Changelog
What changed in the platform, newest first.
Six free templates for IT partners
The downloads page now carries six documents an IT partner hands a client: an incident response plan, a tabletop exercise kit with three scenarios, a supplier security questionnaire, an acceptable use policy, a board memo on NIS2 and CyFun, and the CyFun Basic evidence checklist. Each one in English, Dutch and French, behind the same email form as the other downloads.
Read morePolicy reviews fill themselves from approvals
The policy review register now derives from the document approvals you already make. A review that came from an approval carries a "from approval" badge, a History link to the document and the outcome "First approval" where that is what it was. Approving a changed document asks one question, "What changed and why?", and the answer lands in the register as the change note. The auditor export gains a document-approvals.csv.
Plan an action straight from a risk
In the risk register, "Plan an action" opens the roadmap form with the risk already attached, shown as a chip "For risk: ..." you can remove. The action then counts as treatment for that risk, so a hand-made action closes the gap the same way a generated one does.
The register names the risk behind every gap
Where the register tab used to count risks with no action or no score, it now names them. Each one carries its way out: "Plan an action", "or accept it, with a reason", or "still needs a score".
Google Workspace fills the account register
Organisations that run on Google Workspace without Microsoft 365 now see their users and devices in the account register, read from Workspace. The register no longer stays empty for a Google-only firm.
Connect your AI app to ECP
Claude, ChatGPT, Copilot, Cursor and other AI apps can now connect to ECP through the ECP MCP server. An administrator switches it on under Settings, Connected AI apps. The AI app then reads your readiness, documents and evidence with the rights of the person who connected, and can fill in one document field after you approve it. A new manual page lists the server URL, the steps per app and how to disconnect.
Read moreFree tools & downloads, no login
Four checks you can run before you talk to anyone. An incident reporting clock shows every CCB deadline from the moment you found out. The NIS2 scope check now uses the legal size test. A NIS2 fine calculator gives the number for your size and category. A CyFun Basic readiness quiz asks nineteen plain questions. The downloads page adds the PANIC sheet (one A4 with six report cards and QR codes), NIS2 in six steps on one page, and our guide for IT partners. We ask for an email address first.
Read moreSecurity groups panel opens on the first group with members
Open the security groups page without picking a group and the right-hand panel now shows the first group that has members, or the first group when none has any. A group named in the link still wins. Devices and accounts show straight away.
Read morePatch drafts a new document to the end
We strengthened how Patch, the assistant in the app, writes a new policy document from scratch. Long drafts now finish and land for approval as a full text, with no placeholder to approve by mistake.
Archive an assessment you no longer need
Every assessment card now has Archive. An archived assessment moves to its own section and Restore puts it back. To delete one for good, delete its wiki page.
Put whole groups outside NIS2, with a reason
On IT environment > Scope, one section lists what is outside NIS2: whole groups, single assets and exclusion rules. Adding a group asks for a reason and shows how many assets it holds before you save. You can take it back in at any time.
The dashboard shows where you stand and one next step
Open the dashboard and you see your status and the one thing to do next. An IT partner inside a client also sees whether the next move waits on them or on the client. The rest is one click away.
Pick the members of a security group by hand
A new group can now be built without a rule. Give it a kind and a name, tick the people and assets, and add them in one go without a reason. A group with a rule still asks for a reason on every hand-add.
Patch sets up your profile with three questions
Tell Patch your sector, your number of employees and your turnover. Patch works out your CyFun level and puts the changes on an approval card. Only owners and admins can approve it, and rows that already match are left off.
Score parts of a risk while you review the assessment
Ransomware on servers is not ransomware on phones. While you review an assessment, you can now score one group of the company on its own: likelihood, impact, owner and treatment. You no longer need the risk register for that. Actions stay on the whole risk. When a part goes back to the rest, its actions move with it.
Read moreNarrowing a risk asks what happens to the rest
Did you narrow a risk to one group in the risk register? It used to drop everything else from the register without a word. Now you get the question what happens to the rest, with what is left, such as 20 accounts: the same risk with its own scores, or not applicable with a reason.
Read moreOne risk, different scores per part of the company
Ransomware on your office laptops is not the same risk as ransomware on the systems you run for customers. In the risk register you can now give one group its own likelihood, impact, owner and treatment, without copying the risk. The rest of the company keeps the old scores until you confirm them, and it shows in Te doen until then. Devices that turn up later land in the rest by themselves, so nothing drops off the register. A risk that does not apply to a group needs a reason, and your auditor sees it in the Statement of Applicability and the audit export.
