PProtectSMB GRC

Change log

Everything we have added and improved, newest first. The platform is currently on v1.63.

v1.63current2026-06-23
  • AddedThe website now plays the guided demo as a half-minute clip, captioned step by step so it makes sense with the sound off and on a phone — with a step list you can jump around with.
v1.622026-06-23
  • AddedPlatform console → Feedback: reply to whoever sent it without leaving the console. They get your reply by email with their original message quoted underneath, and every reply is kept on the entry.
  • ChangedAssessment answers are now read from the new framework data model. Everything looks and behaves exactly as before — the original copy is still kept and the switch can be turned back at any time.
v1.612026-06-23
  • AddedYour assessment answers are now kept in the new framework data model as well as the original one, for every framework — curated, imported or uploaded.
  • AddedPlatform console → Framework data model: see how much each store holds, copy everything across, check the two match answer for answer, and switch the whole app between them instantly.
  • AddedOnce you are happy, the original copy can be removed from the same panel — only after a full match, a typed confirmation and an automatic backup.
  • AddedThe user guide now covers the guided demo, the feedback button, importing a risk framework, the DISP register and the register exports — with fresh screenshots of each.
  • AddedPlatform console → Feedback: any entry can now be deleted outright, with a confirmation first and the removal recorded in the audit log.
  • FixedHardened how we connect to a SIEM collector and how your feedback text is carried into our notification email, following a security review.
  • FixedDeleting a workspace now removes its answers from the new model too, and the workspace export includes them.
  • FixedCopying your own network into a new one works again (it was failing with a method error).
v1.602026-06-23
  • ChangedCode review follow-up: the long cloud answer and detail validation, the Essentials-to-Essential-Eight transition logic, the cloud gap report builder and the AI provider error messages were split into smaller focused pieces. No behaviour, scoring or wording changed.
  • ChangedTest-account passwords now come from environment settings rather than being written into the test files, and the test suites use SHA-256 instead of MD5 for file comparison.
  • FixedThe OT isolation readiness list and OT gap report showed the retired wording "Not implemented" instead of "Not effective" for an unmet action.
v1.592026-06-23
  • AddedA Feedback button sits beside Help: pick whether it is an idea, a problem, a question or praise, add a summary, the detail and how to reach you, and it is emailed to the admin address and logged with a reference.
  • AddedPlatform console → Feedback: every submission with its workspace, contact details, summary and full detail, filterable by status with notes as you work through them.
  • AddedExport the whole risk register as an Excel workbook (register plus a summary sheet) or a Word document.
  • AddedAny uncovered DISP requirement can be turned into a risk and a remediation task in one click — scored at the middle of your matrix with the Defence treatment as the plan and a task due in 30 days, ready for you to adjust.
v1.582026-06-23
  • AddedTry Demo now also sits on the ASD Essentials pane, so the guided walkthrough can be started without going back to the dashboard.
  • AddedImport an external risk framework as JSON: choose whether to bring in the risks, the risks with their treatment plans, or treatment plans only for risks already on your register. Scores are mapped onto your own matrix, a preview shows what will change, and a template file is one click away.
  • AddedImported treatment plans — the strategy and each action with its owner, due date and status — now show on the risk in the register.
  • AddedDISP Risk Register: a Defence-facing view of the twelve DISP requirements across governance, personnel, physical and information security, filled in from your own risks with a coverage figure and the gaps marked. It is a view only — nothing is added to your register.
  • AddedExport the completed DISP Risk Register as an Excel workbook (register plus a coverage sheet) or a Word document.
v1.572026-06-22
  • AddedGuided demo mode: a "Try Demo" button on the dashboard and on the first-time framework screen walks you through a complete compliance lifecycle on sample data for Acme Manufacturing Pty Ltd — a scored action, its evidence, the control gap, the risk, the remediation task and the Q4 report they all land in.
  • AddedThe demo asks which framework to base itself on and offers every framework, with the ones outside your plan clearly badged as a preview.
  • AddedSix-step overlay with a progress bar, a one-line explanation per step and a spotlight on the matching part of the screen, ending with "Exit demo and start your own assessment" which clears the sample data.
  • AddedPlatform console → Guided demo: the anchor action and wording for each framework can be changed, and a newly added framework can be given its own demo without a release.
v1.562026-06-22
  • FixedEmail failures reached the console with no usable detail — the real reason was being replaced by a generic gateway error. The console now shows a short, plain reason straight away.
  • AddedEmail → Failures keeps the last 200 email failures. Click the reference on any row to see the mail server's exact reply, the host, port, TLS and mailbox we tried, the recipient and a technical trace.
  • Changed"Not configured" now names exactly which mailbox details are missing, and every failure is written to the server log with its reference for support.
v1.552026-06-22
  • FixedAn MSP workspace no longer drops back to Enterprise. Startup housekeeping and paid add-on upgrades were overwriting the licence tier of MSP and reseller accounts, so the MSP plan appeared to revert on its own.
  • FixedSetting a workspace to the MSP plan from the licence dropdown now marks it as an MSP account (discount, channel and network packs included), and moving it off MSP puts it back to a standard account.
v1.542026-06-22
  • ChangedEvery screenshot in the user guide and on the website has been retaken from the current build, so what you see on the site matches what you see when you sign in.
  • FixedAn assessor link created while you were working in one of your other networks can now be seen and switched off from Share with Assessor. Previously it was created and worked, but never appeared in the list, so it could not be revoked.
  • FixedA new network now appears on the ribbon the moment you add it, including beyond the sixth slot on an MSP account — no refresh needed.
  • FixedThe top menu bar no longer overlaps the workspace name and plan badge on narrower screens.
  • ChangedThe user guide now covers minimising panels, the per-panel help, and how many networks each plan and MSP pack allows.
v1.532026-06-22
  • FixedAn MSP console now shows every client network slot the licence holds — the ten included plus any packs bought — and lets you add a client up to that number. It was stuck at six with no way to add more, no matter how many packs were on the account.
  • ChangedWhen an MSP runs out of slots the message now tells them to buy another pack of five, rather than suggesting an upgrade that does not apply to them.
  • FixedAn MSP workspace whose licence tier had been left behind now shows MSP as its plan, matching how the account is actually billed.
v1.522026-06-21
  • ChangedAn MSP licence now includes ten client network slots as standard, up from six. Every existing MSP account picks up the extra four immediately, with nothing to buy and no change to what they pay.
  • ChangedFurther networks are unchanged: packs of five at a flat AUD 5,000 a year per pack, which no discount touches.
v1.512026-06-21
  • ChangedThe control matrix now draws only the rows you are looking at, and fills in the rest as you scroll. On the full 1,192-control Information Security Manual, searching, clearing a search and the applies-to filters now take about a second each, where they took up to twenty.
  • AddedA platform administrator can email the release notes for any version to every active account, from the administration console — a preview of exactly what customers will read, a test to yourself first, a confirmation step, and a record of what was sent and when. The same version cannot go out twice.
  • ChangedOnly active accounts receive product email. Accounts that have been disabled, and invitations not yet accepted, are left out.
  • FixedThe empty matrix message now offers to clear your search and filters rather than suggesting you import frameworks you already have.
v1.502026-06-21
  • AddedEvery section on the assessment dashboard, the ASD Essentials screens and the pop-up tools can now be minimised and brought back with the chevron beside its title. What you close stays closed on your account — on any device, after signing out — until you choose Help, Reset minimised sections.
  • AddedA question mark on each section. Hover it for a one-line explanation taken from the user guide; click it and the full guidance opens in a panel beside the screen you were on, with a link through to the guide itself. Nothing you were part-way through is lost.
  • FixedThe toolbar, the framework title bar and the matrix column headers stay pinned while you scroll again. They had quietly stopped sticking, which made working down a long catalogue harder than it needed to be.
  • ChangedThe dashboard is markedly quicker with a full catalogue open: minimising a section, opening the guidance and resetting your layout now take about a second, where some took the better part of half a minute.
v1.492026-06-21
  • ChangedBuying a single Enterprise element on the Professional plan is now $4,000 a year for each element, a flat price rather than a share of the Enterprise fee. Take as few or as many as you need.
  • ChangedIf you end up wanting every element, Enterprise at $29,000 costs less than the elements bought one by one — so that is what we charge, on the quote, the running total and the invoice alike.
v1.482026-06-20
  • AddedManaged service providers can be given client network packs from the administration console — five networks per pack, added or removed with the number typed in and the networks and price shown as you type. There is a panel listing every MSP with their networks in use, packs held and annual value, and the same control on each MSP's own record.
  • FixedA managed service provider registered under channel partners now becomes an MSP account in its own right, so it appears where network packs are managed instead of being invisible. Accounts marked as MSP by their licence tier or segment alone are recognised too, and tidied up on sight.
  • ChangedRemoving packs is refused when it would leave an MSP with fewer network slots than the clients already live on the account, and the message says how many are in use.
v1.472026-06-20
  • AddedAll outbound email — board digests, assessor invitations, invoices and billing notices, renewal reminders, security alerts and account notices — now goes out through one managed sending service, with the sender shown as ProtectSMB GRC and replies going to our support address.
  • AddedYour administrator address is copied on outbound email, so there is a record of what the platform sent on your behalf. Password resets and sign-in approval links are deliberately left out: those are single-use keys to somebody's account and belong only in their inbox.
  • ChangedUntil a workspace's sending domain is verified, messages are written to the log rather than delivered, so nothing is sent from an unverified address.
v1.462026-06-19
  • AddedASD Essentials has its own section on the home page: the three chapters with what each one asks of you, and a walkthrough booking that arrives at the calendar already set to ASD Essentials.
