Secureframe

No entries match these filters. Clear filters

1. September 2026 Sep 1, 2026 · release notes

   Secureframe September 2026 adds Virtual Desktop Z: drive, drift detection, activity logging, golden images, autoscaling, GA Notifications Hub, and policy editor redesign.

   └──▷ HOW TO FIND IT
   Monitor configuration changes in your managed Azure Government resources and review discrepancies via the drift log.
   📍In the Virtual Desktop settings, navigate to Drift Detection to view the log of additions, removals, and modifications.
   Create a policy by separating its configuration settings from its textual content using the new two-step flow.
   📍In the policy editor, use the guided flow to define settings first, then add content and view token values before publishing.
   Automate desktop pool lifecycle to save costs by starting them only during core hours.
   📍In the Virtual Desktop settings, configure the scheduled autoscaling rules to define start and stop times for your pools.
   • Adds shared file storage with an automatically mapped Z: drive for Secureframe Virtual Desktop pools
   • Introduces configuration drift detection that monitors managed Azure Government resources and logs discrepancies in a drift log
   • Enables activity logging of sign-ins, sessions, and admin actions to the customer's Azure Government subscription with 365-day retention
   • Deploys hardened Windows 11 golden images preinstalled with Microsoft 365 and nearly 40 security settings for CMMC compliance in Virtual Desktops
   • Adds scheduled autoscaling capabilities that start and stop desktop pools based on customer-defined schedules to reduce compute costs

   +3 more show less

   • Makes the Notifications Hub generally available for all customers to view failing tests, overdue tasks, mentions, and audit activity
   • Redesigns the policy creation experience with a two-step flow separating settings from content and showing token values in the editor
   • Adds post-connection guided setup steps for GitHub, GitLab, Bitbucket, and Azure DevOps integrations

   8 details in Everything

2. August 2026 Aug 1, 2026 · release notes

   Secureframe August 2026: Notifications Hub early access, Custom Fields GA, modular onboarding, and personnel source of truth selection.

   └──▷ HOW TO FIND IT
   Monitor compliance activity centrally without searching across modules.
   📍Check the Notifications Hub dashboard for failing tests and overdue tasks.
   Track organization-specific data within Secureframe instead of using external spreadsheets.
   📍Create custom fields for Personnel and Tasks, then use them in Task Center columns and reporting.
   Resolve data conflicts when multiple personnel integrations are active.
   📍Select which connected system serves as the source of truth for personnel data in the integration settings.
   • Adds Notifications Hub in Early Access to centralize alerts like failing tests, overdue tasks, mentions, audit activity, and vendor updates.
   • Makes Custom Fields generally available for Complete plan customers, enabling custom fields for Personnel and Tasks with support in creation, editing, filtering, Task Center columns, reporting, and a usage dashboard.
   • Refreshes Employee Onboarding setup into modular sections for policies, background checks, training, and Secureframe device management.
   • Allows admins to choose which connected integration serves as the personnel source of truth when multiple systems are connected.

   4 details in Everything

3. July 2026 Jul 1, 2026 · release notes

   Secureframe July 2026 adds VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. cost estimation, FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. USB allowlists, GAF Workload Identity Federation, granular GitHub checks, and bulk finding dismissal with audit justifica

   └──▷ HOW TO FIND IT
   See how much a new pooled VDI will cost before committing to it during provisioning.
   📍Navigate to the VDI provisioning screen in the Secureframe dashboard; look for the estimated cost field displayed alongside your settings.
   Connect GCP or Azure using Workload Identity Federation to avoid managing long-lived static credentials.
   📍In the integrations settings for your cloud provider, select Workload Identity Federation as the authentication method.
   Filter GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. checks to match only the specific tests relevant to your compliance requirements.
   📍When configuring a GitHub integration or repo, use the check selection interface to pick individual check names instead of a broad workflow slug.
   • Shows the estimated cost of a VDI during provisioning
   • Allows defense customers to define an allowlist for specific USB storage devices managed through Secureframe Federal MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.
   • Enables GCP and Azure integrations using Workload Identity Federation instead of static credentials
   • Lets users select specific GitHub Actions check names when configuring a GitHub integration or individual repo
   • Adds the ability to override risk levels on vulnerability findings and dismiss them individually or in bulk with documented justification

   5 details in Everything

4. June 2026 Jun 1, 2026 · issue 014

   Secureframe June 2026 adds multi-policy test linking, reopenable reviews, and daily 81–98% faster personnel syncs.

   ⤢
   • Supports linking multiple policies to a single test, with draft-policy status surfaced as the failure reason.
   • Enables automatic re-running of paired acknowledgement tests when a policy is published, eliminating stale results.
   • Adds ability to reopen completed reviews or individual applications to correct mistakes without losing the audit trail.
   • Enables removal of specific test runs or errors from the Complete tab while preserving audit history.
   • Personnel and access data now syncs daily using incremental pulls, reducing sync times by 81–98% and lowering Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. quota pressure — no configuration required.

   5 details in Everything

5. June 2026 Jun 1, 2026 · release notes

   Secureframe June 2026 adds multi-select policy links for compliance tests, access review reopens, and incremental Office 365 syncs.

   └──▷ HOW TO FIND IT
   Link a draft policy to a compliance test to auto-retrigger acknowledgement upon publish.
   📍In the UI, go to Compliance › Tests, select a test, and use Link multiple policies.
   Reopen a completed access review to correct errors.
   📍In the UI, go to Access Reviews › Complete, select the review, and click Reopen.
   • Link multiple policies to a single test in the UI to automatically trigger acknowledgement test re-runs upon policy publication
   • Reopen and delete completed access reviews or individual applications within the Complete tab without losing audit trail
   • Incremental Office 365 directory syncs that reduce sync times by 81–98% with no configuration needed

   3 details in Everything

6. May 2026 May 1, 2026 · issue 014

   Secureframe May 2026 adds CMMC Scoping Module, Defense Navigator, GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. automation, AI-populated SSPsSSPsSystem Security Plans — documents required by NIST SP 800-18 that describe how a federal system meets its security controls, giving cyber tools a structured, auditable record to parse or generate for compliance workflows., and overhauled evidence management.

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Keep employee acknowledgment records current immediately after saving a revised policy, without extra manual steps.
   📍In the console, go to Policies › [select policy] › Edit, make your changes, and enable Reset existing acceptances before clicking Save. Employees are automatically notified to re-acknowledge.
   Reduce policy maintenance overhead across multiple templates by conditionally showing or hiding sections based on which frameworks or integrations apply.
   📍In the console, go to Policies › [select policy] › Edit, insert a Conditional Token around the relevant section, and define the condition (e.g., framework = CMMC or integration = GCC High) so the section renders only when that condition is met.
   • New Scoping Module guides organizations through CMMC scoping questions, auto-marks out-of-scope requirements with audit-ready justifications, disables irrelevant tests, and tailors SSPSSPA System Security Plan — a formal document required by NIST SP 800-18 that describes how a federal system meets its security controls, giving cyber tools a structured artifact to parse or generate for compliance workflows. and policy language accordingly.
   • New Microsoft GCC High integration automates CMMC-required configurations and provides step-by-step manual guidance where Microsoft APIs don't permit full automation.
   • SSP creation now auto-populates implementation statements from scoping decisions and connected integrations, with bulk or individual acceptance of suggested updates.
   • CMMC Level 2 framework updated with revised control mappings, refreshed policies, and new automated tests for GCC High, Google Workspace, Federal MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., and Virtual Desktop environments.
   • Windows 11 virtual desktops now ship with Microsoft 365 pre-installed and support Common Access Card (CAC) authentication, with automatic smart card redirection and DoD certificate chain configuration.

