details in Everything

243. Easier navigation, notifications, and support in the enhanced Scrut Agent Jun 17, 2025 · release notes

     Enhanced Scrut Agent adds notification history, device details view, OS filter, Auth0 compatibility, and manual update check

     • Adds Device Details button to show Computer Name, Serial Number, and OS Version for each agent device
     • Adds Notification icon in the Scrut Agent UI to view history including last-sync timestamps, sign-in alerts, and logout events
     • Adds Check for Updates button to manually trigger download and installation of the latest agent version
     • Adds Report an Issue feature with predefined types (e.g., login, sync) and custom comments for direct support notification
     • Adds OS filter in the platform Scrut Agent section to sort agents by operating system

     +1 more show less

     • Displays user name and login email in the top-right corner of the agent window profile details

     6 details in Everything

244. Easily export questionnaires at any stage Jun 17, 2025 · release notes

     Export button is now always visible in the top-right corner of the questionnaire screen regardless of completion stage

245. Improved and consistent File Preview experience across all modules Jun 17, 2025 · release notes

     Consistent file preview with zoom, fullscreen, and search across Policies, Evidence, and Vault modules

     • Adds zoom and full-screen controls to the universal file preview modal
     • Enables Cmd + F / Ctrl + F in-document search within the preview modal
     • Expands supported file formats for preview to include .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv, .eml, .doc, .docx, .ppt, .pptx, .mp4, .pdf, .jpg, .jpeg, and .png

     3 details in Everything

246. Identify and manage duplicates in Answer Library Jun 17, 2025 · release notes

     Adds Possible Duplicate Detected tag and management actions to Answer Library

     • 'Possible Duplicate Detected' tag identifies potential duplicate answers in the Answer Library.
     • Clicking the tag displays related duplicates for review.
     • New options to mark an answer as 'Not a duplicate' or 'Delete' it from the library.

     3 details in Everything

247. Choose how many rows you see in Tables Jun 17, 2025 · release notes

     Adds a Show rows per page dropdown to tables for customizable pagination.

     • Adds a new Show rows per page dropdown at the bottom of major platform tables (Controls, Policies, Evidence Tasks, Tests, Vendor & Risk Management, Trust Vault, Audit Center) allowing users to display 10, 20, 50, or 100 rows.
     • Introduces dynamic default row counts: 10 rows per page when a single table is present on the screen, and 5 rows per page when two or more tables are visible.

     2 details in Everything

248. Markdown Support in Trust Vault May 8, 2025 · release notes

     Trust Vault adds Markdown formatting support and increases description field limits to 10,000 characters

     • Trust Vault now supports Markdown formatting in the About section, Frameworks, FAQs, and Updates fields, with a character limit increased to 10,000 characters

     1 detail in Everything

249. Reopening Closed Audit Findings May 8, 2025 · release notes

     Adds Request Revision workflow for closed audit findings via UI

     • Allows requesting revision of closed findings in audits or audit requests, setting status to Needs Revision after a reason is submitted.

     1 detail in Everything

250. Australia ISM (Dec 2024) May 7, 2025 · release notes

     Adds Australia ISM (Dec 2024) framework for compliance assessments

     • Adds Australia ISM (Dec 2024) to the platform's available frameworks list

     1 detail in Everything

251. Automatic Control Linking in Audit Finding May 7, 2025 · release notes

     Linking an artifact to an audit request or finding automatically links associated controls.

     • automatic control linking in the audit finding workflow ensures that selecting a requirement auto-links the corresponding control.

     1 detail in Everything

252. New Jersey Data Privacy Law May 6, 2025 · release notes

     Adds New Jersey Data Privacy Law (NJDPL) framework with pre-mapped controls to the platform's Frameworks section.

253. Sage HR Integration for Automated Employee Data Sync May 6, 2025 · release notes

     Adds Sage HR integration for automated employee data sync

254. Updated Mapping: CMMC Level 2 May 6, 2025 · release notes

     The CMMC Level 2 framework mapping has been updated to provide more accurate coverage.

255. Import Vendor Access Data Workflow - Enhancements May 6, 2025 · release notes

     Adds CSV/XLSX vendor access data import with field mapping to Access Review module (up to 100 MB)

     • Directly import vendor access data from CSV or Excel files (up to 100 MB) into the Access Review module
     • Use a field-mapping interface with dropdowns to align key fields like Account Identifier and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. without manual reformatting

     2 details in Everything

256. Creating New and Linking Existing Risks from Audit Findings May 6, 2025 · release notes

     Scrut Automation adds ability to create new and link existing risks directly within the Audit Center and Audit Requests.

     • Adds a Linked Items section in the Audit Findings and Audit Request sections, displaying associated policies, evidence, tests, and risks
     • Enables linking an existing risk to a finding via the UI path: Click Link Existing → Risk, select the risk, then click Link
     • Enables creating a new risk from a finding via the UI path: Click Create New → Risk and use the pop-up form

     3 details in Everything

257. Multi-Level Reminders for Reviews and Reassessments May 5, 2025 · release notes

     Scrut adds four-stage automated reminders for policy reviews and vendor reassessments

     • When review reminders and multi-level reminders are enabled in Settings > Notifications, sends reminders 30, 15 and 7 days before and on the due date for policy reviews, evidence updates and vendor reassessments.

     1 detail in Everything

258. Use Custom Videos in Training Campaigns May 5, 2025 · release notes

     Enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. custom external videos into training campaigns via embed codes

     • Adds ability to embed custom, externally hosted training videos in Campaigns using Embed Code option

     1 detail in Everything

259. New Integrations in Access Review May 5, 2025 · release notes

     Scrut Access Review adds Xero, New Relic, Azure AD, Cloudflare, Confluence, Slack, and Trello integrations for automated user access data retrieval

     • Adds Xero integration to Access Review module for automatic user access data retrieval
     • Adds New Relic integration to Access Review module for automatic user access data retrieval
     • Adds Azure AD integration to Access Review module for automatic user access data retrieval
     • Adds Cloudflare integration to Access Review module for automatic user access data retrieval
     • Adds Confluence integration to Access Review module for automatic user access data retrieval

     +2 more show less

     • Adds Slack integration to Access Review module for automatic user access data retrieval
     • Adds Trello integration to Access Review module for automatic user access data retrieval

     7 details in Everything

260. Enhanced Task Visibility in Training Portal May 5, 2025 · release notes

     Training Portal now shows all assigned tasks immediately with policy-dependent task locking.

     • Employees can view their entire list of assigned training tasks immediately upon logging into the Training Portal.
     • Tasks dependent on policy acceptance are displayed greyed out and locked until policies are accepted, then unlock automatically.

     2 details in Everything

261. Scope Justification enhancement for Controls May 4, 2025 · release notes

     Adds mandatory justification for out-of-scope controls, bulk scope updates, and a scope filter in the Controls module.

     • Mark Out of Scope action now requires a mandatory justification via a modal dialog
     • Bulk actions enabled to update the scope of multiple controls in a single operation
     • New Scope filter added to the control list view for In Scope and Out of Scope

     3 details in Everything

262. Scrut Digest now available on Slack May 4, 2025 · release notes

     Scrut Compliance Digest can now be delivered to Slack channels and group DMs.

263. Updates in Tests May 4, 2025 · release notes

     Adds Unmapped tags for items without linked controls and Last Checked timestamps for tests.

     • Displays an Unmapped tag on tests, policies, or evidence not linked to a compliance control.
     • Shows a Last Checked timestamp on every test, updated automatically after evaluation.
     • Adds over 25 new automated tests for GitHub, Google Workspace, Microsoft Entra, Slack, Snyk, Heroku, and Qualys.

     3 details in Everything

264. Enhanced Document Preview in Trust Vault May 1, 2025 · release notes

     Trust Vault document preview now supports spreadsheets, emails, videos and zoom.

     • Adds support for viewing .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv spreadsheets directly in the Trust Vault document preview modal
     • Adds support for viewing .eml email files directly in the Trust Vault document preview modal
     • Adds support for viewing .mp4 video files directly in the Trust Vault document preview modal
     • Adds zoom controls including mouse trackpad gestures to the PDF preview
     • Enables single-click opening of file attachments within the preview modal

     5 details in Everything

265. Risk Audit Log Improvement May 1, 2025 · release notes

     Scrut adds audit log tracking for risk settings actions and standardizes message format.

     • Standardizes audit log message format so the action precedes the object (e.g., created new risk)

     1 detail in Everything

266. Bulk Actions in the Vendor Management module Apr 30, 2025 · release notes

     Adds bulk actions (edit, questionnaire, export, delete) in Scrut's Vendor Management module via UI checkboxes and Actions button.

     • Adds checkbox-based selection and an Actions button in the Vendor Management module to perform high-volume operations like editing details, sending questionnaires, exporting documents, and deleting vendors across multiple vendors at once.

     1 detail in Everything

267. Authentication System Migration to Auth0 Apr 30, 2025 · release notes

     Auth0 migration adds dynamic SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login pages; Enterprise SSO users must update OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. configuration while retaining existing redirect URLs.

     • Introduces dynamic login pages that show only integrated SSO options

     1 detail in Everything

268. Audit Center: Test Details in Side Drawer Apr 30, 2025 · release notes

     Audit Center test details open in a side drawer with a new Export button for direct downloads

     • Test details under Linked Artifacts now open in a side drawer instead of redirecting to the Tests page
     • Adds an Export button to download test details directly from the Audit Center view

     2 details in Everything

269. Internal & External Audits with a New Audit Calendar View Apr 6, 2025 · release notes

     New Audit Calendar View for internal & external audit planning in Scrut

270. Efficient Vendor Onboarding via Intake Form: Comments and Attachment feature Apr 6, 2025 · release notes

     Adds question-level comments and file attachments to Trust Vault intake forms.

271. Jira Ticket Creation Automation Apr 3, 2025 · release notes

     Adds Jira ticket creation automation for compliance evidence tasks

     • Enables recurring Jira ticket creation linked to evidence tasks to reduce manual effort.
     • Retains metadata from previous tickets into newly created automated Jira entries.
     • Provides error notifications and detailed logs when automated Jira ticket creation fails.

     3 details in Everything

272. Trello Integration: Create Tickets in Trello Apr 3, 2025 · release notes

     Scrut adds Trello integration enabling users to create tickets in Trello and link existing tasks.

273. SEBI CSCRF Apr 3, 2025 · release notes

     Adds SEBI CSCRF regulatory framework support for automated compliance monitoring in Scrut.

274. NIST 800-53 (High Baseline) Apr 3, 2025 · release notes

     Adds NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. (High Baseline) compliance framework and pre-mapped controls

275. Dynamic Grouping of Evidence Attachment Buckets & Fiscal Year Support Apr 3, 2025 · release notes

     Revamped Evidence Attachment section in the Scrut Platform with dynamic grouping and fiscal year support.

     • Introduces a revamped Evidence Attachment section in the Scrut Platform for uploading, linking, and organizing compliance evidence with dynamic grouping.
     • Adds Fiscal Year Support to the evidence attachment workflow.

     2 details in Everything

276. Slack Notifications Update Apr 2, 2025 · release notes

     Slack notifications now support vendor module alerts and personal tasks for compliance automation.

     • Adds Slack notifications for Not Assessed and In Progress vendor modules
     • Adds Slack notifications for submitted questionnaires that need review
     • Adds Slack notifications for vendor onboarding requests pending review
     • Adds Slack notifications for mitigation tasks needing reviewer approval
     • Adds Slack notifications when vendors submit questionnaires to primary reviewers

     5 details in Everything

277. Multiple Assignees in Vendor Module Apr 2, 2025 · release notes

     Scrut allows multiple assignees and reviewers for vendors, questionnaires, tasks, and onboarding requests in the UI.

     • Allows multiple users to be assigned as primary/secondary assignees when creating or editing a vendor record
     • Enables adding multiple reviewers during questionnaire creation or editing in the Vendor Module
     • Updates the vendor bulk-import template to support multiple assignees.

     3 details in Everything

278. New PingOne SSO integration Apr 2, 2025 · release notes

     Adds PingOne SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration in beta, enabled on request for employee login.

     • Adds PingOne SSO authentication in beta, enabled on request.
     • Provides region-specific redirect URI configuration for the request-enabled PingOne SSO integration.

     2 details in Everything

279. Logout Option in Trust Vault Apr 1, 2025 · release notes

     Trust Vault Portal adds a manual Logout option for users.

280. Enhancement: Improved Source Type Tracking for Risk Entries Mar 31, 2025 · release notes

     Adds Manual Entry and File Import to Source Type filter for risk tracking

     • The Source Type filter now includes Manual Entry and File Import alongside existing options (Test, Vulnerability, Vendor, and Audit Findings)
     • Source Type is automatically assigned as Manual Entry when risks are added individually
     • Source Type is automatically assigned as File Import for CSV imported risks

     3 details in Everything

281. Access Review Improvements Mar 31, 2025 · release notes

     Scrut adds search in owner dropdown, email search, file attachments, and new review management UI features.

