Resources

Everything we publish and everything we ship, in one place: how evidence actually gets collected, how controls get mapped, and what auditors really ask for.

A real questionnaire builder, and notifications you set

Questionnaires get a drag-and-drop builder with a live preview and logic that survives renaming, and notification settings split into categories, a priority inbox and a weekly digest.

questionnairesnotificationsPolicies

Questionnaires, rebuilt. The builder is a real authoring surface now: an outline, a canvas and a properties panel you can resize, drag and drop anywhere, and a right-click menu on every element offering the same actions as the menus. Logic is what changed most. A rule used to point at a question by its database id and match an option by its English wording, so retitling "Yes" to "Yes, fully" quietly stopped every rule reading it, and a translated option matched nothing at all. Rules now address questions and options by a stable key that never follows the words, which makes renaming and translating free. Preview runs that logic while you are still in the builder, so a rule that never fires is something you find in the editor instead of after a vendor has answered.

Notifications, yours to set. Settings split into categories you switch on and off one at a time, the ones worth interrupting you for go to a priority inbox, and the rest arrive in a weekly digest instead of one email at a time.

Questionnaires
  • An outline, a canvas and a properties panel, resizable, with drag and drop and a right-click menu on every element.
  • Preview evaluates the real logic, so a rule that never fires shows up before a vendor sees it.
  • A questionnaire travels as JSON or a spreadsheet, and a paste that does not fit the schema is reported rather than applied.
  • A questionnaire names its own language. English is no longer required as the source.
  • The question bank says where each question is used, and read-only access stays read only.
  • Condition pickers have a text search.
Notifications
  • Six categories, each with its own switch.
  • A priority inbox for the notifications worth interrupting you for.
  • A weekly digest for everything else, instead of an email per event.
Policies
  • Add an approver in bulk, and act on a list of policies at once.
  • Approving a policy confirms the control coverage behind it.
  • Coverage survives a new version instead of being lost when the document is replaced.
  • The save button is gone: an open policy saves itself as you write.
Compliance
  • A framework's readiness score is on the framework page, not only on the overview.
Fixes
  • "Must be acknowledged" saves from a policy's Details drawer.
  • People with an account reach the identity register, instead of being missed by the sync.
  • Extending an assessment deadline no longer revives a revoked link. A recipient whose access you had withdrawn got it back when the deadline moved.

Google Workspace, OneLogin, and evidence that bundles

Two more identity sources collect evidence on their own, evidence files combine without losing the originals, and the app gained a What's new panel.

integrationsEvidenceCompliance

Connecting an identity provider used to light up a card and little else. Google Workspace and OneLogin now read what compliance actually asks about: who has an account, who has a second factor, who holds an admin role, and in Google's case which laptops and phones they sign in from. The answers land in the identity register, the asset register and the controls that ask for them, so a control can pass on a connection you made once.

Integrations
  • Google Workspace is a connected source. It reads your users, who is enrolled in 2-step verification, who holds an admin role, and the ChromeOS and mobile devices on the account. Those answers feed the identity register, the asset register and the controls that ask for them, with nothing to upload.
  • OneLogin is a connected source. It reads your users, the MFA factors they have enrolled, and who administers a role, and feeds the same registers.
Compliance and evidence
  • Bundle evidence files into one new item. Pick files already in the library, combine them into a new evidence item, and every original stays exactly as it was. The bundle runs its validations across all of its files at once.
  • Evidence can be edited and keeps its earlier versions, and two files with the same name no longer collide.
  • Turn a check off on a control. A validation that does not apply can be disabled on a common control, which takes it off every framework control that borrows it, or on one framework control on its own. It leaves that control's list, its score and its required gate together.
  • A published policy answers its own evidence checks. Evidence type, management approval, owner, acknowledgement rate and distribution are read from the policy record, so those checks pass with nothing to upload, and the score moves when you publish, acknowledge or change the owner. Checks that need a reading of the wording stay open under "Needs other evidence".
  • An asset kind's fields are a searchable, filterable table.
Vendors
  • Set a vendor's criticality from its card, without opening it.
  • A "Created at" column on the vendors table, off until you turn it on.
Across the app
  • What's new. Every production release now gets an entry like this one, on the site and in the app's help menu.
Fixes
  • Muting a notification type mutes it everywhere. Rows already in the inbox stayed there and kept counting toward the unread badge, and the policy approval, policy review due and access review emails went out whatever the setting said.
  • Connecting AWS builds a role with the access it needs. The CLI and CloudFormation routes were handed a ViewOnlyAccess policy that cannot be attached, so the role came out half privileged and reads failed later.

