Projects release notes

Redesigned Assessments UI for a seamless navigation and workflows

The Assessments UI has been revamped to provide a more streamlined and consistent user experience. Key areas of improvement include Risks, Controls, Requests, Actions, and Questionnaires, with a particular focus on simplifying workflows. These enhancements are designed to make the interface more intuitive and accessible, especially for users who are not GRC practitioners.

Learn more

Risk Manager integration with Assessments

Risk Manager now integrates with Assessments, letting you complete risk assessments directly in the Assessments app without switching platforms. This streamlines the process, helping you manage risk assessments in one place.

Learn more

• New widgets.

• Attach files has a different component to drag and drop files.

• Completing a test now uses radio buttons.

• To change the next reviewer for the test plan after completing the previous step, select Change.

• Confirmations and Adding issues are now in a side panel.

• Filtering and Finding Risks and Controls are now in the sidebar.

On the Controls page, you can update control activities such as walkthroughs, tests, and test plans in bulk.

Learn more

From the Controls page, users can sign off on multiple cards in bulk.

Learn more

Projects

New filters are added:

• Action Status (from Actions)
• Action Priority (from Actions)
• Sign-off Status (from Controls)
• Testing Rounds (from Controls)
• Request Status Term (from Requests)

• Risk Term (from Risk)

Assessments handles up to 10 custom fields for:

• Walkthrough: Is the control designed appropriately?
• Testing: Did this control operate effectively?

Learn more

Custom sort order for the questionnaire records

You can now apply a custom sort order to the questionnaire records when you send them to participants for certification.

You can apply the sort order in the corresponding Results app table, and this order is applied to the records when they are sent in an email notification.

If you do not apply any order, then the records are sorted based on the record IDs in the Results table.

Learn more

Jan 10, 2024

Once a file is uploaded, you can copy the file name and file link and paste it as a reference. You and also download historical files.

Learn more

Projects

Users can have up to 10 control test ratings with customizable names and ratings within a specific Project Type. This expands the previous pass/fail ratings.

Control test automation (assessment drivers) and reporting are coming soon.

Learn more

Users may rename files and view version history. Version history includes versions for renamed files and PDF annotations. Files attached to a request are also available in the new Requested files section for Risk, Control, Walkthrough, Test Plan, and Testing Round.

Learn more

Help was updated to state that a project backup includes the latest versions of uploaded attachments.

Learn more

Improved Assessments navigation and filtering We've updated several aspects of the Assessments interface for easier navigation and filtering of activity cards. This update also supports future functionality expansion in Assessments.

Learn more

Custom Request statuses You can now customize the number of status options available for Requests, and can define your own terminology for each status level.

Learn more

Risk and control events in history and activity log Risk and control associations now appear in the item history and project activity log.

In addition, updates to Data Analytics, Surveys, and Event Report links to risks, walkthroughs, and tests now appear in the item history and project activity log. These updates applies to events that occur anywhere in Projects and Frameworks.

Learn more

Fully customizable sign-off configurations Sign-off configurations for Projects can now be fully customized to meet the unique requirements of review and approval processes across organizations. This feature introduces the ability to define the number of sign-off levels for each type of item in projects, up to a maximum of five, as well as the ability to define custom sign-off role names.

Learn more

File events in history and activity log All events for Supporting files now appear in the item history and project activity log. Logged events include file uploads, deletions, and annotations. This update applies to Supporting file events that occur anywhere in Projects and Frameworks.

Learn more

History and activity log available for archived projects Previously, when a project was archived, its item history and activity log were no longer available. A project's item history and activity log are now preserved and available to review after the project has been archived.

More management functionality in Assessments You can now manage, monitor, and complete more risk and control tasks in Assessments.

Assessments now includes the following features in My Activities:

• Action cards View and complete actions that you have been assigned to resolve issues.

• Issues Add issues to walkthroughs, test plans, tests, and risks, and view issues that have previously been added.