  • AddedThe user guide now shows the screens it describes — the operational technology and cloud answering screens appear as screenshots in their sections, on the page and in the downloaded Word guide.
  • ChangedThe cloud answering rule is now enforced by the API as well as the screen: an action split across service models has to be answered for every model in use, so an import or a script cannot leave half an answer behind. A provider action with no assurance evidence is still accepted and still scores not effective.
v1.452026-06-19
  • AddedA new page at /compare answering the question we get asked most: Essential Eight or ASD Essentials? What each one covers, how each is scored, what the Eight does not reach, who usually asks for which, and two short lists to tell you where to start. Linked from the website menu, the footer and the pricing section.
  • ChangedASD Essentials is now included with every plan at no extra charge — the Enterprise IT, operational technology and cloud chapters are no longer an Enterprise-only module, and the pricing table says so on every tier.
  • AddedA platform administrator can switch ASD Essentials off or on for an individual workspace from the licence panel. It is on from the start, and a workspace where it is off sees the three chapters greyed in the menu rather than failing when opened.
v1.442026-06-19
  • AddedThe ASD Essentials assessment list now reads the way ASD writes it: every action sits under the principle it delivers, every principle under its category — govern, identify, protect, detect, respond, recover — with ASD's own statement of the principle printed above its actions.
  • AddedAn answering screen for operational technology. Scope the environment, work domain by domain, and score each action with the indicator rubric beside it — plus the detail OT actually turns on: your designated vital OT, a compensating controls register for what cannot be patched, break-glass confirmed and tested, backup coverage across firmware, configuration, licences, calibration, project files and logic, the degraded-state physical access test, and which vital OT each isolation step covers.
  • AddedAn answering screen for cloud, answered by who is responsible for what. What you own is scored outright; what the provider supplies and you operate has to be enabled, configured securely and used consistently; what the provider performs is recorded as assurance evidence with its date, whether its scope covers the services, features, regions and support tiers you actually use, and any gaps — or plainly as no evidence held.
  • AddedOn a mixed software- and platform-as-a-service estate both models are answered, and where they carry the same responsibility the weaker answer is the one that scores. Provider assurance gaps are now reported per service model, and legacy authentication still in use — with its protocols, compensating controls and decommissioning date — shows in the cloud detail report.
  • ChangedThe website, the user guide and the trust page have caught up: new guide sections on the three chapters, the Indicators of Good Practice, assessing OT, assessing cloud and importing ASD's catalogue, and a trust page section naming exactly where the framework content comes from.
v1.432026-06-19
  • AddedEvery ASD Essentials action now carries a collapsible Indicators of Good Practice panel: ASD's own description of what not effective, partially effective and effective look like, as three tabs on a desktop and a stacked accordion on a phone.
  • AddedThe tab matching your current answer is marked as scored and is the one shown when the panel opens, so you can check your call against ASD's wording rather than your own impression of it. The panel is read-only — your reasoning goes in the notes.
v1.422026-06-19
  • AddedASD Essentials for Enterprise IT is now imported from ASD's official OSCAL catalogue rather than transcribed: 28 principles with their statements, 58 actions, their domain assignments and 529 Indicators of Good Practice, all exactly as ASD publishes them.
  • AddedA platform administrator can upload a new catalogue when ASD publishes one and see precisely what it contained — principles, actions, domains, indicator statements and any record that could not be read, with the reason — alongside the history of every previous import.
  • ChangedImports match on the action identifier, so the wording, domains and indicators update around your work: no assessment answer, note, evidence file or score is ever deleted or changed by an import, and a catalogue you upload is not overwritten by the one shipped with the platform.
v1.412026-06-18
  • ChangedASD Essentials is now scored in ASD's own levels — not effective, partially effective, effective — with not applicable kept as a separate answer. Existing answers were converted across, scores included.
  • AddedAn administrator chooses how the workspace sees those scores: ASD's labels, a number, or a percentage. The answer stored is always ASD's wording; only the display changes, on screen and in every report.
v1.402026-06-18
  • AddedThe three ASD Essentials chapters now work as one programme. A principle shared between chapters offers the answer you already gave, with its source named, instead of asking you the same question twice.
  • AddedRisks and remediation tasks are linked across chapters, and a single action plan gathers every chapter's gaps with owners and target dates — exportable as Word, PDF or a spreadsheet.
v1.392026-06-18
  • AddedA transition wizard for anyone coming from the Essential Eight: it carries each answer across to the ASD Essentials action it satisfies, one confirmation at a time, keeps a link back to the source answer and leaves anything you have already answered alone.
  • ChangedThe Government menu is now called ASD Essentials.
v1.382026-06-18
  • AddedA posture dashboard across all three ASD Essentials chapters: where each one stands, which domains are holding you back, and what is due next.
  • AddedTarget dates can be set on any ASD Essentials action, so the plan has dates in it rather than intentions.
v1.372026-06-18
  • AddedA framework home for ASD Essentials: the three chapters with their readiness, what is assessed and what is not, and a way straight into the chapter you are working on.
v1.362026-06-18
  • AddedCloud reporting views: responsibility completion, provider assurance coverage gaps, non-person identities, vital cloud services and the shared responsibility register, with the cloud gap report in Word and PDF.
v1.352026-06-18
  • AddedCloud-specific assessment logic: actions answered by responsibility marker, the three-part test for a supplied capability, and provider assurance judged on whether its scope covers what you actually use.
v1.342026-06-18
  • AddedThe ASD Essentials cloud chapter seeded: its domains, principles, actions and responsibility markers for software- and platform-as-a-service.
v1.332026-06-18
  • AddedOT reporting: isolation readiness, the compensating controls register with its review dates, vital OT coverage and the OT gap report in Word and PDF.
v1.322026-06-18
  • AddedOT-specific assessment logic, including the supporting detail an OT action needs before it can honestly be called effective: designated vital OT, compensating controls, break-glass testing, backup coverage by file type and degraded-state access.
v1.312026-06-18
  • AddedThe ASD Essentials operational technology chapter seeded: its domains, principles and actions, with user devices recorded as non-mappable and explained rather than silently dropped.
v1.302026-06-18
  • AddedThe ASD Essentials Enterprise IT assessment: scope the environment, work through the actions domain by domain with notes and evidence, and see your readiness by priority phase.
  • AddedA crosswalk from the Essential Eight to ASD Essentials, so anyone already assessing the Eight can see what it covers and what it does not.
v1.292026-06-18
  • AddedASD Essentials for Enterprise IT seeded into the framework model — its domains with their priority phases, its principles and every action, with the ATT&CK techniques each one is there to frustrate.
v1.282026-06-17
  • AddedThe assessment engine now has a generic framework data model underneath it: a framework has chapters, a chapter has domains with a capability or technical type and a priority phase, and a framework has principles whose actions are mapped to those domains, with MITRE ATT&CK techniques against each action.
  • AddedThe Essential Eight is seeded into that model on every deployment — nine domains, nine principles and every mapped requirement as an action, each with the techniques it is there to frustrate — so a multi-chapter standard like ASD Essentials can be added without a line of special-case code.
  • AddedExisting Essential Eight answers have been migrated into the new response and maturity tables, scores included, and a reconciliation report proves nothing was lost or changed.
  • ChangedNothing has been cut over yet: the matrix, the maturity heatmap, the roadmap and every report still read from the existing engine and behave exactly as they did.
v1.272026-06-17
  • ChangedThe network ribbon now gathers every slot on the same network into one box wherever it happens to sit, and prints that network's name once, centred underneath the group, instead of repeating it on every button.
  • AddedSearch the ribbon by framework or network name, narrow it to a single network with the dropdown beside it, and scroll the row with arrows that appear only when it runs off the screen.
v1.262026-06-17
  • AddedDeal registration. A reseller or MSP registers a prospect's email domain from their own console and we hold it for them for ninety days. When somebody from that domain signs up, their workspace is attributed to that partner automatically — no claim to make and nothing to remember.
  • AddedA domain can only be held by one partner at a time, and a domain that already has a workspace cannot be registered at all. Registrations run Registered, then Converted once a workspace appears, or Expired after ninety days.
  • AddedEvery registration across the channel is listed on the admin console, where it can be rejected, reinstated or held open longer when a deal is taking its time.
  • AddedPartner statements. Any partner can download a statement of their book as a PDF or a Word document: their account and agreed discount, every client with tier, channel, subscription status, annual fee, discount, net payable and renewal date, the totals, what is renewing inside ninety days, and for an MSP their slot entitlement and pack purchase history. The platform owner can pull the same statement for any partner, with invoice references and payment status included.
  • ChangedSetting a workspace to an MSP or reseller account now creates its channel partner record automatically, so the partner features are ready to use straight away.
  • ChangedThe user guide and the website have caught up: a new guide section for resellers and MSPs covering their own console, deal registration and statements, the MSP section rewritten for the client-invited access flow, and a new 'For resellers and MSPs' block on the public site explaining the model, the slot packs and how to partner with us.
v1.252026-06-17
  • AddedReseller accounts. A reseller buys licences at an agreed discount and on-sells them, with no access to any client workspace at all. Their own console at /reseller lists what they have sold — client name, plan, subscription status and renewal date only — alongside their current discount rate, the number of licences sold, what is renewing inside ninety days, and a button to reach us.
  • AddedChannel partners on the admin console, split into MSP and Reseller tabs. Each partner opens into a commercial panel: the annual net revenue attributed to them, how many live workspaces they hold, their own subscription status and renewal date, every workspace sold through them, and — for an MSP — slot entitlement, slots in use and the full slot pack purchase history.
  • AddedDiscount rates are now managed properly. A channel partner's rate can be changed between 0% and 50%, from a date, and the reason is required and kept. Every change is held as history on the partner record with the administrator who made it, and the partner's own account picks up the new rate immediately.