Read moreMake a group or a boundary by name or ID
On the Scope tab, a condition can now use the name of anything in your register, or the ID of a device or account (applications and networks have no ID yet). You type part of it: is, is not, contains, does not contain, starts with or ends with. Upper and lower case count the same. For example: "name contains 3cx" finds every hosted phone system, and a boundary with "name does not contain 3cx" keeps them out of your organisation. The ID is a serial number (Microsoft 365, SentinelOne, NinjaOne), Entra device ID, AWS instance ID, import ID or account e-mail address; the name never counts as an ID. Bitdefender, Check Point Harmony and Sophos give no ID, so an ID condition never finds their devices. The count shows at once how many match, and the group page and the auditor's export say the rule in words.
Read moreA device that several tools see now counts once
Does Intune see a laptop, and SentinelOne or NinjaOne the same one under another name? Then it is now one row in your register, and it counts once. We recognise the same device by its serial number, then its Microsoft Entra device id, then its name without the domain, and an account by its e-mail address. Your number of devices may go down, and a control may get a different verdict. A rule can now combine facts from several tools on one device, such as ownership from Intune and the role from SentinelOne. Where to look? Open a device in the Asset register: under Seen by you see each tool, what it reports and where they disagree. Wrong merge? Click Does not belong here, give a reason, and undo it there later if needed.
Read moreYour numbers may change: company and personal devices now count apart
Microsoft 365 now tells us which devices belong to the company, which are personal and which accounts are administrators, and SentinelOne tells us whether a device is a laptop, a desktop or a server. Your numbers may change after the next sync. The controls about company devices now count only devices marked as the company's. A personal phone no longer counts there. With more than 1,000 Microsoft 365 users the account count can go up, because we now read every account. What to check? Open the Scope tab to see what counts, and make a group such as "company laptops" there if you need one. Does your IT partner use one SentinelOne key for several clients? Then your IT partner chooses your site once. Until then nothing is read from SentinelOne for you, and SentinelOne devices that were read without a site leave the register.
Read moreNinjaOne, Bitdefender and Check Point now feed your groups too
Your numbers may change after the next sync. Bitdefender now fills in the operating system of each device, which stayed empty before. Bitdefender adds the device type, its company and its group. Check Point adds the device type (a domain controller counts as a server), the operating system and its groups. NinjaOne adds the location and whether a device is a server, a workstation or a mobile device. NinjaOne puts devices on your register only when it is your only device connection, so one laptop never counts twice under two names. Does your IT partner use one Bitdefender key for several clients? Then they choose your company once, and until then nothing from Bitdefender is written for you. What to check? Open the Scope tab to see what counts.
Read moreDecide what each control applies to
In the Scope tab of your register you can now create groups, for example the laptops of one site, and choose what counts. An exception can now cover a single requirement of a control, with a reason and an end date. In Audit Readiness, "Show for" shows where one part of your organisation stands. Open scope questions, such as an exception without an end date, appear on your dashboard. Your existing exceptions stay in force.
See until when each control holds, and what to do next
Every control now shows one status, the same on every screen: "Ready until {date}", "Expiring soon" or "Expired". When something is missing, the control says what, why, and the one thing to do next. Your maturity score is still shown, as a plain number next to it, without green or red.
Monthly, quarterly and yearly checks now count
Some controls need a check that you repeat: a monthly backup test, a quarterly review of who has access, a yearly incident exercise. When one is due, add it to its register or upload new proof, and the control is ready again. The clock starts now, so nothing turns "Expired" today; a check you have not logged yet shows as a to-do with a date, and a monthly one as "Expiring soon".
Fairer maturity totals and reports
Controls marked "not applicable" no longer count in your maturity averages. Reports no longer treat a control without a score as a score of 1: it now shows as not yet scored.
Approval for your own policies and procedures
Policies and procedures you write yourself now go through the same steps as the templates: someone reviews them, every approver approves, then they go online. It is on by default; you can switch it off per document.
Ask someone to review a document
Ask colleagues, or someone without an account such as your IT partner, to review a document. They agree or ask for changes on the exact version they read. When everyone agrees, it moves to approval, and approvers get an email with a reminder.
Approval works on every document type now
Switching on approval for a document you wrote yourself used to work for policies and procedures only. It now works the same way on every document type.