   +4 more show less

   • New Conditional Tokens allow entire policy sections to appear or disappear automatically based on defined conditions such as connected integrations or applicable frameworks.
   • Evidence management for Upload Tests has been significantly overhauled with new workflow capabilities.
   • Adds integration-level email filtering rules, enabling per-integration exclusions independent of org-wide settings.
   • Policy updates that require employee acknowledgment can now trigger an acknowledgment reset directly at save time, automatically notifying employees to re-acknowledge.

   9 details in Everything

7. May 2026 May 1, 2026 · release notes

   New CMMC scoping module, automated GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. config, conditional policy tokens, and enhanced Virtual Desktop support

   └──▷ HOW TO FIND IT
   Configure conditional policy sections to only display for GCC High environments.
   📍Use Conditional Tokens in the Policy Editor to set visibility based on 'connected integrations == GCC High'.
   Automate CMMC prerequisite configurations for Microsoft GCC High tenants.
   📍Link your Microsoft GCC High integration in Secureframe to trigger automated MFA and conditional access policy setup.
   Manage personnel exclusion for a specific outdated email domain within one integration.
   📍Go to Integration Settings › Filter Personnel and add an email filtering rule for the specific domain.
   • Adds a Scoping Module to guide CMMC compliance program scope definition with audit-ready justifications.
   • Unlocks Defense Navigator step-by-step guidance for the full CMMC readiness process based on prerequisites.
   • Automates GCC High configurations (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., conditional access, audit logging) via Microsoft APIs for CMMC.
   • Auto-populates SSPSSPA System Security Plan — a formal document required by NIST SP 800-18 that describes how a federal system meets its security controls, giving cyber tools a structured artifact to parse or generate for compliance workflows. implementation statements from scoping decisions and connected integrations.
   • Updates CMMC Level 2 framework with revised control mappings and automated tests for GCC High, Google Workspace, Federal MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., and Virtual Desktops.

   +5 more show less

   • Enables Common Access Card (CAC) authentication on Windows 11 virtual desktops with automatic certificate chain configuration.
   • Introduces Conditional Tokens to show or hide policy sections based on connected integrations or frameworks.
   • Changes Upload Tests expiry logic to depend on when work was performed, flagging expired evidence instead of auto-archiving.
   • Adds integration-level email filtering rules for personnel management.
   • Allows resetting existing employee policy acknowledgments directly during policy save operations.

   10 details in Everything

8. April 2026 Apr 1, 2026 · issue 014

   Secureframe April 2026 adds a faster Org Picker with role/team visibility and improved Personnel access tables.

   └──▷ HOW TO FIND IT
   Quickly validate which systems and devices are tied to a specific employee during an audit preparation.
   📍In the console, go to Personnel › Accounts or Personnel › Devices, then use the updated sort and filter controls to narrow results by user.
   Switch between client or team organizations without losing context on your role or needing to re-authenticate.
   📍In the console, open the Org Picker, review the role and team size displayed per org, pin frequently used orgs to Favorites, then select the target org or use the built-in sign-out option.
   • New Org Picker shows role and team size per organization at a glance, with an improved favorites section and built-in sign-out access for faster multi-org navigation.
   • Updated Accounts and Devices tables in Personnel add improved sorting, filtering, and navigation to streamline user access and device assignment reviews.

   2 details in Everything

9. March 2026 Mar 1, 2026 · issue 014

   Secureframe adds GA User Access Reviews, guided ComplyAI risk workflows, a dedicated Auditors view, and flexible user onboarding controls.

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Launch a recurring User Access Review for an application to generate audit-ready evidence for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. or ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 — use CSV upload to cover apps without native integrations.
   📍In Secureframe, go to Comply › User Access Reviews, click New Review, select Recurring, choose the target application, upload a CSV for non-integrated apps, assign reviewers, and click Launch Review.
   • Adds User Access Reviews (UAR) — generally available for Comply Complete customers — enabling scheduled or one-time access reviews with approve/revoke/follow-up decisions, bulk actions, CSV uploads for non-integrated apps, and exportable audit-ready evidence across SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, ISO 27001, and CMMC.
   • Improves ComplyAI risk assessment workflow with guided field completion (risk description, owner) before AI recommendations are generated, surfacing the next required step dynamically.
   • Introduces a dedicated Auditors tab within Personnel, separating auditor accounts into a tailored view aligned to their role.
   • Enables admins to control whether users without a start date are automatically invited, allowing onboarding workflows to match organizational timelines.

   4 details in Everything

10. February 2026 Feb 1, 2026 · issue 014

    Secureframe adds Smart User Mentions, Audit Completion Workflow, multilingual onboarding, and expanded Azure/Sentinel integrations.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Keep audit feedback inside Secureframe instead of Slack — mention your auditor directly on a failing test so they receive an email with the comment and a deep link to that exact test.
    📍In the Audit Module, open the relevant test, add a comment, and type '@' followed by the auditor's name to trigger an email notification with a direct link back to the test and comment.
    Formally close out an audit lifecycle by uploading all report versions and confirming receipt of the final report without leaving Secureframe.
    📍In the Audit Module, open the audit and navigate to the Audit Completion modal. Upload draft, revised, and final report files, use the built-in comments with @mentions for feedback, then enable the final report received toggle and mark the audit as complete.
    • Adds Smart User Mentions: tag customers or auditors with '@' in comments across the platform, triggering email notifications with a direct link back to the relevant comment and test location in the Audit Module.
    • Introduces a structured Audit Completion Workflow with a dedicated modal for uploading multiple report versions (drafts, revisions, finals), a built-in comments section with @mentions, a toggle to confirm final report receipt, and the ability for either party to mark the audit complete.
    • Supports employee onboarding workflows — including policy acknowledgments and training steps — in French, German, and Spanish for global teams.
    • Expands Azure integration to ingest user data, increasing identity-based compliance testing coverage in the Access tab.
    • Adds support for the government version of Microsoft Sentinel, extending SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. coverage for regulated and public sector environments.

    +2 more show less

    • Enhances Datadog integration for improved monitoring and logging validation.
    • Updates ServiceNow integration to improve sync reliability and alignment between ticketing workflows and compliance evidence collection.