We have also improved display functionality in the Risk and Control Matrix with:

• Risk Owner filter option

• Column config menu to control which columns appear

• Expand and collapse all rows or individual rows

Learn more

New privilege for project type management – The new Project Type Admin privilege provides permissions for users to create, update, and delete project types, without granting full administrative privileges for the project or organization.

This update allows System Admins to delegate project type management tasks to other users in the organization, while maintaining control over elevated administrative permissions.

Project Type Admins may be granted permissions for one or more project types.

Learn more

More Custom Attributes – Projects now supports up to 10 custom attributes for risks, controls, and any other component for which custom attributes can be added.

This update is fully supported for linked items in Frameworks. Bulk Importer also now supports up to 10 custom attributes.

Note that Reports does not support custom reporting dashboards for custom attributes beyond the previous limit of five.

Learn more

Risk Owner role affects display logic in Assessments - A Risk Owner role has been added to the Projects app. With the introduction of this role, the Assess a risk card in Assessments now shows risks for which the user is assigned the Risk Owner role. Previously, this card appeared for users with the Assigned User role for an objective.

Introducing Assessments App Assessments presents the risk and control information, assigned to you in the Projects app, in a simplified view that’s also easy to access. You can use Assessments to manage the risks and controls you have access to, while completing your assessments and testing activities in one place.

Learn more

Redesigned detailed work pages We have redesigned the detailed work pages in the Projects app. The new design is cleaner and easier to use.

The changes are turned off by default. On pages with an available redesign, you will see a banner, and can enable the new design yourself. You can switch back to the old design if there is anything you don't like. Eventually, we will make the new design permanent. Before then, test out the new design and leave feedback at your convenience.

What pages are changing?

All detailed work pages can switch to the new design.

• Narratives
• Risks
• Controls
• Walkthroughs
• Test plans
• Tests

What exactly changes on each page?

When you enable the new design, you will notice several changes.

• Text boxes for information like titles and descriptions have been converted to plain text. This makes content easier to read, especially when you have lengthy descriptions. Clicking on text to edit it will restore the usual text box.
• Information that isn't always required has been reorganized into expandable/collapsible sections. This includes metrics, Results tables, risk-control associations, entity coverage, certifications, control performance, and change history. For many of you, this will significantly reduce scrolling and the feeling of being overwhelmed by data.
• Empty sections now include commentary and links to help, so new users can more easily populate data for the first time.
• Actions that used to be text links are now buttons, making your available options more obvious.

Redesigned detailed work pages We have redesigned detailed work pages in the Projects app. Over the years, we added a lot of features to Projects, and some people reported that things felt a bit cluttered. This new design is more intuitive and relieves that perception.

This change places related options into sets of panels. It's almost entirely visual. Projects will continue to work the same way they did before.

What exactly changed:

• Narrative details pages: segmented into panels that contain related elements.
• Control details pages:
  • Segmented into panels that contain related elements.
  • The Control X-Ray/Procedure X-Ray button is now on the right side of the page, above the panels in the right column.
• Risk details pages: Segmented into panels that contain related elements.
• Walkthrough/Execute Procedure pages
  • Segmented into panels that contain related elements.
  • The Control X-Ray/Procedure X-Ray button is now on the right side of the page, above the panels in the right column.
• Test plan pages
  • Segmented into panels that contain related elements.
  • The Control X-Ray/Procedure X-Ray button is now on the right side of the page, above the panels in the right column.
• Testing round pages: Segmented into panels that contain related elements.

Introducing Utility Toolbar We’ve added the Utility Toolbar to Projects. It's a slim quick access toolbar where the Issues (formally Issue List), Requests, To-dos, and Time entries (formally Time Tracking) side panels now display with a click of an icon.

The functionality behind adding and viewing Issues, Requests, To-dos, and Time entries within the panels is still the same. This change is to help optimize your workspace, and is the first of a number of usability improvements we will be rolling out in Projects in the future. Learn more

Relocated sign-offs The sign-offs section for the Narratives, Walkthrough, Test Plan, and testing round pages is now located on the right side of these pages. This change is part of a number of usability improvements coming to Projects.