  • AddedAn invoice billing register for every Tier 3 and above workspace: name, channel, tier, annual fee, discount applied, net payable, invoice reference, due date, payment status and days until renewal, with totals pending, paid and overdue. Invoices are raised outside the platform — this records the reference, not a document.
  • AddedPer workspace an administrator can record an invoice (reference, amount, due date), mark it paid with the date it landed and a note, flag it overdue with an internal note, and renew the subscription by twelve months on payment confirmation. Every one of those actions is written to the audit trail with the administrator's identity and the time.
  • AddedRenewals are flagged at 30, 60 and 90 days on the register, on top of the existing reminder emails to the client contact and our own mailbox at 60 and 30 days.
  • AddedSlot pack purchases are recorded from the partner's panel: choose the number of packs, the amount is priced automatically at $5,000 flat each with no discount, add the payment reference and the date, and the slots are live the moment it is saved.
v1.242026-06-17
  • AddedMSP access is now invited by the client, not claimed by the provider. A client administrator enters their provider's email domain under Organisation Profile → MSP access, chooses full access or read-only, optionally sets an expiry date, and sends the invitation.
  • AddedTwo-step approval. The invitation does nothing until a second email, sent to every administrator of the client workspace, is opened and approved. Until then it reads 'Pending your approval'. One mistaken or unauthorised request can therefore never grant anybody access.
  • AddedOnce the client approves, the provider is notified and the invitation appears in their console with the client's name, the access level and the expiry date, to accept or decline. Accepting consumes one network slot, activates the network and tells the client; declining removes it, tells the client, and costs no slot.
  • AddedMSP team members and per-client permissions. An MSP administrator invites colleagues — only addresses on the provider's own registered domain — and sets each person's permission on each client: full access, read-only, or no access, which is what everybody starts with. A granted permission is itself sent to the client's administrators to approve before it works.
  • AddedRead-only really is read-only: inside a client workspace a read-only provider or team member can see everything and change nothing, enforced on the server for every request.
  • ChangedRevocation by either side now ends live sessions in that workspace immediately, returns the slot to the provider, emails both parties and writes to both audit trails. An expiry date is enforced overnight and closes the arrangement the same way.
v1.232026-06-16
  • AddedMSP accounts. A managed service provider now gets its own account type and console at /msp, where it manages every client network it has been invited into, alongside running its own compliance in its own workspace. The capability sits behind a FEATURE_MSP_TIER flag so a deployment that does not sell through MSPs never sees it.
  • AddedThe MSP licence is $30,000 a year RRP with a default 20% discount, so $24,000 payable, and the discount is held against the account for the platform admin to adjust. It is invoiced, never self-serve — there is no card checkout for an MSP account and payment is recorded by hand.
  • AddedSix client network slots are included. More come in packs of five at $5,000 flat per pack per year, which no discount touches. The platform admin records a pack against the account as its own line item and the slots are live the moment it is saved.
  • AddedThe entitlement is enforced, not just displayed. An MSP cannot link more client networks than it has slots for, the dashboard shows slots purchased, in use and remaining, and at one slot left it says so plainly with a contact us prompt to buy another pack.
  • AddedThe client list shows each client's organisation, the MSP channel flag, their Essential Eight maturity level, when they were last assessed, what is still outstanding in gaps and open tasks, whether the MSP is operating on their behalf or assisting while they self-manage, the invitation status, and a button to enter the network.
  • AddedEntering a client network swaps the whole interface into that client's context with a persistent banner reading 'Managing [client] — [MSP] via ProtectSMB GRC' and a single click back to the dashboard. While inside, no other client's data is reachable at all, and every action is written to the audit trail against both the MSP user and the client organisation.
  • AddedPortfolio reporting in Word and PDF: a compliance summary across every managed client, a one-page health report for any single client, and an activity report of every action by the MSP's people across all clients for a date range.
  • ChangedA client stays in control. Their administrator sees who manages them, has to accept an invitation before anyone enters, and can revoke access at any time — which hands the slot straight back to the MSP.
v1.222026-06-16
  • AddedEvery workspace now records how its licence was sold. Direct means the client bought straight from us, Reseller means a partner sold it and the client runs it themselves, and MSP means a partner sold it and manages it on the client's behalf. The channel shows as a badge on the workspace, is set when the workspace is created, and can be changed by a platform administrator at any time.
  • AddedA reseller and MSP register. Register each partner once — organisation, contact name, email and phone, ABN, the date the relationship commenced and any notes — and the platform issues them an account ID. Attach a workspace to a partner and their details are carried onto it, so changing a contact is done once rather than on every client record. A partner cannot be removed while workspaces still point at them.
  • AddedA commercial record on every workspace: market segment (SMB, Government, MSP or Reseller), annual licence fee, discount rate, net payable, subscription start and renewal dates, billing method, invoice reference, payment status, the date payment was received and internal notes. An agreed net amount beats the list price, so the revenue forecast reflects what the client actually pays.
  • AddedA new Tier 5 — MSP licence with its own list price, carrying everything Enterprise does because an MSP runs other people's compliance.
  • ChangedTiers 1 and 2 keep self-serve card payment. Tier 3 and above are invoiced and settled by transfer, and card checkout is refused for them with an explanation rather than quietly offered.
  • ChangedThe licence register CSV now carries the channel, the partner and their contact details, the agreed fee, discount, net payable, invoice reference and payment status alongside everything it held before.
  • ChangedEvery change to a channel, a partner or a billing record is written to the audit log with the administrator's name, what changed from and to, and the time it happened.
v1.212026-06-16
  • AddedRisk beside posture. The board snapshot now carries your risk register: how many risks are live, how many sit above the appetite your board agreed, how many are waiting on a sign-off, how many are still unscored and how many have nobody's name against them — with the residual heatmap and your five worst risks after treatment, right next to the posture numbers.
  • AddedPerformance monitoring for administrators. Every request is timed and recorded, every error and unhandled exception is captured with its stack trace, and both are kept for ninety days and then expire themselves. Nothing is slowed down by being measured: the writing happens after the response has gone back.
  • AddedA new Performance tab in the administration console, also reachable directly at /admin/performance. It reports whether the system is healthy, degraded or critical and why, thirty-day uptime, request volumes over a day, a week and a month, the error rate, average, median and 95th percentile response times, the ten slowest endpoints, a thirty-day trend, errors by type with a searchable log, and who is actually using the platform — active people, busiest workspaces, most used endpoints and new sign-ups.
  • AddedWorkspace administrators get their own view at /admin/organisation/performance: everyone in the workspace with their last sign-in and whether multi-factor is on, how complete each assessment is, which parts of the app they use most, and the reports they have generated.
  • AddedAlerts. Every five minutes the platform checks the last five minutes: if more than 5% of requests are failing, if the average response time passes two seconds, or if the database stops answering, the owner is emailed. Any critical error is emailed the moment it happens. A thirty-minute cooldown keeps one bad window from sending twenty emails, and every alert is written to the audit log whether or not the email got through.
  • ChangedThe thresholds, the cooldown and how much traffic is recorded are all administrator options, so a busy instance can sample rather than keep everything — failures and slow requests are always kept regardless.
  • ChangedThe health check at /api/health now reports database connectivity, its round-trip time, the application version and a timestamp, for uptime monitoring. It still needs no sign-in and still answers during start-up.
v1.202026-06-16
  • AddedCommon risks. The risk register now offers the risks nearly every small business carries — phishing and invoice fraud, ransomware, accounts without multi-factor, unpatched systems, untested backups, a supplier breach, a departed staff member who still has access, and a dozen more. Tick the ones that apply and they go straight on the register.
  • AddedThey arrive deliberately unscored and flagged as such, because the likelihood and impact are your judgement, not ours. Each one comes with plain-English wording you can edit, and where the Essential Eight obviously treats it the ISM controls behind that strategy are linked for you. Anything already on your register is skipped, so you cannot double up.
  • AddedChoose your own risk matrix. Administrators can now score on a 3x3, a 4x4, a 5x5 or a grid of their own size, with their own wording for every likelihood and impact level. Ratings and the heatmap adjust to the grid you choose.
  • ChangedChange the matrix and your existing risks are carried across proportionally rather than thrown away, your appetite threshold moves with it, and every risk records the rescale in its own history.
  • ChangedDeleting a risk now asks you to confirm first, and unscored risks can be scored straight from the register without opening a form.
v1.192026-06-16
  • AddedThe Essential Eight grid is now in the board snapshot on screen, not only in the PDF. Open Report → Board Snapshot on the Essential Eight and you get the same strategy-by-level grid you see in the maturity view, with the level you could claim and the supporting logging and response controls underneath.
  • AddedTarget dates on the level roadmap. Every outstanding control now takes a date, so the next maturity level has a deadline rather than just a list. Items past their date turn red and are counted as overdue in the header, anything due within a fortnight turns amber, and the nearest deadlines sort to the top of each strategy.
  • AddedSet one deadline for the level itself — 'ML1 by' — and every control without a date of its own takes it, leaving any date you set by hand untouched. Clear the level deadline and the dates it handed out go with it.
  • AddedA control's date follows it into the work: raise a remediation task from a roadmap row and the task is created with that due date, and the checklist CSV now carries the level deadline and a target date column.
v1.182026-06-16
  • AddedLevel roadmap. A second tab in the Essential Eight maturity view takes the lowest level you have not achieved and lists every control standing between you and it, grouped by strategy with a count each, and says why each one is blocking — not assessed, ineffective, partly in place, or one step short.
