Policies, and a boundary to measure against

Write and adopt policies inside Cyberwiz, and scope every compliance number to a Target and a Program.

ComplianceEvidence

Two things landed this week that change what the compliance numbers mean.

The Policies module. Authoring, templates, import and export, all in the product. Policies map to Common Controls in both directions, and publishing one emits evidence, so adopting a policy moves your score without anyone uploading a PDF of it afterwards.

Audit scope. Targets and Programs give every measurement a boundary. A Program can choose whether it inherits the organization-wide evidence library or stands on its own, and evidence is filed against a Target rather than floating at the org level. "94% covered" now answers the question covered for what.

Improvements
  • Evidence intake runs on a queue, so a large upload stops blocking the page it was started from.
  • Questionnaire sections are first-class, rather than a naming convention on questions.
  • The asset register gained kind badges, bulk actions, and filters on kind, owner and source.
  • Evidence types attach in bulk from the library, and framework control mappings are derived from the common controls beneath them.
  • Catalog pickers are searchable, and a category can be created without leaving the picker.
  • Toasts are dismissable, in whichever corner you put them.
Fixes
  • Excluded questionnaire sections no longer read as a zero score, and are hidden from Scores by Section in both reports and the vendor portal.
  • Deleting an assessment now cascades to its child rows instead of leaving them behind.
  • The "Other" option is translated in the single-page questionnaire view.
  • Chart bars take their fill correctly, and axis labels are sized to the gutter.