October 2026

New Features

Business Impact Assessment

Assets in the register can now carry a full business impact assessment. Rate an asset once and the platform derives criticality and recovery objectives from those ratings. Assessments live on the asset record under Risk Management > Assets.

• Harm Ratings - Rate each asset from Negligible to Catastrophic across confidentiality, integrity and availability. A shared reference grid of consequence types (financial, reputation, operations, regulatory and safety) anchors each level so that different assessors reach the same answer. The worst credible outcome sets the rating.

• Derived Criticality - Criticality is calculated from the three ratings using either the highest rating or the average, as your organisation prefers. The result can be overridden, with a justification recorded to the audit trail.

• Recovery Objectives - RTO is derived from the availability rating and RPO from the integrity rating. Both are ceilings and both can be overridden on the asset overview, where tooltips explain each objective.

• Outage Curve and MTPD - Rate availability harm at 1 hour, 4 hours, 12 hours, 24 hours and 1 week to show how harm grows over time. The platform derives the maximum tolerable period of disruption from the curve and flags any asset whose recovery target exceeds it.

• Dependencies - Link the systems an asset relies on. Any dependency that recovers more slowly than the asset’s own limit is flagged.

• Workshop Mode - Assess several assets in one facilitated session. Set a facilitator and attendees, work through the assets in sequence and keep notes against each one.

• Not Assessed State - An asset without an assessment derives no criticality, RTO or RPO. The register shows it as not assessed, with a direct route into starting one.

• Configurable Scale - Administrators can tailor the harm scale, consequence anchors, criticality vocabulary and recovery objective bands. Published scales are versioned, so historical assessments keep the scale they were rated against.

Asset Context and Register

• Richer Asset Records - Assets now carry class, zone, environment, data classification, business function, business owner, technical owner, team and contact email, all editable in place.

• New Register Columns - Criticality, assessment status and recovery time are available as register columns.

• Guided Asset Creation - A stepped wizard replaces the create-asset form, guiding you through identity, context, impact ratings and recovery objectives.

• Spreadsheet Import - Import asset context and initial impact ratings from a spreadsheet, with a downloadable template and a full preview before anything is written.

Configurable Risk Matrix

The risk matrix is now owned by your workspace and is no longer fixed at 5×5. Assessors still pick a likelihood and an impact; what those choices resolve to is now yours to define. Existing matrices are unchanged, and workspaces continue to score on their current configuration until they publish a new version.

• Grid Size - Square grids from 3×3 to 7×7. Changing size shows where each current level lands on the new scale before anything is applied.

• Per-Cell Scoring - Every cell starts at likelihood × impact and any cell can be set by hand, so an impact-weighted rubric can be expressed directly. Where a score has been set by hand, the risk shows a note stating this and the value the formula would otherwise have given.

• Bands - Between three and eight bands with editable labels, colours and thresholds. Individual cells can be recoloured independently.

• Risk Appetite - Select cells on the grid and mark them inside or outside appetite. Cells outside appetite are hatched and their risks are flagged for escalation.

• Draft, Publish and Versions - Edits accumulate as a draft while live risks keep scoring on the published matrix. On publish, choose whether to re-score every risk immediately or apply the new matrix to new risks only. Every published version is kept and can be reopened and restored.

• Warnings Instead of Blocks - A grid that scores a cell lower than its neighbour raises a warning naming the cells but always saves, since a deliberately non-linear rubric is valid.

AESCSF Trends Dashboard

A new Trends tab on the AESCSF dashboard shows how your programme is moving over time.

• Trend Charts - Maturity, anti-pattern and security profile trends, with the score labelled at the end of each line.

• Practice Trend Table - A per-practice period trend table with domain tiles and filters.

• Remediation View - A remediation queue and open anti-pattern cards with task counts and roadmap-based projections.

• Drill-In Detail - Open any practice or anti-pattern to see scheduled tasks and create new ones. Task links open the task directly in the programme.

Improvements

Risk Register

• Export and Re-Import Without Duplicates - Export the risk register, add to it and import it back. Re-imported rows link to existing records instead of creating duplicate assets, threats and risks.

• Promote Third-Party Risks - A third-party risk can be promoted to the main risk register, either copied so it exists in both places or moved outright. The vendor name is appended to the title, the third-party score carries across as the residual rating, and the promoted risk starts in draft pending full evaluation.

Security Programme

• Task Import - Import tasks from Excel or CSV, including priority, status, project, title and due date, with validation before import.

• Targeted Task Generation - Multi-select controls anywhere in the control tree, across categories and scopes, and generate tasks for that selection from the same place recommendations are generated. This suits running a workshop on one area and raising tasks for it immediately.

• Assignees Carry Over - A user assigned to a control in an assessment is now carried onto tasks generated from that control.

• Multi-Scope Score Predictions - One task can now lift the score for a chosen set of scopes, in addition to a single scope or all scopes.

• Bulk Selection - Select all tasks within a programme from the bulk update menu. Group checkboxes are easier to see.

• Financial Year Roadmaps - The quarterly roadmap scale now follows the financial year start month set on the project. The separate financial year scale has been removed.

Assessments and Reporting

• Multi-Scope Dashboards - Select any combination of scopes to see an aggregate view, in the same way the all-scopes view works today.

• Scope-Aware Generation - Generated findings, recommendations and reports now use each scope’s own scores, and every generated item is assigned to the scope it belongs to. Reports present findings and recommendations under the correct scope, with per-scope score breakdowns alongside the overall figures. Scopes can carry a description, which is used as context during generation. Workspaces that do not use scopes see no change.

• Assessment Ownership - Any organisation member can be set as assessment owner.

• Clean Starts - Finished and follow-up statuses are no longer carried over when you create an assessment based on a previous one.

Third-Party Risk

• Questionnaire Management - Questionnaires can now be unpublished, edited, archived and deleted, with guards against editing a questionnaire already in use.

‍