     • Adds a search bar to the Owner in Scrut dropdown for finding owners
     • Enables searching by user email/identifier in addition to name
     • Allows reviewers to upload file attachments (screenshots/evidence) during reviews, with owner/admin visibility and removal rights
     • Requires a justification reason when revoking access, matching admin approval workflow
     • Makes the Select All action respect current filters so only visible users are selected

     +7 more show less

     • Adds a Pending Review filter and clickable doughnut chart to focus on specific review statuses
     • Greys out unassigned applications in the review list to highlight actionable items
     • Hides MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. columns and flags when MFA data is not relevant or supported
     • Places newly created reviews at the top of the review list
     • Retains manual owner mappings automatically across future review cycles
     • Allows setting a review start date for the same day to enable faster turnarounds
     • Ensures case-insensitive email matching so users are auto-mapped regardless of casing

     12 details in Everything

282. [Access Reviews] Validate Review feature - First in segment! Mar 30, 2025 · release notes

     Scrut adds Validate Review for real-time access change verification with an Access validated column.

     • For integrated applications that support real-time data retrieval, adds Validate Review to trigger on-demand comparison of revocations or role changes against the external application, such as GitHub.
     • Adds Access validated column in the interface and export files to display validation results for applications and users
     • Introduces visual status indicators (green checkmarks and red crosses) with summary counts and timestamps for live discrepancy highlighting

     3 details in Everything

283. [Access Reviews] Approve Review feature - First in segment! Mar 30, 2025 · release notes

     Scrut adds a two-person approval workflow for Access Reviews with distinct Reviewer and Approver roles.

     • Introduces a dual-check approval workflow in Access Reviews where a separate Approver must confirm changes before finalization
     • Approvers can use Validate Review where available and export final approval status, timestamp and comments.

     2 details in Everything

284. People Module Updates Mar 28, 2025 · release notes

     Users can now edit the Group field for employees synced from HRIMS tools via a new button on the Employee Details page.

     • Adds an Edit button beside Group on the Employee Details page for changing employee groups separately from locked HRIMS-synced data; changes cannot be saved if all groups are removed.
     • Removes the Group field from the Edit Employee modal to simplify editing workflows.

     2 details in Everything

285. CSM Notifications for @Scrut Team Mentions in Comments Mar 28, 2025 · release notes

     CSM email notifications when users tag @Scrut Team in comments

286. Select Controls in Bulk: Faster Audits, Policies & Framework Mapping Mar 27, 2025 · release notes

     Adds bulk control selection UI to simplify audits and framework mapping workflows

     • Adds Select All checkbox and individual checkboxes to the control selection modal across modules for bulk control selection
     • Enables application of filters (e.g., framework, category) before bulk-selecting filtered results in the control selection workflow

     2 details in Everything

287. Bulk Actions for Controls Mar 27, 2025 · release notes

     Scrut adds bulk select, edit, and delete actions for multiple controls in the Control Table

     • Allows Admins and Contributors with control-module access to select multiple controls in the Control Table for simultaneous operations.
     • Adds bulk editing of Assignee, Control Domain, Function Grouping, and Entities fields
     • Allows bulk deletion of selected controls with a confirmation modal

     3 details in Everything

288. Updates in CATs Mar 26, 2025 · release notes

     Scrut adds MongoDB Atlas and Slack compliance tests with unified status and audit center visibility.

     • Adds new automated tests for MongoDB Atlas including cluster storage autoscaling, tier autoscaling, backup, encryption, dedicated nodes, and replication checks
     • Adds a Slack MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.-enforcement compliance test.
     • Adds an Asset Management test checking that the asset list tracks resources containing critical data.
     • Displays Automated Tests in the Audit Center side panel

     4 details in Everything

289. In-App Video Tutorials for Seamless Guidance Mar 26, 2025 · release notes

     Begins an ongoing rollout of contextual in-app video tutorials for Scrut modules.

290. Enhancement in Setup Wizard Workflow Mar 25, 2025 · release notes

     Setup Wizard now supports adding departments and tagging new audits as internal

     • Adds a Department step in the Setup Wizard to define organizational structure during initial configuration
     • Tags audits created via the Setup Wizard with the internal tag by default

     2 details in Everything

291. Enhanced Risk Factor and Score Creation Process Mar 2, 2025 · release notes

     Adds structured UI for defining custom risk factors and configuring scoring ranges in the risk management module

     • Provides a structured, user-friendly interface in the risk management module for defining custom risk factors
     • Allows configuration of scoring ranges within the new risk assessment workflow
     • Enables application of custom risk formulas to automate score calculations

     3 details in Everything

292. Adding Source: Integrations as Vendors Mar 2, 2025 · release notes

     Automatically adds vendors from new integrations made from January onwards and introduces a Source column.

     • New integrations made from January onwards are automatically added as vendors in Vendor Management, with their source identifying the integration origin.
     • A new Source column (hidden by default) distinguishes vendor origins: Existing, Manual, Integration, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. discovery, Intake form

     2 details in Everything

293. Enhanced Bulk Actions in Policy and Evidence Modules Feb 27, 2025 · release notes

     Enhanced Bulk Actions in Policy and Evidence Modules

     • Enables bulk editing and publishing of policies via selection in the UI

     1 detail in Everything

294. Introducing Bulk Promote Employees to Users Feb 27, 2025 · release notes

     Scrut adds bulk role promotion for employees to users via UI.

     • Enables administrators to change user roles or permissions for multiple employees at once

     1 detail in Everything

295. SetUp Wizard Improvements Feb 27, 2025 · release notes

     Setup Wizard adds mandatory org fields, department management cards, and training preview.

     • Adds Client industry/vertical as a mandatory organization info field in the Setup Wizard
     • Adds Geographical scope (country multi-select) as a mandatory organization info field in the Setup Wizard
     • Introduces Manage Department cards showing default departments and requiring Department Owners.
     • Adds preview option to training module selection cards in the Setup Wizard

     4 details in Everything

296. Added Search Functionality for Selecting Predefined Risks During Risk Creation Feb 24, 2025 · release notes

     Adds searchable risk selection field for predefined risks during risk creation in Scrut Automation.

     • Adds a searchable input field to replace the drop-down list when selecting predefined risks, allowing keyword filtering.

     1 detail in Everything

297. Enhanced Weekly Digest: Improved CSM Visibility and Grammar Refinements Feb 23, 2025 · release notes

     Weekly digest now includes CSM recipients and customer name in subject; fixes grammar for singular/plural counts.

     • CSMs added to a customer account receive the weekly email digest alongside account admins.
     • Digest email subject lines now include the customer’s name (e.g., '[Customer Name] - Weekly digest: Key compliance tasks').
     • Weekly digest alerts dynamically adjust for singular/plural grammar (e.g., 1 Policy to be published vs. 10 Policies to be published).

     3 details in Everything

298. Trust Vault Pending User Workflow Refinement Feb 23, 2025 · release notes

     Trust Vault adds NDA selection and expiry date controls to the Pending User Workflow UI

     • Adds an NDA selection drop-down to the pending user acceptance flow in Trust Vault
     • Adds an expiry date selector to control the duration of user access during approval

     2 details in Everything

299. In-line Policy Editor Improvements Feb 23, 2025 · release notes

     Scrut Automation adds in-line policy editor autosave and removes deprecated UI elements.

     • Adds Autosave functionality to the policy editor to prevent accidental loss of changes
     • Restricts inline editor size to A4 dimensions for accurate export preview
     • Removes Select All action from the inline editor toolbar
     • Removes Scroll to save the comment action in the inline editor

     4 details in Everything

300. Audit Log Enhancements in Vendor Management Module Feb 19, 2025 · release notes

     Scrut adds vendor settings and template-level audit logs to Vendor Management module.

     • Added new audit logs to track changes to vendor settings
     • Introduced new audit logs for template-level actions

     2 details in Everything

301. Law 25 Framework Feb 19, 2025 · release notes

     Scrut introduces a Law 25 framework for Quebec privacy compliance, including risk management and accountability controls.

302. Enhancements in Vendor Intake Form Feb 18, 2025 · release notes

     New audit logs, admin email notifications, and CSV export for vendor intake forms

     • Adds audit logs to track submission, approvals, and changes during the intake form workflow
     • Sends email notifications to admins when an employee submits a vendor onboarding request
     • Enables one-click export of intake form questions and answers in CSV format

     3 details in Everything

303. Administrative Units (AUs) Integration for Azure AD Users Feb 17, 2025 · release notes

     Adds Administrative Units visibility for Azure AD users on employee detail pages

     • Displays the Administrative Unit an Azure AD user belongs to on their employee detail page

     1 detail in Everything

304. UI/UX Enhancements to Integrations for a Smoother Experience Feb 16, 2025 · release notes

     New Integrations Library replaces the Available tab and groups integrations by category in the UI.

     • Replaces the Available tab with an Integrations Library combining Connected and Available integrations
     • Groups integrations by categories such as cloud providers and identity management tools

     2 details in Everything

305. Improved Slack Notifications and Digest Summaries for Enhanced Engagement Feb 16, 2025 · release notes

     Scrut adds configurable digest summaries with module and frequency selection to Slack integration

     • Adds digest summary configuration for admin-defined module activities in the Scrut platform, allowing selection of specific modules and frequency settings (daily or weekly).
     • Enables hyperlinks within Slack notifications and digests to redirect directly to specific task, vendor control, or policy pages on the Scrut platform.
     • Improves notification filtering and ordering for risks, vendor management, and audit center modules by displaying only relevant statuses prioritized by urgency (e.g., overdue tasks, due soon, pending approvals).

     3 details in Everything

306. Search (CMD+K) (Internal Beta) Jan 19, 2025 · release notes

     Internal-only beta adds evidence and policy filename search; it has not been released to customers.

307. Introducing 'Govern' function grouping in 'Controls' Jan 16, 2025 · release notes

     Adds Govern function grouping to UCF controls aligned with NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0

308. Test Library - Addition to CATs Jan 16, 2025 · release notes

     Adds Test Library with test review workflows and bulk acceptance to CATs

     • Introduces the Test Library as a centralized repository for managing new and updated tests.
     • Adds a New tag for new tests appearing in the library, requiring customer review and acceptance into scope.
     • Adds an Update tag for existing test changes, replacing old tests only upon customer acceptance.
     • Restricts assigning tests, creating tickets, or exporting until tests are accepted as in scope.
     • Enables bulk acceptance of multiple tests to put them in scope simultaneously.

     5 details in Everything

309. UX improvement: Campaign end date setting Jan 15, 2025 · release notes

     UX update clarifies evergreen campaign configuration

     • Replaces the Evergreen radio button with a 'This campaign does not have an end date' checkbox to configure indefinite campaigns

     1 detail in Everything

310. Integrations & more updates Jan 15, 2025 · release notes

     Scrut adds Dashlane and KiteCyber MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integrations; GCP proof generation in Scrut Monitor.

     • Adds Dashlane support for password manager detection
     • Adds GCP support in Scrut Monitor for automated proof generation
     • New integration: KiteCyber MDM is now available

     3 details in Everything

311. New Vendor Portal: vendor.scrut.io Jan 14, 2025 · release notes

     New vendor portal at vendor.scrut.io with a refreshed UI/UX

     • Adds vendor.scrut.io as the new vendor portal URL and uses it in vendor-related emails.
     • The vendor portal now features a redesigned UI/UX aligned with the main Scrut platform.

     2 details in Everything

312. CIS v8.1 (Framework mapping updated) Jan 14, 2025 · release notes

     CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. framework mapping updated to v8.1 with reduced controls and policies.

313. COBIT 2019 Framework Jan 13, 2025 · release notes

     Adds COBIT 2019 framework support for IT governance and compliance alignment

314. 'No Framework' Filter Jan 12, 2025 · release notes

     Adds No Framework filter in UI to manage unmapped artifacts during framework migrations

315. Enhanced Risk Dashboard Jan 8, 2025 · release notes

     Enhanced Risk Dashboard adds Risk Trend graph and replaces Risk Aging with Treatment Strategy graph.

     • Adds a Risk Trend graph to observe risk counts across statuses over time, with refined filters

     1 detail in Everything

316. Video-based Security Awareness Training Jan 8, 2025 · release notes

     Scrut introduces video-based security awareness training

317. Simplifying risk management: Auto-populating controls in mitigation tasks Jan 7, 2025 · release notes

     Mitigation tasks now auto-populate controls to simplify risk management workflows.

318. Introducing Slack integration Jan 6, 2025 · release notes

     Introduces Slack integration for Scrut Automation.

     • Introduces Slack integration.

     1 detail in Everything

319. Enhancements to Manage Evidence Section Dec 18, 2024 · release notes

     Manage Evidence Table now supports CSV export and includes a new Note column for tracking context.

     • Adds CSV export capability to the Manage Evidence Table under Settings
     • Adds a Note column to the Manage Evidence Table to display contextual details from uploaded evidence

     2 details in Everything

320. Trust Vault Audit Log & Other Improvements Dec 18, 2024 · release notes

     Trust Vault audit log now captures admin actions and document downloads; improved clickwrap attachment consistency.

     • Audit log now captures admin actions (accepting or declining requests) and logged-in user actions (document downloads) in Trust Vault
     • Document download metric on the Trust Vault Dashboard now counts every download event rather than unique users
     • Clickwrap attachment behavior updated to ensure users remain associated with the specific NDA version they initially accepted when modified via inline editor

     3 details in Everything

321. Security Campaigns and Employee Onboarding Updates Dec 17, 2024 · release notes

     Scrut adds send reminder buttons and bulk actions for security campaigns, automated onboarding welcome emails, and empty checklist support with a No tasks assigned filter

     • Adds a Send Reminder button to the campaign detail page for active campaigns, showing the count of incomplete employees in the resulting modal
     • Enables bulk selection of employees on a security campaign's employee list page to send reminder emails at scale
     • Adds a toggle in notification settings to automatically send welcome emails with assigned tasks to new employees upon onboarding
     • Allows creation of empty checklists and adds a No tasks assigned filter on the employee list/detail pages for visibility

     4 details in Everything

322. Adding Multiple Points of Contact(POC) to a Vendor Dec 16, 2024 · release notes

     Adds ability to assign multiple Points of Contact (POC) to a single vendor record in the UI.