Copy project types We've added the ability to copy a project type. You no longer need to create a new project type and manually add existing configurations in order to make a copy. Learn more

Update actions post-sign-off Professional users can now follow up and change actions that become restricted post-sign-off, including: 

• Leaving comments
• Adding attachments
• Setting completion dates
• Changing the status

Learn more

Strengthen the cybersecurity posture of your organization by using the Cybersecurity Maturity Model Certification (CMMC) 2021 in HighBond The full set of controls for Cybersecurity Maturity Model Certification (CMMC) are now available for HighBond.

The CMMC framework includes a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. There are 5 separate frameworks and each level consists of a set of processes and practices, with the practices ranging from basic cyber hygiene at level 1 to advanced or progressive cybersecurity at level 5. Essentially, each level up indicates a higher degree of protection for sensitive information. In order for an organization to achieve a specific CMMC level, it must demonstrate achievement of all of the preceding lower levels.

There are a total of 5 frameworks in this release. Import or learn more or get content.

New header alert You can now display a custom or default message as a red banner at the top of each page within a project. Learn more

Unlink an asset from a risk category in a project ITRMBond subscribers can now remove the association between an asset and a risk category in a project. Learn more

Arrange, sort and filter Controls table by Assigned User The Controls Dashboard now has an Assigned User option, which makes it easier to:

• See which team member, or Assigned User, is testing controls.
• Find specific controls and their tests by Assigned User.

This option is now available in the following menus:

• The arrange columns dropdown menu, which you can also use to show/hide the Assigned User column.
• The sort dropdown menu.
• The filter side panel.

There will be up to four testing rounds, which means an equal number of new Assigned User columns and entries in each menu. Terms for the testing rounds are also configurable. Learn more

New Controls tab We have added a new Controls tab. Now, you can see an overview of your controls in a customizable table, navigate to the procedures or walkthroughs and test plans associated with those controls, and see their results at a glance. You can show or hide this tab in your project type settings. Learn more

To support this change, we've also introduced the ability to customize the plural term for controls in project type settings.

• You now have breadcrumb-style links in the header that give better insight into where you are.
• We have simplified the menu you can use to switch between projects and frameworks. We have removed the portion you could use to navigate to different places within the Projects and Frameworks apps.

New page headers We are continuing to release improved page headers in more apps. These headers provide more consistent design and easier navigation throughout HighBond.

In Strategy, the tab menu was previously on the right side of the screen, but has moved to the left on the redesigned page header.

In Assurance Plans, we have removed a menu that you could use to switch between projects and places within the Projects app from the header.

• For controls that are linked to source controls in a framework, in the Control X-Ray panel, we have added a link to the source framework.
• For projects and frameworks, on the Fieldwork tab, we have replaced the “Control definition” header with the name of the control.

Strengthen the cybersecurity posture of your organization by using CIS Controls IG1 version 8 (2021) in HighBond The full set of controls for CIS Controls IG1 version 8 (2021) are now available for HighBond.

Version 8 is the latest version of CIS controls needed by organizations to accomplish security and privacy objectives. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. 

This control catalog contains 18 cybersecurity controls to ensure and support an IG1 organization’s compliance against diverse set of threats and risks. A company self-identifies as IG1 when resources and cybersecurity expertise are limited and the impact of implementation is low. IG1 is considered to be Basic Cyber Hygiene. Learn about frameworks or see other content for security and IT compliance.

Strengthen the cybersecurity posture of your organization by using CIS Controls IG2 version 8 (2021) in HighBond The full set of controls for CIS Controls IG2 version 8 (2021) are now available for HighBond.

Version 8 is the latest version of CIS controls needed by organizations to accomplish security and privacy objectives. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines.

This control catalog contains 18 cybersecurity controls to ensure and support an IG2 organization’s compliance against diverse set of threats and risks. A company self-identifies as IG2 when resources and cybersecurity expertise are moderate and is typically focused on technical mitigations to manage sensitive client or company information. Learn about frameworks or see other content for security and IT compliance.

Strengthen the cybersecurity posture of your organization by using CIS Controls IG3 version 8 (2021) in HighBond The full set of controls for CIS Controls IG3 version 8 (2021) are now available for HighBond.