  • AddedTick a control off and it leaves the list, the counter drops and the heatmap moves with it. One click raises a remediation task against that control, assigned to whoever you name, so the checklist feeds your work queue. The whole list downloads as a CSV, and the board snapshot now carries a 'what the next level costs' summary.
  • SecuritySecurity audit hardening. The SIEM forwarding endpoint is now checked against the address it actually resolves to, so it can only be a collector on the public internet — an internal or cloud-metadata address is refused, redirects are no longer followed, and the test button gives a generic failure rather than reporting what did or did not answer.
  • SecurityThe founding owner of a new workspace — whether created by signing up or by Google sign-in — is now required to use two-factor, the same as any other administrator.
  • SecurityWhen you first switch on approval for sign-ins from new networks, each account is trusted on the networks it has genuinely used in the last 30 days rather than on whoever signs in first. A new setting beside it lets you choose that older behaviour, or require approval for every network including the first.
  • Securitylocalhost is no longer a trusted browser origin on deployed instances, and an expired trial can no longer be used to change a workspace's SIEM or security settings.
  • AddedEssential Eight by maturity level. Report → Essential Eight Maturity shows the 123 ISM controls ASD itself maps to the Eight, each tagged with its strategy and the levels it applies at — so you assess real ISM controls rather than eight vague headings.
  • AddedThe heatmap reads the way the model does: one column per strategy, ML3 on top, ML2 in the middle, ML1 at the bottom. Each cell shows how many of its applicable controls are effective and is coloured on that. A control counts at every level it applies at, so ML3 includes the work you did for ML1.
  • AddedA score for each level, with an honest achieved badge — ACSC grades a level all or nothing, so the percentage is progress towards it. The level shown at the top is the one you could actually claim, and only moves up once every level below it is complete.
  • AddedClick any cell to see and score just the controls behind that strategy at that level, and keep 'Group by maturity level' ticked to work ML1 to completion before starting ML2. Centralised logging, event log monitoring and incident response are real ML2 and ML3 requirements but not one of the eight strategies, so they sit in their own line under the grid.
  • AddedAlready assessing the ISM? Those answers carry across automatically and are marked 'from ISM'; answering directly in the Essential Eight view always wins. The same grid is printed in the board snapshot.
  • AddedKeeping the model current: platform administrators can re-pull ASD's Essential Eight catalogue from the maturity view, see exactly what ASD added, withdrew or changed, and apply it or discard it. On a sovereign site with no internet, upload ASD's OSCAL file instead. Assessments are kept by control ID, so nothing is lost — a withdrawn control simply stops counting. The product also checks monthly and emails the difference, but never applies it on its own.
v1.172026-06-16
  • AddedEvery demo and trial workspace now runs for 30 days, with the countdown at the top of the dashboard — amber in the last week, red on the last day.
  • AddedWhen the 30 days are up the workspace becomes read-only rather than locked. Everyone can still sign in, read every control, note and piece of evidence, and download every report and export. Nothing is deleted; only changes stop, and they come straight back the moment the subscription starts.
  • AddedThe platform console's workspace list has a Trial column showing days left or expired, with one-click extensions of 14 or 30 days or a date of your choosing. Extending an expired trial runs from today, and marking the workspace paid lifts the restriction immediately. Every change is audited.
  • ChangedTrial admins are emailed a week out, the day before and on the day the window closes, and the platform owner gets a daily summary of trials reaching a milestone. Existing trial workspaces were given a fresh 30 days rather than a backdated one, so nobody was caught by a rule that did not exist when they signed up.
v1.162026-06-16
  • SecurityTwo-factor is now mandatory for administrators, automatically. The moment somebody is given the admin role — by promotion, by invitation, or by your identity provider through SCIM — an authenticator is required of them, and it cannot be turned off or exempted while they hold the role.
  • SecurityIf a new administrator already had an authenticator enrolled it is cleared and their sessions are ended, so they enrol afresh at their next sign-in. You are warned before that happens, and the reasoning is simple: a new administrator should never be the weakest account in the workspace.
  • ChangedAdministrators who held the role before this rule existed are left alone until it is deliberately switched on for them, so nobody is surprised mid-session. Both consoles now read 'MFA mandatory (admin)' on those accounts, with the buttons disabled and the reason on hover.
  • ChangedThe platform console's user list now shows how and from where each account last signed in — the method, the approximate location and the IP address — underneath the time, with the last five sign-ins still a click away.
  • AddedWindows sovereign deployments can now be rehearsed before a client ever sees them: pilot-run.ps1 and PILOT-RUN.md run pre-flight, install, a full smoke test, a backup and a proven restore, then tear the machine down, printing a pass or fail verdict and a transcript.
v1.152026-06-15
  • AddedRequire two-factor of one person, not just everyone. Config → User Management now has a “Require MFA” button on each member: turn it on and that account must use an authenticator even when the workspace-wide policy is off. The row shows which of the three states applies — required for this person, required by the workspace, or exempt — and whether they have actually enrolled yet.
  • AddedRequiring it of someone who already has an authenticator clears it and signs them out everywhere, so they set it up again at their next sign-in and no existing session carries on without the factor. You are asked to confirm before that happens.
  • ChangedThe two controls can no longer contradict each other: you cannot exempt an account that two-factor is required of, or require it of an exempt account, and the message tells you which to change first. Every change is audited with who made it and what it did.
v1.142026-06-15
  • AddedSign-in approval for new networks. Turn it on under Config → Preferences → Security and any sign-in from an IP range the account has never used is refused on the spot, with an email to your workspace admins showing the address, roughly where it came from, the device and the time. Approving trusts that whole range — a /24 — so a home or office network keeps working afterwards, and requests lapse after 24 hours.
  • AddedConfig → User Management → Sign-in approvals lists what is waiting, lets you approve or deny without hunting for the email, shows every network currently trusted and lets you withdraw one. Office ranges can be put on an always-allowed list so staff there are never challenged, and the first network an account ever uses is trusted automatically so switching the policy on cannot lock anybody out.
  • AddedSign-in history: click the time in the “Last signed in” column, in your workspace or in the admin console, for that person's last five sign-ins with the device, the approximate location and the IP address. Everyone can see their own from the header.
  • AddedSovereign hosting on Windows: a complete third deployment path for clients standardised on Windows — Windows Server 2022 on an Azure VM, IIS in front of two native Windows services, MongoDB on the machine, no Docker and no Linux. Ships with a PowerShell installer, an IIS configuration, a nightly backup task and an operations script, all inside the deployment pack under /sovereign/windows.
  • ChangedThe sovereign deployment pack in the admin console now includes the Windows path, and the trust page, pricing notes and user guide list all three hosting options.
  • ChangedBlocked sign-in emails now carry one-tap Approve and Deny buttons, sized for a phone. Each link is single-use and bound to its own decision, so a mail scanner that follows a link cannot approve anything by accident.
  • ChangedEvery blocked sign-in and every approval or denial is written to the audit log and forwarded to your SIEM if you have one configured. Administrator access sessions still never count as a sign-in.
v1.132026-06-14
  • AddedBoth consoles now show when each person last signed in — Config → User Management for your own workspace, and the platform console's user list and platform administrators list. Hover over the time for the exact stamp, how they signed in (password, MFA or single sign-on) and roughly where from.
  • AddedYour own last sign-in is shown in the header next to your email address, so you can tell at a glance whether somebody else has been in your account since you were last here.
  • ChangedSign-in times are recorded on every real sign-in and nowhere else — an administrator's access session deliberately does not update them, because that is not you signing in.
v1.122026-06-14
  • SecurityAccess sessions are now completely separate from the administrator's own sign-in. Starting one clears their own access, refresh and single sign-on cookies, so nothing done during the session can fall back to their identity or quietly mint a new token for it. All that is kept is a resume marker, which cannot authenticate anything on its own — it only says which account to sign back into, and only for that one session.
  • SecurityLeaving a session now signs the administrator back in with brand new tokens, and only if the resume marker matches that session and their account is still active. Otherwise every cookie is cleared and they sign in again by hand.
  • SecurityTwo-factor authentication can no longer be set up, enabled or switched off while acting as somebody else, even in a session the user approved for changes — that was the one route by which a session could have been turned into lasting control of an account. Platform administration remains unreachable from inside a session, and every action continues to be recorded against both identities.
  • SecurityPayment confirmation is now watertight: starting a checkout grants nothing at all, and an invoice is only marked paid — and a subscription only reopened — once Stripe or PayPal confirms the money, whether that confirmation arrives by webhook or when the payer returns.
  • SecurityEvery payment operation now carries an idempotency key, so a double-click, a retry or a dropped connection cannot charge twice, create a second payable checkout, or refund the same amount again. Webhook deliveries are de-duplicated by event, and a webhook arriving without a verified signature is refused outright.
v1.112026-06-14
  • AddedPlatform administrators now have an Admin console button in the header of the normal working view, next to the theme switch, and a matching entry under Config. It only appears for accounts that actually hold the platform administrator role — everyone else sees nothing, and the console itself re-checks the role on every request regardless.
v1.102026-06-14
  • ChangedEvery “Talk to us” button on the pricing page now opens the enquiry form instead of dropping you at the contact section, with the plan you clicked already recorded and the right boxes pre-ticked — Sovereign arrives with “Sovereign / air-gapped install” selected and the heading reworded for a dedicated instance.
  • AddedLeads in the admin console now show which plan the visitor was looking at when they enquired, so you can answer with the right price in hand, and the notification email says so in its subject line.
  • ChangedThe pricing editor in the console now spells out that a tier left at 0 shows “Talk to us” on the website rather than a price — set the Enterprise figure there and it appears immediately.
v1.092026-06-14
  • AddedA public trust and security page at /trust answers what a prospect's security questionnaire usually asks, in one place: where the platform runs and where your data sits, who can reach it and how that is enforced, what the audit trail records and how to forward it to your own SIEM, backups and what happens when you leave, and every legal document. It is linked from the footer and from the pricing page.