323. New Report: Audit Readiness Dec 15, 2024 · release notes

     Adds an Audit Readiness report to Scrut.

324. Introducing Requirements View in Framework-Based Audits Dec 12, 2024 · release notes

     Introducing Requirements View in Framework-Based Audits

325. FERPA Framework Dec 11, 2024 · release notes

     Adds FERPA compliance framework to Scrut Automation for educational institutions.

326. COPPA Framework Dec 10, 2024 · release notes

     Adds the COPPA Framework to Scrut Automation.

327. Freshservice Integration Dec 10, 2024 · release notes

     Adds Freshservice integration for ticket creation and evidence sync.

     └──▷ HOW TO FIND IT
     Use the integration guide to enable Freshservice connectivity and ticket syncing in Scrut.
     📍https://help.scrut.io/docs/integrating-freshservice
     • Adds Freshservice integration to create and sync tickets directly within Scrut
     • Enables automated collection of Freshservice evidence including ticket lists, activities, agents/roles, and vendors
     • Adds Freshservice support for access reviews to ensure compliance and visibility

     3 details in Everything

328. Azure Gov Cloud Support Dec 10, 2024 · release notes

     Scrut now supports Azure Gov Cloud for government cloud compliance, accessible via the new toggle in the Azure integration UI.

329. CrowdStrike Antivirus Detection Dec 9, 2024 · release notes

     Scrut adds detection of CrowdStrike Falcon Antivirus status on employee devices via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or agent.

     • Adds support for detecting CrowdStrike Falcon Antivirus installation status on employee devices
     • Enables tracking of antivirus compliance through MDM solutions or the Scrut agent

     2 details in Everything

330. IDP Termination Logic Update Dec 9, 2024 · release notes

     For IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. customers without HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records., automatically triggers offboarding and skips initially importing already-deprovisioned or deleted employees.

     • For customers without HRIS alongside their IDP integration, automatically initiates offboarding when an employee account is deleted, suspended or de-provisioned in the IDP.
     • For those customers, the first sync of a new IDP integration skips employees already de-provisioned or deleted.

     2 details in Everything

331. SonarCloud Integration Dec 9, 2024 · release notes

     Scrut adds SonarCloud integration to pull vulnerabilities and statuses into the Vulnerability Management module.

     └──▷ HOW TO FIND IT
     Connect Scrut to SonarCloud to sync code quality and security issues.
     📍https://help.scrut.io/docs/integrating-sonarcloud
     • Provides a centralized view of all SonarCloud vulnerabilities within Scrut for tracking

     1 detail in Everything

332. CIS v8.1 Framework Nov 13, 2024 · release notes

     Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. v8.1 framework support to Scrut Automation for compliance mapping

     • Adds the CIS v8.1 benchmarking framework as a new supported compliance option in the platform.

     1 detail in Everything

333. Okta Integration: New Flow Nov 12, 2024 · release notes

     Scrut Automation introduces a new flow for its Okta integration.

334. Customizing Trust Vault Controls Oct 17, 2024 · release notes

     Adds capability to customize Trust Vault controls in Scrut Automation

335. New Integrations in Scrut: Vercel, Qualys, Defender, Zendesk Oct 16, 2024 · release notes

     Scrut adds new integrations with Vercel, Qualys, Defender, and Zendesk.

     • Adds a Vercel integration.
     • Adds a Qualys integration.
     • Adds a Defender integration.
     • Adds a Zendesk integration.

     4 details in Everything

336. Mobile Responsive Trust Vault Website Oct 14, 2024 · release notes

     Trust Vault portal is now mobile responsive

     • Trust Vault website is now fully cross-device-compatible

     1 detail in Everything

337. New Integrations & Automated Evidence Tasks - AWS CodeCommit, Heroku & ServiceNo Sep 19, 2024 · release notes

     Adds AWS CodeCommit, Heroku, and ServiceNow integrations for automated evidence collection

     • Adds AWS CodeCommit integration to automate evidence collection from Git repositories.
     • Adds Heroku integration to automate evidence collection from the Heroku platform.
     • Adds ServiceNow integration to automatically attach incident lists to Evidence Tasks on a monthly cadence.

     3 details in Everything

338. Main Dashboard Enhancements Sep 19, 2024 · release notes

     Scrut Dashboard adds clickable compliance graph, framework/compliance percentages, and upcoming audits sections.

     • Adds a clickable compliance progress graph on the main dashboard that redirects to the controls page upon selection
     • Adds top metrics to the dashboard showing open risks, vendors not assessed, employees at risk, and audits in progress
     • Adds a frameworks section displaying all compliance frameworks and their respective compliance percentages
     • Adds an upcoming audit section displaying the next three planned audits with a view all link
     • Revamps the tasks/jobs requiring attention section spanning policies, evidence, and tests with user-specific views

     5 details in Everything

339. UKG Pro Integration Sep 19, 2024 · release notes

     Adds UKG Pro integration to fetch employee details in the Scrut platform

     • Adds UKG Pro integration in Integrations > Available to fetch employee name, email, department, reporting manager, joining date, and exit date

     1 detail in Everything

340. DTAC Framework Sep 18, 2024 · release notes

     Adds DTAC framework support for mapping NHS Digital Technology Assessment Criteria controls to compliance processes

341. Employee Application Access Overview Sep 18, 2024 · release notes

     Adds an Access tab for administrators to view employee applications and available account details.

342. Essential Eight Level 1 Framework Sep 17, 2024 · release notes

     Adds support for the Essential Eight Level 1 framework.

343. EASA Regulation 2022/1645 Framework Sep 17, 2024 · release notes

     Adds the EASA Regulation 2022/1645 framework to Scrut.

344. Enhanced Vendor Mitigation Task Workflow Sep 16, 2024 · release notes

     Enhanced vendor mitigation task workflow enables direct vendor assignment, file uploads, and audit logging

     • Enables assigning mitigation tasks directly to vendors via the Assignee drop-down in the Vendor Profile's Mitigation Task tab.
     • Allows vendors to upload supporting documents, add notes, and submit them for review in the vendor portal.
     • Sends email notifications when vendors add comments to mitigation tasks.
     • Creates audit logs visible to the vendor for every action performed on a mitigation task.

     4 details in Everything

345. Risk Bulk Import Enhancement Sep 16, 2024 · release notes

     New Entity column in Risk Bulk Import CSV template allows assigning risks to specific organizational units.

     • Adds an Entity column to the Risk Bulk Import CSV template, allowing users to assign relevant entities to each risk during bulk import.

     1 detail in Everything

346. Scrut Agent Updates Sep 16, 2024 · release notes

     Scrut Agent now auto-updates in background and runs as a persistent daemon.

     • Adds automatic background updates for the Scrut Agent to ensure it always runs the latest version
     • Enables persistent background operation by running the agent as an unquittable daemon process

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Users can no longer manually quit the Scrut Agent, which now runs as a persistent daemon process
347. Essential Eight Level 2 Framework Sep 16, 2024 · release notes

     Adds support for the Essential Eight Level 2 framework.

348. Introducing Diverse Vendor Custom Fields eg. Dropdown Sep 16, 2024 · release notes

     Vendor custom fields now support six field types, including dropdown selections, with filtering and export controls.

     • Vendor custom fields support Text Box, Text Area, Currency, Single Select, Multi Select, and Date types.
     • Supports searching text custom fields through the search bar and filtering other custom-field types, such as single-select and multi-select, through Filters.
     • Allows selecting custom field columns in the column selector to control which fields appear in exports.

     3 details in Everything

349. People Module: Groups & Checklist Feature Aug 11, 2024 · release notes

     Adds Groups and Checklists to People module for bulk onboarding/offboarding task management

     • Adds ability to organize users into Groups via the 'People > Employees > gear icon > Groups page'
     • Enables assigning checklists of ongoing and offboarding tasks to multiple users simultaneously through group membership
     • Supports importing groups from connected IDPs and syncing membership changes; imported group membership and names must be managed in the IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., and deleting an imported group returns its users to their prior Scrut default group.

     3 details in Everything

350. Employee Access To Vendor Apps Aug 11, 2024 · release notes

     Scrut Automation adds an Access tab to employee profiles showing vendor app access details.

     • Adds an Access tab in the Employee Profile UI displaying vendor app name, account name, and role.
     • Enables administrators to view all external applications and vendors an employee has access to.

     2 details in Everything

351. Pagerduty Integration: Evidence Collection Automation Aug 9, 2024 · release notes

     New PagerDuty integration for automated incident tracking and evidence collection

     • Adds PagerDuty integration to sync detailed incident information including status, urgency, assignments, and resolution details.
     • Adds PagerDuty user management capabilities to retrieve roles, contact methods, and team associations.
     • Adds Service Oversight to monitor PagerDuty service configurations and incident urgency rules.
     • Adds customizable scope selection to include specific services in the integration for tailored monitoring.
     • Enhances Scrut Monitor to automatically generate evidence lists for PagerDuty users, incidents, escalation policies, on-call schedules, and services.

     5 details in Everything

352. People dashboard group metrics Aug 9, 2024 · release notes

     People Dashboard now shows group-level metrics for task completion and pending activities.

     • Adds group metrics to the People Dashboard UI to display employee counts with pending tasks per group
     • Enables clicking on group metrics in the People Dashboard to view detailed lists of employees and their pending tasks

     2 details in Everything

353. NIST CSF 2.0 Jul 18, 2024 · release notes

     Adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 framework to Scrut's pre-built library for compliance monitoring.

     • Adds support for the NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals.) Version 2.0 as a new pre-built framework option.

     1 detail in Everything

354. Google Drive Integration: Upload Evidence from Google Drive Jul 17, 2024 · release notes

     Adds Google Drive integration for uploading evidence documents directly in Evidence Task section.

     • Adds manual upload option from Google Drive to the Evidence Task section side panel.
     • Supports OAuth authentication and multi-select file browsing from Google Drive folders.

     2 details in Everything

355. Improved Risk Lifecycle - Risk Monitor State Jul 16, 2024 · release notes

     Scrut Automation introduces monitored risk state for continuous oversight of mitigating controls.

356. Automatic Saving for Vendor Questionnaires in Vendor Portal Jul 16, 2024 · release notes

     Vendor Portal automatically saves questionnaire responses after each input

     • Vendor responses are automatically saved after each answer selection or text entry; if the device has an internet issue, automatic saving stops and a manual Save button is presented.

     1 detail in Everything

357. Mapping Difference Sheet - Admin Panel Jul 16, 2024 · release notes

     Adds a Mapping Difference Sheet in the Admin Panel for comparing customer vs master framework mappings

358. Personio Integration: Sync Employees to Scrut Jul 15, 2024 · release notes

     New Personio integration syncs employee data to Scrut via Settings > Integrations.

     • Adds Personio under Settings > Integrations to sync employees from Personio HRMS to Scrut
     • Adds automatic 24-hour sync of employee details (name, email, department, reporting manager, joining date, exit date) from Personio

     2 details in Everything

359. EC Council Integration: Sync Employees Training Data to Scrut Jul 15, 2024 · release notes

     Adds EC Council integration for syncing employee security training data to Scrut

     • Adds EC Council integration under Settings > Integrations with Organisation ID configuration and campaign toggling.

     1 detail in Everything

360. Charlie HR Integration: Sync Employee to Scrut Jul 15, 2024 · release notes

     Adds Charlie HR integration to sync employee data via settings > integrations

     • Adds the ability to integrate Charlie HR with Scrut to fetch employee details including name, email, department, reporting manager, joining date, and exit date.
     • Adds auto-sync of employees from Charlie HR to Scrut every 24 hours.

     2 details in Everything

361. Deel Integration: Sync Employees to Scrut Jul 15, 2024 · release notes

     Adds Deel integration to sync employee data (name, email, department, manager, dates) automatically.

     • Adds Deel integration option in Settings > Integrations for syncing employee details including name, email, department, reporting manager, joining date, and exit date
     • Enables auto-sync of synced employees to the Employees list under People every 24 hours

     2 details in Everything

362. CyberArk Integration: User Access Review Jul 14, 2024 · release notes

     Scrut adds CyberArk integration for automated user access review and sync

     • Adds CyberArk to the Integrations section of the Scrut dashboard for automated user list retrieval and compliance evidence collection

     1 detail in Everything

363. DigitalOcean Integration: Automate Evidence Collection Jul 14, 2024 · release notes

     New DigitalOcean integration for automated evidence collection in Scrut Monitor

     • Adds support for a new DigitalOcean integration that automates evidence collection
     • Scrut Monitor now automatically generates evidence including lists of Droplets, user accounts, firewall configurations, backup configs, load balancers, monitoring events, and Kubernetes clusters

     2 details in Everything

364. Auth0 Integration: Automated Evidence collection Jul 14, 2024 · release notes

     New Auth0 integration for automated evidence collection of user lists, organization members, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. statuses.

     • Adds Auth0 integration to automate retrieval of user data (IDs, emails, names, phone numbers, creation dates, identities, MFA statuses) and organization details (roles assigned to users).

     1 detail in Everything

365. Downloadable NDAs: Streamline NDA Management in Trust Vault Jul 12, 2024 · release notes

     Adds Download NDA option in Trust Vault to export signed agreements as PDFs

     • Adds a Download NDA link in the Access Management section of the user account details table for downloading signed NDAs.
     • Enables download of Clickwrap NDAs with placeholders (e.g. {firstName}) replaced by actual user details.