    7 details in Everything

11. February 2026 Feb 1, 2026 · release notes

    Secureframe February 2026 adds Smart User Mentions in comments, Audit Completion Modal, and locale updates for Azure/Sentinel/Datadog/ServiceNow integrations

    • Adds smart @ user mentions to comments across the platform, including Audit Module, with email notifications and deep links
    • Introduces a structured Audit Completion Workflow via a dedicated modal for uploading multiple reports and tracking versions
    • Makes Employee onboarding workflows (policy acknowledgments and training steps) available in French, German, and Spanish
    • Expands Azure integration to pull in user data for improved visibility in the Access tab
    • Adds support for the government version of Microsoft Sentinel for public sector SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. coverage

    +2 more show less

    • Improves Datadog integration monitoring and logging validation
    • Updates ServiceNow integration to improve syncing reliability

    7 details in Everything

12. January 2026 Jan 1, 2026 · issue 014

    Secureframe adds new audit test statuses, 100% Met progress tracking, log deep-links, and progressive auditor-firm search.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Link your audit firm without manual lookup by typing its name in the progressive search field during auditor setup.
    📍In the platform, go to the Audit Module › Auditor Setup, type your firm's name in the search field, and select the matching firm from the Auditor Partner Console (APC) results.
    Quickly navigate to a specific change during an active audit without scrolling through the full audit trail.
    📍In the Audit Module, open the Audit Log table, locate the relevant entry, and click the direct link in the row to jump to the changed item.
    • New test statuses in the Audit Module improve transparency between auditors and admins throughout the audit lifecycle.
    • Audit Module progress bar now tracks completion toward 100% Met, giving an at-a-glance readiness indicator.
    • Audit Log gains direct links to changed items, enabling users to jump instantly from the log table to any updated record.
    • Progressive search for audit firms lets users type a firm name to search across all partners with an Auditor Partner Console (APC), enabling self-service auditor linking.

    4 details in Everything

13. January 2026 Jan 1, 2026 · release notes

    Secureframe Jan 2026 adds audit test statuses, 100% Met progress tracking, audit log navigation links, and progressive auditor search.

    └──▷ HOW TO FIND IT
    Monitor overall compliance readiness at a glance using the new progress metric.
    📍In the Audit Module, view the progress bar tracking your approach to 100% Met.
    Quickly navigate audit history to identify recent changes in your audit log.
    📍In the Audit Log table, click the new links next to entries to jump directly to changed items.
    • Adds new test statuses in the Audit Module for clearer communication between auditors and admins
    • Updates the Audit Module’s progress bar to track progress toward 100% Met
    • Enhances the Audit Log with new links to jump directly to changed items from the log table
    • Implements progressive search across all audit firms with an Auditor Partner Console (APC)

    4 details in Everything

14. December 2025 Dec 1, 2025 · issue 014

    Secureframe December 2025 adds a full Audits Module, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. JSON export, Trust Center versioning, and automated test-status email alerts.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Keep external stakeholders current when a security report or certification is renewed — no manual outreach needed.
    📍In the Trust Center, open an existing resource, select Replace Resource, upload the new version, and enable Notify previously approved users before saving.
    Give non-admin users visibility into only the tests they own so they can act on emerging failures between audits.
    📍In Secureframe, go to Settings › Notifications, set Test Status Change frequency to Weekly, and confirm the recipient scope — Admins/Super Admins see all tests; other users see only tests they own.
    Produce a structured FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. 20x KSI submission artifact from current control and evidence data for assessor review.
    📍In the Secureframe dashboard, navigate to Reports › FedRAMP 20x and select Export KSI JSON to download the machine-readable file containing system details, control health, test results, and evidence references.
    • New Audits Module centralizes the entire audit lifecycle — admins create audits, invite auditors, assign internal stakeholders, and a complete audit history is stored for future reference.
    • Auditors can review requests, accept or reject evidence, request additional information, and add new requests directly within the platform.
    • Evidence uploads now capture an Activity Completion Date, distinguishing when work occurred from when evidence was submitted to improve audit scoping accuracy.
    • New FedRAMP 20x machine-readable JSON export aligns to Key Security Indicators (KSIs), including system details, control health, test results, and evidence references for assessor review.
    • Trust Center gains a resource-versioning workflow: teams can replace an existing document and automatically notify previously approved users when a new version is available.

    +1 more show less

    • New automated email notifications alert users to test status changes on a daily, weekly, or biweekly cadence, summarizing shifts to at-risk, failing, or other monitored statuses.

    6 details in Everything

15. October 2025 Oct 1, 2025 · issue 014

    Secureframe adds Gap Assessments, Snowflake & Freshservice integrations, Custom Integrations, GovRAMP Core, and bulk employee scoping.

    ⤢
    └──▷ HOW TO FIND IT
    Evaluate readiness against a specific framework before an audit to surface and prioritize control gaps in one view.
    📍In the Secureframe console, navigate to Frameworks › select your target framework (e.g., ISO 27001) › click Run Gap Assessment to generate a prioritized list of missing controls.
    Route compliance tasks to your internal IT service desk and automatically track SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. adherence for vulnerability and access review tickets.
    📍In the Secureframe console, go to Integrations › ITSM › Freshservice › Connect, then set Freshservice as the task destination for the desired compliance workflow (e.g., Vulnerability Management) to enable bi-directional ticket sync.
    Automate evidence collection from a homegrown or unsupported system by mapping its resources into Secureframe's compliance engine.
    📍In the Secureframe console, go to Integrations › Custom Integrations › New Integration, then define resource types (e.g., user accounts, devices) and upload or connect your data source to begin automated compliance testing.
    • Adds Gap Assessments for any supported framework (SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST 800-171, and more), automatically comparing current posture against requirements and surfacing prioritized remediation actions.
    • New Snowflake integration automates continuous compliance testing across authentication, high availability, firewall rules, and alerting for the cloud data platform.
    • New Freshservice integration enables bi-directional ticket syncing as a task destination to track compliance for incidents, vulnerabilities, nonconformities, system changes, and user access against SLAs.
    • Introduces Custom Integrations, allowing teams to ingest, map, and test compliance resources (user accounts, devices, training records, cloud infrastructure) from any system not covered by native integrations.
    • Adds GovRAMP Core framework support, a streamlined baseline derived from GovRAMP Low and Moderate to simplify the authorization process.

    +1 more show less

    • Admins can now mark employees as out of scope individually or in bulk, with a required rationale, to reflect leave, reassignment, or other workforce changes for audit transparency.

    6 details in Everything

16. October 2025 Oct 1, 2025 · release notes

    Secureframe adds Gap Assessments for any framework, out-of-scope employee marking, Snowflake and Custom Integrations, Freshservice sync, and GovRAMP Core support.

    • Adds Gap Assessments for any framework to evaluate readiness and identify control gaps
    • Allows admins to mark employees as out of scope with rationale, individually or in bulk
    • Integrates Snowflake to automate testing of authentication, high availability, firewall rules, and alerting
    • Enables Custom Integrations to ingest, map, and test compliance resources from any system
    • Integrates Freshservice for bi-directional ticket syncing to track compliance incidents and vulnerabilities

    5 details in Everything

17. September 2025 Sep 1, 2025 · issue 014

    Secureframe adds EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. compliance framework, MongoDB Atlas integration, and Freshdesk bi-directional sync

    • Adds full EU Artificial Intelligence Act (EU AI Act) compliance framework with a risk-based approach to categorizing and safeguarding AI systems.
    • New MongoDB Atlas integration enables automated compliance testing for authentication, backup and availability, encryption, firewall rules, and logging and alerting.
    • New Freshdesk integration with bi-directional syncing automates evidence collection for customer support and ticketing workflows, eliminating manual uploads for audit readiness.