  • AddedThe trust page deliberately makes no claim about our own assessed security posture or any certification we have not been through — when that work has been done independently, it will appear there with the date and who did it.
  • AddedSovereign instances now report their health daily. The register shows amber after two quiet days and red after seven, with a plain sentence saying what to do, and counts how many have gone quiet at a glance.
  • AddedExpiry reminders now email you rather than waiting to be noticed: 60, 30 and 7 days before a client certificate expires, again once it has passed, and whenever an instance has not reported in for a week. Each reminder is sent once and recorded in the audit trail.
  • ChangedPricing now shows the Sovereign dedicated instance from AUD $40,000 per year, and every tier says ex GST on the card so there is no doubt.
v1.082026-06-14
  • AddedSovereign client onboarding is now one command: sovereign/deploy-sovereign.sh stands up a whole dedicated instance in Australia East — resource group, logging, managed identity, Key Vault and secrets, Cosmos DB, both container images, both apps, custom domains and certificates — then runs the verification checks and prints the live URLs. It is safe to run again, and --dry-run shows you every command before anything changes.
  • AddedA Sovereign instance register in the platform console tracks every dedicated client you have deployed: client, domain, region, deployment path, version, database, certificate expiry with a countdown that turns amber at 30 days, support contact, status and notes. Instances given a register key report themselves in with their version and expiry; air-gapped ones are added by hand. The register exports to CSV.
  • AddedAudit forwarding to your own SIEM now actually works — Microsoft Sentinel, Splunk HTTP Event Collector, CEF or plain JSON — with the categories you choose: sign-ins, administrative actions, exports, assessment changes or everything. Set it up under Config → Preferences → Audit forwarding, send a test event to prove it, and see how many events have been sent and why any failed.
  • ChangedForwarding happens after each audit entry is written, in the background, so a collector outage never blocks anyone's work — the entry stays in your audit trail and the failure is reported in the interface. Your collector key is encrypted before it is stored and never sent back to the browser.
  • AddedThe pricing page now shows a fifth option: Sovereign, a dedicated instance on Australian infrastructure, with its dedicated database, your own domain, SIEM forwarding and air-gapped option spelled out. Its price is set in the console like every other tier, and reads "Talk to us" until you set one.
v1.072026-06-14
  • ChangedCloud implementation guidance is now marked coming soon. The Azure, AWS and Google Cloud buttons, the per-control cloud ticks, the cloud filter and the Get Implementation Advice button are hidden until the feature is ready, so nothing in the interface promises advice we are not yet giving.
  • AddedA deployment can switch the feature on in its own configuration when it is ready — nothing is removed, and any cloud ticks already recorded stay saved and keep appearing in your exports.
  • ChangedConfig → Preferences → AI connector now lists Cloud implementation guidance with a Coming soon marker, so you can see what is on the way without being able to turn on something unfinished. The user guide and the website no longer advertise cloud advice as available.
  • AddedThe website footer now carries the Privacy Policy, Website Terms of Use, Data Processing Addendum, Software Supply Agreement, Supply Terms & Conditions and the Sub-processor List, each on its own page with the plain-text version available to download, along with the company details: R & J Consulting Services Pty Ltd, trading as ProtectSMB, ABN 14 091 293 319 — Australian owned and operated. The documents are published as drafts pending legal review, and say so on the page.
  • AddedA Sub-processor List is now published as clause 5 of the Data Processing Addendum promises: every provider we rely on for hosting, email, payments and optional AI advice, what it does, where it is actually hosted and which data it touches — including the note that self-hosted and sovereign installations use none of them.
  • AddedA short cookie notice now appears on first visit: essential cookies only, no advertising or third-party tracking, with a link to the Privacy Policy and an Understood button that remembers your choice.
  • AddedSovereign single-tenant deployment artefacts now ship in the repository under /sovereign: a fully commented environment template, a Docker Compose stack with Nginx, TLS and health checks for on-premises installs, an Azure Container Apps specification pinned to Australia East with every secret read from Key Vault, and a plain-English deployment guide covering prerequisites, custom domains, verification and troubleshooting.
  • AddedDeployment & branding in the platform console now has a Sovereign section: it lists every variable a dedicated client instance needs, what each one is for, which live setting it feeds, and whether this instance has it set — names only, never values — and will hand you the whole deployment pack as a zip.
v1.062026-06-03
  • ChangedProfessional now covers one framework of your choosing rather than all five. The first time an administrator opens the dashboard the workspace is asked which standard it is working to — Essential Eight, the ISM, ISO/IEC 27001, the NIST CSF or SOC 2 — and everything is built on that: the matrix, the reports, the remediation work and the readiness score. Your own uploaded control set counts as your one framework. Essentials still covers the Essential Eight, and Enterprise still covers all five at once.
  • ChangedChoosing is a one-time decision, so it cannot be flipped back and forth by mistake. If your situation changes, contact us and we will move you across — anything you have already assessed stays saved either way, so nothing is lost if you switch or move up to Enterprise.
  • ChangedCross-framework coverage — answering a control once and applying it everywhere — needs several frameworks, so it is now part of Enterprise. Existing Professional workspaces keep the framework they have assessed most, with their other work saved but out of the way.
  • AddedThe website pricing table now spells this out, with a 'Frameworks covered' row reading Essential Eight only, one of your choosing, or all five.
v1.052026-06-03
  • AddedWhite-labelling: the product name, short name, legal entity, tagline, logo and accent colours now come from configuration rather than being written into the code, so the same platform can be deployed under your own brand — it carries through the interface, every email, every PDF and Word document, the user guide and the website.
  • AddedPer-deployment feature switches for Essential Eight, ISM, ISO 27001, NIST CSF, SOC 2, custom framework uploads, AI governance and the multi-workspace console, plus a sovereign mode for an air-gapped install that refuses every outbound connection and sends email through your own mail server. Switching a framework off hides it from the interface; anything already assessed against it stays readable.
  • ChangedEvery setting — database, service URLs, provider keys, email sender and SMTP details — is now read from the environment with nothing hardcoded, and a documented reference file lists every variable, whether it is required and what it does, so a new instance can be stood up without anyone reading the source.
  • ChangedCreating an account now asks for your full name — first name and surname, both required — and the name of your company, which becomes the name of your workspace and appears on every report and invoice you produce. If your organisation already has a workspace on your email domain we recognise it and skip the company question, since we already know who you work for.
  • ChangedFailed sign-ins are now counted against the device and network they come from, not against your account. Somebody guessing at your password gets slowed down — a minute, then five, then fifteen, then an hour — while you carry on signing in as normal from your own laptop. Nobody can lock a colleague out of the platform by hammering their email address.
  • AddedYou are emailed when there have been repeated failed sign-ins on your account, with the device, the address they came from and the approximate location, and a plain reminder that your account is still open. Every failed attempt is written to the audit log with the same detail, so an administrator can see the pattern.
  • ChangedHardening: text you have typed in — organisation and workspace names, control notes, findings, invoice notes and billing details — is now escaped everywhere it is rendered, in the app, in the emails we send and in every generated PDF and Word document, so a stray angle bracket can never change the shape of a document or an email.
v1.042026-10-02
  • ChangedBooking a demo now asks for your full name and your company name, both required. A first name on its own is no longer accepted — we use your name in the confirmation and reminder emails, and knowing the company means the walkthrough is pitched at your situation rather than a generic one.
v1.032026-10-01
  • AddedRisk appetite: set the score at which a risk becomes more than your board is willing to live with, with its own threshold for particular categories if you tolerate less in some areas than others, and a plain-words appetite statement. The heatmap now shades against your appetite instead of a generic scale, the register flags every risk above it, and the readiness score measures you against your own number rather than a hard-coded 'High or worse'.
  • AddedSign-off on acceptance: deciding to live with a risk that sits above appetite now needs a name against the decision. The register will not accept it without one, and the date is stamped automatically — that is the record an auditor looks for.
  • AddedAudit programme: clause 9.2 asks for a programme, not a one-off audit. Choose a monthly, quarterly or half-yearly cycle and a start date, then give each period a slice of the checklist with an auditor and a due date. A coverage bar shows how much of the system is accounted for across the cycle, anything not audited anywhere is listed plainly, and periods past their date are flagged overdue.
  • AddedAudit reminders: the owner of each slice is emailed 14 days and 3 days before it is due, with a link straight into the checklist, so the programme runs without anyone chasing it.
  • ChangedThe website and the user guide now cover the risk register, risk appetite, certification readiness, the internal audit and the audit programme, with real screenshots and the control totals taken from the live catalogues.
v1.022026-06-30
  • AddedRisk register: every risk with an owner, how likely it is and how much it would hurt — scored before treatment and again after — the treatment you have chosen (mitigate, accept, transfer or avoid), its status, and the controls that actually treat it. A 5×5 heatmap shows where your live risks sit once treatment is taken into account, and the register flags anything unowned, untreated or overdue for review.
  • AddedCertification readiness: one honest score for how you would fare if the auditor walked in tomorrow, built from whether every control has an applicability decision, how many are assessed, how many are actually working, evidence on file, your Statement of Applicability, the health of your risk register and your internal audit findings. It lists exactly what is costing you the most points and what to do about it, and records the score each day so you can see your readiness trend.
  • AddedInternal audit: the clause-by-clause checklist an ISO 27001 auditor works through — the management system clauses 4 to 10 plus every Annex A control — each with the question they will ask and what good looks like. Record a verdict (conforming, observation, minor or major nonconformity, or not applicable), your finding, the evidence you saw, an owner and a due date, and raise a risk or a remediation task straight from anything that falls short.
