https://cybertoolchain.io/tools/secureframe New releases and features in Secureframe, tracked by The Cyber Toolchain. en Mon, 01 Jun 2026 00:00:00 GMT https://secureframe.com/product-updates https://secureframe.com/product-updates Mon, 01 Jun 2026 00:00:00 GMT Secureframe June 2026 adds multi-policy test linking, reopenable reviews, and daily 81–98% faster personnel syncs. • Supports linking multiple policies to a single test, with draft-policy status surfaced as the failure reason. • Enables automatic re-running of paired acknowledgement tests when a policy is published, eliminating stale results. • Adds ability to reopen completed reviews or individual applications to correct mistakes without losing the audit trail. • Enables removal of specific test runs or errors from the Complete tab while preserving audit history. • Personnel and access data now syncs daily using incremental pulls, reducing sync times by 81–98% and lowering Microsoft Graph API quota pressure — no configuration required. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Mon, 01 Jun 2026 00:00:00 GMT Secureframe June 2026 adds multi-select policy links for compliance tests, access review reopens, and incremental Office 365 syncs. • Link multiple policies to a single test in the UI to automatically trigger acknowledgement test re-runs upon policy publication • Reopen and delete completed access reviews or individual applications within the Complete tab without losing audit trail • Incremental Office 365 directory syncs that reduce sync times by 81–98% with no configuration needed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://support.secureframe.com/hc/en-us/articles/9216296479891/live_preview/01KRRQ9H0WYY94J6V1GB4614AF https://support.secureframe.com/hc/en-us/articles/9216296479891/live_preview/01KRRQ9H0WYY94J6V1GB4614AF Fri, 01 May 2026 00:00:00 GMT Secureframe May 2026 adds CMMC Scoping Module, Defense Navigator, GCC High automation, AI-populated SSPs, and overhauled evidence management. • New Scoping Module guides organizations through CMMC scoping questions, auto-marks out-of-scope requirements with audit-ready justifications, disables irrelevant tests, and tailors SSP and policy language accordingly. • New Microsoft GCC High integration automates CMMC-required configurations and provides step-by-step manual guidance where Microsoft APIs don't permit full automation. • SSP creation now auto-populates implementation statements from scoping decisions and connected integrations, with bulk or individual acceptance of suggested updates. • CMMC Level 2 framework updated with revised control mappings, refreshed policies, and new automated tests for GCC High, Google Workspace, Federal MDM, and Virtual Desktop environments. • Windows 11 virtual desktops now ship with Microsoft 365 pre-installed and support Common Access Card (CAC) authentication, with automatic smart card redirection and DoD certificate chain configuration. • New Conditional Tokens allow entire policy sections to appear or disappear automatically based on defined conditions such as connected integrations or applicable frameworks. • Evidence management for Upload Tests has been significantly overhauled with new workflow capabilities. • Adds integration-level email filtering rules, enabling per-integration exclusions independent of org-wide settings. • Policy updates that require employee acknowledgment can now trigger an acknowledgment reset directly at save time, automatically notifying employees to re-acknowledge. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Fri, 01 May 2026 00:00:00 GMT New CMMC scoping module, automated GCC High config, conditional policy tokens, and enhanced Virtual Desktop support • Adds a `Scoping Module` to guide CMMC compliance program scope definition with audit-ready justifications. • Unlocks Defense Navigator step-by-step guidance for the full CMMC readiness process based on prerequisites. • Automates GCC High configurations (MFA, conditional access, audit logging) via Microsoft APIs for CMMC. • Auto-populates SSP implementation statements from scoping decisions and connected integrations. • Updates CMMC Level 2 framework with revised control mappings and automated tests for GCC High, Google Workspace, Federal MDM, and Virtual Desktops. • Enables Common Access Card (CAC) authentication on Windows 11 virtual desktops with automatic certificate chain configuration. • Introduces `Conditional Tokens` to show or hide policy sections based on connected integrations or frameworks. • Changes Upload Tests expiry logic to depend on when work was performed, flagging expired evidence instead of auto-archiving. • Adds integration-level email filtering rules for personnel management. • Allows resetting existing employee policy acknowledgments directly during policy save operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Wed, 01 Apr 2026 00:00:00 GMT Secureframe April 2026 adds a faster Org Picker with role/team visibility and improved Personnel access tables. • New Org Picker shows role and team size per organization at a glance, with an improved favorites section and built-in sign-out access for faster multi-org navigation. • Updated Accounts and Devices tables in Personnel add improved sorting, filtering, and navigation to streamline user access and device assignment reviews. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Sun, 01 Mar 2026 00:00:00 GMT Secureframe adds GA User Access Reviews, guided ComplyAI risk workflows, a dedicated Auditors view, and flexible user onboarding controls. • Adds User Access Reviews (UAR) — generally available for Comply Complete customers — enabling scheduled or one-time access reviews with approve/revoke/follow-up decisions, bulk actions, CSV uploads for non-integrated apps, and exportable audit-ready evidence across SOC 2, ISO 27001, and CMMC. • Improves ComplyAI risk assessment workflow with guided field completion (risk description, owner) before AI recommendations are generated, surfacing the next required step dynamically. • Introduces a dedicated Auditors tab within Personnel, separating auditor accounts into a tailored view aligned to their role. • Enables admins to control whether users without a start date are automatically invited, allowing onboarding workflows to match organizational timelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://support.secureframe.com/hc/en-us/articles/48787399317523-Using-Smart-User-Mentions-in-Comments https://support.secureframe.com/hc/en-us/articles/48787399317523-Using-Smart-User-Mentions-in-Comments Sun, 01 Feb 2026 00:00:00 GMT Secureframe adds Smart User Mentions, Audit Completion Workflow, multilingual onboarding, and expanded Azure/Sentinel integrations. • Adds Smart User Mentions: tag customers or auditors with '@' in comments across the platform, triggering email notifications with a direct link back to the relevant comment and test location in the Audit Module. • Introduces a structured Audit Completion Workflow with a dedicated modal for uploading multiple report versions (drafts, revisions, finals), a built-in comments section with @mentions, a toggle to confirm final report receipt, and the ability for either party to mark the audit complete. • Supports employee onboarding workflows — including policy acknowledgments and training steps — in French, German, and Spanish for global teams. • Expands Azure integration to ingest user data, increasing identity-based compliance testing coverage in the Access tab. • Adds support for the government version of Microsoft Sentinel, extending SIEM coverage for regulated and public sector environments. • Enhances Datadog integration for improved monitoring and logging validation. • Updates ServiceNow integration to improve sync reliability and alignment between ticketing workflows and compliance evidence collection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Thu, 01 Jan 2026 00:00:00 GMT Secureframe adds new audit test statuses, 100% Met progress tracking, log deep-links, and progressive auditor-firm search. • New test statuses in the Audit Module improve transparency between auditors and admins throughout the audit lifecycle. • Audit Module progress bar now tracks completion toward 100% Met, giving an at-a-glance readiness indicator. • Audit Log gains direct links to changed items, enabling users to jump instantly from the log table to any updated record. • Progressive search for audit firms lets users type a firm name to search across all partners with an Auditor Partner Console (APC), enabling self-service auditor linking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Mon, 01 Dec 2025 00:00:00 GMT Secureframe December 2025 adds a full Audits Module, FedRAMP 20x JSON export, Trust Center versioning, and automated test-status email alerts. • New Audits Module centralizes the entire audit lifecycle — admins create audits, invite auditors, assign internal stakeholders, and a complete audit history is stored for future reference. • Auditors can review requests, accept or reject evidence, request additional information, and add new requests directly within the platform. • Evidence uploads now capture an Activity Completion Date, distinguishing when work occurred from when evidence was submitted to improve audit scoping accuracy. • New FedRAMP 20x machine-readable JSON export aligns to Key Security Indicators (KSIs), including system details, control health, test results, and evidence references for assessor review. • Trust Center gains a resource-versioning workflow: teams can replace an existing document and automatically notify previously approved users when a new version is available. • New automated email notifications alert users to test status changes on a daily, weekly, or biweekly cadence, summarizing shifts to at-risk, failing, or other monitored statuses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://support.secureframe.com/hc/en-us/articles/45075010619667-Snowflake https://support.secureframe.com/hc/en-us/articles/45075010619667-Snowflake Wed, 01 Oct 2025 00:00:00 GMT Secureframe adds Gap Assessments, Snowflake & Freshservice integrations, Custom Integrations, GovRAMP Core, and bulk employee scoping. • Adds Gap Assessments for any supported framework (SOC 2, ISO 27001, NIST 800-171, and more), automatically comparing current posture against requirements and surfacing prioritized remediation actions. • New Snowflake integration automates continuous compliance testing across authentication, high