    3 details in Everything

18. September 2025 Sep 1, 2025 · release notes

    Secureframe adds EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. framework, MongoDB Atlas and Freshdesk integrations, plus custom automated testing for repos.

    • EU AI Act Framework support added for risk-based AI governance compliance.
    • MongoDB Atlas Integration enables automated compliance testing for authentication, backup, encryption, firewall, and logging.
    • Freshdesk Integration adds bi-directional sync for tasks and uses Freshdesk tickets as automated evidence for compliance tests.
    • Custom Automated Testing (CAT) now supports repository-based data sources.

    4 details in Everything

19. August 2025 Aug 1, 2025 · issue 014

    Secureframe adds 7 new vuln-scanner integrations, Addigy MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. support, C5 compliance, and overhauled vendor review scheduling.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Clean up legacy policies quickly rather than archiving them one by one before an audit.
    📍In Secureframe, go to Policies, select the checkboxes for the outdated policies you want to remove, then choose Archive from the bulk action bar.
    • Centralizes vendor review schedules so frequency, question sets, requested documents, and vendor lists are configured at the review level rather than per vendor.
    • Adds requested documents to review schedules, automatically prompting vendors to upload items like SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports and spinning up a vendor portal on the review start date.
    • New integrations with Rapid7 InsightVM, Tenable VMS, Qualys, Wiz, Microsoft Defender, Aikido, and Snyk automate evidence collection for vulnerability scanning, dependency testing, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment..
    • New integration with Addigy enables automated compliance testing for hard drive encryption, firewall configuration, screen lock enforcement, and anti-malware on macOS devices.
    • Supports the C5 Controls Catalog (BSI) for organizations operating in the EU or targeting the German public sector.

    +5 more show less

    • Enables bulk archiving of multiple policies at once via the Policies table bulk action bar.
    • Adds spam filtering to Trust Center request forms, automatically flagging and archiving suspicious submissions with a SPAM label.
    • Adds a Completed at column to the Vendor Review table to improve auditability of third-party risk management timelines.
    • Adds pagination and navigation controls to the Policy Tests table for teams managing large numbers of test-policy relationships.
    • Redesigned first-time login experience shows only the authentication methods enabled for a user's organization, eliminating password reset loops.

    10 details in Everything

20. August 2025 Aug 1, 2025 · release notes

    Secureframe August 2025 adds vendor review scheduling, C5 framework support, and new vulnerability scanning integrations.

    • Adds requested documents field to vendor review schedules to prompt vendors for items like SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports
    • New Completed at column in the Vendor Review table to track review completion timestamps
    • Bulk archive policies feature via the bulk action bar on the Policies table
    • C5 Controls Catalog framework support (Early access) for EU/German regulatory compliance
    • Addigy MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration for automated macOS endpoint compliance testing

    +8 more show less

    • New vulnerability management integrations: Rapid7 InsightVM, Tenable VMS, Qualys, Wiz, Microsoft Defender, Aikido, and Snyk
    • AWS Identity Center sync in the AWS integration for automatic user syncing to the Access tab
    • Export Federal SSPSSPA System Security Plan — a formal document required by NIST SP 800-18 that describes how a federal system meets its security controls, giving cyber tools a structured artifact to parse or generate for compliance workflows. reports with all attachments and policy files included
    • Explanation context added to CMMC control slideouts in the SSP tool
    • Guidance in Security Questionnaires module clarifying that completed questionnaires go to the Knowledge Base
    • Spam filtering for Trust Center request forms, flagging suspicious submissions with a SPAM label
    • Pagination and navigation controls added to the Policy Tests table
    • Improved first-time login flow redirecting welcome email users to available authentication methods only

    13 details in Everything

21. July 2025 Jul 1, 2025 · release notes

    Secureframe July 2025: Live SPRS tracking, Microsoft Sentinel integration, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. v2 role controls, and Check Point Quantum support.

    └──▷ HOW TO FIND IT
    Monitor CMMC readiness by viewing real-time SPRS scores directly in the platform.
    📍Check the Control Implementation table for live SPRS score updates based on current CMMC Level 2 controls.
    Authorize real-time syncing for Okta to ensure timely identity compliance checks.
    📍In the Integration Page settings for Okta, authorize two additional API scopes.
    Configure MFA v2 policies to restrict multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements to specific organizational roles.
    📍As a Super Admin, use the MFA v2 controls to enable or disable MFA for any selected access role.
    • Adds live SPRS score tracking in the Control Implementation table for CMMC Level 2 readiness
    • Integrates Microsoft Sentinel as a cloud-native SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. connector for security incident and alerting evidence automation
    • Enables role-based MFA configuration via MFA v2, allowing Super Admins to enable or disable MFA for any access role
    • Adds sorting and filtering controls to the refreshed Data Room experience (early access)
    • Enhances Okta integration with real-time updates requiring authorization of two additional API scopes

    5 details in Everything

22. June 2025 Jun 1, 2025 · issue 014

    Secureframe launches MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., HubSpot integration, self-service SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and a refreshed sidebar in June 2025.

    ⤢
    └──▷ HOW TO FIND IT
    Ask an AI assistant to surface failing SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. controls directly from Secureframe without logging into the platform.
    📍In Claude or Cursor (with the Secureframe MCP Server connected), prompt: "Show me all failing controls for our SOC 2 program in Secureframe."
    Enable self-service SSO and domain verification to enforce login restrictions without a support ticket.
    📍In the Secureframe console, go to Settings › Domain Management, claim and verify your domain, then enable SSO and configure login restrictions from the same self-service flow.
    • New Secureframe MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server (public beta): a read-only Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server lets AI assistants (ChatGPT, Claude, Cursor) query compliance data — failing controls, high-risk vendors, framework status across SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, CMMC, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. — using natural language in real time.
    • New HubSpot integration: scans HubSpot users and access data to support compliance-related requirements, centralizing CRM data into the compliance program.
    • New self-service domain and SSO management: customers can claim and verify domain ownership, enable single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and configure login restrictions entirely within the platform without requiring vendor assistance.
    • Refreshed sidebar navigation: users can now switch between modules even when the sidebar is collapsed, with a cleaner and more consistent layout.

    4 details in Everything

23. June 2025 Jun 1, 2025 · release notes

    Secureframe June 2025 adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. beta, HubSpot integration, domain claiming, and UI updates

    • Launches the Secureframe MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server in public beta, enabling developer tools to query compliance data via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
    • Adds HubSpot integration to scan users and access CRM data for compliance requirements
    • Enables self-service domain claiming, verification, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enablement within the platform UI

    3 details in Everything

24. May 2025 May 1, 2025 · issue 014

    Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. support, Email Log, and new Vercel/Supabase integrations.

    ⤢ ⤢ ⤢
    • Adds AI Evidence Validation that analyzes uploaded evidence files and metadata in real time, checking document relevance to the control under test and whether timestamps fall within the required testing window.
    • Supports the FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. 20x KSI framework out of the box, with Phase One pilot key security indicators pre-mapped to controls and tests for FedRAMP Low KSI requirements — part of the FedRAMP 20x pilot alongside Coalfire.
    • New OneSchema-powered device data upload experience provides instant template validation feedback and highlights file issues before submission, with backend performance improvements for faster, more reliable uploads.
    • New centralized Email Log gives admins visibility into all outbound Secureframe communications (onboarding invites, task notifications, role changes) with searchable, filterable delivery status and open history for messages sent on or after March 17, 2025.
    • Revamped User Access Review Access Table built on Castle components with improved navigation, filtering, and search capabilities.