Search the wiki by meaning, not just by word
Search now finds pages that use different words for the same idea, alongside exact keyword matches, so a search for "who patches our laptops" can surface a page about update management even without that exact phrase.
Pick exactly who a role applies to
When a role like "IT contact" holds several people, you can now pick which of them a document or field actually refers to, instead of it always showing the first person on the list.
Group or delete hundreds of assets in one go
Bulk actions on your asset list, grouping or deleting many items at once, no longer stop at a fixed size: select as many as you need and run the action in one step.
Evidence links now open at the right section
Clicking an integration evidence link now scrolls straight to the control it belongs to, instead of landing at the top of the page.
Documents in four clear steps
Every policy now shows where it stands: fill in, review, approve, read. Every named approver approves the version they see, a required field that does not apply gets a short reason, and the history shows who approved which version and when, ready for your auditor.
Ask employees to read and confirm a policy by email
Choose who must read a document: everyone, a group or nobody. Each person gets an email with a personal link, no account needed, and confirms with one click. Reminders, an optional deadline and newcomers are handled for you, and you see per person who still has to read.
See who still has to approve, from any control
The control page, audit readiness and your dashboard now show each document's step and who still has to approve. "Review and approve" always takes you to the document itself, so you approve what you see.
Audit readiness says why a control is not ready
Each control now names the reason it is not audit-ready yet, such as missing or expired evidence, the wrong kind of evidence, or a document that still needs approval, so you know what to do next.
Accounts and employees counted separately
Your declared environment now counts user accounts and the people who work for you separately, optionally from a Microsoft 365 group, so shared mailboxes and service accounts no longer skew your numbers.
Due dates for your learners
Give each person a date to finish their course by. Late finishers are marked overdue, and learners get a reminder mail before their date.
Nothing renews without your yes
A course year never renews on its own. You get reminders 30, 14, 7, 3 and 1 days before it ends, and it only continues when you confirm.
Course invitations come in your MSP's name
Learners invited by an MSP partner get their invitation in that partner's name. A learner who lost their link can have it mailed again from the course page.
Review a template update before you take it
When a newer version of a template page exists, you can walk through it section by section and choose per section to apply it or keep your own text.
Finished training counts as evidence
Every finished #CyberLearn course shows up per person against the security awareness training control (PR.AT-01.1): who finished, who has not, who is due a refresher. Export it as one file with a checksum for your auditor.
MSPs enrol a client's people from its staff list
As an MSP partner you enrol a client's people straight from that client's employee register: everyone, one group or hand-picked people. Enrolments stay in step with the staff list, and nobody gets a mail unless you send one.
A Training page per client
Each client organisation has a Training page with its courses and people, and MSP partners get one overview of training across all their clients.
Straight into the course after paying
Paying online takes you straight into the course, and the buy box disappears once you have access. Certificates come from our own record, so a course finished on a second device still counts. All four courses can be ordered from the #CyberLearn page.
Read more#CyberLearn courses are live
Security awareness courses for your team, in English, Dutch and French. Order a course on its course page; once it is active, you add each person and they get their own link.
Read moreMSP partners can give courses to their clients
As an MSP partner you can assign #CyberLearn courses to the client organisations you manage, at the partner price.
New templates reach existing organisations
Organisations set up earlier now get new templates too. If a page you already have gets a newer version, you see a notice and your page stays as it is.
Policy templates and CyFun guidance checked against the sources
We went through the policy templates and the guidance on CyberFundamentals controls and removed figures and claims we could not trace to a source. References to the GDPR and the AI Act were checked against the official texts and corrected.
Disconnecting an integration removes its data
When you disconnect an integration, the register entries it added are removed, and a sync that was still running can no longer write them back.
Passwords are stored more securely
Resetting a password now also signs you out on your other devices.
See per control what an integration proves
The page of a connected integration now shows, per control, what the data proves: which users or devices meet it and which exceptions are named.
Download a backup of your organisation
Organisation owners can download a full backup from Settings. It is a copy for your own records, separate from an audit export.
Out of scope, with a reason
Mark an asset out of scope and give the reason, which the auditor reads. Rules can keep whole groups of items out of scope, including items that future imports bring in.
Who is responsible for each control
Record for each control who carries it: the MSP, the client, or shared.
One supplier list
The supplier register now shows the suppliers from the asset register. Add, edit or remove a supplier in one place and it changes in both.
Installed software from NinjaOne, grouped by product
The asset register now lists the software installed on your own devices, imported from NinjaOne. Releases are grouped under their product, older releases that are still installed are flagged, and you can mark two entries as the same product.