     2 details in Everything

366. Audit Log for Settings Jul 12, 2024 · release notes

     Adds comprehensive audit logs for Actions taken in Settings sections like Users, Workflows, and Notifications.

367. Say Goodbye to Region Selection: Scrut Improves Login Experience Jul 11, 2024 · release notes

     Scrut removes pre-login region selection, routing users directly to app.scrut.io with OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. options

     • Removes the data localization region selector (IN, US, EU) from the login flow for all users

     1 detail in Everything

368. Enhanced Quantitative Risk Assessment with Factor Descriptions Jul 11, 2024 · release notes

     Adds factor descriptions and edit capabilities within the Risk Settings UI.

     • Adds description field support when creating new risk factors.
     • Enables editing of existing factor names and descriptions via the Actions column in the Factors tab under Risk Settings.
     • Adds a description icon to the assessment interface to view factor details without leaving the screen.

     3 details in Everything

369. Delete Department Enhancements Jul 5, 2024 · release notes

     Adds department deletion warning modal with artifact counts and auto-reassignment to NO DEPARTMENT.

     • Shows a confirmation pop-up listing affected policies, evidence, and risks when deleting a department.
     • Automatically sets orphaned artifacts' department field to NO DEPARTMENT upon successful deletion.
     • Sends email notifications to all admins after a department is deleted.

     3 details in Everything

370. Introducing Risk Approval Workflow Jul 5, 2024 · release notes

     Adds an optional Approver workflow in Risk Management for validating risk assessments and treatment strategies.

     • Adds an optional Risk Approval Flow in Risk Settings with distinct Assignee and Approver roles; approving a risk closes it and makes its fields read-only except comments.
     • Adds Notify Approver button on the Risk Detail page, which triggers an email notification to the designated Approver.
     • Adds Approver visibility in the Risk Register Table, allowing users to identify who is responsible for final risk acceptance.

     3 details in Everything

371. Employee Source and its Filter in the Employee Section Jul 4, 2024 · release notes

     Adds Source column and filter to Employee section in Scrut platform

     • Adds a new Source column to the employee table in the People > Employees view to indicate whether data is from integrations or manual entry.
     • Adds a dedicated Employee Source filter in the advanced filter settings for the employee table.
     • Includes the employee source information in exported data files.

     3 details in Everything

372. Manual Sync for Integrations Jul 4, 2024 · release notes

     Adds a manual sync action for supported integrations through Settings > Integrations.

     • Adds Sync now in the three-dot menu under Settings > Integrations, limited to once per integration in 24 hours; cloud-provider and project-management integrations are excluded.

     1 detail in Everything

373. Editable Custom Framework Names Jul 4, 2024 · release notes

     Adds ability to edit custom framework names in the Frameworks UI

     • Allows editing the name of an existing or newly created custom framework via the Frameworks interface

     1 detail in Everything

374. Policy & Evidence Tasks Enhancement : Non Relevant Artefacts Justification & Art Jul 4, 2024 · release notes

     Announces an upcoming Source column and filter for Policy/Evidence Tasks, plus mandatory justification for irrelevant items.

     • For an upcoming release, announces a Source column and filter distinguishing Custom and Scrut-provided policies and evidence tasks.
     • For that release, announces mandatory justification when marking policies or evidence tasks irrelevant; the policy procedure specifies a Policy Justification Reason with a 500-character limit.

     2 details in Everything

375. Marking Employee Device as Out of Scope Jul 4, 2024 · release notes

     Scrut adds UI controls to mark employee devices as Out of Scope or In Scope for compliance calculations.

     • Adds a new workflow in the People > Employees view to mark MDMsMDMsMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. as Out of Scope, excluding them from compliance calculations.

     1 detail in Everything

376. Notifying Vendor About Flagged Responses Jul 3, 2024 · release notes

     Adds email notifications for flagged vendor questionnaire responses in Vendor Management module.

     • Lets a GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. user send an email about a flagged vendor questionnaire response by selecting the Notify Vendor checkbox and a POC.
     • Adds vendor notification to the Flag as Issue workflow, alongside its Risk Score and Flagging Reason fields.

     2 details in Everything

377. Significant Enhancements in Vendor Assessment Workflow Jul 3, 2024 · release notes

     Vendor assessment workflow gains editable risk scores, undo actions, and comment threads

     • Allows editing the risk score of a vendor questionnaire after an assessment has started by clicking the Edit icon and then Update
     • Adds Undo Accept and Undo Flag buttons to reverse permanent accept or flag decisions on individual answers
     • Enables adding comments to specific answers via the three dots menu, which triggers an email notification to the vendor

     3 details in Everything

378. Audit Centre Enhancement: Export Findings and Requests Jul 2, 2024 · release notes

     Audit Centre now supports exporting Findings and Requests as CSV via the UI

379. Configure and Display Custom Terms in Trust Vault Jul 2, 2024 · release notes

     Add custom Privacy Policy and Terms of Service URLs to Trust Vault settings

380. Integration Failure Email Notifications Jul 2, 2024 · release notes

     Scrut now sends email notifications when Daily Scan or Manual Integration fails, with a Re-Integrate link.

     • Users receive immediate email notifications if any integration encounters a failure during the Daily Scan or Manual Integration

     1 detail in Everything

381. Introducing Framework Recommendations: Jumpstart Compliance Jul 1, 2024 · release notes

     New Framework Recommendations feature and revamped Frameworks page with Compliance Progress tracking in Scrut Automation

     • Adds Compliance Progress metrics (Policy, Evidence, Tests) to each framework card on the revamped Frameworks page
     • Displays upcoming audits directly within the Frameworks page view

     2 details in Everything

382. Azure DevOps Integration: Create Ticket/Work Item Jul 1, 2024 · release notes

     Scrut now integrates with Azure DevOps to create work items directly from policy, test, and risk tasks.

     • Adds Azure DevOps integration enabling creation of tasks, issues, bugs, and epics via the Actions button in Policy, Test, Evidence, and Risk Management modules

     1 detail in Everything

383. Introducing Application Tests: Automated Compliance Testing for Your Organizatio Jul 1, 2024 · release notes

     Scrut introduces Application Tests module with automated compliance scanning for Cloudflare and Datadog integrations.

     • Adds Application Tests for daily automated compliance testing of supported integrated applications using predefined Scrut tests; users cannot customize or add tests.
     • Adds initial support for Cloudflare and Datadog as sources for Application Tests
     • Adds test statuses (Danger, Warning, Compliant, Ignored) to Application Test results

     3 details in Everything

384. Confluence Integration: Sync Policies Jun 30, 2024 · release notes

     Adds Confluence policy import and synchronization, with user review and renewed approval for updates to published policies.

     • Enables label-filtered Confluence policy imports through Settings > Integrations > Policy Management; users choose whether to sync updates, which return published policies to Draft for approval again.

     1 detail in Everything

385. Notion Integration: Access Review Jun 30, 2024 · release notes

     New Notion integration for access reviews accessible via Settings > Integrations

     • Adds Notion integration for user access reviews; the user list is retrieved, but user roles cannot be fetched and the role column remains empty.
     • Adds a new Notion integration option in the Integrations section under Settings.

     2 details in Everything

386. PDPA Singapore Jun 28, 2024 · release notes

     Adds PDPA Singapore as a supported compliance framework for audit

387. Introducing Risk Audit Log Jun 28, 2024 · release notes

     Scrut adds a Risk Audit Log tab on the Risk Details page to track user actions.

388. ISO 13485:2016 Jun 27, 2024 · release notes

     Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 13485:2016 framework support for medical device QMS compliance

389. ISO 9001:2015 Jun 27, 2024 · release notes

     Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 9001:2015 Quality Management Systems compliance framework support

     • Adds ISO 9001:2015 to the library of supported compliance frameworks

     1 detail in Everything

390. Centralized Audit Findings and Requests Jun 27, 2024 · release notes

     Adds centralized Requests and Findings views to Audit Centre and combines Current and Completed audits under All Audits.

     • Adds a Requests and Findings section on the Audit Centre main page; Current and Completed audits are combined under All Audits.
     • Adds a Requests tab within Audit Centre displaying all requests across audits with filterable columns (Status, Assignee) and export capability via the three-dot menu.
     • Adds a Findings tab within Audit Centre displaying all findings across audits with advanced filters (Nature of Findings, Department, Created By, Corrective Action Created) and export capability.

     3 details in Everything

391. TISAX Jun 27, 2024 · release notes

     Scrut adds TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. framework support for automotive supply chain compliance assessments

     • Adds TISAX (Trusted Information Security Assessment Exchange) framework to the list of supported compliance frameworks

     1 detail in Everything

392. Archiving for Evidence Attachments Jun 26, 2024 · release notes

     New feature allows archiving evidence attachments to declutter workspace and manage compliance records.

     • Archiving for Evidence Attachments

     1 detail in Everything

393. Enhancements to the Risk Register: Created On and Last-Modified Dates Jun 26, 2024 · release notes

     Adds creation and last modification date filtering to the Risk Register, with export columns for these dates.

     • Adds filter controls to the Risk Register UI allowing users to view risks by Created On and Last-Modified Date using predefined ranges or custom input
     • Includes Creation Date, Last Modified Date, and Control Code columns in Risk Register CSV exports

     2 details in Everything

394. ISO 27018:2019 Jun 26, 2024 · release notes

     Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27018:2019 compliance framework support for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. protection in cloud environments.

395. Adding FAQ and Updates in Trust Vault Jun 25, 2024 · release notes

     Trust Vault now supports publishing FAQs and Updates to communicate security practices.

     • Enables companies to create and publish FAQs within their Trust Vault
     • Allows companies to publish Updates about security posture (certifications, audits, measures) in Trust Vault

     2 details in Everything

396. Introducing: Vulnerabilities Management Module in Scrut: Get a comprehensive vie Jun 25, 2024 · release notes

     Scrut adds a new Vulnerabilities Management module with integration for AWS Inspector, Snyk, and GitHub Dependabot, plus JIRA incident tracking.

     • Adds the Vulnerabilities Management module for visibility into vulnerabilities from connected supported applications.
     • Supports AWS Inspector as a vulnerability data source
     • Supports Snyk SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. as vulnerability data sources
     • Supports GitHub Dependabot as a vulnerability data source
     • Enables two-way JIRA integration to create tickets for identified vulnerabilities

     +1 more show less

     • Adds the Edit SLA UI button to configure severity-based remediation timelines

     6 details in Everything

397. Framework Compliance Report Jun 25, 2024 · release notes

     Adds framework-level compliance report downloads from platform UI

     • Users can now download a framework-specific compliance report via the Report Section or the framework detail page.
     • Downloaded reports are delivered via email with a link that expires in 7 days.

     2 details in Everything

398. Improvements in Vendor Management Module Jun 25, 2024 · release notes

     Adds ability to edit and delete mitigation tasks in the Vendor Management module

     • Enables editing of mitigation tasks directly within the Vendor Management Module.
     • Allows deletion of mitigation tasks via the Vendor Management UI.
     • Permits editing the vendor questionnaire template name for organizational updates.

     3 details in Everything

399. Introducing New Risk Status: Treatment in Progress Jun 24, 2024 · release notes

     New Treatment in Progress risk status allows tracking of active mitigation tasks.

400. Saudi Arabia PDPL Jun 24, 2024 · release notes

     Scrut adds Saudi Arabia PDPL pre-built compliance framework

401. Employment Hero Integration: Sync Employee Deals Jun 22, 2024 · release notes

     Adds Employment Hero HRMS integration to sync employee details.

402. SharePoint Integration: Sync Policies Jun 22, 2024 · release notes

     Scrut adds SharePoint Integration for automatic policy sync and management.

     • Adds SharePoint Integration entry in the Integrations section to import and sync policies from SharePoint sites.
     • Adds Sync a file attachment option with SharePoint source selection within the Policy Editor.
     • Enables automatic re-sync of policies every 6 hours with tagging and status updates.

     3 details in Everything

403. MongoDB Integration Jun 22, 2024 · release notes

     Adds MongoDB Atlas integration for automated database encryption at rest compliance testing

     • Adds MongoDB Atlas integration that makes the MongoDB database-encryption-at-rest test available in the Application Test module.

     1 detail in Everything

404. Automated Policy Metadata in Inline Editor Jun 21, 2024 · release notes

     Adds automatic policy metadata in the inline editor and PDF exports; existing users must enable it in policy settings.

     • When enabled, the inline editor automatically displays approver, assignee and publisher metadata; existing users must enable the feature and manually remove their existing revision-history tables.
     • Downloading a policy from the inline editor now appends the Policy Metadata Table to the end of the generated PDF.

     2 details in Everything

405. Improved Evidence Export Jun 21, 2024 · release notes

     Reorganizes exported evidence attachments under Evidence Tasks instead of framework requirement codes.

     • Groups exported attachments under their Evidence Tasks; links are not downloaded and tasks without attachments are excluded.

     1 detail in Everything

406. Introducing Vendor Intake Form Jun 21, 2024 · release notes

     Adds Vendor Intake Form workflow for structured vendor onboarding and risk assessment

     • Adds Intake Form creation via Settings > Intake Form > Create Intake Form to build custom vendor onboarding questions
     • Enables employees to submit vendor requests via the Employee Portal tab Vendor Onboarding > New Request
     • Adds GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. approval/decline workflow for Vendor Onboarding requests with mandatory declination reasons and email notifications

     3 details in Everything

407. Introducing Diverse Risk Custom Fields Jun 21, 2024 · release notes

     Scrut adds Currency, Single Select, Multi Select, Textbox, and TextArea custom field types to the risk register.