    +2 more show less

    • Extends Intune and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. integrations to GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. environments, supporting FedRAMP and CMMC 2.0 compliance with deeper identity and device management automation in Microsoft's government cloud.
    • Adds integrations for Vercel and Supabase, automatically scanning projects as cloud resources and surfacing evidence for relevant compliance tests.

    7 details in Everything

25. May 2025 May 1, 2025 · release notes

    Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. support, Vercel/Supabase integrations, and email logs.

    • AI Evidence Validation analyzes uploaded files in real time to check control correctness and timestamp validity
    • FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. 20x KSI framework support with pre-built controls and tests for FedRAMP Low KSI requirements
    • New OneSchema-powered device upload experience with smart template validation for admins
    • Centralized searchable Email Log for outbound communications sent on or after March 17, 2025
    • Revamped Access Table in User Access Review (UAR) with new filtering and search capabilities

    +2 more show less

    • GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. environment support for Intune and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. integrations
    • New integrations with Vercel and Supabase for scanning cloud resources and surfacing compliance evidence

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. column has been removed from the Access table
    • !The Privileged column has been temporarily removed from the Access table
26. April 2025 Apr 1, 2025 · release notes

    Secureframe April 2025 adds CMMC 3, GovRAMP, Azure Gov Cloud sync, GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. login, and vendor table improvements.

    └──▷ HOW TO FIND IT
    Sync resources from Azure Government environments for CMMC 2.0 or FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. compliance.
    📍In Secureframe, go to Integrations › Cloud Providers and add an Azure Government connection.
    Log in to Secureframe using Microsoft GCC High credentials for government identity requirements.
    📍Click Sign in on the Secureframe login page and select Microsoft GCC High as the identity provider.
    Track vendor review status and assignees directly from the Vendor Module table.
    📍Navigate to the Vendor Module and view the updated table columns showing review status, upcoming dates, and current assignee.
    • Adds support for CMMC Level 3 compliance framework with 24 additional requirements to complete the CMMC 2.0 portfolio
    • Adds full support for GovRAMP Low and Moderate frameworks (formerly StateRAMP) built on NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework.
    • Enables sync of resources from Azure Government Cloud environments alongside existing AWS GovCloud support
    • Enables login via Microsoft GCC High credentials for customers in Microsoft 365 Government environments
    • Updates the Vendor Module table view to display in-progress/upcoming reviews and current assignees with customizable columns

    5 details in Everything

27. March 2025 Mar 1, 2025 · issue 014

    Secureframe March 2025 adds an Audit Module, Zendesk integration, CMMC personnel fields, and new auth policies.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Use Zendesk as a compliance task destination so ticket updates flow into Secureframe and map to your compliance tests — ideal for teams already triaging incidents or vulnerabilities in Zendesk.
    📍In the Secureframe console, go to Settings › Integrations, select Zendesk, and enable bi-directional sync. Choose the record types to import (incidents, nonconformities, vulnerabilities, system changes, user access) and map them to your compliance tests.
    Streamline vendor security reviews by uploading existing questionnaire documents rather than re-entering data manually.
    📍In the Secureframe console, navigate to Security Questionnaires, click Import, and upload a .doc or PDF file to populate the questionnaire module.
    • Introduces a new Audit Module designed to streamline the end-to-end audit process for customers and auditors.
    • Refreshes the Dashboard with an updated design and a new Action Items widget surfacing expiring evidence, upcoming reviews, and task due dates.
    • Adds bi-directional Zendesk integration for task syncing and ticket import, covering incidents, nonconformities, vulnerabilities, system changes, and user access mapped to compliance tests.
    • Launches a new Help Flyout replacing the old help menu, with direct access to Secureframe Academy, the Get Started page, and Customer Success.
    • Adds two new CMMC-focused columns to the Personnel Table to support Access Control and Account Management requirements.

    +4 more show less

    • Supports importing .doc and PDF files directly into the Security Questionnaires module for vendor reviews.
    • Introduces new authentication and password policies to meet compliance standards including CMMC.
    • Updates the TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. framework and Statement of Applicability (SOA) export to align with the latest TISAX assessment requirements.
    • Adds two new columns to the Policy Table.

    9 details in Everything

28. March 2025 Mar 1, 2025 · release notes

    Secureframe March 2025 adds Audit Module, Zendesk integration, CMMC personnel columns, doc/PDF imports, and TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. updates.

    └──▷ HOW TO FIND IT
    Sync Zendesk tickets to Secureframe for incident tracking mapped to compliance tests.
    📍In Secureframe, navigate to Integrations › Zendesk and enable bidirectional sync for tasks and incident data.
    Import existing security questionnaire content from Word or PDF files.
    📍In the Security Questionnaires module, select Import and upload your .doc or PDF file directly.
    • Introduces the new Audit Module for centralized audit creation, tracking, and report storage with auto-provisioned auditor access
    • Adds bidirectional Zendesk integration to sync tasks, incidents, nonconformities, vulnerabilities, system changes, and user access to Secureframe
    • Adds Last Login and Secureframe MFA columns to the Personnel Table for CMMC compliance tracking
    • Enables .doc and PDF file imports directly into the Security Questionnaires module
    • Updates TISAX framework and Statement of Applicability (SOA) export to align with latest assessment requirements

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.) is now required for all Super Admins, Admins, and Auditors for direct login and magic link authentication
    • !Passwords now expire every 12 months and cannot be reused for four cycles
29. February 2025 Feb 1, 2025 · release notes

    Secureframe February 2025 adds CMMC 2.0 L1/L2, DORA Tech Standards, Teams integration, Trust Center CAPTCHA, Agent signing, manual personnel add.

    └──▷ HOW TO FIND IT
    Coordinate CMMC compliance tasks within Microsoft Teams channels
    📍Use the Secureframe app in MS Teams to create a task, reply with updates, and mark as closed.
    Add a single POC or admin without uploading a CSV file
    📍Open the new Add Personnel modal in Secureframe and enter details for one individual.
    • Adds CMMC Level 1 and Level 2 frameworks with finalized DoD requirements, controls, and tests
    • Expands DORA framework to include Technical Standards requirements and control/test mappings
    • Adds Microsoft Teams integration for creating, posting replies, and closing out compliance tasks
    • Adds CAPTCHA validation to resource requests in the Secureframe Trust Center
    • Implements Windows build signing for all new Secureframe Agent connections and builds

    +1 more show less

    • Adds ability to manually add single personnel via a new modal without CSV upload

    6 details in Everything

30. January 2025 Jan 1, 2025 · release notes

    Secureframe Jan 2025 adds NIST 800-171 Rev 3 support and new endpoint integrations

    └──▷ HOW TO FIND IT
    Align your infrastructure with the latest federal security standards using the new framework.
    📍In the console, go to Compliance › Frameworks and select 'NIST 800-171 Rev. 3'
    Automate device compliance checks by connecting new endpoint tools via the Integrations library.
    📍In the console, go to Integrations › Endpoint Security and enable Scalefusion MDM
    • Adds Support for NIST 800-171 Revision 3 compliance framework alongside existing Rev. 2 support
    • Adds Scalefusion MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration for automated firewall and hard drive encryption testing
    • Adds WatchGuard EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration for anti-malware, firewall, and hard drive encryption testing
    • Adds Sophos EDR integration for anti-malware and hard drive encryption testing
    • Upgrades Service Partner console with instant subscription packaging details and transparent pricing

    5 details in Everything

31. December 2024 Dec 1, 2024 · release notes

    Physical security tests now accept direct evidence uploads; refreshes Frameworks page progress tracking.