Trust, people, and policies that read themselves

A public Trust Center, a register of the people behind every account, and an import that suggests the controls a policy covers.

TrustIdentitiesPolicies

Three weeks in one entry, because three things landed that are easier to explain together than apart.

The Trust Center. Every organization gets a public page at its own address, built from what is already in Cyberwiz: the frameworks you run, the documents you are willing to share, and the posture behind them. A stranger asks for what they need, the request lands in an inbox, and you grant or refuse it under the access rules you set. The public page reads a rendered copy rather than your data, so nothing reaches it that you did not put there.

People. Compliance keeps asking who, and the answer used to live in whichever system you happened to check. The identity register answers it once: a row per person, the accounts behind them in every connected source, and the orphans that belong to nobody. A sync shows what it is about to write before it writes it. People can be grouped, and a policy aimed at a group instead of at everyone.

Policies that read themselves. Importing a policy used to mean uploading a document and then mapping it to controls by hand. The import now reads the document, suggests the controls it covers, and quotes the sentence behind each suggestion, so a claim you accept is a claim you checked. Publishing the policy asks the people in scope to sign it.

Trust Center
  • A document replaces in place, so a renewed report keeps its row and its link.
  • The access inbox opens on everything, newest first, and filters on several states at once.
  • An accent colour picker, so the portal reads as yours rather than ours.
  • Open the portal from the access-granted menu, to see what you just handed over.
  • The portal is laid out like the trust page on our own site, and asks for access in a dialog rather than on a page of its own.
Compliance and evidence
  • A Program's scope is a settings page. One tab per population, each picking from the same table as the rest of the product, with a single save across all of them. A population can be set to None, which is not the same as leaving it empty.
  • A Program assesses a set of Targets, and can change that set after adoption. The whole organization is one of the things it can assess.
  • Add evidence in a sheet that stages first. Pick the files, see what each one is thought to prove, link what already exists in the library, then commit the lot.
  • The evidence library is one tab away from every upload button, so reusing a document no longer starts on another page.
  • A Target's evidence tab links in bulk, keeps a Linked view, and says which programs inherit the organization-wide library.
  • Evidence type suggestions are scoped to the control you uploaded from, not to the whole catalog.
  • Required or optional is authored, not inferred. A validation's gate is set on the common control and overridden per framework control, instead of being read off severity.
  • Cyberwiz is an evidence source for its own controls. The registers you already keep here answer the controls that ask for them, with nothing to upload.
  • An unsure AI verdict asks for a review rather than failing the control. It stays out of the readiness percentage and holds the control back from passing until someone looks.
  • Integration evidence keeps itself current instead of ageing between syncs.
  • Export a framework's controls with their requirements, guidance and evidence examples.
  • Frameworks split into a table and a browsable catalog, and the catalog can ask us for a framework it does not have.
  • A common control opens as a drawer, and a framework control's drawer lists the policies that cover it.
  • The compliance overview fills three rows and sizes its widgets to the space it has.
Policies
  • Import a policy from a document already uploaded as evidence, and land on the policy rather than back in the list.
  • An upload recognised as a policy offers to join the register, one row or a whole bulk upload at a time, with a single Confirm all for the suggestions behind it.
  • A coverage run suggests up to 60 controls, each with a confidence and the quote it read.
  • A policy's scope carries onto the evidence it mints.
  • The template catalog was rebuilt on the Bindsec documents.
  • Export from the toolbar, and aim a new policy at a group without opening it first.
  • An open draft saves itself again, and leaving with unsaved words asks first.
  • The register pages, sorts and totals on the server, so a large register opens like a small one.
Vendors and assets
  • Add a vendor from a catalog of known providers, instead of describing one from scratch.
  • Create a system straight from a vendor row.
  • Findings carry an audit trail, and a risk change asks for a reason.
  • Asset filters pick from what exists, and survive a reload.
Across the app
  • Agent opens on what you can ask from where you are, and renders its own markdown.
  • Integrations show a validation count per connection, expandable to the list, with one status colour across every surface and errors that say why.
  • A second dark palette, dark classic.
  • Tasks gained an add button where the next card would go.
  • cyberwiz.ai was rebuilt around a single resources shelf, a page per framework, a demo page the calls to action point at, and this changelog.
Fixes
  • A dropped folder gives one evidence per file, rather than one for the folder.
  • A coverage suggestion must quote the policy sentence behind it, so a claim with nothing under it cannot pass.
  • A cancelled policy import leaves nothing behind, and says so when it had already become a draft.
  • An imported DOCX or PDF reads its section titles as headings, not its page markers.
  • Evidence tables sort and page again, and the evidence filters say what they filter.
  • Cancelling a single upload leaves it in the Inbox instead of dropping it.
  • Selecting text no longer swipes a side drawer shut, and a drawer slides out however it was closed.
  • An owner contact with no email stops blocking scheduling.
  • A bare stored website stops blocking every vendor edit.
  • A failing GitHub App reports its own error, rather than a 403 from an unrelated call.
  • File sizes read left to right in Hebrew, and the Hebrew itself was reviewed rather than counted.
  • The questionnaire builder survives dark mode.