  • AddedInternal audit report: download the completed checklist as a branded Word report, grouped by section, showing coverage, every finding and the evidence seen — and a clear warning while any major nonconformity is still open.
v1.012026-06-29
  • ChangedThe framework and version pickers now show how many controls each one carries and mark a complete catalogue as 'full', so ISO 27001 clearly reads as the whole 93-control Annex A and the smaller starter versions are marked as a subset.
  • AddedProgress by section can be collapsed into a single summary line — a dot per section, one progress bar and the totals — and the app remembers how you left it. Click the line to open it back up.
  • FixedThe top bar and toolbar no longer push the page sideways on a phone.
  • AddedISO 27001 Statement of Applicability: the document your auditor asks for, covering all 93 Annex A controls with whether each applies, your justification, the implementation status from your assessment and how the related risk is treated. It downloads as a proper Word table, grouped by theme, and can be versioned and approved like the rest of the pack. Justifications come from the notes you have already written, and if you have your own AI key connected you can have the missing ones drafted for you — each one is marked for review.
  • AddedMoving to a new framework version no longer means starting again: you get a preview of what carries straight across, what has changed in wording and needs a second look, what is new and what has been withdrawn, and nothing is written until you confirm. The version you came from keeps all of its answers, so you can switch back at any time.
  • AddedProgress by section: a card per framework section — the four ISO themes, the ISM sections, the SOC 2 criteria — showing how many controls you have answered, your average maturity and how many are left. Click one to filter the matrix to it. The board snapshot report now shows answered and maturity per section too.
  • AddedISO/IEC 27001 now carries the complete Annex A catalogue — all 93 controls across the four themes (Organisational, People, Physical and Technological), grouped by subject so you can work through them a section at a time.
  • ChangedImport Latest Frameworks now refreshes every framework at once and reports which versions are new, but never moves you onto a new version or touches your saved answers. You stay on the version you are assessing until you choose the new one from the version list.
  • AddedBooking a demo now starts with a quick email confirmation: we hold your time for 24 hours and send you a link to confirm it, so the calendar only ever shows times that are genuinely free.
  • AddedYou can move or cancel your own demo from the link in your confirmation and reminder emails — pick any other free time, no emails back and forth needed.
  • AddedSOC 2 is now one of the frameworks you can pick when booking a walkthrough.
v1.002026-06-29
  • AddedFramework cross-mapping: where one control answers the same question in several frameworks, a new mapping icon on the row shows every equivalent control, how each is currently rated, and lets you copy your effectiveness, maturity, note and applicability across in one click — so you answer once instead of five times. Every copy is recorded in the audit log.
  • AddedCross-framework coverage view and report: one row per shared theme, one column per framework, showing which controls cover it and how far you have got. Available as a PDF, with a print-friendly version.
  • AddedEvidence requests: an auditor's request list, tracked in the app. Raise a request against a control with a description, owner and due date, attach the evidence files that answer it, and move it from outstanding to submitted to accepted or rejected. A summary shows what is still outstanding and what is overdue, and a standard starter list can be raised for any framework — SOC 2 comes with the twenty requests a service auditor normally asks for.
  • AddedThe website now has a public change log at /changelog, linked from the footer, so anyone can see what has shipped.
  • FixedSecurity hardening from a full audit of the platform: text typed into the public demo form can no longer be treated as a formula by a spreadsheet when the booking list is exported, visitor-supplied text is escaped in the emails it appears in, the public booking form is rate-limited per address, and the fallback owner account that existed when no administrator was configured has been removed.
  • ChangedSubscriptions are annual. Tiers 1 to 3 are sold on an annual cycle only; monthly billing remains available on the Bespoke tier, where the amount and cycle are agreed per client.
v0.992026-06-28
  • AddedSOC 2 is now an assessable framework, covering all five Trust Services Criteria categories — Security (the common criteria CC1 to CC9), Availability, Confidentiality, Processing Integrity and Privacy — 49 criteria in all, assessed the same way as every other framework with applicability, effectiveness, maturity and evidence.
  • AddedDocumentation packs for every framework. On top of the shared policy set, the document list now changes with your framework: Essential Eight adds a maturity implementation plan and an operating procedure for each of the eight mitigation strategies; ISO 27001 adds the ISMS scope and context, the Statement of Applicability, the risk treatment plan and a management review record; NIST CSF adds current and target profiles and an action plan; SOC 2 adds the system description, the criteria control matrix and a readiness assessment.
  • AddedEach new document is prefilled from your own assessment in the same way as the rest — your results by domain, your gaps, your implementation notes and the evidence on file — with anything we cannot know marked [To be confirmed].
  • AddedDemo reminders: anyone with a booking gets a reminder on the morning of their demo, and so does the team, so fewer people forget.
  • ChangedThe website and user guide now describe all five frameworks and the per-framework documentation.
v0.982026-06-28
  • AddedBook a demo: the website now offers real time slots instead of a plain message. Availability is Tuesday to Thursday, 10:00–16:00 Sydney time in 30-minute slots, at least a day ahead; visitors pick a free time and give their name, work email, organisation, phone, how many people are in the business, the framework they care about and what they want to cover. Both you and they get a confirmation email, and a taken slot cannot be double-booked.
  • Added"Send a message" is still there as a second tab for anyone who would rather not book a time.
  • AddedSearch visibility: proper page titles, meta descriptions, canonical URLs, social share cards and structured data on the front page and the user guide, plus a sitemap.xml and robots.txt generated at build time for whichever domain the site is served from. Private pages — admin, share links, invites, payment and password reset — are excluded from indexing.
v0.972026-06-28
  • ChangedDocumentation brought up to date: the user guide now explains signing in from the website at /login, says that the guide itself is public at /guide and downloadable as a single Word document, and points at the website contact form for anyone without a named contact.
  • ChangedWebsite feature list brought up to date with the newer capabilities: evidence listed against its control in the SSP Annex, assessment report and POA&M; print-friendly versions of every report; the light and dark themes; and the public user guide.
  • ChangedProduct screenshots used on the website and in the guide were recaptured with the account details replaced by neutral placeholders, so nothing personal is visible on the public pages.
v0.962026-06-28
  • AddedPublic website: the address now opens a proper front page — what the product does, screenshots of the matrix, notes and evidence, reporting, the documentation pack, versioning and multi-network working, and a full list of what you can do with it. Signing in moved to /login, and anyone already signed in still lands straight on their dashboard.
  • AddedFrameworks section states plainly that all four frameworks are fully assessable today, and that the prefilled documentation pack covers the ISM now with Essential Eight, NIST CSF and ISO 27001 coming soon.
  • AddedContact form: enquiries are emailed to the business without the address ever appearing on the page, with basic flood protection and a record kept of every enquiry.
  • ChangedThe sign-in page now links back to the site and to the user guide.
v0.952026-06-28
  • AddedUser guide: a full documentation set for the platform at Help → User Guide — how to assess controls, work with notes and evidence, run multiple networks, produce reports, use the ISM documentation pack, publish and approve documents, and (for admins) manage users, SSO, SCIM, licensing and billing.
  • AddedThe guide is a proper documentation browser with a topic sidebar, search and screenshots of the main screens, and it is readable without signing in — there is a link on the sign-in page so prospects can read it too.
  • AddedDownload the whole guide as a single Word document, including the screenshots and a contents page. When you are signed in it picks up your workspace logo, name and accent colour.
v0.942026-06-27
  • AddedEvidence linking: the files you have attached to each control now appear in the documentation pack. The SSP Annex lists, for every applicable control, each file with its type, size, who uploaded it and when, alongside a line confirming the material is held in the ProtectSMB GRC evidence vault and can be produced on request.
  • AddedThe same evidence list appears against every finding in the Security Assessment Report and against every item in the POA&M, so an assessor can see immediately what backs each claim and what is still missing.
  • AddedControls with nothing attached are marked "Evidence: none recorded", and the SSP implementation summary now reports how many controls have evidence and how many files are on file in total.
  • ChangedNew evidence uploads record who uploaded them, so the documentation can name the person as well as the date.
v0.932026-06-27
  • AddedDocument versioning and approval: publish the current wording of any documentation-pack document as a numbered version, recorded against a named approver with a review period (annual by default, or 3 months to 3 years). The last 10 versions are kept per document, each downloadable as a .docx exactly as it was approved.
  • AddedAuditor view: compare any two published versions side by side and see line-by-line what wording was added or removed in each section, with who published it, who approved it and when.
  • AddedReview reminders: document cards show "review due in Nd" and "review overdue" badges as the next review date approaches, based on the period you set when publishing.
  • AddedNamed approvers: workspace admins keep a list of the people allowed to approve documentation (name, email and role); only those people can be recorded as an approver.
  • AddedNote starters: the "How we meet this" dialog now suggests starter wording matched to the control's own text — MFA, patching, application control, backups, logging, access reviews, training and more — so a note takes a few seconds instead of a blank page.
  • AddedReusable snippets: save any note you will use again, give it a name, and apply it to any control with one click.
v0.922026-06-27
  • AddedISM Documentation Pack (Report → ISM Documentation Pack): 17 Word templates covering the documentation the ISM expects you to hold — System Security Plan, SSP Annex, Security Risk Management Plan, Incident Response Plan, Continuous Monitoring Plan, Security Assessment Report, POA&M, and the supporting policies for access control, patching, backups, logging, acceptable use, data breach response, suppliers, media handling, remote working and awareness training. Tick the ones you need and download a single .docx or the whole selection as a zip.