Version 8 is the latest version of CIS controls needed by organizations to accomplish security and privacy objectives. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines.

This control catalog contains 18 cybersecurity controls to ensure and support an IG3 organization’s compliance against diverse set of threats and risks. A company self-identifies as IG3 when resources and cybersecurity expertise are mature and is typically very technically focused on security automation for reducing zero-day and targeted attacks. Learn about frameworks or see other content for security and IT compliance.

• On the Dashboard tab, in the My work status table, the order of objectives matches any sorting you have applied on the Fieldwork tab, in the Objective List table.

  Note: You have to refresh your browser to see the changes on the Dashboard tab.

• For projects and frameworks, on the Fieldwork tab, we have improved the menu you use to navigate between different controls and aspects within those controls.

Bulk update the assigned user for control tests You can now bulk update the assigned user for multiple controls at once. Then, that user gets one digest email notification, instead of one email per control. Learn more

Expanded permissions for bulk updating control and testing attributes Bulk updates in Mission Control are no longer restricted to Launchpad System Admins only.

Learn more about the new bulk update permissions

We have made several improvements to the People tab in the Scheduler app:

• We have added a column that shows the number of scheduled and remaining hours for each user, so you can see at a glance if a user has been scheduled for too many or too few hours for the time frame you’re viewing in the scheduler.
• You can now choose to view the Gantt chart by week, month, quarter, or fiscal year, and jump to either today or a specific date.
• If a user is scheduled to a phase outside of the time frame that’s currently visible in the Gantt chart, the phase now displays anyway, so you can check when they’re scheduled for that phase.
• You can click and drag the start, end, or an entire bar to adjust scheduled project time within the visible portion of the Gantt chart.

Notification improvements We have made some improvements to the communications you receive when you bulk update controls.

• When you bulk update the Owner for multiple controls, the new Owner now receives one digest email notification rather than one email per control.
• We have improved the readability of the messages that let you know whether you have successfully or unsuccessfully updated one or more controls.

Learn more

Usability improvements when bulk updating controls We have made some helpful improvements to the bulk update process.

• When you change an attribute, a blue dot appears next to the attribute name, indicating that it will change.
• When you change an attribute, a small reset icon or link appears, so you can quickly undo that change.
• You can now set any attribute to "blank". Doing this removes the data from that attribute. It does not revert your changes.
• When bulk updating controls, the Update and Cancel buttons are always visible when the list of attributes is taller than your browser window.

Cosmetic improvements We have made cosmetic changes to better standardize Mission Control.

• Better, more colorful icons
• When you examine a control, custom attributes are now on the right side, below the rest of the attributes

We have made a variety of enhancements to the People tab in the Scheduler app.

• You can now assign resources to projects and phases to ensure you have adequate capacity to complete planned projects. Any tasks (planning files, objectives, and results files) that were previously scheduled are now displayed as phases (planning, fieldwork, results). This change offers a less granular Gantt chart view, more flexibility, and ease of scheduling resources to significant stages in a project.
• You can now account for absences that are not based around project functions, such as vacations, leaves, professional development, administrative tasks, and more.
• Project Admins can now configure the default working days and full-time hours for people in their organization. They can also set individual hours if they need to specify different work hours for certain people. This information is used to calculate how many hours a resource is expected to work, and how much of the resource's time can be spent on project work.

Learn more

Labels for My Fieldwork status For better concision and clarity, we changed some of the labels in the My Fieldwork status dashboard tool:

• My Fieldwork status is now called My work status.
• The Preparer review column in the table is now called Prepared.

Learn more

Offline Projects The latest release resolves the following customer reported issues.

• Custom Terms were overflowing the sidebar and not wrapping around when they contained long words without spaces. (OPM-851)
• Line spacing was not maintained in the Description field when text was copy-pasted with new line characters or edited in the web application with new line characters. (OPM-933) and (OPM-864)
• The Risk/Impact and Owner fields were mandatory, but they should be optional. (OPM-886) and (OPM-930)
• Names in the Next Reviewer dropdown list were not sorted alphabetically. OPM-934
• Random text displayed in the Impact and Likelihood fields under Associated Risk when the fields did not have any selected value. (OPM-935)
• Newly created issue under Walkthrough did not display the saved field values. (OPM-940)

Note To upgrade to the latest version of Offline Projects, check in all checked out sections to auto-update Offline Projects to the most recent version.