     • Adds Currency custom field type for capturing monetary values with configurable currency settings
     • Adds Single Select custom field type allowing users to configure drop-downs for single value selection
     • Adds Multi Select custom field type enabling configuration of drop-downs for multiple value selection
     • Adds Textbox custom field type for small notes with a 100-character limit
     • Adds TextArea custom field type for descriptions with a 500-character limit

     +1 more show less

     • Adds Assessment or Residual categorization for custom fields; a custom field’s type cannot be changed after creation.

     6 details in Everything

408. Vendor Reassessment Workflow Jun 19, 2024 · release notes

     Adds automated vendor reassessment workflows with status transitions and dashboard metrics

     • Adds Needs Reassessment metric to the Vendor Dashboard for identifying vendors due for review
     • Enables automatic status changes from Assessed to Needs Reassessment on the next assessment date based on configured recurrence
     • When enabled in Settings > Notifications, sends the vendor assignee a reminder one week before reassessment.

     3 details in Everything

409. Introducing Multi-Entity Support in Vendor Management Jun 19, 2024 · release notes

     Multi-entity support in Vendor Management adds entity selection during vendor creation, bulk import, discovery, onboarding, and dashboard filtering.

     • Entity Selection during Vendor Creation allows selecting one or more entities relevant to the vendor's services during vendor creation or editing.
     • Bulk Import template now includes a dedicated Entities column to efficiently assign entities during the import process.
     • Entity selecting during Vendor Discovery enables selecting one or more entities when creating vendors from the Vendor Discovery tab.
     • Entity filter in Vendor Dashboard allows users to see vendor compliance for specific entities.

     4 details in Everything

410. Essential Cybersecurity Controls(ECC-1:2018) Framework Jun 19, 2024 · release notes

     Adds Essential Cybersecurity Controls (ECC-1:2018) framework support for Saudi Arabian compliance.

411. Audit Log and enhancements in Vault Jun 18, 2024 · release notes

     Adds audit logs and Root folder visibility to the Scrut Vault

     • Enables comprehensive audit logs within the Vault section for tracking actions
     • Displays the Root folder in the Folders tab with protection against rename or delete

     2 details in Everything

412. Dynamic Control Status based on Framework and Entity selected Jun 18, 2024 · release notes

     Control status now dynamically reflects the selected Framework and Entity filters.

     • The Controls table shows control status determined by the currently applied framework and entity filter
     • Framework Detail page displays control status based on the specific framework in context

     2 details in Everything

413. Zenefits Integration Jun 8, 2024 · release notes

     Adds Zenefits HRMS integration to sync employee data in Scrut.

     • Adds Zenefits integration in Settings > Integrations for syncing employee details (name, email, department, reporting manager, joining date, exit date).

     1 detail in Everything

414. Importing AWS Tags and Ignoring Resources Based on Specific Tags Jun 8, 2024 · release notes

     New UI navigation to import AWS tags and ignore resources by tag in Settings > Integrations

     • Adds Tags under Configure AWS in Integrations to fetch AWS tags after sync and ignore their linked resources; ignoring a tag requires a justification.
     • Displays imported AWS tags directly in the resources table for visibility.

     2 details in Everything

415. Automated Evidence Collection of Completed Security Campaigns Jun 7, 2024 · release notes

     Automated population of evidence attachments for completed security campaigns via a new toggle.

     • When Automated Evidence is enabled for a campaign, exports Security Awareness Training Report and Refresher Training on ISMS evidence at the next automated sync after 100% completion or Completed status.
     • Introduces a toggle switch under the Automated Evidence section within each security campaign UI to enable or disable this automated attachment population.

     2 details in Everything

416. Resetting Offboarded and Terminated Employees Jun 7, 2024 · release notes

     Adds Reset Offboarding Completed and Reset Termination options to correct employee statuses in the Scrut platform.

     • Adds Reset Offboarding Completed option inside the three dots of each employee to revert status back to Offboarding Needed
     • Adds Reset Termination option inside the three dots of each employee to revert status back to Training Incomplete

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Delete Employee option is removed from the Scrut platform; reset actions can correct offboarding or termination status.
417. JIRA bi-directional integration Jun 7, 2024 · release notes

     Scrut adds bi-directional JIRA integration for real-time ticket status sync and automatic evidence attachment import.

     • Adds bi-directional JIRA sync for linked ticket status; automatic import of new attachments into evidence tasks requires enabling the attachment-import toggle.
     • Automatically sets the Scrut evidence task status to Draft when attachments are imported from JIRA

     2 details in Everything

418. SAMA MVC Jun 6, 2024 · release notes

     Adds support for the SAMA MVC framework to automate compliance for Saudi financial institutions.

     • Integrates the SAMA MVC framework into the compliance automation platform

     1 detail in Everything

419. PCI DSS 4.0 Jun 6, 2024 · release notes

     Adds PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0 framework to enable compliance automation for the latest standard.

     └──▷ BREAKING ON UPGRADE

     • !The vendor notes PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. SSC retirement of PCI DSS 3.2.1 after March 31, 2024 and advises transitioning to PCI DSS 4.0 for continued compliance.
420. Marking Framework Requirements Out of Scope and Download SOA Jun 6, 2024 · release notes

     New capabilities to mark framework requirements out of scope and download Statements of Applicability

     • Adds the ability to mark framework requirements out of scope with a justification note.
     • Enables exporting in-scope requirements as a CSV file (Statement of Applicability) via the Scope filter and three-dot menu.

     2 details in Everything

421. Introducing Unified Mitigation Tasks Tab in Risk Module Jun 5, 2024 · release notes

     Introducing Unified Mitigation Tasks Tab in Risk Module

     • Adds a Mitigation Tasks Tab within the Risk Management Module to provide a centralized hub for viewing all mitigation tasks across risks.
     • Enables filtering mitigation tasks by Status, Assignee, and Due Date.
     • Displays the associated risk name on the mitigation task detail page.
     • Introduces a Mitigation task chart to filter and navigate to the list of mitigation tasks.

     4 details in Everything

422. Introducing Bulk Actions on Policy & Evidence Jun 5, 2024 · release notes

     New Bulk Actions UI for policy and evidence management on Scrut service

     • Adds checkboxes to the Policy and Evidence Table to select multiple items for bulk operations
     • Adds Bulk Assignee, Bulk Delete, Mark as Relevant and Mark as Not Relevant actions; bulk assignment replaces existing assignees, deleted policies cannot be recovered, and marking policies not relevant requires a justification.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Action column from older versions has been removed.
423. Real-Time Employee Sync for Security Campaigns Jun 5, 2024 · release notes

     Adds manual immediate employee sync for security campaigns configured with all learners.

     • Allows immediate training-portal access for newly added employees after manually triggering synchronization in campaigns configured with all learners.

     1 detail in Everything

424. Introducing Dashboard Filters in Policy & Evidence Jun 4, 2024 · release notes

     Adds dashboard filters (Assignee, Department, Framework, Entity) to Policy & Evidence modules with persistent state across views.

     • Adds Assignee, Department, Framework, and Entity dropdowns as primary filters in the Policy and Evidence dashboards
     • Persists applied filters and column selectors when switching tabs between Dashboard and All Policies/Evidence tables or clicking into graph details

     2 details in Everything

425. Audit Project Creation by Controls Jun 4, 2024 · release notes

     Scrut now allows creating Audit projects by selecting specific controls or control domains via UI.

     • Adds the ability to create an audit by choosing Create an audit by control instead of only by Framework during creation.
     • Enables linking and unlinking specific controls to an existing audit project through the UI.

     2 details in Everything

426. Integrating Project Management Tools to Risk Management Jun 4, 2024 · release notes

     New project management integrations for risk treatment tasks in Scrut's UI

     • Extends project-management integration to Risk Management, using tools connected through Settings > Integrations > Project Management Platforms.
     • Enables creation of treatment plan tasks as tickets in connected project management tools directly from the risk detail page's three-dot menu.

     2 details in Everything

427. Vendor Custom Categories Jun 3, 2024 · release notes

     Adds ability to create and manage custom vendor categories in Vendor Management settings.

     • Introduces New Category button in the Category tab of the Vendor Management section settings to allow creation of custom vendor categories
     • Adds ability to delete custom vendor categories via the Delete icon, with existing vendors automatically linked to Others
     • Adds support for custom vendor categories to replace the previous limitation to pre-defined lists

     3 details in Everything

428. Comment Feature Added to Corrective Action Module Jun 1, 2024 · release notes

     Adds a comment feature to the Corrective Action module for context and collaboration

     • Enables adding comments to individual corrective actions in the Corrective Action section

     1 detail in Everything

429. Simplified User Creation During Artifact Assignment Jun 1, 2024 · release notes

     Adds Add New User option during artifact assignment to create users on-the-fly

     • In the first phase, adds Add New User during assignment in Policy, Evidence, Risk Management, Audit Center, Corrective Action Tracker and Vendor Management; other modules are planned for later phases.
     • Introduces a modal window triggered by Add New User to enter necessary details and automatically assign the new user to the current task or policy

     2 details in Everything

430. Enhanced Visibility in Scrut Agent UI Jun 1, 2024 · release notes

     New visibility in Scrut Agent UI for AV, Screenlock, and HD encryption status

     • Displays Antivirus (AV) installation status directly within the Scrut agent user interface
     • Displays Screenlock status directly within the Scrut agent user interface
     • Displays Hard Drive (HD) encryption status directly within the Scrut agent user interface

     3 details in Everything

431. Asana Integration May 31, 2024 · release notes

     Adds Asana integration for creating compliance tasks from Policy, Test, Evidence, and Risk modules.

     • Adds Asana integration accessible via Settings > Integrations > Asana to raise tickets and manage tasks
     • Adds Create Asana Task dropdown option in Policy, Test, Evidence task, and Risk Management modules

     2 details in Everything

432. Enhanced AWS Test Findings May 31, 2024 · release notes

     AWS test findings now include detailed remediation steps and enhanced explanations for concerns.

     • Displays complete test findings with detailed remediation steps for all AWS test findings
     • Provides enhanced, clarified explanations for concerns associated with AWS test findings

     2 details in Everything

433. Azure DevOps Integration: Auto-Collect Pull Requests Evidence May 31, 2024 · release notes

     New Azure DevOps integration for auto-collecting pull request evidence via Settings > Integrations > Version Control

     • Automatically attaches Code Review Evidence on the 15th and last days of the month for configured repositories.

     1 detail in Everything

434. Microsoft Teams Integration May 30, 2024 · release notes

     Adds Microsoft Teams integration for real-time evidence assignment, comment, and review deadline notifications.

     • Enables Microsoft Teams Integration in the Scrut platform via Settings > Integrations to receive real-time notifications for evidence activities.

     1 detail in Everything

435. ISO 42001 May 30, 2024 · release notes

     Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 42001 framework support for AI compliance automation

436. NIS 2 Directive May 29, 2024 · release notes

     Scrut adds NIS 2 Directive framework support for EU cybersecurity compliance

     • Adds NIS 2 Directive framework support to assess Essential and Important Entities (EEIs) across the EU

     1 detail in Everything

437. ISO 27017 May 29, 2024 · release notes

     Adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27017 framework support for cloud security compliance

438. Framework Detail Page UX improvement May 28, 2024 · release notes

     Scrut adds accordion requirement view, inline control side-panel, and status color-coding to Framework detail page

     • Adds accordion-style Requirement View on the Framework Detail Page to expand controls directly without a second click
     • Adds side panel for Controls within the accordion that displays linked policies and evidence without leaving the framework detail page

     2 details in Everything

439. Vendor Dashboard May 28, 2024 · release notes

     Adds a Vendor Dashboard with risk metrics, questionnaire and mitigation-task charts, assessment deadlines, and assignee/category filters.

     • Adds Vendor Dashboard with clickable metrics for Vendor Assessment Status (Not Assessed, In Progress, Assessed) and Highest Risk Score
     • Adds Questionnaire Status Donut Chart showing breakdown of Created, Sent, Overdue, Submitted, Assessed statuses and Average Response Time
     • Adds Mitigation Task Donut Chart to track progress of mitigation tasks associated with vendors
     • Adds Inherent Risk Donut Chart and Residual Risk Donut Chart for clicking through to explore distribution across High, Medium, Low categories
     • Adds Vendors By Assignee/Category Stacked Bar Graph with switchable Assignee View and Category View

     +2 more show less

     • Adds Upcoming Vendor Assessment Bar Graph to identify vendors with approaching assessment deadlines
     • Adds Assignee Filter and Category Filter as global filters for the Vendor Dashboard

     7 details in Everything

440. Audit Logs for Security Awareness and Employee Section May 27, 2024 · release notes

     Audit Logs for Security Awareness and Employee sections under People module

     • Adds Audit Log view for Security Awareness campaigns in the People module with search and filters.
     • Adds Audit Log view for Employees in the People module showing user action history with date and time.

     2 details in Everything

441. AWS Extended Cloud Findings with Metadata May 27, 2024 · release notes

     Adds 23 new AWS cloud security test findings with detailed metadata to Scrut's Tests section

     • Adds Global Service Logging Duplicated test finding with comprehensive metadata.
     • Adds Trail Is Not Integrated with CloudWatch test finding with comprehensive metadata.
     • Adds Data Events Logging Not Configured test finding with comprehensive metadata.
     • Adds CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. Logs Not Encrypted with KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. Customer Master Keys (CMKs) test finding with comprehensive metadata.
     • Adds Group with No Users test finding with comprehensive metadata.

