Backlog

Next up

In Progress

Done

Main Roadmap

Add the ability to send vendors questionnaires through the vendor management platform

In Review

Vendor Questionnaires

Lewis Carhart

<ul><li>Pick a commercial-grade provider (Auth0, AWS Cognito, etc.) for enterprise; open-source SSO won’t reassure large buyers.</li><li>Add basic SCIM user provisioning later, but get SAML/OIDC login out first.</li></ul>

Anthony Green

Adding the ability to manage controls would allow everyone to tailer the SOC2 Controls to best match their companies and requirements. I have a number of Controls in my pre-import documents that are not a perfect match for the available controls, and the ones I need are perfectly in line with SOC2. Example for my Disaster Recover Policy: Mapping to SOC 2 Trust Services Criteria<ul><li>A1.1–A1.3 (Availability)</li></ul><ul><li>CC7.1–CC7.4 (System Operations)</li></ul>

Controls - Add/Edit/Delete

wbechard-corum

As an alternative to installing the CompAI agent, would be great to just leverage existing MDMs and their API’s to pull end users’ device data to find out if their machines are encrypted, have an anti-virus, etc.

Integrate with MDMs (i.e., JumpCloud, Intune, Endpoint Central) to pull user endpoint info

lravelo

I propose a feature where we can store documents and other evidence, linked to appropriate controls. This allows a one stop evidence store for audit purposes. <ul><li>Should allow the use of private S3 buckets to securely store evidence in the desired bucket (We’re in Canada, we want our data to stay in Canada).</li><li>Can tag the relevant controls</li><li>Should list the controls tagged</li><li>Controls UI should show the evidence tagged to each control, and show the list of items.</li><li>Data - document_filename, document_name, document_type, created_date, updated_date, uploaded_by </li></ul>This feature would be hugely beneficial for companies using CompAI and using their own third-party auditors.

Evidence Vault

<ul><li>Link tasks to risks so owners have clear deliverables.</li><li>Add fields for due date, next review date, residual risk, sign-off status.</li><li>Implement automatic reminder emails / in-app alerts keyed off those dates.</li><li>Keep a version history every time a risk or mitigation is edited.</li></ul>

Mature risk module - Link tasks to risks

Would love to have an automated AI assistant that I can send our customers questionnaires to and it would help me draft the responses, so I can just review them and send.

AI security / vendor questionnaire filler

Markus Palm

Add NIST 800-53 Framework

Mariano Fuentes

Add the ability to link risks/vendors to policies/controls, e.g. if ransomware risk has a high inherent risk, after you link it to a control or policy, that risk becomes residual..

Link Risks/Vendors to Policies or Controls

We are evaluating the option to move from Drata. One issue is that we manually need to copy and paste everything, which takes a significant amount of time and is a major stopper — policies, evidence, and so on.Is it any way to Import from Drata (or Vanta as well will be beneficial to others).I can show the ZIP file format (there is a structured tree inside the zip that can be easily parsed).Both Drata and Vanta offer the option to generate an auditor's offline ZIP file for auditing your company.

Import from Drata/Vanta

Ievgen Iosifov

Completed

Add Support for ISO 27001

Claudio Fuentes

Add Support for GDPR

Currently its unclear what to do after signing up , this is meant to provide a “wizard” type experience that walks a user step by step on how to become compliant.

Guided Onboarding Experience

It would be nice if we could export the policies as PDF. We have a client that is asking for specific policies to review so it will help a lot if we can export these directly from the UI.

Export Policies to PDF

Marko Ilievski

Add the ability to add attachments to vendors &amp; risks

Attachments for Vendors & Risks

Add a trust portal for employees to sign policies and complete training.

Trust Portal

<img data-width="100%" data-align="left" data-featurebase-content-key="67f3ef88c36cf1caece13051/post/68c2e3a16eaabecc7e18ac6b/01993948-8ac9-7e9a-a709-2481bae9d667/b64u-aW1hZ2UucG5n.png" src="https://67f3ef88c36cf1caece13051.featurebase-attachments.com/c/post/68c2e3a16eaabecc7e18ac6b/01993948-8ac9-7e9a-a709-2481bae9d667/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260823T230000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260823%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=9a886aa9ac1671761a55dc545522f955972975f7c1a2e689a8b302bd52cb4441" data-featurebase-content-filename="image.png"> The table should have quick filters by department (missing field, added as feature request) and by admin. that way I can quickly review wchich ones I need to approbe.

Policy Table Filter

Francisco Saez

The initial policies are half-baked, and it's not clear whether I should accept them as-is, try to keep working on them by myself, or wait for someone (or a bot) to help me with them in a certain future point in time (e.g. after finishing other steps)

Comp AI

Main Roadmap