    └──▷ HOW TO FIND IT
    Verify physical security implementation by uploading specific evidence files to a test.
    📍In the Secureframe console, navigate to Physical Security › Tests › [Test Name] and use the Upload Evidence action to attach supporting documents.
    Monitor evidence freshness for physical security tests using the new column and visual indicators.
    📍In the Secureframe console, go to Physical Security › Tests and check the Last Upload At column; look for color-coded tags to identify stale evidence requiring refresh.
    Visualize how many controls overlap with a new framework on the Frameworks page.
    📍In the Secureframe console, go to Frameworks and view the reinstated progress bar showing control overlaps for faster adoption planning.
    • Upgrades physical security tests to upload-based verification for direct evidence submission
    • Adds Last Upload At column and color-coded tags to identify stale physical security test evidence
    • Reinstates framework overlap progress bar on the refreshed Frameworks page

    3 details in Everything

32. October 2024 Oct 1, 2024 · release notes

    Secureframe adds Custom Automated Tests (CATs) against cloud integrations and supports CMMC Level 1 as separate framework.

    • Create Custom Automated Tests (CATs) for AWS, Azure, GCP, and DigitalOcean to automate security and compliance checks
    • Split CMMC offering into separate frameworks for CMMC 2.0 Level 1 and CMMC 2.0 Level 2
    • Add SecurityScorecard widget to display company rating and details
    • Enable bulk upload of documents for vendor risk assessments and portal
    • Allow bulk assignment of categories and departments to vendors

    +1 more show less

    • Allow viewing excluded child connections for AWS, Azure, and GCP integrations

    6 details in Everything

33. September 2024 Sep 1, 2024 · release notes

    New Vendor Portal, bi-directional Linear syncing, faster framework provisioning, and enhanced auditor permissions in Secureframe.

    • Adds the new Vendor Portal for sending security questionnaires to vendors and tracking responses.
    • Enables bi-directional task syncing between Linear and Secureframe for compliance tracking.
    • Reduces integration sync times by allowing individual test refreshes that sync only specific resources.
    • Increases framework provisioning speed by up to 5x with background execution.
    • Allows customization of document-specific rejection reasons and generic messages in the Trust Center.

    +1 more show less

    • Expands Auditor role permissions to include view-only access to tests, controls, policies, and asset inventories.

    6 details in Everything

34. August 2024 Aug 1, 2024 · release notes

    Secureframe August 2024 adds TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. framework support, manual control overrides, and Trust Center UI customizations.

    └──▷ HOW TO FIND IT
    Customize your Trust Center's logo and link it to your corporate website.
    📍In the site designer, go to App bar and edit the logo URL and description.
    Override a control's health status during a compliance assessment.
    📍Use the Control Overrides feature to manually set the health status of specific controls.
    Document remediation plans for third-party risks in a dedicated field.
    📍Edit the new response field in TPRM review findings to add remediation details.
    • Adds TISAX Framework as a supported compliance framework
    • Allows manual setting of the health status for controls via Control Overrides
    • Upgrades the Generative Model for Security Questionnaires to handle over 1,000 questions with improved speed
    • Enables customization of the Trust Center logo URL and description in the App bar section of the site designer
    • Simplifies updating and deleting custom domains and secureframetrust.com subdomains in Trust Center settings

    +6 more show less

    • Adds a review status column to the main vendors page in Third-Party Risk ManagementThird-Party Risk ManagementAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data.
    • Adds a new response field for documenting remediation plans in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. review findings
    • Adds a Documents column to the main vendors page in TPRM, toggleable via column selector
    • Enables bulk editing of schedules and templates in TPRM from a single modal
    • Allows direct editing of the Last reviewed at date for vendors in TPRM who have not completed a review
    • Automatically completes parent reviews in TPRM when all child reviews are completed

    11 details in Everything

35. July 2024 Jul 1, 2024 · release notes

    Secureframe July 2024 adds TX-RAMP support, ClickUp integration, GitHub public repo opt-out, and Trust Center bulk-import/subprocessor management.

    • Adds TX-RAMP framework support with coverage for both levels to enable Texas state agency compliance workflows
    • Integrates ClickUp as a task destination for automated compliance testing and sync of access changes, vulnerabilities, nonconformities, incidents, and system changes based on SLAs
    • Allows GitHub integration to opt out of syncing public repositories to exclude them from audit scope and check execution
    • Enables bulk-import of subprocessors directly from the vendor list within the third-party risk management experience
    • Adds grid view option for Trust Center compliance, resources, and sub-processors sections with a View All link for detailed searchable content

    +1 more show less

    • Provides Zapier integration to automate Trust Center document request management and notifications via custom rules

    6 details in Everything

36. June 2024 Jun 1, 2024 · release notes

    Secureframe June 2024 adds SOX ITGC support and custom control monitoring.

    └──▷ HOW TO FIND IT
    Add a custom control from any framework to monitor in the Trust Center.
    📍In the Secureframe console, go to Trust Center › Monitoring and click Add Custom Control.
    • Adds SOX ITGC compliance capabilities including policy setup, evidence collection, and continuous control monitoring
    • Enables tracking of custom controls from any framework in the Trust Center Monitoring section with customizable display language

    2 details in Everything

37. May 2024 May 1, 2024 · release notes

    Secureframe May 2024 adds Bitwarden and Figma integrations, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27017 support, and framework scoping controls.

    └──▷ HOW TO FIND IT
    Configure the new Bitwarden integration tests within Secureframe.
    📍Navigate to Integrations › Bitwarden and follow the setup wizard for specific test configurations.
    Scope your SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. audit by segregating environments and tagging assets.
    📍Go to Frameworks › [Framework Name] › Scoping, link a segregated environment, and tag relevant personnel.
    • Adds integration with Bitwarden via specific tests for organizations using it in their tech stack
    • Adds integration with Figma via specific tests for organizations using it in their tech stack
    • Adds support for syncing user information from FactorialHR
    • Allows linking frameworks to segregated environments to tag assets and personnel
    • Enables filtering out assets with no compliance relevance or evidence chance

    +2 more show less

    • Enables excluding assets from reports during framework scoping
    • Adds the ability to add comments on controls for better communication

    7 details in Everything

38. April 2024 Apr 1, 2024 · release notes

    Secureframe April 2024 adds SimpleMDM/Salesforce/FusionAuth integrations, URL evidence, tags, and AI questionnaire automation.