     +18 more show less

     • Adds User without MFA test finding with comprehensive metadata.
     • Adds Users with Access Keys Created during Initial Setup and Not Used test finding with comprehensive metadata.
     • Adds Auto Minor Version Upgrade Disabled test finding with comprehensive metadata.
     • Adds RDS Instance Publicly Accessible test finding with comprehensive metadata.
     • Adds Publicly Accessible Snapshot test finding with comprehensive metadata.
     • Adds DKIM Not Enabled test finding with comprehensive metadata.
     • Adds DKIM Not Verified test finding with comprehensive metadata.
     • Adds Publicly Accessible AMI test finding with comprehensive metadata.
     • Adds Unused Security Group test finding with comprehensive metadata.
     • Adds Public EBS Snapshot test finding with comprehensive metadata.
     • Adds Potential Secret in Instance User Data test finding with comprehensive metadata.
     • Adds Instance with a Public IP Address test finding with comprehensive metadata.
     • Adds Drop Invalid Header Fields Disabled test finding with comprehensive metadata.
     • Adds Bucket without MFA Delete test finding with comprehensive metadata.
     • Adds GetTopicAttributes Authorized to All Principals test finding with comprehensive metadata.
     • Adds ListSubscriptionsByTopic Authorized to All Principals test finding with comprehensive metadata.
     • Adds Queue with Encryption Disabled test finding with comprehensive metadata.
     • Adds Version Upgrade Disabled test finding with comprehensive metadata.

     23 details in Everything

442. Scrut Agent Version Visibility in Employee table & the Technicals tab - People s May 25, 2024 · release notes

     Agent version visibility added to People table and Technicals tab in Scrut

     • Adds agent version display in the Technicals tab for individual employees under the People > Employees section.
     • Enables hovering over the Scrut logo in the Employee table to view the installed agent version.

     2 details in Everything

443. Fetching and Displaying Antivirus Name/Version from the Scrut Agent May 25, 2024 · release notes

     Scrut Agent now fetches and displays installed antivirus name and version via UI.

444. Enhanced Audit Request and Finding Status Workflow May 24, 2024 · release notes

     Enhanced audit workflows introduce Needs Review status and Request Revision for findings.

     • Adds a new Needs Review status to audit requests and findings, visible after an assignee submits work for review.
     • Enables auditors to Request Revision on submitted findings, moving the status to Needs Revision.

     2 details in Everything

445. Introducing Customization of Risk Categories May 22, 2024 · release notes

     Adds customizable risk categories in Risk Management settings and makes the Category field optional

     • Adds a Categories tab in Settings > Risk Management to allow users to create and delete custom risk categories
     • Makes the Category field optional for risk creation instead of mandatory
     • Reassigns risks from deleted categories to OTHERS and notifies admin via email

     3 details in Everything

446. Policy Re-Acceptance Workflow May 22, 2024 · release notes

     Admins can now control whether republished policies require employee re-acceptance in the Employee Training Portal.

     • For policies linked on Settings > Employee Training, lets administrators decide whether republishing requires employee re-acceptance.

     1 detail in Everything

447. Removal of inactive employee from Security campaign & People Dashboard Feb 28, 2024 · release notes

     Scrut now excludes inactive employees from new security campaigns and People Dashboard metrics

     • Excludes employees from new security campaigns when they are Non-Personnel, deleted, Offboarding Completed, or their exit/termination date is today or earlier.
     • Adding employees via the Configure Employees button automatically excludes inactive staff from existing campaigns
     • People Dashboard calculations for Agents Installed, HD Encrypted, Screenlock Enabled, AV Installed, Policy Acceptance Rate, Campaign Overview, and Quiz Overview now reflect only active employees

     3 details in Everything

448. Delete Department Enhancements Feb 27, 2024 · release notes

     Adds confirmation modal showing artifact counts before deleting a department in Scrut.

     • Display a warning pop-up when initiating department deletion, detailing the number of affected policies, evidence, and risks.
     • Send an email notification to all admins upon successful department deletion.
     • Pre-apply a NO DEPARTMENT filter to the impacted artifacts hyperlink in the post-deletion toast message.

     3 details in Everything

449. Introducing Risk Audit Log Feb 27, 2024 · release notes

     Adds Risk Audit Log tab and Comments feature to Scrut Risk Management

     • Adds a new Risk Audit Log tab on the Risk Details page that logs every user action with timestamps and user names.

     1 detail in Everything

450. Introducing Vendor Onboarding Workflows Feb 27, 2024 · release notes

     Adds Vendor Onboarding Workflows with configurable intake forms and approval workflows for vendor risk management.

     • Adds the Intake Form setting under Settings to create customized vendor onboarding questionnaires
     • Adds a Vendor Onboarding tab in the employee portal for submitting new vendor requests and answering intake questions
     • Adds GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. approval or decline of vendor-onboarding requests; declining requires a reason and sends the employee an email.

     3 details in Everything

451. Introducing Risk Approval Workflow Feb 26, 2024 · release notes

     New Risk Approval Workflow with Approver persona, UI toggle, and residual risk approval flow in Scrut's Risk Management module.

     • Adds the Approver user persona to Risk Management, enabling a dedicated validation step for risk treatment strategies separate from the Assignee.
     • Introduces a new toggle switch in Risk Management Settings > Configuration Tab to enable the Risk Approval Flow.
     • Adds a Notify Approver button on the Risk detail page that triggers an email to the designated Approver once residual risk assessment is complete.
     • Lets the Approver accept or decline risks, requiring a reason for decline; approval closes the risk and prevents further field edits except comments, with audit logs captured.

     4 details in Everything

452. Marking Employee Device as Out of Scope Feb 23, 2024 · release notes

     Adds Mark Out of Scope action to exclude MDMsMDMsMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. from compliance calculations

     • Lets users mark employee devices Out of Scope to exclude them from compliance calculations and record a justification.
     • Lets users mark devices back In Scope so they are included in compliance calculations again.

     2 details in Everything

453. Essential Cybersecurity Controls(ECC-1:2018) Framework Feb 23, 2024 · release notes

     Adds ECC-1:2018 framework support for compliance automation

454. Editable Custom Framework Names Feb 22, 2024 · release notes

     Scrut now permits editing the display name of custom frameworks via a pencil icon in the UI.

455. Policy & Evidence Tasks Enhancement : Non Relevant Artefacts Justification & Art Feb 22, 2024 · release notes

     Announces an upcoming Source column/filter and mandatory irrelevant-item justification for Policy & Evidence Tasks.

     • For an upcoming release, announces a Source column showing custom or Scrut origin in the Policy and Evidence Tasks table.
     • For that release, announces mandatory Policy Justification Reason of up to 500 characters when marking a policy not relevant.
     • The announced enhancement includes an advanced Source filter for Policy and Evidence Tasks.

     3 details in Everything

456. Employee Source and its Filter in the Employee section Feb 22, 2024 · release notes

     New Source column and filter in the Employees section to distinguish integration vs manual data

     • Adds a Source column to the Employee table in People > Employees with sorting functionality
     • Adds an advanced filter for employee source to isolate integration-sourced or manually created employees
     • Includes the employee Source field in exported data files

     3 details in Everything

457. Notifying Vendor about flagged responses Feb 21, 2024 · release notes

     Adds email notifications to vendors when GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. teams flag responses in questionnaires.

     • Adds Notify Vendor checkbox to the response flagging workflow to trigger email alerts.

     1 detail in Everything

458. Draft/Unsent Vendor Questionnaire Deletion Feb 21, 2024 · release notes

     Adds ability to delete draft and unsent vendor questionnaires from the UI

459. Audit Centre Enhancement: Export Findings and Requests Feb 20, 2024 · release notes

     New export functionality allows sharing audit data via CSV, improving external collaboration.

     • Enables employees to share Audit Requests and Findings with external auditors or any stakeholders without access to the Scrut Platform.

     1 detail in Everything

460. Configure and Display Custom Terms in Trust Vault Feb 20, 2024 · release notes

     Trust Vault preview now supports custom legal document links via new Settings section.

461. Integration Failure Email Notifications Feb 19, 2024 · release notes

     Scrut now sends email notifications when integrations fail during Daily Scan or Manual Integration

     • Sends immediate email notifications to users when any integration fails during the Daily Scan process.
     • Sends immediate email notifications to users when any integration fails during a Manual Integration process.

     2 details in Everything

462. Configuring policies and profiles for Screenlock and AV detection - MS Intune & Feb 19, 2024 · release notes

     Adds UI controls in Scrut to select MS Intune policies and JamfPro profiles for AV and screenlock detection.

     • Adds a new Configure Policies option within the MS Intune integration settings to select specific device management policies
     • Adds a new Configure Profiles option within the JamfPro integration settings to select specific device management profiles
     • Enables fetching of antivirus and screenlock status for users based on selected Intune/Jamf profiles via the UI

     3 details in Everything

463. Status of Inactive Resources Jan 17, 2024 · release notes

     Scrut adds visual indicators for inactive cloud resources in Tests and By Resources views

     • Fades out inactive resources in the Tests section to indicate an account may be inactive
     • Fades out inactive resources on the By Resources page with an indicator message

     2 details in Everything

464. Edit and Delete Risk Mitigation Task Jan 16, 2024 · release notes

     New UI actions for editing, deleting, and auditing Mitigation Tasks with a new status workflow

     • Adds an Action column to the Mitigation Task table that enables deletion of tasks directly from the UI
     • Adds ability to edit Mitigation Task names and descriptions via the Mitigation Task Page
     • Adds an Audit Log to capture and track changes made to Mitigation Tasks
     • Redefines Mitigation Task status categories to Not Due, Due, and Closed based on assigned dates and approval

     4 details in Everything

465. Creating Corrective Action from Audit Finding Jan 16, 2024 · release notes

     Scrut now allows creating Corrective Actions directly from Audit Findings via the UI.

     • Adds creation of Corrective Actions linked to Audit Findings from the Actions menu or finding details; all linked corrective actions must close before the finding can close.
     • Introduces Source Name and Source Type columns in the Corrective Action Tracker, with Source Name linking back to the associated audit.

     2 details in Everything

466. Active employee calculation and Employee type filters Jan 15, 2024 · release notes

     Adds Employee type filter UI option for Active and Ex-Employee statuses

     • Adds an Employee type filter in the portal UI with Active employees and Ex-Employees options to control visibility based on offboarding status.
     • Enhances the backend logic for Active Employee calculations to exclude users marked as NOT A PERSON or OFFBOARDING COMPLETED, and include those with OFFBOARDING NEEDED status and a future exit date.

     2 details in Everything

467. Introducing Risk ID in Risk Register Jan 15, 2024 · release notes

     Adds Risk ID with configurable prefix and search to Scrut Risk Register UI

     • Adds a Risk ID toggle in Configuration > Risk Settings, disabled by default; enabling it generates identifiers for existing and new risks.
     • Supports user-defined alpha-numeric prefix (max 6 chars) for Risk IDs, once set immutable
     • When Risk ID is enabled, displays it as the first Risk Register column and supports searching by ID.
     • When enabled, displays Risk ID at the top of Risk Details alongside Risk Name; with the toggle off, the previous layouts remain unchanged.

     4 details in Everything

468. GCP Integration using service account impersonation Jan 12, 2024 · release notes

     Adds GCP integration through service-account impersonation, recommended over the earlier JSON-file method because credentials are short-lived.

     • Adds new UI navigation to integrate GCP accounts using service account impersonation under Settings > Integrations > Cloud Provider
     • Enables automatic scanning for misconfigurations every 24 hours across integrated GCP accounts, with results displayed in the Test section of the Scrut platform
     • Introduces a recommended integration method over the previous JSON file mechanism to enhance security through short-lived credentials

     3 details in Everything

469. Introducing Policy Multi-level Approval Workflow Jan 11, 2024 · release notes

     Scrut now supports multi-level policy approval workflows with configurable approver chains and progress tracking.

     • Adds a sequential chain of up to five policy approvers; every designated approver must approve before publication, and renewal repeats the workflow.
     • Adds a Policy Approval toggle under Settings > Workflows to activate multi-level approval workflows
     • Adds a Progress Bar on the Policy detail page to visualize approval status and identify the next approver in line

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !When the Policy Workflow is OFF, the Approver field from the policy is removed; values can be retrieved by turning the toggle ON for Policy Approval Workflow.
470. ADP Integration Jan 4, 2024 · release notes

     New ADP integration fetches employee details via Settings > Integrations

     • Adds ADP WorkForceNow integration to sync Employee Name, email, department, reporting manager, joining date, and exit date
     • New Integrate button in Settings > Integrations for ADP connection setup

     2 details in Everything

471. Reset MDM Integration and Delete employee’s system details in the "Technicals" t Jan 4, 2024 · release notes

     Reset integration and delete Technicals data in Scrut Automation

     • Adds option to 'Reset Integration + Remove Technicals data like HD encrypted, etc.' when disconnecting MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integrations via the UI

     1 detail in Everything

472. CMMC 2.0 Level 1 Framework Jan 4, 2024 · release notes

     Adds CMMC 2.0 Level 1 framework support for self-assessment and compliance monitoring.