availability, firewall rules, and alerting for the cloud data platform. • New Freshservice integration enables bi-directional ticket syncing as a task destination to track compliance for incidents, vulnerabilities, nonconformities, system changes, and user access against SLAs. • Introduces Custom Integrations, allowing teams to ingest, map, and test compliance resources (user accounts, devices, training records, cloud infrastructure) from any system not covered by native integrations. • Adds GovRAMP Core framework support, a streamlined baseline derived from GovRAMP Low and Moderate to simplify the authorization process. • Admins can now mark employees as out of scope individually or in bulk, with a required rationale, to reflect leave, reassignment, or other workforce changes for audit transparency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/blog/eu-ai-act-compliance https://secureframe.com/blog/eu-ai-act-compliance Mon, 01 Sep 2025 00:00:00 GMT Secureframe adds EU AI Act compliance framework, MongoDB Atlas integration, and Freshdesk bi-directional sync • Adds full EU Artificial Intelligence Act (EU AI Act) compliance framework with a risk-based approach to categorizing and safeguarding AI systems. • New MongoDB Atlas integration enables automated compliance testing for authentication, backup and availability, encryption, firewall rules, and logging and alerting. • New Freshdesk integration with bi-directional syncing automates evidence collection for customer support and ticketing workflows, eliminating manual uploads for audit readiness. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Mon, 01 Sep 2025 00:00:00 GMT Secureframe adds EU AI Act framework, MongoDB Atlas and Freshdesk integrations, plus custom automated testing for repos. • `EU AI Act Framework` support added for risk-based AI governance compliance. • `MongoDB Atlas Integration` enables automated compliance testing for authentication, backup, encryption, firewall, and logging. • `Freshdesk Integration` adds bi-directional sync for tasks and uses Freshdesk tickets as automated evidence for compliance tests. • Custom Automated Testing (CAT) now supports repository-based data sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://support.secureframe.com/hc/en-us/articles/43301615166483-Addigy https://support.secureframe.com/hc/en-us/articles/43301615166483-Addigy Fri, 01 Aug 2025 00:00:00 GMT Secureframe adds 7 new vuln-scanner integrations, Addigy MDM support, C5 compliance, and overhauled vendor review scheduling. • Centralizes vendor review schedules so frequency, question sets, requested documents, and vendor lists are configured at the review level rather than per vendor. • Adds 'requested documents' to review schedules, automatically prompting vendors to upload items like SOC 2 reports and spinning up a vendor portal on the review start date. • New integrations with Rapid7 InsightVM, Tenable VMS, Qualys, Wiz, Microsoft Defender, Aikido, and Snyk automate evidence collection for vulnerability scanning, dependency testing, and SAST. • New integration with Addigy enables automated compliance testing for hard drive encryption, firewall configuration, screen lock enforcement, and anti-malware on macOS devices. • Supports the C5 Controls Catalog (BSI) for organizations operating in the EU or targeting the German public sector. • Enables bulk archiving of multiple policies at once via the Policies table bulk action bar. • Adds spam filtering to Trust Center request forms, automatically flagging and archiving suspicious submissions with a 'SPAM' label. • Adds a 'Completed at' column to the Vendor Review table to improve auditability of third-party risk management timelines. • Adds pagination and navigation controls to the Policy Tests table for teams managing large numbers of test-policy relationships. • Redesigned first-time login experience shows only the authentication methods enabled for a user's organization, eliminating password reset loops. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/blog/secureframe-mcp-server https://secureframe.com/blog/secureframe-mcp-server Sun, 01 Jun 2025 00:00:00 GMT Secureframe launches MCP Server, HubSpot integration, self-service SSO, and a refreshed sidebar in June 2025. • New Secureframe MCP Server (public beta): a read-only Model Context Protocol server lets AI assistants (ChatGPT, Claude, Cursor) query compliance data — failing controls, high-risk vendors, framework status across SOC 2, ISO 27001, CMMC, and FedRAMP — using natural language in real time. • New HubSpot integration: scans HubSpot users and access data to support compliance-related requirements, centralizing CRM data into the compliance program. • New self-service domain and SSO management: customers can claim and verify domain ownership, enable single sign-on, and configure login restrictions entirely within the platform without requiring vendor assistance. • Refreshed sidebar navigation: users can now switch between modules even when the sidebar is collapsed, with a cleaner and more consistent layout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/blog/announcing-ai-evidence-validation https://secureframe.com/blog/announcing-ai-evidence-validation Thu, 01 May 