    • Adds integration with FusionAuth via dedicated compliance tests
    • Adds integration with Salesforce via dedicated compliance tests
    • Adds integration with SimpleMDM via dedicated compliance tests
    • Allows adding tags to tests and controls for filtering
    • Enables using URLs as evidence instead of files alone

    +2 more show less

    • Allows downloading completed questionnaires or RFPs as a zip file
    • Adds Generative AI (Trust AI) verification for questionnaire answers

    7 details in Everything

39. March 2024 Mar 1, 2024 · release notes

    Secureframe March 2024 adds NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. and Essential Eight frameworks, SentinelOne integration, and Trust Center Site Designer overhaul.

    • Adds NIS2 framework support for EU cybersecurity compliance
    • Adds Essential Eight framework support for Australian compliance
    • Adds SentinelOne integration for threat prevention and detection monitoring
    • Adds Purpose and Location fields to subprocessor details in Trust Center
    • Adds global CSS stylesheet capability to override layout in the new Trust Center Site Designer

    5 details in Everything

40. February 2024 Feb 1, 2024 · release notes

    Secureframe adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 9001 framework support, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0 compliance, Duo/Crowdstrike/LaunchDarkly integrations, and Jira ticket visibility

    └──▷ HOW TO FIND IT
    View synchronized Jira tickets for audit controls directly in Secureframe.
    📍Navigate to Asset Inventory › Tickets to view synced Jira issues.
    Start compliance mapping for the new ISO 9001 standard using built-in templates.
    📍Select ISO 9001 from the framework list to access QMS manual and quality policy templates.
    • Adds support for the ISO 9001 quality management framework with policy templates
    • Adds support for PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS version 4.0 standard for reports and self-assessments
    • Adds Asset Inventory > Tickets table showing synced Jira tickets for audit visibility
    • Adds new tests specific to Duo integration
    • Adds new tests specific to CrowdStrike EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration

    +1 more show less

    • Adds new tests specific to LaunchDarkly feature flag integration

    6 details in Everything

41. January 2024 Jan 1, 2024 · release notes

    Secureframe Jan 2024 adds CPRA compliance support, personnel status filtering, editable fields, and group imports.

    • Adds Status column to Personnel table showing outstanding tasks
    • Enables filtering Personnel table columns by outstanding task relevance
    • Allows direct editing of personnel attributes on the Personnel details page
    • Supports group imports from Google Workspace, O365, MS Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. (Azure AD), and Okta in Personnel settings
    • Launches support for CPRA compliance including additional tests and controls

    5 details in Everything

42. December 2023 Dec 1, 2023 · release notes

    Secureframe adds FTC/NYDFS/Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. frameworks, device connection labels, and bulk cloud resource actions

    └──▷ HOW TO FIND IT
    Filter test results to quickly identify and triage assets that are failing compliance checks.
    📍In the Test Evidence tab, use the asset filter dropdown to select failing.
    Use the new device inventory field to distinguish between MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. connections for the same vendor.
    📍View the device connection source column in the Device Inventory table.
    Perform mass updates on cloud resources without clicking into each asset individually.
    📍Select multiple rows in the Assets › Cloud Resources table and use the bulk actions bar.
    • Adds support for the FTC Safeguards Rule framework with control mapping and automated evidence collection
    • Adds support for the NYDFS NYCRR 500 framework with control mapping and automated evidence collection
    • Adds support for the Cyber Essentials framework with control mapping and automated evidence collection
    • Adds advanced filtering for test evidence assets by status (failing, passing, or ignored)
    • Shows device connection source in the device inventory to identify multiple connections from the same MDM vendor

    +1 more show less

    • Adds a bulk actions bar to the Assets > Cloud Resources table for mass operations on cloud resources

    6 details in Everything

43. November 2023 Nov 1, 2023 · release notes

    Secureframe November 2023 adds API access, quantitative risk assessment via ALE, CSV upload, task notifications, and policy AI.

    └──▷ HOW TO FIND IT
    Organize cloud resources by setting up child connections for different Azure subscriptions to manage integrations effectively.
    📍In Secureframe, go to Integrations › Cloud Resources › Add Child Connection and select the target subscription to filter and sync specifically with that environment.
    Generate policy text using Comply AI by highlighting a section of your policy document and sending a custom prompt for refinement.
    📍Highlight text in the Policy Editor, click Comply AI, type custom prompt like Make this more concise and select Insert changes.
    • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to programmatically read and write data, enabling integration with any tool or service beyond the 200+ native integrations
    • Adds Quantitative Risk Assessment using the Annualized Loss Expectancy Methodology for precise financial loss understanding
    • Adds Flexible CSV upload for risk registers that allows importing existing risk register without pre-formatting based on Secureframe templates
    • Adds Document attachments capability to attach supporting documents like cyber liability insurance proof during the risk assessment workflow
    • Adds Tasks and notifications feature allowing creation of risk management tasks with delivery via email, Jira, or Slack

    +4 more show less

    • Adds ability to view and hard delete archived risks from archives to remove duplicates or accidental entries
    • Adds Organizations & Child Accounts structure for organizing cloud resource integrations (AWS, Azure & GCP) with filtering and sync controls
    • Adds Custom Security Training URLs linking to third-party security awareness training when selecting Other (Third Party) vendor
    • Adds AI-powered text revisions in Policy Editor via Comply AI for Policies, allowing users to highlight text and select from out-of-the-box prompts or custom prompts for generative suggestions

    9 details in Everything

44. October 2023 Oct 1, 2023 · release notes

    Secureframe October 2023 release adds Comply AI risk management, Office365 user filtering, read-only policies, Azure AD fields, and JamfPro screen lock sync.

    └──▷ HOW TO FIND IT
    Use UI navigation to make policies read-only so reviewers don't need to click Accept.
    📍In Secureframe, go to Policies › Edit Policy and mark it as read-only.
    Exclude unlicensed or guest accounts from Office365 integration by creating a new connection.
    📍Archive the existing Office365 connection and create a new one with user filtering enabled.
    • Improved Risk Management module with Comply AI for Risk
    • Enhancements to Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Integration
    • JamfPro Screen Lock Support

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing Office365 connections must be archived and a new connection must be created for user filtering to work
45. September 2023 Sep 1, 2023 · release notes

    Secureframe adds Bulk Action Bar, TSC options for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., AWS Inspector update, CSV control creation, and questionnaire automation

    • Adds Bulk Action Bar on Personnel Tests and Asset Inventory pages to consolidate bulk actions into a floating UI element
    • Adds Processing Integrity and Privacy as optional Trust Services Criteria (TSC) for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 reports, defaulted to disabled
    • Updates AWS Inspector integration to support container images, multi-account management via Systems Manager Agent, and improved scalability while retaining syncing for Inspector Classic
    • Enables creating custom controls AND mapping them to framework requirements in a single CSV file, with auto-updated date fields, input validation warnings, and typo suggestion assistance
    • Improves Secureframe Questionnaire Automation performance and introduces the Security Questionnaires Starter Pack for common security questionnaires

    5 details in Everything

46. August 2023 Aug 1, 2023 · release notes

    Secureframe adds Comply AI for remediation across clouds, custom frameworks, Test Library access, and Trust Center email/FAQ controls.