The policy page, rebuilt

Policies get tabs, a version picker and a real list, and the copilot stops refusing the follow-up.

Policies

The policy detail page grew one surface at a time and ended up hiding the two things people came for. Coverage and history were sheets behind an overflow menu, which meant you had to already know coverage existed to find out whether a policy had any.

It now reads as four tabs (Document, Details, Control coverage, History), and each one is in the URL, so a link to a policy's coverage is a link to its coverage. The version chip beside the document became a picker listing every revision rather than a button that navigated away. Details was a flat run of eight fields where "Owner" and "Approver" looked interchangeable; it is now five labelled sections, with a save bar that appears only once you have changed something.

The policies list moved onto the same table as everything else in the product: page, sort and filters live in the URL, rows are clickable, and an export tells you how many archived policies it left out.

Improvements
  • Assessments open in a drawer straight from the row, with a findings tab you can edit in place.
  • The AI copilot edits questions, not just drafts them.
  • Evidence types are editable from the library, the drawer and the selection bar.
Fixes
  • The copilot answers a follow-up. The guardrail was blocking every refinement after the first.
  • A model decline reads as a decline, rather than a 502.
  • The Archived policies filter matches, and an archived policy can be restored from the list.

Policies, and a boundary to measure against

Write and adopt policies inside Cyberwiz, and scope every compliance number to a Target and a Program.

ComplianceEvidence

Two things landed this week that change what the compliance numbers mean.

The Policies module. Authoring, templates, import and export, all in the product. Policies map to Common Controls in both directions, and publishing one emits evidence, so adopting a policy moves your score without anyone uploading a PDF of it afterwards.

Audit scope. Targets and Programs give every measurement a boundary. A Program can choose whether it inherits the organization-wide evidence library or stands on its own, and evidence is filed against a Target rather than floating at the org level. "94% covered" now answers the question covered for what.

Improvements
  • Evidence intake runs on a queue, so a large upload stops blocking the page it was started from.
  • Questionnaire sections are first-class, rather than a naming convention on questions.
  • The asset register gained kind badges, bulk actions, and filters on kind, owner and source.
  • Evidence types attach in bulk from the library, and framework control mappings are derived from the common controls beneath them.
  • Catalog pickers are searchable, and a category can be created without leaving the picker.
  • Toasts are dismissable, in whichever corner you put them.
Fixes
  • Excluded questionnaire sections no longer read as a zero score, and are hidden from Scores by Section in both reports and the vendor portal.
  • Deleting an assessment now cascades to its child rows instead of leaving them behind.
  • The "Other" option is translated in the single-page questionnaire view.
  • Chart bars take their fill correctly, and axis labels are sized to the gutter.