Compliance_Essentials

Release Notes

Compliance Essentials 3.0.1

Auguest 14, 2024

This release adds new React-based workflows for system boundaries, assessments, control posture, evidence runs, search inventory, POA&M, baselines, assets, and settings.

New Compliance Operations Experience

• Added a redesigned React UI across the core app pages. Reorganized navigation around compliance health, monitoring dashboards, monitoring management, evidence/artifacts, assessments, and administration.
• Added an app setup workflow to initialize required KV store data and refresh app navigation during setup or upgrade. Framework and Control Management
• Added Framework Setup and Frameworks & Catalogs pages.
• Added support for enabled/disabled framework configuration.
• Added expanded CMMC 2.0 and NIST RMF control catalog data.
• Added RMF-specific metadata support, including CIA categorization and CCI identifiers where enabled.
• Added configurable display settings for control metadata.

System Boundaries and Asset Inventory

• Replaced System Boundaries Overview and System Boundary Detail workflows.
• Added support for framework/profile scope, target baselines, control applicability, FIPS 199 categorization, permissions, and asset linkage.
• Updated CSV import for system boundaries with field mapping and permissions handling.
• Added Asset Inventory page and system asset services.
• Added support for syncing system boundary assets into the app-maintained asset inventory. Compliance Posture and Control Health
• Replaced Control/Domain/Executive Overview with Compliance Posture and Control Health pages.
• Added posture setup guidance for fresh installs.
• Added control status summary storage and calculation.
• Added manual control status override support with revert-to-calculated behavior.
• Added RMF CIA and CCI filters where enabled.
• Updated Compliance Posture to use system boundary control applicability and control status summary data.

Assessments

• Replaced Audit Entries with Assessment Overview and Assessment Detail pages.
• Added assessment creation and import workflows.
• Added assessment scope editing with framework, system boundary, and control selection.
• Added objective evaluation workflows using control objectives.
• Added support for linking artifacts and control gaps to objectives.
• Added audit/activity logging for assessment changes.

Control Detail and Control Gaps

• Replaced Control XML dashboard with Control Detail (reduces thousands of dashboards with one Control Detail Page)
• Added linked searches, control requirements, expanded guidance, RMF metadata, control status, artifacts, and control gaps.
• Added Control Gaps page and unified gap edit workflow.
• Added affected assets and missing evidence/data sources on gaps. Search Inventory, Evidence Runs, and Monitoring Dashboards
• Replaced Custom Content Page with Saved Search Inventory page and Monitoring Dashboards
• Added saved search configuration for schedules, lookback windows, thresholds, linked controls, system boundary enablement, and cloning.
• Added setup seeding of recommended control mappings.
• Added Evidence Run Explorer backed by idx_compliance_results.

Baseline, Training, Artifacts, and POA&M

• Replaced Baseline Management with baselines, baseline groups, allowlist, exceptions, and change records.
• Added bulk import workflows and sample CSVs for baseline testing. Added Training Management with training types, records, and quick filters.
• Added Artifacts & Evidence Repository with artifact type handling, linked controls, linked boundaries, edit protection, and delete confirmation.
• Added POA&M Overview and Detail workflows with updated creation and edit behavior.

Upgrade Notes

Run the app setup workflow after upgrade to initialize KV store collections and seed required lookup-backed data.

Compliance Essentials 2.1.1

April 17, 2024

• Bug Fixes
  • User permission not saving after creating a system in System Overview
  • Mismatched ID’s in OMB lookup causing incorrect data requirements to appear on some dashboards
  • OMB data requirement entry being displayed throughout multiple dashboards
  • User and role names consisting of only numbers were not properly supported under the permissions configuration for a system

Compliance Essentials 2.1.0

November 10, 2023

• Added four new frameworks:
  • Australian Information Security Manual (ISM)
    • 800+ ISM Control dashboards
    • ISM Assessment Overview
  • Essential 8 (E8)
    • 130+ Essential Eight Control dashboards
    • Essential Eight Assessment Overview
  • Australian Energy Sector Cyber Security Framework (AES-CSF)
    • AES-CSF Control dashboards.
  • NCSC Cyber Assessment Framework (CAF)
    • 39 CAF Control dashboards
    • CAF IGP Requirements Overview
• Added ability to add multiple panels to a dashboard at once
• Added System Health Dashboard
• Fixed OMB Overview Drilldown bug
• Updated ‘Reviewer Activity’ visualization to Timeline in the Executive Overview dashboard
• Added 50+ new custom content panels

Compliance Essentials 2.0.1

June 20, 2023

• Supports Multi-system
  • Systems can be split by hosts, index, source, or sourcetype
  • System permissions can be set by user and/or role
  • Practices are hidden/displayed on Practice Overview by System
  • Dashboards can be filtered by systems
• Split ‘OMB Data Inventory’ Data Sets into individual Data Models (Deprecated ‘OMB Data Inventory’ Data Model)
• Added drilldowns to Practice Dashboards from Executive - Overview and OMB Data Requirements Overview
• “No Status/Not Yet Reviewed” added on Overview Dashboards
• Default lookback for Data Models added
• Documentation Updates

Compliance Essentials 1.1.0

February 17, 2023

• Supports multiple frameworks
• ‘OMB Data Inventory’ Data Model added for Data Introspection panel searches (application no longer dependent on SSE)
• Data Tracking Requirements capability and Overview Page added for OMB
• Expanded Guidance now supports Markdown
• Search Head Cluster Environments now supported