    └──▷ HOW TO FIND IT
    Create and manage custom compliance frameworks tailored to organizational standards.
    📍Configure a new custom framework by mapping specific security controls, processes, and policies in the Secureframe console.
    Access all automated tests available for custom controls and frameworks.
    📍Open the tests page from the left side navigation to browse Secureframe and user-created custom tests.
    • Supports custom frameworks with user-defined security controls, processes, and policies mapped to pre-built or custom tests
    • Test Library provides access to all Secureframe and user-created custom tests via the tests page in left navigation
    • Custom email destinations for document request notifications in Trust Center
    • FAQs can be added and answered in the Trust Center Site Designer to reduce security questionnaire volume
    • default Version Control Branches settings allow specifying default branch and testing configs per integration connection

    5 details in Everything

47. June 2023 Jun 1, 2023 · release notes

    Secureframe adds Comply AI for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. remediation, custom controls, AWS GovCloud integration, and improved onboarding in June 2023

    └──▷ HOW TO FIND IT
    Use the new chatbot interface to get tailored IaC remediation steps for AWS misconfigurations.
    📍Submit a request via the Comply AI chatbot in the Secureframe console.
    Create custom security controls in bulk to align compliance with organizational policies.
    📍Navigate to the Controls tab › Add controls › Select Bulk and upload control definitions.
    Connect Secureframe to an AWS GovCloud account to automate compliance monitoring for federal requirements.
    📍In the Integrations section, select AWS GovCloud and follow the authentication wizard.
    • Introduces Comply AI for remediation to auto-generate IaC guidance for AWS misconfigurations and a chatbot for tailored requests.
    • Enables creation of custom controls individually or in bulk via the Controls tab.
    • Adds AWS GovCloud integration for monitoring, policies, and evidence collection.

    3 details in Everything

48. May 2023 May 1, 2023 · release notes

    Secureframe adds Secureframe Trust portal, JSON evidence export, and has_production_branches filter.

    • Adds Secureframe Trust, a customizable Trust Center that continuously syncs platform data and integrates Questionnaire Automation with NDAs and document uploads
    • Adds raw JSON evidence export for failed tests to identify remediation details faster than CSV-only output
    • Adds has_production_branches as a filterable field in the repositories table and search_data to identify unconfigured resources.

    3 details in Everything

49. April 2023 Apr 1, 2023 · release notes

    Secureframe April 2023 adds PDF policy uploads, new training lessons, default group assignments for new policies, and pass indicators for evidence

    • Adds ability to upload one or multiple PDF policies in addition to the inline editor
    • Adds two new Security Awareness Training lessons: Anti-Counterfeiting and Privacy
    • Adds visual indicator showing if each test has evidence uploaded against it
    • Adds group multi-select option when creating a new policy for the first time, defaulting to employees and contractor groups
    • Changes policies view to always show the last accepted date for policy acceptance

    5 details in Everything

50. March 2023 Mar 1, 2023 · release notes

    Secureframe March 2023 adds Test Activity Dashboard for test updates, enhanced Microsoft Intune and JumpCloud integrations.

    └──▷ HOW TO FIND IT
    Review new or updated tests on the dashboard to decide whether to keep them in their current state before the automatic introduction date.
    📍In the console, go to Test Activity Dashboard to review pending updates.
    • Launches Test Activity Dashboard to manage test updates, automating compliance check enforcement with a Required Action Date at least 3 weeks after introduction
    • Enhances Microsoft Intune automation for four endpoint security upload tests: anti-malware enforcement, 15-minute screen lock policy, continuous local firewall logging, and strong password policy (8+ characters)
    • Expands JumpCloud integration to sync device information from the account and automate compliance checks like hard drive encryption enforcement via REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services.

    3 details in Everything

51. February 2023 Feb 1, 2023 · release notes

    Secureframe February 2023 adds multi-tenant MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. portal, DattoRMM integration, and custom upload tests.

    └──▷ HOW TO FIND IT
    To create a custom compliance check that validates specific upload-based evidence not covered by built-in tests.
    📍On the test page in Secureframe, click to create a new Custom Upload Test.
    • Launches multi-tenant portal for Secureframe for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. to centralize customer compliance management
    • Adds DattoRMM integration to pull automated evidence like antivirus status and asset inventory
    • Introduces Custom Upload Tests allowing authors to create new tests that take uploads as evidence

    3 details in Everything

52. January 2023 Jan 1, 2023 · release notes

    Secureframe January 2023 adds Knowledge Base Chrome extension, Test Comments collaboration, and AI questionnaire automation.

    • Knowledge Base Chrome Extension allows users to look up content and answers from the Secureframe Knowledge Base while on calls, emails, or questionnaires.
    • Questionnaire Automation uses machine learning to suggest responses to RFPs and security questionnaires with 90%+ accuracy using context from the Secureframe platform.

    2 details in Everything

53. December 2022 Dec 1, 2022 · release notes

    Secureframe adds Security Awareness Training modules to its in-platform training catalog.

    └──▷ HOW TO FIND IT
    Review available Security Awareness modules for onboarding workflows.
    📍Navigate to Personnel › Settings › Onboarding in the Secureframe app
54. November 2022 Nov 1, 2022 · release notes

    Secureframe November 2022 adds Knowledge Base scheduled reviews and four new integration partners

    • Adds ability to schedule regular review cycles for Knowledge Base content with automated email notifications on expiry
    • Integrates Rootly, Electric, Basis Theory, and Indent into the Trusted Partner Program

    2 details in Everything

55. October 2022 Oct 1, 2022 · release notes

    Secureframe October 2022 adds Comments tab for tests and custom tags for Knowledge Base records

    └──▷ HOW TO FIND IT
    Collaborate on remediation steps for a specific compliance test.
    📍In the console, go to Tests, click on a test, and navigate to the Comments tab
    Filter Knowledge Base records by team or topic.
    📍In the console, go to Knowledge Base, upload security questionnaires or RFPs, and create custom tags for different teams.
    • Adds a Comments tab on the Tests page to collaborate with other users

    1 detail in Everything

56. September 2022 Sep 1, 2022 · release notes

    Secureframe September 2022 adds tolerance windows for tests, questionnaire automation, and 12 new frameworks.

    • Test update notifications now include a configurable tolerance window so tests show an at risk status before failing
    • Due dates and auto-increment intervals can be set for Upload Tests to remind owners when evidence needs refreshing
    • Secureframe Questionnaires allows uploading RFPs/security questionnaires, verifying ML-suggested answers from the Knowledge Base, and exporting in the original format
    • Support added for NIST SP 800-53, CMMC, NIST 800-171, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. SAQSAQSelf-Assessment Questionnaire: a PCI DSS compliance form that merchants and service providers complete to validate how they handle cardholder data, with different variants scoping different payment environments.-A and -D, NIST Privacy, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27701, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals., Microsoft SSPA, and MSVP frameworks
    • JIRA integration automates compliance checks and evidence collection for five existing requirements

    +1 more show less

    • Vendors page now supports filtering and sorting to identify high-risk vendors

    6 details in Everything

57. June 2022 Jun 1, 2022 · release notes

    Adds Custom Upload Tests allowing you to author custom evidence tests that accept file uploads

    └──▷ HOW TO FIND IT
    Create a custom test that requires uploading a specific compliance document for verification.
    📍In the console, go to Tests › New Test and select Custom Upload to create a new set of tests that accept file uploads as evidence