473. Ticket link & Ticket created filter in Tests module→ By Rules section Jan 3, 2024 · release notes

     Adds ticket links and a Ticket created filter to Tests > By Rules.

     • Displays Ticket Link in the Tickets field of the Tests → By Rules table for findings with associated tickets.
     • Adds Ticket created filter (Yes/No) to the Tests → By Rules section.

     2 details in Everything

474. Evidence Dashboard Jan 2, 2024 · release notes

     Scrut adds Evidence Dashboard to visualize evidence metrics by department, assignee, and framework.

     • Adds an Evidence Dashboard excluding Not Relevant evidence from all metrics and graphs; draft counts appear only when Evidence Approval Workflow is enabled.
     • Adds an Evidence by Department bar chart with drill-down to pre-filtered All Evidence views.
     • Adds an Evidence by Assignee bar chart with drill-down to pre-filtered All Evidence views.
     • Adds an Evidence by Framework bar chart with drill-down to pre-filtered All Evidence views.
     • Adds an Upcoming Evidence for Review section showing overdue counts and a 4-month projection.

     5 details in Everything

475. Vendor Custom Fields Jan 2, 2024 · release notes

     Adds Vendor Custom Fields for tailoring vendor profiles beyond default data

     • Enables users to define and capture additional custom fields in vendor profiles via the Vendor Management module Settings.
     • Allows bulk import of custom field values by appending them starting from Column H in the Import Vendors template.

     2 details in Everything

476. Vendor Overview Jan 2, 2024 · release notes

     Adds a Vendor Overview tab with risk scores and questionnaire-status charts for each vendor.

     • Adds a Vendor Overview tab within the Vendors Management module to view risk scores and questionnaire status.
     • Introduces a Risk Score by Domain bar graph for breakdown of vendor risk areas.
     • Adds a Questionnaire Status Donut Chart showing Created, Sent, Submitted, Accepted, and Overdue states.
     • Adds a Mitigation Task Status donut chart tracking open and closed tasks.

     4 details in Everything

477. Duration filter and Access Requests Granted term change in Trust Vault Jan 1, 2024 · release notes

     Adds Duration filter to Trust Vault tabs and renames Active Access Request to Access Requests Granted

     • Adds a Duration filter to the Trust Vault module to refine search results by time range (last 7 days to last 1 year).
     • Renames the tab label from Active Access Request to Access Requests Granted in the Trust Vault interface.

     2 details in Everything

478. Jira Integration Now Includes Future Sprints Jan 1, 2024 · release notes

     Scrut Jira integration now lists future sprints in the task creation dropdown.

     • Adds future sprints to the Jira sprint dropdown when creating compliance tasks

     1 detail in Everything

479. Status Filter for Employee Section in a Campaign Dec 30, 2023 · release notes

     Enhances the user interface for tracking campaign completion by introducing status-based filtering and clearer labeling for employee training states.

     • Adds "Not Completed" and "Completed" status options to the employee section filter dropdown under People > Security Awareness

     1 detail in Everything

480. SAMA Framework Dec 30, 2023 · release notes

     Adds support for the SAMA Cybersecurity Framework in Scrut.

     • Adds SAMA Framework as a selectable compliance framework option for organizations.

     1 detail in Everything

481. Introducing NIST CSF v1.1 Dec 29, 2023 · release notes

     Introduces NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v1.1 support in Scrut.

482. Policy Dashboard Dec 29, 2023 · release notes

     New Policy Dashboard adds overview metrics and department, assignee, framework breakdowns for GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. management

     • Enables clicking on graph bars in the Policy Dashboard to navigate to the policy page with department, assignee, or framework filters pre-applied.

     1 detail in Everything

483. Enhanced Navigation: Introducing Trust Module Dec 28, 2023 · release notes

     Scrut adds Trust Module with Trust Vault and Questionnaire sub-modules.

     • Adds Trust module in side panel for managing trust-related functionalities
     • Introduces Trust Vault sub-module to manage certificates and vital records

     2 details in Everything

484. Email Notification and Audit log for Daily Cloud Scan Summary Nov 30, 2023 · release notes

     Adds email notifications for daily cloud scan summaries via a new UI toggle.

485. Displaying Risk Score while selecting Treatment Strategy Nov 29, 2023 · release notes

     Risk scores now displayed inline during Treatment Strategy selection in risk assessment flow

     • Displaying Risk Score while selecting Treatment Strategy

     1 detail in Everything

486. Automated Access Review (aka Access Review Integrations) - Phase 1 Nov 27, 2023 · release notes

     Adds automated Access Review data retrieval; the supported-app list names Jira, Microsoft AD, Google Workspace and Monday.com.

487. Multi-Entity filter in Dashboard Nov 24, 2023 · release notes

     Multi-Entity filter in Dashboard allows viewing data across multiple entities in the Entity filter option.

     • Adds an 'Entity' filter option to the dashboard interface for selecting and filtering data by entity.
     • Filters Compliance Progress, Metrics and Critical Issues by selected entities plus organization-wide data; Needs Attention shows Policy/Evidence/Test data for the selected entity.

     2 details in Everything

488. Clone Campaign Nov 24, 2023 · release notes

     Adds Clone Campaign capability in Security Awareness module for rapid campaign duplication.

     • Adds the ability to clone an existing security campaign via the Clone action in the Security Awareness dashboard.
     • Enables admins to manage campaigns (Edit, Clone, Extend, Delete) by clicking the three dots menu near each campaign.

     2 details in Everything

489. Cloud Integration Status Indicator and Credential Audit Logs Enhancement Nov 23, 2023 · release notes

     Scrut adds visual integration status indicators and expanded credential failure details in audit logs

     • Adds a visual green (active) or red (inactive) status indicator in the integrations list table for all cloud providers, updated after each scan
     • Enables viewing root cause messages for failed or expired credentials via a new popover from the Red Warning icon in the Audit logs section of any cloud provider integration page

     2 details in Everything

490. Search and Export Option in Security Campaign -> Employees Nov 23, 2023 · release notes

     Adds search box and CSV export to Employees section in Security Campaign UI

     • Adds an Export option to download employee campaign data as a .csv file containing List of Employees, Attempted On, and Status fields

     1 detail in Everything

491. Freshteam Integration Nov 22, 2023 · release notes

     Adds Freshteam integration to fetch employee details via Settings > Integrations.

     • Adds Freshteam integration to fetch Employee Name, Email, Department, Reporting Manager, Joining Date, and Exit Date.
     • Adds UI navigation path: Settings > Integrations > Freshteam with Connect button.

     2 details in Everything

492. Certn Integration Nov 22, 2023 · release notes

     Scrut adds Certn background verification integration accessible via Integrations settings.

     • Adds Certn Background Verification App integration to Scrut, enabling collection of background check evidence within the platform.
     • Adds Background Check integration option in Settings > Integrations requiring a Certn API token to connect and streamlines access to verification results.
     • Displays Education Verification, Background Screening, and Employment Verification status alongside employee records under the Onboarding tab.

     3 details in Everything

493. Evidence Review Workflow Nov 21, 2023 · release notes

     Scrut adds an Evidence Review Workflow with new task states and automated status transitions.

     • Adds a Review Date field to the Evidence Requirement Card to schedule evidence checks.
     • On the review date, evidence becomes Needs Attention; user review or update returns it to Draft, where recurrence cannot change. An Admin must publish it to restore Uploaded status.

     2 details in Everything

494. Displaying Mitigation Tasks in Vendor Portal Nov 21, 2023 · release notes

     Vendor Portal now displays mitigation tasks and status graphs for questionnaire accountability.

     • Vendors can view a list of mitigation tasks created by the GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. team in the Vendor Portal
     • Vendors can see graphical representations of Questionnaire Status (Answered/Not Answered) and Mitigation Tasks Status (Open/Closed)

     2 details in Everything

495. CMMC 2.0 Level 2 Framework Nov 20, 2023 · release notes

     Adds CMMC 2.0 Level 2 framework support, including self-assessment of certain requirements for Defense Industrial Base organizations.

     • Adds support for the CMMC 2.0 Level 2 framework as a new compliance assessment option within the platform.

     1 detail in Everything

496. HiBob Integration Nov 20, 2023 · release notes

     Adds HiBob HRMS integration to sync employee data.

     • Adds HiBob integration to fetch employee details including Name, Email, Department, Reporting Manager, Joining Date, and Exit Date into the Scrut platform.

     1 detail in Everything

497. Edit Risk Details Nov 16, 2023 · release notes

     New capability to edit risk details (Potential Risk, Description, Assignee, etc.) in Open, Treated, and Assessed statuses via the UI.

498. Linear Integration Nov 15, 2023 · release notes

     Scrut adds Linear integration for creating compliance tasks directly from Policy, Test, and Evidence modules.

     • Adds Linear option under Settings > Integrations to connect Scrut with your Linear workspace.
     • Enables creation of Linear issues from the Action button in Policy, Test, and Evidence task modules.
     • Allows configuration of additional Linear issue fields via the Configure Additional Fields button in the integration settings.

     3 details in Everything

499. Power operator in the risk formula Nov 15, 2023 · release notes

     Adds power operator support in risk formula builder

     • Adds the ^ (caret) symbol to the Risk Formula editor to enable exponentiation.

     1 detail in Everything

500. Cloud integration validation & Audit-logs Nov 5, 2023 · release notes

     Adds Integration ID to AWS/Azure/GCP configs and UI-based Audit Logs for integration tracking

     • Adds Integration ID field to the Integration tab in Settings > Integration for unique identification of cloud connections.
     • Adds a new Audit Logs tab (within Settings > Integration) recording all integration actions with date/time, user, and specific outcomes like credential validation or deletion details.
     • Adds filter and sort controls to the Audit Logs UI, including an Action dropdown with values like integrations deleted, 'deleted with data purged', account credentials invalid, and integration added, plus user/date filters.

     3 details in Everything

501. NIST AI RMF Framework Nov 4, 2023 · release notes

     Scrut adds NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold. framework as a new default standard

502. Technical Details columns in Employees table Nov 3, 2023 · release notes

     New technical details columns, filters, bulk actions, and filtered exports in the Employees table.

     • Adds Agent Installed, Antivirus Installed (Yes/No), Hard Drive Encryption (Yes/No), Screen Lock Enabled (Yes/No), Policy Accepted (Yes/No), and Email columns to the Employee table
     • Adds filtering options for each new technical detail column in the Employee module
     • Adds bulk actions NOT A PERSON, DELETE EMPLOYEE, and SEND A REMINDER with filtered data export

     3 details in Everything

503. Policy Review Workflow Nov 3, 2023 · release notes

     Adds automatic policy review dates and Needs Review status; completing review requires an uploaded attachment and reapproval when Policy Approval is enabled.

     • Adds automatic calculation of the Next Review Date based on recurrence type when a policy is published
     • Adds audit log entry generation for Policy status changes to Needs Review
     • Enforces immutability of recurrence and review date fields while a policy is in Needs Review status

     3 details in Everything

504. Multiple Assignee - Risk Nov 2, 2023 · release notes

     Risk Management now supports assigning multiple assignees per risk with consolidated email notifications

     • Adds Add Assignee button under the Others section in the Risk Management Module UI to include additional assignees beyond the primary
     • Updates bulk import template to accept comma-separated email addresses for multiple assignees instead of a single Owner field
     • Enables consolidated email notifications sent to all assigned users when a risk is assigned

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Renames the Owner field to Assignee in manual risk creation and bulk import templates
505. Make People Dashboard Clickable Nov 2, 2023 · release notes

     People Dashboard metrics (e.g., View Employees) are now clickable links for direct employee list access

     • Technicals Overview metrics in the People Dashboard now feature a clickable View Employees option to jump directly to relevant employee lists.
     • Policy Acceptance Rate metrics in the People Dashboard now feature clickable View Employees options for accepted and unaccepted policy categories.

     2 details in Everything

506. Link Artifacts to Controls via Requirements - Part 2 Nov 1, 2023 · release notes

     Extends artifact-to-control mapping via requirements to Evidence and Findings modules

     • Adds Requirements tab linking in the Evidence module for creating or editing Evidence Tasks.
     • Adds Requirements tab linking in the Audit Center Findings module for creating or editing findings.

     2 details in Everything

507. Numeric in Risk Formula Oct 31, 2023 · release notes

     Scrut Automation adds support for numeric constants in risk score formulas

     • Adds ability to include numeric values in risk score formulas within the Risk Management module
     • Supports decimal numbers in calculated risk scores (e.g., / 2.5)

     2 details in Everything

508. Link audit requests and findings to policy and evidence Oct 24, 2023 · release notes

     Scrut now allows linking audit requests and findings to existing policies or evidence via the Audit Center UI.

     • Adds Link Artifacts workflow option in the Audit Center's Requests and Findings sections to associate existing policies or evidences
     • Adds Create and Link workflow option to generate new Policy or Evidence artifacts directly from an audit request/finding
     • Adds an Upload a File option; choosing it disables the other association options, and closed requests cannot receive further attachments.

     3 details in Everything

509. Shortcut integration Oct 23, 2023 · release notes

     Adds Shortcut integration to enable creating stories from Policy, Test, and Evidence modules

     • Adds Shortcut integration via Settings > Integrations > Shortcut using an API token for authentication.
     • Enables creating a Shortcut story directly from the Action dropdown in Policy, Test, and Evidence task modules.
     • Allows configuring additional fields for the Shortcut integration via the Configure Additional Fields button.

     3 details in Everything

510. Link Artifacts to Controls via Requirements - Part 1 Oct 23, 2023 · release notes

     Scrut allows linking Policy, Risk, and Audit artifacts to UCF controls via framework requirements.

