-
released this
2026-10-05 11:43:54 +00:00 | 0 commits to main since this releaseCyber Suite — single-tenant export
Version: v2.6.107
Built (UTC): 2026-10-05T11:42:33Z
Source tag: v2.6.107
Image digest: sha256:628b1552b6841cf9288d526995eb516e23502d9851ce1fb377547f5258c9deed
Target: linux/amd64 (CGO_ENABLED=0, static)
Provenance: binary extracted from the cosign-verified image build.yml
published for this commit — never rebuilt here.Notable since v2.6.103 (75 commits):
SCF 2026.3 — please read this one
- The control catalogue moves to SCF 2026.3. The 34 domains are unchanged, but
the SCF Council renumbered most controls and REUSED the vacated numbers: the
control that was GOV-01 is now GOV-02, and GOV-01 now means something else.
1,534 controls become 1,591, assessment objectives 5,956 become 6,446, and
none of the old controls were dropped. - Upgrading refreshes the shipped catalogue on its own, with no action from
you. Your own control register does NOT move until somebody presses
Reset to SCF — until then it carries the numbering you already had. - So the order matters: upgrade, confirm the suite is running this version,
then Reset to SCF in each workspace. Run the preview first — it lists
exactly what will be deleted. If it shows evidence, applicability decisions
or control testing you want to keep, do not reset: tell us, because those
records are keyed to the old control numbers and need translating rather
than deleting. - Risks and threats are now graded per control as Likely or Possible rather
than simply mapped, so a control carries the dozen or so risks that actually
bear on it instead of nearly the whole catalogue.
Controls now carry SCF's own ranking
- Every control states the weighting SCF gives it, 1 to 10, where 10 means a
deficiency would be a material weakness to the programme. 194 of the 1,591
are material; 193 sit at 4 or below. The NIST CSF function and whether the
control bears on people, process, technology, data or facilities come with
it. - Your register picks this up when you Reset to SCF, in the same pass that
brings the new numbering. Coverage figures can then be read with weight in
mind: 82% evidenced says something quite different when the gaps are
weighted 9s and 10s.
Reset to SCF
- An install with its own authored policy library now gets THAT library back
after a reset. It previously restored the generic SCF documents over the
top, and nothing in the product could put the authored ones back. - The catalogue refresh now replaces rather than merges, which is what makes a
renumbering land cleanly, and only one process performs it — so a
deployment running more than one copy of the suite cannot half-write the
catalogue between them.
Projects
- Every project carries a Cyber profile ID — CP-2026-001 — shown before its
name. It is assigned once, never changes and is never reused, so it is safe
to quote in a report, an email or a meeting. - Share a project with /p/CP-2026-001. Whoever opens it signs in as usual and
still needs access to the workspace: the link carries no credential, it
simply lands them on the project instead of the home page. Copy link is on
the project page.
Policies, standards and the control register
- The policies and standards tables drop the summary column, so several times
as many rows fit on a screen. The summary is still searchable and still on
the document; hover a name to read it. - The control register and the RACI matrix filter by SCF domain, so working
inside one domain is a single selection rather than a search term that also
matches any control mentioning it.
Settings
- Workspace settings shows your Workspace ID, with a copy button. It is the
value the Grafana dashboards ask for as the Tenant, and the word a Reset to
SCF asks you to type. It was previously visible only as a placeholder that
disappeared once a display name was set.
Elsewhere in the suite
- Cyber Risk Assessment rescales the register from 5x5 to 4x4.
- Exceptions in GRC become tabs, on both the list and the detail page.
- Cyber Advisory gains a Design tab for the detailed design and data flow
diagram, and a Components tab under Threats. A finished threat model leads
with View rather than offering to run it again, and the Word download no
longer 404s.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- The control catalogue moves to SCF 2026.3. The 34 domains are unchanged, but