2025 00:00:00 GMT Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20x support, Email Log, and new Vercel/Supabase integrations. • Adds AI Evidence Validation that analyzes uploaded evidence files and metadata in real time, checking document relevance to the control under test and whether timestamps fall within the required testing window. • Supports the FedRAMP 20x KSI framework out of the box, with Phase One pilot key security indicators pre-mapped to controls and tests for FedRAMP Low KSI requirements — part of the FedRAMP 20x pilot alongside Coalfire. • New OneSchema-powered device data upload experience provides instant template validation feedback and highlights file issues before submission, with backend performance improvements for faster, more reliable uploads. • New centralized Email Log gives admins visibility into all outbound Secureframe communications (onboarding invites, task notifications, role changes) with searchable, filterable delivery status and open history for messages sent on or after March 17, 2025. • Revamped User Access Review Access Table built on Castle components with improved navigation, filtering, and search capabilities. • Extends Intune and Entra ID integrations to GCC High environments, supporting FedRAMP and CMMC 2.0 compliance with deeper identity and device management automation in Microsoft's government cloud. • Adds integrations for Vercel and Supabase, automatically scanning projects as cloud resources and surfacing evidence for relevant compliance tests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Thu, 01 May 2025 00:00:00 GMT Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20x support, Vercel/Supabase integrations, and email logs. • `AI Evidence Validation` analyzes uploaded files in real time to check control correctness and timestamp validity • FedRAMP `20x KSI framework` support with pre-built controls and tests for FedRAMP Low KSI requirements • New `OneSchema`-powered device upload experience with smart template validation for admins • Centralized searchable `Email Log` for outbound communications sent on or after March 17, 2025 • Revamped `Access Table` in User Access Review (UAR) with new filtering and search capabilities • `GCC High` environment support for `Intune` and `Entra ID` integrations • New integrations with `Vercel` and `Supabase` for scanning cloud resources and surfacing compliance evidence Breaking changes: • The 'SSO' column has been removed from the Access table • The 'Privileged' column has been temporarily removed from the Access table Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Tue, 01 Apr 2025 00:00:00 GMT Secureframe April 2025 adds CMMC 3, GovRAMP, Azure Gov Cloud sync, GCC High login, and vendor table improvements. • Adds support for CMMC Level 3 compliance framework with 24 additional requirements to complete the CMMC 2.0 portfolio • Adds full support for GovRAMP Low and Moderate frameworks (formerly StateRAMP) built on NIST 800-53 • Enables sync of resources from Azure Government Cloud environments alongside existing AWS GovCloud support • Enables login via Microsoft GCC High credentials for customers in Microsoft 365 Government environments • Updates the Vendor Module table view to display in-progress/upcoming reviews and current assignees with customizable columns Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://support.secureframe.com/hc/en-us/articles/39509088005907-Dashboard-Charts-Action-Items-and-Frameworks https://support.secureframe.com/hc/en-us/articles/39509088005907-Dashboard-Charts-Action-Items-and-Frameworks Sat, 01 Mar 2025 00:00:00 GMT Secureframe March 2025 adds an Audit Module, Zendesk integration, CMMC personnel fields, and new auth policies. • Introduces a new Audit Module designed to streamline the end-to-end audit process for customers and auditors. • Refreshes the Dashboard with an updated design and a new Action Items widget surfacing expiring evidence, upcoming reviews, and task due dates. • Adds bi-directional Zendesk integration for task syncing and ticket import, covering incidents, nonconformities, vulnerabilities, system changes, and user access mapped to compliance tests. • Launches a new Help Flyout replacing the old help menu, with direct access to Secureframe Academy, the Get Started page, and Customer Success. • Adds two new CMMC-focused columns to the Personnel Table to support Access Control and Account Management requirements. • Supports importing .doc and PDF files directly into the Security Questionnaires module for vendor reviews. • Introduces new authentication and password policies to meet compliance standards including CMMC. • Updates the TISAX framework and Statement of Applicability (SOA) export to align with the latest TISAX assessment requirements. • Adds two new columns to the Policy Table. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Sat, 01 Feb 2025 00:00:00 GMT Secureframe February 2025 adds CMMC 2.0 L1/L2, DORA Tech Standards, Teams integration, Trust Center CAPTCHA, Agent signing, manual personnel add. • Adds CMMC Level 1 and Level 2 frameworks with finalized DoD requirements, controls, and tests • Expands DORA framework to include Technical Standards requirements and control/test mappings • Adds Microsoft Teams integration for creating, posting replies, and closing out compliance tasks • Adds CAPTCHA validation to resource requests in the Secureframe Trust Center • Implements Windows build signing for all new Secureframe Agent connections and builds • Adds ability to manually add single personnel via a new modal without CSV upload Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Sun, 01 Dec 2024 00:00:00 GMT Physical security tests now accept direct evidence uploads; refreshes Frameworks page progress tracking. • Upgrades physical security tests to upload-based verification for direct evidence submission • Adds 'Last Upload At' column and color-coded tags to identify stale physical security test evidence • Reinstates framework overlap progress bar on the refreshed Frameworks page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Tue, 01 Oct 2024 00:00:00 GMT Secureframe adds Custom Automated Tests (CATs) against cloud integrations and supports CMMC Level 1 as separate framework. • Create Custom Automated Tests (CATs) for AWS, Azure, GCP, and DigitalOcean to automate security and compliance checks • Split CMMC offering into separate frameworks for CMMC 2.0 Level 1 and CMMC 2.0 Level 2 • Add SecurityScorecard widget to display company rating and details • Enable bulk upload of documents for vendor risk assessments and portal • Allow bulk assignment of categories and departments to vendors • Allow viewing excluded child connections for AWS, Azure, and GCP integrations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Sun, 01 Sep 2024 00:00:00 GMT New Vendor Portal, bi-directional Linear syncing, faster framework provisioning, and enhanced auditor permissions in Secureframe. • Adds the new Vendor Portal for sending security questionnaires to vendors and tracking responses. • Enables bi-directional task syncing between Linear and Secureframe for compliance tracking. • Reduces integration sync times by allowing individual test refreshes that sync only specific resources. • Increases framework provisioning speed by up to 5x with background execution. • Allows customization of document-specific rejection reasons and generic messages in the Trust Center. • Expands Auditor role permissions to include view-only access to tests, controls, policies, and asset inventories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Thu, 01 Aug 2024 00:00:00 GMT Secureframe August 2024 adds TISAX framework support, manual control overrides, and Trust Center UI customizations. • Adds `TISAX Framework` as a supported compliance framework • Allows manual setting of the health status for controls via `Control Overrides` • Upgrades the Generative Model for Security Questionnaires to handle over 1,000 questions with improved speed • Enables customization of the Trust Center logo URL and description in the 'App bar' section of the site designer • Simplifies updating and deleting custom domains and secureframetrust.com subdomains in Trust Center settings • Adds a `review status` column to the main vendors page in Third-Party Risk Management • Adds a new response field for documenting remediation plans in TPRM review findings • Adds a `Documents` column to the main vendors page in TPRM, toggleable via column selector • Enables bulk editing of schedules and templates in TPRM from a single modal • Allows direct editing of the 'Last reviewed at' date for vendors in TPRM who have not completed a review • Automatically completes parent reviews in TPRM when all child reviews are completed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Mon, 01 Jul 2024 00:00:00 GMT Secureframe July 2024 adds TX-RAMP support, ClickUp integration, GitHub public repo opt-out, and Trust Center bulk-import/subprocessor management. • Adds `TX-RAMP` framework support with coverage for both levels to enable Texas state agency compliance workflows • Integrates ClickUp as a task destination for automated compliance testing and sync of access changes, vulnerabilities, nonconformities, incidents, and system changes based on SLAs • Allows GitHub integration to opt out of syncing public repositories to exclude them from audit scope and check execution • Enables bulk-import of subprocessors directly from the vendor list within the third-party risk management experience • Adds grid view option for Trust Center compliance, resources, and sub-processors sections with a 'View All' link for detailed searchable content • Provides Zapier integration to automate Trust Center document request management and notifications via custom rules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Thu, 01 Dec 2022 00:00:00 GMT Secureframe adds Security Awareness Training modules to its in-platform training catalog. • Adds Security Awareness Training content to Secureframe's existing HIPAA, GDPR, CCPA, PCI, and Secure Coding training library Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe https://secureframe.com/product-updates https://secureframe.com/product-updates Sat, 01 Oct 2022 00:00:00 GMT Secureframe October 2022 adds Comments tab for tests and custom tags for Knowledge Base records • Adds a 'Comments' tab on the Tests page to collaborate with other users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/secureframe