     • Adds a Requirements tab in the Policy module to map policies directly to Universal Control Framework (UCF) controls by selecting requirements first.

     1 detail in Everything

511. DPDPA Framework Oct 14, 2023 · release notes

     Adds DPDPA framework support to Scrut for Indian data privacy compliance

512. Keka Integration Oct 13, 2023 · release notes

     Adds Keka HRMS integration to fetch employee details automatically via Settings > Integrations

     • Adds Keka under Human Resources Integration Systems in the UI for automated HRMS data sync.
     • Enables automatic fetching of Employee Name, Email, Joining Date, Exit Date, Department, and Reporting Manager from Keka.

     2 details in Everything

513. Bulk upload audit center requests and findings Oct 13, 2023 · release notes

     Scrut adds bulk upload for audit center requests and findings via CSV or XLSX import

514. Bulk Importing Vendor Questionnaire Sep 15, 2023 · release notes

     Adds bulk import of vendor questionnaires via CSV upload in Vendor Management > Templates.

     • Enables users to upload a CSV file containing multiple vendor questions when creating a template in the Vendor Management module, eliminating manual entry.

     1 detail in Everything

515. Disabling Scrut Agent Banner in the Employee Training Portal Sep 15, 2023 · release notes

     Adds toggle to disable Scrut Agent banner in Employee Training Portal via Settings

516. Bulk Importing Vendors Sep 14, 2023 · release notes

     New bulk vendor import feature allows uploading vendor data via CSV/Excel to reduce manual entry effort in Vendor Management.

517. Audit Logs in Test Sep 14, 2023 · release notes

     Scrut adds Audit Logs to Cloud Test module with action tracking and daily summaries

     • Adds Audit Log view in Cloud Test for visibility into security management activities
     • Enables access via left navigation under Cloud > Test > Audit Log
     • Records specific actions including Assignment, Reassignment, Ignore Test, Monitor Test, Resource level actions, Test Now, External Ticket Creation, and Export
     • Provides daily Cloud Provider Level Summaries with insights like scan result counts (e.g., 'AWS scan results - 17 danger, 23 warning…')

     4 details in Everything

518. Editing Risk Score Sep 13, 2023 · release notes

     Adds ability to edit Risk Score and Factor Values for risks in Assessed or Treated state via UI

519. Multi-Entity Support: Part 3 Sep 12, 2023 · release notes

     Multi-Entity support extends to Audit Center and Risk Management modules

     • Admins configure organizational entities through Settings > Manage Entities for use with the expanded Audit Center and Risk Management support.
     • Allows linking specific entities when creating new audits in the Audit Center
     • Enables editing entity associations for existing and completed audits via the pencil icon
     • Adds capability to link specific entities when creating new risks in Risk Management
     • Adds filtering by entities on the Risk Management dashboard

     +1 more show less

     • Adds filtering by entities on the Controls tab within a risk

     6 details in Everything

520. Mark Exit Date while Terminating an Employee Sep 12, 2023 · release notes

     Adds ability to specify exact exit date when terminating an employee in Scrut Automation

     • Adds a modal dialog during the Terminate Employee workflow that allows selecting the specific exit date, which then appears on the employee dashboard.

     1 detail in Everything

521. Rippling Integration Sep 11, 2023 · release notes

     Scrut adds Rippling integration to sync employee details via Settings > Integrations.

     • Adds Rippling integration to import employee names, emails, departments, managers and joining/exit dates into Scrut; setup requires a Rippling Super Admin.
     • Displays employees synced from Rippling in People > Employees.

     2 details in Everything

522. Multi-Entity Support: Part 2 Sep 11, 2023 · release notes

     Scrut extends multi-entity support to allow admins to manage organizational units and link frameworks, controls, and cloud resources to specific entities for targeted compliance tracking.

523. Link Audit Requests and Findings to Controls Aug 12, 2023 · release notes

     Scrut adds ability to link audit requests and findings directly to compliance controls.

     • Adds the ability to create an audit request and link it to specific compliance controls within an audit project
     • Automatically updates control status to Non-Compliant when a linked request is created
     • Displays associated Requests and Findings directly on the Control page
     • Automatically updates a linked control to Compliant when the Request is closed by an Assignee/Auditor, provided the other policy/evidence artifacts are also uploaded.

     4 details in Everything

524. Send Email Notification when a comment is added in Policy, Evidence, etc. by tag Aug 11, 2023 · release notes

     New tagging-based email notification feature enhances collaboration within the Scrut Automation Platform.

525. Bulk Assign option - Test module Aug 8, 2023 · release notes

     Adds Bulk Assign option in Test module to assign multiple tests to team members simultaneously

526. SAP SuccessFactors Integration Aug 8, 2023 · release notes

     Adds SAP SuccessFactors integration to fetch employee details into Scrut.

527. Bamboo HR Integration Aug 7, 2023 · release notes

     Adds BambooHR integration to sync employee data via Settings > Integrations

     • Enables syncing of Employee Name, Email, Date of Joining, Date of Exit, Department, and Reporting Manager from BambooHR by navigating to Settings → Integrations → BambooHR and clicking Connect
     • Supports authorization flow for non-admin users by allowing entry of an admin's email ID to send an authorization link

     2 details in Everything

528. Multi-Entity Support: Part 1 Aug 4, 2023 · release notes

     Multi-Entity Support Part 1 introduces entity filtering and management for single-tenant compliance

     • Adds Manage Products option in Settings to configure multiple entities like Business Units or Subsidiaries within a single tenant
     • Adds Entity Filter on Policy and Evidence pages to view data specific to a particular entity
     • Allows linking specific entities to new policies and evidence items during creation

     3 details in Everything

529. Introducing ScrutGPT - Security Questionnaire Automation (Beta Release) Aug 3, 2023 · release notes

     ScrutGPT beta automates security questionnaire responses through Auto-Fill; interested customers must contact their account manager.

     • Adds ScrutGPT beta feature that leverages LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. and OpenAI to automatically answer security questionnaires uploaded by users.
     • Adds an Auto-Fill button in the questionnaire UI to trigger AI-generated responses based on the organization's cloud environment context.
     • Adds workflow buttons for reviewing/editing AI responses, submitting with Complete Questionnaire, and exporting completed questionnaires.

     3 details in Everything

530. Access Review (Beta Release) Aug 3, 2023 · release notes

     Scrut Automation adds Access Review beta module for reviewing and validating user access rights in third-party vendor applications.

531. Compliance Summary Report Jul 31, 2023 · release notes

     Adds Compliance Summary Report accessible via Reports menu to email for overview of org compliance and security posture.

     • Adds Compliance Summary Report which provides key metrics across frameworks, cloud security, and training modules to assess team effectiveness.
     • Enables download of the report by setting a date period in the Reports menu, with results delivered via email containing a link that expires in 7 days.

     2 details in Everything

532. Cloud Security Report Jul 27, 2023 · release notes

     Adds Cloud Security Report download via UI to export misconfigurations against CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks.

533. Conduct GDPR Training on Scrut Jul 26, 2023 · release notes

     Scrut adds pre-built GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. Security Training with interactive quizzes to Security Campaigns

     • Adds default GDPR training material and interactive quizzes to the Security Awareness module
     • Automatically includes GDPR content in new Security Campaigns alongside ISMS and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. by default

     2 details in Everything

534. Auditor Role Enhancements Jul 25, 2023 · release notes

     Auditor role gains Edit, Delete, and Close finding permissions

535. Edit vendor questionnaire Jul 24, 2023 · release notes

     Scrut adds in-platform editing for vendor questionnaires

     • Adds the ability to edit vendor questionnaires directly within the platform

     1 detail in Everything

536. Edit vendor details Jul 21, 2023 · release notes

     Adds ability to edit vendor details and POC contact information directly within the Scrut platform.

     • Users can now update vendor name, URL, category, assignee, risk impact, POC name, and POC email via the vendor management module's Edit button.

     1 detail in Everything

537. ClickUp Integration Jun 26, 2023 · release notes

     Scrut adds ClickUp integration for creating compliance tasks via UI navigation

     • Adds ClickUp under Project Management in Settings > Integrations to connect workspaces using Client ID and Secret.
     • Adds Create ClickUp Task option in the Actions Dropdown for policies, evidence, and tests to generate tasks in ClickUp.

     2 details in Everything

538. OneLogin Integration Jun 21, 2023 · release notes

     Adds OneLogin Single Sign-On (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) integration for authentication via Identity Providers.

     • Enables OneLogin as an Identity Provider for user login
     • Allows configuration of OneLogin Client ID, Secret, and Domain Name in Settings > Integrations

     2 details in Everything

539. New and Improved Dashboard Jun 19, 2023 · release notes

     Scrut introduces a new executive summary dashboard with Compliance Progress tracking, an Audit Calendar, and detailed Metrics cards.

     • Adds an executive summary dashboard featuring the Compliance Progress Card for holistic compliance progress visibility
     • Adds the Upcoming Audits Calendar to provide a centralized view of all upcoming audits
     • Adds new Metrics cards including Open Risks, Vendor Questionnaires, Audits in progress, and Trust Vault Views

     3 details in Everything

540. New Corrective Action Tracker Jun 13, 2023 · release notes

     Standalone corrective action module launched.

541. Trust Vault Dashboard May 18, 2023 · release notes

     New Trust Vault Dashboard adds portal views, downloads, and access request metrics.

     • Adds a Trust Vault dashboard under the Trust Vault section to track total portal views, documents downloaded, active access requests, and pending requests.
     • Provides metrics for logged-in and anonymous user views of the trust center portal.

     2 details in Everything

542. Edit Policy Name May 17, 2023 · release notes

     UI now allows editing policy names via the policy module.

543. Add Justification for “Not a Person” May 15, 2023 · release notes

     Adds justification field for Not a Person employee status in compliance checks

     • Admins can add a justification when marking one employee at a time as Not a Person to exclude them from compliance checks and reports; bulk justification is unsupported.
     • Employees marked Not a person now display an informational icon with the stored justification reason on hover.
     • The employees page now supports filtering specifically for employees with the Not a person status.

     3 details in Everything

544. Add account ID in containers page May 12, 2023 · release notes

     New Account ID column and filter in the Containers page for AWS accounts

     • Adds an Account ID column to the Containers section of the UI
     • Adds filtering capability on the Containers page by selecting an Account ID

     2 details in Everything

545. Delete Documents in Vendor Management May 10, 2023 · release notes

     Adds ability to delete user-uploaded documents in the Vendor Management module.

546. Audit Log in Trust Vault May 3, 2023 · release notes

     Scrut introduces a Trust Vault Audit Log to monitor and record private file access events.

547. Unified Control Framework (UCF) May 2, 2023 · release notes

     Scrut adds Unified Control Framework (UCF) to satisfy multiple compliance standards from a single set of policies and evidence.

     • Adds the Unified Control Framework (UCF) capability to map and satisfy controls across multiple compliance frameworks simultaneously
     • Enables creation of custom frameworks and controls via the UI interface

     2 details in Everything

548. Role Based Access Control (RBAC) Apr 28, 2023 · release notes

     Scrut introduces RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with role, module and data access scopes.

     • RBAC uses Admin, Contributor, Auditor and Employee roles; Admin permissions remain unrestricted and unchangeable, while Employees can access only training.
     • Enables module-based access control for sub-module level permissions
     • Enables data-based access control scoped to departments and frameworks
     • Role and access settings are configured through Settings > Manage Users > Add User.

     4 details in Everything

549. Risk Management Module 2.0 Apr 28, 2023 · release notes

     Scrut Risk Management Module 2.0 adds configurable risk register setup with custom factors, scores, and formulas via the settings UI

     • Adds factors configuration in Settings to define variables for Risk Score Formula, including stage (assessment/residual) and min/max values.
     • Adds scores tab to create named risk scores (e.g., CIA, RPN) using formulas built from configured factors and operators.
     • Adds fields section in Settings to add custom fields for the risk register.

     3 details in Everything

550. Customize & Manage Departments Apr 26, 2023 · release notes

     Adds department management UI for creating, editing, deleting departments and exporting CSVs

     • Settings > Manage Department supports creating and deleting departments and editing their owners; changing a department name requires deleting and recreating it.
     • Department owners can be assigned to receive policy/evidence upload notifications at the department level.
     • Export departments data via a downloaded CSV file from the manage department interface.

     3 details in Everything

551. Send Training Certificate To Your Employees Apr 21, 2023 · release notes

     Adds automated training certificate emails for employees who pass security quizzes via a new workflow setting

     • Admins can enable Send Training Certificate Emails in Settings > Workflow to send certificates when employees pass their training quiz.

     1 detail in Everything

552. Reschedule Security Campaigns Apr 17, 2023 · release notes

     Adds Reschedule action in UI to extend deadlines for active and completed security campaigns.

553. Microsoft Intune Integration Apr 14, 2023 · release notes

     Adds Microsoft Intune integration for automated device compliance data via Settings > Integrations

     • Adds Microsoft Intune integration to pull device and app info (screen lock, antivirus status) for Windows and macOS devices
     • Allows viewing integrated device details on the People dashboard under the Technical tab

     2 details in Everything

554. Let Trust accelerate your SaaS sales 🔑 Jun 27, 2022 · release notes

     Introduces Trust Vault to streamline certification requests and share security posture with customers.

     • Adds Trust Vault capability to demonstrate security protocols and keep customers informed about subprocessors

     1 detail in Everything