  • AddedEvery document is prefilled from your own assessment data — org and contact details, framework and version, posture and maturity, per-domain results, your control gaps and your "how we meet this" notes — at no cost. Anything we cannot know is marked [To be confirmed] so it is obvious what still needs your input.
  • AddedEdit any section in the app and save it; your wording is kept per network and reused on the next download. An optional "Improve with AI" button rewrites a section using your own connected provider — each rewrite is a separate call charged to your key, so the cost note on screen explains that token usage rises with the number and length of the sections you improve.
  • AddedBranding is optional: apply your logo, name and accent colour to the cover page, or download plain documents.
  • ChangedThe framework title, posture and maturity KPIs now stay pinned alongside the column headers while you scroll the control matrix.
v0.912026-06-27
  • AddedAssessment notes: every control now takes a short "how we meet this" statement. Write it from the note icon on the control row or inside the Evidence Vault, and a dot on the row shows at a glance which controls are documented.
  • AddedNotes flow into your reporting: a "What We Already Do" section and a per-control column in the Executive Summary, an appendix in the Compliance Certificate, a "What we already do" block on the Board Snapshot, a new column in the CSV export, and they were already visible to assessors on share links.
  • ChangedAI implementation advice is now given your own note for the control, so the guidance builds on what you already have in place instead of repeating it.
v0.902026-06-27
  • AddedPrint-friendly reports: the Export and Report menus now offer a print-friendly Compliance Certificate and Executive Summary, and the Board Snapshot dialog has a Print-friendly PDF button. Same content and branding, but outlined panels instead of heavy dark fills — kinder to your printer and easier to read as a handout.
  • AddedFrozen Control ID column: the control reference stays visible on the left while you scroll the matrix sideways.
  • AddedSCIM group preview (Config → User Management → Domains & SSO): see every group your identity provider has pushed, how many members it has and exactly which role it will grant, before the next provisioning run.
  • ChangedSCIM filters now accept the full grammar identity providers send — and / or with eq, ne, co, sw, ew and pr — so larger Okta and Entra ID push rules work unchanged instead of matching everything.
v0.892026-06-27
  • AddedSticky section headings: when Group by parent control is on, the section heading and its score stay pinned under the column headers while you scroll through a long control list.
  • AddedLight theme: a Light/Dark toggle in the top bar switches the dashboard to a bright boardroom palette, remembered on your device. The admin console and PDF reports stay on the dark theme.
  • AddedFull SCIM 2.0 provisioning: Users and Groups with PUT, PATCH, soft delete, filtering, pagination and the ServiceProviderConfig, ResourceTypes and Schemas discovery documents, so Okta and Microsoft Entra ID can be pointed straight at the base URL. A group named after a role — admin, assessor, contributor or viewer — sets that role on its members, and provisioning that would exceed your licensed seats is rejected with a clear reason.
  • ChangedThe main and matrix scroll bars are wider and brighter so they are easier to grab.
v0.812026-06-22
  • AddedPlatform admins: a new tab in the Platform Console lets you promote an existing ProtectSMB account to platform administrator, see who granted each one and when, spot any admin without MFA, and revoke access again. Your owner account is permanent and can never be removed, and every change is written to the audit log.
  • FixedPlatform admin access now survives a deploy — previously anyone other than the owner account lost it on restart.
v0.802026-06-21
  • AddedBring your own AI: Config → Preferences → AI connector lets a workspace admin connect OpenAI, Anthropic, Google Gemini or any OpenAI-compatible endpoint with their own API key. The key is checked against the provider before anything switches on, is encrypted at rest and never shown again beyond its last four characters. Pick a model from the provider's own list or type an exact model name.
  • ChangedAI features are now off until a provider is connected — the advice button reads "AI Not Connected" and board summaries fall back to a plain factual paragraph, so reports keep working either way.
  • FixedGitHub Copilot is not offered as a provider: GitHub retired the API that made key-based access possible in July 2026. Azure AI Foundry works through the "Other (OpenAI-compatible)" option.
v0.792026-06-21
  • AddedISM controls now show which classifications they apply to (NC · OS · P · S · TS), taken straight from the official ASD catalogue, with an "Applies to" filter so you can pick any combination of levels.
  • AddedNetwork classification (Config → Preferences → Network scope): set the highest classification your network handles — UNOFFICIAL, OFFICIAL: Sensitive, PROTECTED, SECRET or TOP SECRET — and controls that do not apply at that level are hidden and recorded as Not Applicable, so the scoping decision lands in your audit log. Change it and the list rescopes straight away; anything you set by hand is left alone.
  • AddedPayPal now sits alongside card payment on invoices, and invoice emails carry Pay-now buttons so clients can settle without hunting for the link.
  • AddedPlatform console: clear all invoicing data (with confirmation) and exclude individual workspaces from the MRR/ARR forecast.
  • ChangedReplies to invites, invoices and digests now go to admin@protectsmb.com.au.
v0.782026-06-20
  • FixedLicence tiers can now only be changed by ProtectSMB — workspaces could previously upgrade themselves without an invoice. The Licence tab now shows your plan read-only.
  • FixedHeavy work — evidence uploads and downloads, report PDFs, spreadsheet imports and the brand pack — now runs off the main thread, so one big download no longer slows everyone else down.
  • FixedWhen email, card payments, the AI advice service or file storage has a problem you now get a clear message telling you what to do, instead of a blank gateway error.
  • FixedPreferences now offers a retry if it cannot load, the platform console no longer caps at 10,000 users, and the seat limit can no longer be beaten by two invitations sent at once.
v0.772026-06-20
  • AddedBrand assets (Config → Brand Assets…): high-resolution logos for your website, documents and social profiles — the shield on its own, horizontal and stacked lockups, favicons, link-preview, profile and banner images, and SVG masters, each in transparent, navy and white versions.
  • AddedDownload any single asset from the tile, or take the whole pack as a zip, with the palette and typeface notes alongside.
  • ChangedThe browser tab icon and link previews now use the new high-resolution artwork.
v0.762026-06-20
  • ChangedThe Azure, AWS and Google Cloud buttons now sit grey and quiet when they are not in use, and light up in their own colour when selected, so it is obvious at a glance which clouds your advice covers.
  • AddedHover any of the three to see what that platform's advice covers and whether it is currently included.
v0.752026-06-20
  • AddedEmail a share link straight to your assessor: in Share with Assessor, each active link has an Email button — add up to five addresses and a short note, and we send a branded invitation carrying your logo, what's shared, the expiry date and a button to open it. Replies come back to you.
  • AddedAfter you generate a new link the invite form opens automatically, so no more copying URLs by hand.
  • ChangedSending an assessor invite is admin-only, written to the audit log and raises a security alert, so your assessment never leaves the workspace silently.
v0.742026-06-20
  • Added"Send me a test digest" in Preferences → Notifications — see exactly what the monthly board digest looks like before the 1st. It goes to you only, is marked as a preview, and never replaces the real send.
  • AddedSaved column mappings for imports: name a mapping once (e.g. "IRAP worksheet v2") and the next upload with matching headers reuses it automatically, along with the import mode and target framework — a repeat IRAP import is one click.
  • AddedManage saved mappings from the import screen: pick one manually, rename it or delete it.
v0.732026-06-20
  • AddedImport a control set from a spreadsheet (Import → Import Control Set from File…): upload .xlsx or .csv, we find the header row and guess the columns, you confirm the mapping and preview the rows before anything is saved.
  • AddedBring in an existing IRAP assessment worksheet — either assess it as its own framework, or map it onto the ISM catalogue so your assessment starts pre-filled with the assessor's findings.
  • AddedDownloadable template for your own framework, and uploaded control sets sit alongside the built-in ones with the same grid, reports, snapshots and share links.
  • ChangedThe assessor share page now carries your logo and brand colour throughout — filters, posture badge, table headers, control IDs, your replies, the audit history and the footer.
v0.722026-06-20
  • AddedPreferences (Config → Preferences): choose the framework that opens by default, whether controls start grouped, row density, your date format and time zone.
  • AddedNotification settings in one place — security alerts, the security contact, the monthly board digest and extra digest recipients.
  • AddedBrand accent colour per organisation, applied to certificates, executive summaries, board snapshots and assessor share pages alongside your logo.
  • AddedMonthly board digest email on the 1st of each month to the owner and admins: posture, maturity, open items, month-on-month movement and your focus areas.
  • AddedYour logo now also appears on invoices, credit notes and statements of account.
v0.712026-06-14
  • AddedRevenue tab in the Platform Console — a month-by-month chart of what was billed, credited and collected across the financial year, with a cumulative collections line.
  • AddedTop-line figures for the year: billed, credited, net billed, collected, still outstanding and your collection rate, plus a year selector to look back at earlier financial years.
  • AddedBreakdowns of net billing by licence tier and by domain (top ten), and a CSV export of the monthly figures.
  • ChangedPayments count in the month they were actually paid, so the chart reflects real cash flow rather than invoice dates.
v0.702026-06-14
  • ChangedThe app is now called ProtectSMB GRC — the name is updated everywhere, including the sign-in screen, menus, emails, share links, invoices, statements and every report PDF.
  • ChangedLogo refreshed to a PS monogram on the same shield, in both the app and the documents it produces.
v0.692026-06-14
  • AddedCredit notes — issue a full or partial credit against any invoice with a reason, numbered CN-2026-0001, with its own branded PDF and an email to the point of contact. Optionally refund the card at the same time.
  • AddedThe register now lists credit notes beneath the invoices, shows how much of an invoice has been credited, and nets credits off the amount billed this financial year.
  • AddedPay now by card — every invoice PDF and email carries a Pay now link to a secure Stripe checkout for the exact amount. Paying marks the invoice paid, sets the domain back to paid, stops any chasing and emails a receipt.
