Continuous Monitoring, Control Tests and Access Review Delegation

Plans: see Plans and features for which plan includes each feature. Where: ISO 27001 → Monitoring, ISO 27001 → Control Tests, Supply Chain → Findings

New features

Continuous monitoring

AutoCISO now continuously monitors ISO 27001 controls for staleness. When a control has not been reviewed or updated within its configured window, the platform automatically sends an alert to the control owner. Configure monitoring intervals under ISO 27001 → Monitoring.

Control testing

Owners and Managers can now create and run structured control tests directly in AutoCISO. Tests support multi-step workflows, evidence attachment, and sign-off by named participants. Find them under ISO 27001 → Control Tests.

Access reviews — send to managers

The access review workflow now supports delegating individual review items to direct managers. Reviewers receive an email with a link to their pending items and can approve or revoke access without logging into the full console.

Vulnerability management surface

Owners and Managers can now view and triage vulnerabilities identified from uploaded SBOMs under Supply Chain → Findings. Vulnerabilities are sourced from NVD/RHSA and are updated nightly.

Improvements

• Backup test reports now auto-compute scenario results from step outcomes
• Shared Markdown rendering component for AI chat, partner panel, and help drawer
• Server-side pagination and status filtering for access review detail view

Bug fixes

• Fixed PDF download authentication in backup test reports
• Fixed sign-off participant matching using internal user ID instead of external auth ID
• Fixed SOA generation timeout for organizations with more than 93 ISO controls