October 2026

Key Features & Enhancements

Assess your readiness for PDPA Malaysia and RBI requirements

Stay prepared for evolving regulatory requirements with three new compliance frameworks in Scrut:

• PDPA Malaysia
• RBI Digital Payment Security Controls for NBFCs
• RBI Cybersecurity, Technology Risk, Resilience and Assurance Directions, 2026

Add the frameworks relevant to your organization from Compliance → Frameworks. Scrut automatically maps overlapping controls and evidence from frameworks you already manage, such as ISO 27001 and other RBI frameworks, helping you identify gaps, track outstanding requirements, and assess your compliance posture without duplicating work.

Keep security reviews moving with access approvals from your AI assistant

Managing Trust Vault access requests can be time-consuming, especially when you have to handle them multiple times a week. For each request, you have to open it in Scrut, check who is asking, and review which documents they want. You then choose the NDA type and expiry, and decide whether to grant full or partial access. When requests come in daily, repeating these steps slows you down. Prospects wait longer for access, and the queue keeps growing.

With Scrut MCP connected, you can now review, approve, and decline Trust Vault access requests right from your AI assistant. Tell it your preferences, such as the NDA type, expiry, and which documents to share, and it takes the action for you. Your assistant confirms your choices before it acts, so you stay in control while the queue clears faster.

Control who can access your vendor questionnaires

GRC program managers and vendor risk teams usually send a questionnaire to one or two vendor contacts. Until now, the Vendor Portal showed it to anyone on that vendor’s email domain. People who were never sent the questionnaire could see it. You also couldn't add contacts with personal email addresses, such as Gmail. That blocked you from working with smaller vendors and consultants who have no work email.

With the revamped Vendor Portal, you can now:

• Restrict access to assigned contacts: Only the vendor POCs you send the questionnaire to, or those added by an existing assignee, can view and respond to a questionnaire.
• Include contacts with personal email addresses: Assign vendor POCs who use personal email domains, such as Gmail. This is especially useful when working with smaller vendors or independent consultants who don't have a corporate email address.
• Approve additional access: Vendor contacts cannot add assignees from other domains or with personal email addresses. These requests come to you for approval, so you stay in control of access.
• Get clear visibility into questionnaire access: Know exactly who can view and submit each questionnaire before reviewing responses.

Manage risks without unnecessary tasks

Managing risks often involves more than creating mitigation tasks. You may already have controls in place, rely on insurance coverage, or have long-term mitigation activities underway. The previous risk workflow was restrictive, making it difficult to reflect your actual risk treatment strategies.

The revamped risk workflow gives you more flexibility to manage risks without unnecessary tasks or workflow roadblocks. You also get clearer risk statuses, a timeline to track progress, and greater control over treated risks, approvals, and reviews.

Here's how the new workflow works:

1. Assess: Evaluate the inherent risk.
2. Choose: Select a treatment strategy: Accept, Avoid, Mitigate, or Transfer.
3. Link: Associate relevant controls with the risk.
4. Optional: Create mitigation tasks only when needed. You can also update residual risk while mitigation tasks are still open.

Other Updates

Evidence Collection

• Accurate evidence statuses: Evidence statuses and next review dates now update automatically when your fiscal year or recurrence changes. You can see what is uploaded, pending, or needs attention quickly, without opening each evidence task.

Vendor Risk Management

• Share flagged answers with vendors: When you flag a vendor's answer and notify them, they can now see the flagged answer and your comments in the Vendor Portal.
• Customize questionnaire order: Reorder questions in intake forms, questionnaire templates, and questionnaires using drag and drop. Preview the new order before saving. Follow-up questions stay with their parent questions, and question numbers update automatically.

Audit Management

• Record the audit firm on external audits: When creating an external audit, you now select an audit firm from your organization's existing list or add a new one. The firm name is also displayed on the audit details page. This applies to external audits only.

Vulnerability Management

• Close affected resources on third-party scan findings: Close individual affected resources from third-party scan findings or select multiple findings or resources to close them together.

People and Access

• Start every access review cycle fresh: Recurring access reviews no longer carry forward the previous cycle's Approved status. Deleted applications are automatically excluded from the next cycle.
• Upload role names with special characters: Access review file uploads now accept role names with hyphens and other special characters.
• Delete training campaigns at any stage: You can now delete campaigns that are In Progress or Completed, as well as ones that have not started.
• Get up to date on ISO 27701: Help your team refresh their privacy knowledge with updated ISO 27701 training content and quiz questions, so they can better understand and apply privacy requirements.