  • AddedYearly statements — a statement of account for any domain covering the Australian financial year, listing every invoice, credit and payment with totals invoiced, credited, paid and outstanding. Download it or email it to the point of contact.
v0.682026-06-14
  • AddedBranded invoices — raise a tax invoice for any domain's renewal in one click, with licence number, plan, seats, PO number, tax, payment details and a PAID marker once settled. Every invoice is numbered, stored and re-downloadable.
  • AddedEmail an invoice straight from the console: the point of contact gets a secure link to the PDF and you are copied, with the send recorded.
  • AddedEditable invoice template — your business name, ABN, address, bank and BSB details, tax label and rate, payment terms, footer note and invoice number prefix. Blank fields are left off the page.
  • AddedInvoices tab listing every invoice with its total, due date and status, plus mark-as-paid which also sets that domain's subscription back to paid.
  • AddedOverdue nudges — domains showing as overdue get a polite reminder to their point of contact every 14 days, four at most, with the outstanding amount and a link to the invoice. You are copied on each.
  • AddedAuto roll-forward — once a paid licence's renewal date passes it moves to the next period automatically, so the 60 and 30-day reminders fire for the new date. Trial, overdue, suspended and cancelled licences are left alone.
v0.672026-06-14
  • AddedRevenue overview across the top of the Platform Console — workspaces by subscription status, monthly and annualised revenue, revenue at risk, seats used against seats sold and renewals due in the next 30 and 90 days. Click a status to filter the table.
  • AddedPricing popup for the platform admin: flat monthly or annual prices for Tiers 1 and 2, a per-seat price for Tier 3, and the currency — these drive every revenue figure and renewal amount.
  • AddedRenewals tab listing every upcoming renewal with its amount and point of contact, plus a record of the reminders already sent.
  • AddedRenewal reminders — you and each domain's point of contact are emailed 60 and then 30 days before a licence renews, once each, with the licence, plan, seats and amount.
  • AddedSeat enforcement — a workspace can no longer invite or enable people beyond its licensed seats, counting active accounts plus outstanding invitations, with a clear message naming the seat count.
  • ChangedEach licence now records whether it bills monthly or annually, and the licence register CSV carries the cycle, value and open invitations.
v0.662026-06-14
  • AddedPlatform Console now tracks each domain's subscription status — trial, paid, overdue, suspended or cancelled — as a coloured pill you can change in place, with every change recorded.
  • AddedLicence record per domain: licence number, point-of-contact email, renewal date and seat count, with seats used shown against the seats bought.
  • AddedOne-click licence generation — issue a fresh licence number and mark the subscription paid when a trial converts.
  • AddedExport a single domain's entire content as a JSON file, or the whole licence register as CSV.
  • AddedDelete a domain permanently — users, assessments, evidence files and all — guarded by typing the domain name, with an Export first button beside it.
  • ChangedA cancelled subscription now blocks sign-in for that domain; overdue and suspended are labels only, so nobody is locked out by accident.
v0.652026-06-14
  • AddedDomain-bound tenancy — every organisation is separated by its email domain. Admins only ever see their own domain's people, data and audit trail, and no domain can see another.
  • AddedSame-domain sign-ups now ask to join your existing workspace instead of creating a second one: your admins are emailed and the person has no access until approved (Approve / Reject under User Management).
  • AddedPersonal email domains such as gmail.com and outlook.com stay private — each account keeps its own separate workspace.
  • AddedPlatform Console for the application owner — every workspace, its domain, users and licence tier in one place, with tier changes applied instantly.
  • AddedConsented impersonation — an admin can ask to act as a user, the user is emailed and must approve, the session is read-only for 60 minutes and can be ended by either side at any time.
  • AddedWrite access during impersonation is a separate, explicit permission the user grants on the approval page; otherwise every change is blocked server-side.
  • AddedEvery request, approval, denial, session start and session end is written to the audit log, and actions taken during a session are stamped with who was really behind them.
v0.642026-06-01
  • AddedLicence tiers — Essentials (Essential Eight only), Professional (all frameworks, live updates, remediation tracker, board snapshot) and Enterprise (assessor sharing, audit log, security alerts, backup restore).
  • AddedLocked features stay visible but greyed with a padlock and the plan that unlocks them; your tier is shown in the menu bar.
  • AddedLicence tab under User Management lets the workspace owner switch tiers and see exactly what each one includes.
  • ChangedAI advice, user management, RBAC, SSO and SCIM are included on every tier.
v0.632026-06-01
  • AddedHelp menu with What's New and About — About shows your version, build date, organisation and role.
  • ChangedWhat's New no longer pops up on sign-in; open it from Help whenever you want to catch up.
v0.622026-06-01
  • ChangedGrouped view now lines its section figures up in the matching columns — score under Assessed Effectiveness, maturity under Maturity — starting at the middle of the page so every section reads down the page cleanly.
v0.612026-06-01
  • AddedRead-only members now see a clear banner explaining their access instead of edits silently failing.
v0.602026-06-01
  • AddedUser management — invite colleagues under Config, see everyone's email, role and status, change roles and disable accounts at any time.
  • AddedFour roles: Admin, Assessor, Contributor and Viewer, enforced on the server as well as in the menus. Everyone now shares one workspace and the same assessment data.
  • AddedInvites either email a one-time link so the person sets their own password, or create the account with a temporary password you hand over.
  • AddedExternal-domain protection — invites outside your own domain are blocked unless the domain is allow-listed, must be confirmed, are badged 'external' and are written to the audit log.
  • AddedGoogle SSO auto-join for allowed domains, plus SCIM 2.0 provisioning so your identity provider can create and deactivate users automatically.
v0.592026-06-01
  • FixedFailed sign-in lockout now counts attempts per account rather than per server, so five wrong passwords always lock the account.
  • ChangedSecurity alerts are de-duplicated to one email per type every ten minutes, and a provider hold-up is now reported as pending instead of failed.
v0.582026-06-01
  • AddedSnapshot trend — the Board Snapshot now shows how posture, maturity and open items have moved since your last snapshot, with a trend line and biggest-mover domains, and the same deltas appear on the PDF.
  • AddedSecurity alert emails for new-device sign-ins, account lockouts, MFA being switched off, new assessor links and audit purges — with your own security contact address set under Config.
  • AddedAudit Evidence Pack — assessor share links can now include the append-only audit history so IRAP reviewers see the full change record.
v0.572026-06-01
  • AddedAdmins can purge audit entries older than a chosen date — unless the trail has been locked as immutable.
  • FixedAssessor share-link views are now credited to the assessor rather than the account owner in the audit log.
v0.562026-06-01
  • AddedComprehensive audit trail — every sign-in, assessment change, evidence upload, task, comment, report and backup is recorded with timestamp, user, detail and IP address.
  • AddedAdmin-only Audit Log viewer under Report, with filters by action, user, date range and free text, plus CSV export.
  • AddedOptional one-way lock to make the audit trail permanently immutable for assessor evidence.
v0.552026-06-01
  • AddedNew ProtectSMB GRC shield logo with the CG monogram — now on the login screen, menu bar, browser tab icon and PDF report headers.
v0.542026-06-01
  • ChangedApplication renamed to ProtectSMB GRC — login screen, menu bar, PDF reports, shared assessor pages and browser tab all updated.
  • ChangedBackup files are now named cyberguard-backup-…json; older backups still restore normally.
v0.532026-06-01
  • AddedBoard Snapshot — a one-page posture summary for leadership and clients, with an on-screen preview before you download the branded PDF.
  • AddedAI-written plain-English posture paragraph, top strengths and focus areas, Essential Eight readiness strip and a traffic-light domain table.
v0.522026-06-01
  • AddedLocal JSON backup — Export → Backup Assessments saves your assessments, tasks, comments and org profile to a file.
  • AddedRestore Backup — Import → Restore Backup lets you merge or replace data from a saved backup file.
v0.512026-06-01
  • AddedIn-app changelog — click the version badge or Help → What's New to see what changed each build.
  • ChangedPre-publish versioning scheme: versions now run 0.xx and bump on every build.
v0.502026-06-01
  • AddedControl maturity scoring (0–5) with average maturity on section headers and the dashboard.
  • AddedEssential Eight ML1 / ML2 / ML3 filters and maturity-level progress stats.
  • AddedScale help popovers explaining Applicability, Effectiveness, Automation and Maturity.
  • FixedFull scrolling of large frameworks such as the ISM (1,192+ controls).
v0.492026-05-20
  • AddedGroup By view, saved filters and a default “ALL” framework view.
  • AddedDomain and Parent Control columns in the control matrix.
  • AddedSection posture scores shown on group headers.
v0.482026-05-08
  • AddedAssessor sharing — read-only links for IRAP assessors with per-control commenting.
  • AddedRemediation Tracker for assigning and closing out ineffective controls.
  • AddedOrganisation Profile branding applied to PDF reports.
  • ChangedApplication renamed to Small Business GRC.
  • FixedLive framework fetch for Essential Eight and the ISM via the OSCAL mirror.
v0.452026-04-18
  • AddedEvidence Vault file uploads against individual controls.
  • AddedAI implementation advice for Azure, AWS and Google Cloud.
  • AddedCompliance heatmap, version delta view and CSV export.
  • ChangedSecurity hardening: CSRF checks, upload validation and MFA rate limiting.
v0.402026-03-30
  • AddedFirst release — ISM, Essential Eight and NIST CSF 2.0 control matrix.
  • AddedEmail/password sign-in with TOTP MFA and Google single sign-on.
  • AddedSaved assessments for applicability, effectiveness, automation and cloud coverage.

We use essential cookies only — one to keep you signed in and to protect your session. No advertising or third-party tracking. Read the Privacy Policy.