Clearer access confirmation emails
The confirmation email you receive when you sign in now explains what it is and what each button does. It also names a contact person for questions.
Earlier changes
App available in English, Dutch and French
Choose your language for the whole app: settings, workflows, charts and forms.
Meet Patch and Norm
Patch guides you through audits and suggests next steps in the app. Norm is an independent CyFun assessor that checks your compliance.
Risk assessment page redesigned
See your organization's risks, the controls that address them and the machines not yet covered. You can add internal risks and follow progress on one screen.
Generate a Statement of Applicability
The app lists your controls and shows which apply to your organization's size and CyFun level.
Two-factor authentication (optional)
Add a security key or an authenticator app to your account as a second step when you sign in.
Demo organization comes filled
The demo now has a filled risk register, improvement roadmap and asset inventory to look through.
Control page shows one list of work
See what needs doing, which controls cover it and which machines are still missing, in one list.
Controls validated by your connected tools
Once your systems are connected, the platform checks which controls are backed by the tools you have installed.
Learn articles show their CyFun level
Each security article now shows which CyFun level it relates to and links to the controls that need that topic.
Policy template library
Download ready-to-use policy templates for all CyFun levels, including access control, risk management and disaster recovery. Templates are available in English, Dutch and French.
GDPR and AI Act policy templates
New templates for the GDPR record of processing activities, breach response, processor agreements and AI risk management, in all three languages.
Statement of work generator for partners
MSP partners can create a scope of work and a nulmeting report for a customer and export it as a proposal or an internal handover document.
ECP nulmeting report for partners
Run a baseline assessment for a customer and get a report of the starting point, in the language the organization has chosen.
Nulmeting report in your language
The baseline report is now available in English, Dutch or French, following the organization's language choice.
Work with GDPR and the AI Act next to NIS2
Switch between active frameworks in settings and manage GDPR, EU AI Act and NIS2 compliance in one view.
Better policy suggestions from the AI assistant
The AI assistant now suggests the most relevant of your existing policies for each control.
Mark entities out of scope
Exclude specific devices, users or locations from your compliance scope and see which controls remain covered.
Coverage matrix by device
See which controls cover each device, user or location, and spot the gaps.
Do-it-yourself compliance report
Order a pre-drafted NIS2 scope and baseline report. Start free with the quick check, or subscribe for the full report with quarterly updates.
See missing devices by name
Audit readiness now lists the devices or users your scope does not cover, instead of only a number.
Upload compliance evidence
Attach policy documents, meeting notes or screenshots directly to a control.
Import asset lists from a spreadsheet
Import devices that have several names or IDs, plus departments, locations and teams. You can adjust the column mapping before you import.
Detail page per device or user
See the controls, requirements and coverage that apply to one specific device or user.
Control status badges
Each control shows whether its status is calculated automatically, confirmed manually or overridden.
Co-branded microlearning for MSPs
Send weekly compliance topics to your customers' staff with your own logo and cartoons. Includes an editor, preview, delivery tracking and subscriber management.
NinjaOne backup and device data in one integration
NinjaOne backup and device management data now come in through a single integration card. You choose which parts to import.
Signed audit bundles
Exported audit bundles are now digitally signed, so your auditor can verify that they are authentic.
Try the platform with a demo
Explore a demo environment with sample data and a guided tour. It resets itself, so you cannot break anything.
Learning paths by role
The Learn hub now has separate tracks for SME owners, MSP practitioners and enterprise teams.
Integration overview
See all available integrations in one place: what data each one imports, which controls it covers and which ones are already active.
Concrete steps in audit readiness
Audit readiness now shows specific steps per control, highlights the top 5 quick wins, gives AI action hints and lets you link evidence in bulk.
Aikido endpoint risk detection
Vulnerability data on endpoints from Aikido Security now feeds your assessment, so you can see which devices are exposed and need fixing.
Audit bundle export and re-import
Export your compliance data as a bundle for your auditor. When they send feedback back, import it into your wiki to keep tracking it.
Control health dashboard
See the CMMI maturity score of every control on your dashboard and in the audit readiness list, and follow progress toward level 3.
SentinelOne endpoint detection
Endpoint detection and response data from SentinelOne now feeds your assessment, so you can compare it with your declared scope.
Audit readiness snapshots
Save a snapshot of your compliance status at any time and compare snapshots over weeks and months.