A new harmonized security and data privacy controls framework Added a the Secure Controls Framework^TM Harmonized Controls - a comprehensive catalog of controls harmonizing requirements across about 100 statutory, regulatory and contractual frameworks spanning multiple geographic regions.

• Learn more or import
• Get content

Project Admins now have the flexibility to define who can update the status of an action. The new option (Allow anyone to update the status of actions) is available under System administration > Settings.

• Enabled Anyone with access to actions can update the Status field (default).
• Disabled Only licensed HighBond users with access to actions (Professional Managers, Professional Users, Oversight Executives, and action creators) can update the Status field.

The new option applies to all projects in your HighBond instance.

Learn more

COVID-19 toolkit We've released the first phase of our COVID-19 toolkit. This toolkit is available for free to all customers. It includes a pandemic risk and response management framework and enterprise risk, a data analytics package with COVID-19 infection data from Johns Hopkins University, and more.

Cloning or importing items To better handle copying items from different project types, we have implemented the following behavioral change:

When cloning or importing items, if the target project or framework has a required field that is blank, the first available value from the required field is chosen.

To learn more, see the following topics:

• Cloning and importing objectives
• Importing narratives
• Importing risks
• Importing procedures or controls

Action fields Issue owners, while still maintaining control over action fields, can now allocate some responsibility to action owners. Action owners can specify when they have completed an action.

These completion updates can be collected in a systematic and reportable way, and are accessible to all action owners.

To support this enhanced workflow, we made the following changes:

• A new Submitted On field has been added to enable action owners to choose their completion date.
• The Discussion tab has been renamed to Update Action to better indicate the area where the action owner makes updates.
• All users (including assigned action owners without access to HighBond) can interact with the Update Action tab.
• The action Status field has been moved to the Update Action tab so that action owners can update their status of completion.

  Tip

  Issue owners can still maintain control to close the action, using the Action state field.

• The default action status option (Closed) has been renamed to Completed.

Learn more

Working with issues When you create or update an issue from the Issues tab or Issue List panel, you can now interact with the page in context while the side panel is open. We have also reordered the list of fields and made some styling improvements in the side panel. Learn more

Automatic issue assignment When you bulk upload issues and specify a HighBond user's email in an owner field (Owner, Executive Owner, Project Owner), the person is now automatically assigned the issue in Projects.

Previously, automatic issue assignment via bulk upload was not supported. Learn more

Deleting items associated with certifications Before you can delete an item associated with a certification, you must either remove the item from the certification or delete the certification. Learn more

Deleting projects containing certifications

• If you temporarily delete a project, the Results collection is archived.
• If you restore a deleted project, the Results collection is also restored, and the certification process resumes.
• If you permanently delete a project, the Results collection is archived and no longer displays a link to the project.

Learn more

Importing risks or controls When you import risks, you can now choose to include associated controls. Similarly, when importing controls, you can also choose to include associated risks.

• Learn more about importing controls
• Learn more about importing risks

The updated HighBond mobile app for iOS 5.6 fixes the following customer reported issues:

• HighBond Help is pointing to the Support website instead of Help website. (MOBDEV-2789)
• Reference to www.aclgrc.com should read www.highbond.com. (MOBDEV-2790)
• Unable to edit Did this Control operate effectively? when Are you testing this key control as part of this testing round? is equal to Yes. (MOBDEV-2796)
• Japanese text display is distorted in the iPad app. (MOBDEV-2801)

The updated HighBond mobile app for Android 2.5 fixes the following customer reported issues:

• Unable to capture evidence from testing tab using the camera. (ANDROID-417)
• HighBond mobile app crashes when using the camera. (ANDROID-425)

Redesigned and simplified emails We have refreshed the design and content of our HighBond emails, making them simpler and easier to act on.

If you have specified a logo for your organization in Launchpad, the logo now displays in the footer of all system email notifications, which helps users identify that the notifications are from a legitimate source. Learn more

The updated HighBond mobile app for iOS 5.5 includes:

• Visual updates associated with our rebranded company and platform, including new logos and names. (MOBDEV-2771 and MOBDEV-2772)
• The ability to view and remove images inserted in rich text fields. (MOBDEV-2779)

The following customer reported issues have also been resolved:

• Unlinking risks and controls does not work. (MOBDEV-2647)
• Error message displays when creating a request and leaving the Contact Email field blank. (MOBDEV-1590)
• Difficult to see table headers as font color and background color is very similar. (MOBDEV-2786)

The updated HighBond mobile app for Android 2.4 includes:

• Visual updates associated with our rebranded company and platform, including new logos and names. (ANDROID-397 and ANDROID-398)
• The ability to view and remove images inserted in rich text fields. (ANDROID-404)

The following customer reported issues have also been resolved:

• Text is being duplicated when editing information within rich text fields. (ANDROID-411)
• A previously viewed planning overview page opens when you edit the planning overview for a different project. (ANDROID-412)
• Text typed into fields is not being display when creating a new project item. (ANDROID-414)
• Mobile app requests permission to access Phone and Device ID & Call Information. (ANDROID-402)

• Remediation Deadline
• Actual Remediation Date
• Retest Deadline Date
• Actual Retest Date

New role Assign control owners that are responsible for control testing the Contributor Tester role.

Users assigned the Contributor Tester role have the same permissions as Contributor Users, with the addition of read and write access to walkthroughs and tests they own in Projects and Mission Control.

Learn more

Mission Control Frontline staff can now evaluate the design and operational effectiveness of controls, view test plans, and easily access critical information about controls. Learn more

• The Assurance Plans Admin privilege provides read and write access to assurance plans. Learn more
• Use the Risks tab to see how your plan aligns with your organization's strategic risks. Learn more

Scheduling projects

• Add planning files, objectives, and results files directly from the Scheduler to build out your projects.
• View all projects by fiscal quarter or fiscal year.
• Filter by collaborator to view a team member's workload across multiple ongoing projects.
• The timeline start now defaults to the current day of the previous month.

Learn more

Assurance plans

• Download an assurance plan report in .docx or .pdf format to share with stakeholders.
• View a complete history of changes to an assurance plan.
• View each project's status and allocated hours in an assurance plan.

Learn more

The updated ACL GRC mobile app for iOS 5.4.7 fixes a scrolling issue associated with accessing different organizations.

Use the Scheduler to easily manage timelines and dates across the different phases of all active projects. The interactive Gantt chart allows you to quickly determine the risk of schedule slips, dependencies, and audit schedule overlaps. Learn more

The updated ACL GRC mobile app for iOS 5.4.6 includes:

• Support for fields that are automated using Assessment Drivers. (MOBDEV-2700 and MOBDEV-2701)
• Support for Super Retina display for iPhone X. (MOBDEV-2721)

• a maximum of 400 highlights and links (total of both)
• a maximum of 30 files per link
• a maximum of 200 clippings per file

Learn more

• consolidating the To-dos (Mine) and To-dos (Others) tabs into a single view, and adding improved filtering and sorting options. Learn more
• adding improved filtering and sorting options to the Requests tab. Learn more
• adding improved filtering and sorting options to the Reviews tab. Learn more

The updated ACL GRC mobile app for Android 2.3.4 includes:

• Support for fields that are automated using Assessment Drivers. (ANDROID-367)
• Preventative measures for editing text containing citations. (ANDROID-368)

The following customer reported issues have also been resolved:

• The objective Owner field is mandatory and should be optional. (ANDROID-323)
• When you add an issue, the Published field displays old user role names: "Client, Executives, and External Reviewers". (ANDROID-362)

The updated ACL GRC mobile app for iOS 5.4.5 implements preventative measures for editing text that contain citations. (MOBDEV-2704)