Language selector
Choose English, Dutch or French in Settings for policies, assessments, reports and framework guidance.
Microsoft 365 device sync
Connect your Microsoft 365 tenant once. Devices, security scores and audit logs then fill in answers to your intake questions.
Access and roles
The new Access tab lets you invite team members, give them a role (Owner, Auditor or Viewer) and control who sees what.
Audit readiness export to Excel
Export the audit readiness report as an Excel file with control status, maturity levels and an evidence summary to share with your auditor.
Policy wizard with AI drafting
Start from any control in your assessment and answer questions about your scope. The AI drafts the policy section by section, and you review and adjust each part before accepting it.
Improve policies in place with the assistant
Click Improve on a policy or procedure page and the assistant rewrites the section based on your scope and the control requirements. You accept or reject each edit inline.
Assessment hub with three views
View your assessment as a matrix, a Kanban board by status or a roadmap by priority.
AI assistant for compliance
Ask the assistant about NIS2, CyFun, your policies and your evidence. Answers show the framework sources they rely on.
Search and Documents tab
Press Cmd+K to search your policies, controls and evidence. The new Documents tab shows your compliance library as a tree.
Controls grouped by function
See all your security controls in one view and browse them by function group to check your status.
Team chat
Talk with your team inside the app about your compliance work.
Team invitations
Invite colleagues to your workspace and manage their roles. New members start with a guided assessment.
Onboarding starts with the assessment
Setup now begins with your organization's assessment, so you find out where you stand first.
Document library and control templates
Start from ready-made procedures, policies and plans for your sector and framework, customize them and track their completion.
Scope and coverage tracking
See which devices, departments or locations each control applies to.
White-label branding
Add your own logo and brand colors. Your clients see your brand throughout the interface.
PDF report export
Export compliance reports and assessments as PDF files to share with stakeholders, auditors and authorities.
Evidence page redesigned
The evidence section now focuses on verification, with actions inline and a clearer layout showing what to do next for each control.
Plain-language assessment options
The dropdowns in the assessment now describe each option in plain language.
Evidence records scope and source
An evidence entry can now say which devices or entities it applies to and where it comes from.
Guided workflow with Navigator
The new Navigator walks you through your compliance work step by step, with plan pages that show what to do and in what order.
Feedback from inside the app
Send feedback from the app about what works and what does not.
Import devices and infrastructure from a spreadsheet
Upload a CSV file to import devices and infrastructure. Columns are matched to fields automatically.
Cyber-readiness check
A short guided assessment that shows where your cybersecurity stands today and what needs attention.
Controls as a searchable wiki
Your controls are now organized as a searchable wiki, with the evidence and procedures inside each control page.
Safer magic-link sign-in
Passwordless sign-in now also asks for a 4-digit code, so a forwarded or shared link is not enough to get into your account.
Organizations can be deleted again
Deleting an organization now removes it together with all its data.
Activity log
See who changed what and when across controls, checklists and entities. You can search, filter and add remarks.
Incidents dashboard
Track incidents in a dedicated dashboard with a chat-style log of what happened, who was involved and how it was resolved.
Accessibility improvements
Better support for screen readers, keyboard navigation and color contrast throughout the app.
Checklists with recurring tasks
Guided checklists replace the Evidence system. Set how often each control must be reviewed, and recurring checklists remind you when it is due.
Onboarding uses your own selections
Onboarding now works with the framework and controls you selected, so you can set up your compliance program step by step.
CyFun Basic framework
A lighter framework of 34 controls for small organizations that are starting with NIS2 compliance.
Manage your subscription in the app
See your current plan and the upgrade options, and switch plans without interrupting your work.
Automatic language detection
The app now detects your browser language and opens in it.
Manage team access and roles
Add team members, set their roles and permissions, and control how MSP partners access your organization.
Yearly billing option
Choose between monthly and yearly payment.
Partner onboarding portal
MSP partners can register and add customers themselves in a dedicated portal.
Sign in with magic links
No password needed: sign in with a secure link sent to your email. You can invite teammates with one click.
Comments and activity feed
Comment on tasks and evidence, and follow a live feed of changes in your organization.
Search bar and command palette
Find things with the search bar and move around with keyboard shortcuts.
Manage your IT inventory
Add your employees, devices, networks and workplaces. Search before you add, filter by type and edit details with simple forms.
Track networks and workplaces
Record your network infrastructure and workplace locations as part of your compliance inventory.