KCM GRC Change Log

• We resolved an issue where you were prompted to transfer responsibilities when disabling a Vendor User. You are no longer prompted to transfer responsibilities for the Vendor User user role. To learn more, see Disabling Users and Transferring Responsibilities.
• You can now send questionnaires to vendors when the Vendor Status is "Pending Approval". Previously, the Vendor Status had to be "Active" to send questionnaires. To learn more, please see Sending Vendor Questionnaires.
• The following updated Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • California Consumer Privacy Act Final Text v12.2020 to v3.2021
  • IRS Publication 1075 v9.2016 to v8.2020
  • OWASP v4.0 to v4.0.2 (all levels)
  • Technology Risk Management Checklist Framework - Monetary Authority of Singapore v6.2013 to v1.2021

• We've added several CSV exports to your platform. You can now export information about the scoped requirements, controls, and vendors that you've added to your account.
  • We've also added the Data Exports page to your account. When you create a new CSV export, you will download the CSV file from the Data Exports page. To learn more, see our Data Exports Guide.
• The following updated Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • Australian Privacy Act v12.2018 to v2.2021
  • Australian Government (ASD) Information Security Manual v3.2019 to v4.2021
  • CIS Critical Security Controls (all groups) v7.1 to v8
  • Cloud Computing Compliance Controls Catalogue v9.2017 to v2020
  • Cloud Security Alliance - Cloud Controls Matrix v3.0.1 to v4.0.1
  • Connecticut Insurance Data Security Law v7.2019 to v10.2020
  • Secure Software Lifecycle Requirements and Assessment Procedures v1.0 to v1.1
  • Singapore Personal Data Protection Act v11.2012 to v06.2021
  • UK Cyber Security Essentials v2.1 to v2.2
  • UK Ministry of Defense - Defense Standard 05-138 Issue 2 High Profile to UK Defence Cyber Protection Partnership v6.2020 High Profile
  • UK Ministry of Defense - Defense Standard 05-138 Issue 2 Moderate Profile to UK Defence Cyber Protection Partnership v6.2020 Moderate Profile
  • UK Ministry of Defense - Defense Standard 05-138 Issue 2 Low Profile to UK Defence Cyber Protection Partnership v6.2020 Low Profile
  • VDA - Trusted Information Security Assessment Exchange (TISAX) v4.1.1 to v5.0.4

• We've added Policy Templates under your Policy Management module! Visit the Policy Templates page to download templates and customize policies for your organization. To learn more, see KCM GRC: Policy Templates.
  • In addition to KCM GRC's policy templates, our customers are eligible for a 25% discount when purchasing the Altius IT Policy Collection. See the Policy Templates page in your account to learn more.
• We've added two new Standardized Information Gathering (SIG) questionnaire templates for you to use when creating a questionnaire in your Vendor Risk Management module:
  • 2021 SIG Core
  • 2021 SIG Lite
  Please note, KCM GRC pre-defines the "correct" answers for the questions in our questionnaire templates. The KCM GRC system has defined "N/A" as the correct answer for questions in both SIG 2021 templates:
  • There are 37 N/A answers in 2021 SIG Core.
  • There are 23 N/A answers in 2021 SIG Lite.
  Please refer to this guide to learn more about these questions and why KCM GRC has defined N/A as the correct answer.

• We've made enhancements to our scope export feature. Now, each scope that you export will include all of its requirements and the controls that they are mapped to. For more information please see our Scope Exports article.
  • Previously, scope exports only contained the requirements and controls where one or more tasks had been created for the control.

• We've improved scope exports by adding task names to the folders that contain evidence files, within your scope export folder. To learn more see the Understanding the File Structure section of our Scope Exports article.
• The following updated Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • FedRAMP High Baseline Controls v8.2018 to v6.2020
  • FedRAMP Moderate Baseline Controls v8.2018 to v6.2020
  • FedRAMP Low Baseline Controls v8.2018 to v6.2020
  • FedRAMP LI-SaaS Baseline Controls v8.2018 to v6.2020
  • Standardized Information Gathering (SIG) Core Full v2020 to v2021

• The following new Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • NIST 800-53 High Baseline Rev 5
  • NIST 800-53 Moderate Baseline Rev 5
  • NIST 800-53 Low Baseline Rev 5
  • NIST 800-53 Privacy Baseline Rev 5

• We've added a robust guide to our knowledge base for your users who are assigned to approve tasks for controls: Monitoring and Approving Tasks (a Guide for Approving Managers). This guide will explain the following for users who are assigned to a task as an Approving Manager, Second-level Approving Manager, or Group Lead: 
  • How do I know if I need to approve a task?
  • How do I monitor my upcoming tasks?
  • How do I navigate my account?
  • Understanding task requirements
  • Reviewing evidence and approving tasks
• As of January 15, 2021, the 192.254.121.248 IP address is no longer being used to send emails from the KCM GRC platform. If you have whitelisted notifications from KCM GRC, please see our Whitelisting Notifications from KCM GRC article for the latest whitelisting information.
• We've added a Templates column to the Map Requirement to Scope window (click to view example). When a new version of a managed template is released, this column can simplify the process of updating your scope.
  
  ×

  New Column: Templates

  

  Close
• The following new Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • NERC CIP Cyber Security — BES Cyber System Categorization CIP-002-5.1a
  • NERC CIP Cyber Security — Security Management Controls CIP-003-8
  • NERC CIP Cyber Security — Personnel & Training CIP-004-6
  • NERC CIP Cyber Security — Electronic Security Perimeters CIP-005-6
  • NERC CIP Cyber Security — Physical Security of BES Cyber Systems CIP-006-6
  • NERC CIP Cyber Security — Systems Security Management CIP-007-6
  • NERC CIP Cyber Security — Incident Reporting and Response Planning CIP-008-6
  • NERC CIP Cyber Security — Recovery Plans for BES Cyber Systems CIP-009-6
  • NERC CIP Cyber Security — Configuration Change Management and Vulnerability Assessments CIP-010-3
  • NERC CIP Cyber Security — Information Protection CIP-011-2
  • NERC CIP Cyber Security — Supply Chain Risk Management CIP-013-1
  • NERC CIP Physical Security CIP-014-2
  • Payment Application Data Security Standard
  • Standardized Information Gathering (SIG) Core Full v2020
• The following updated Managed Templates are now available. Contact your Customer Success Manager to have additional templates added to your account:
  • Secure Controls Framework v2020.3 to v2021.1

• We've added the ability to download a CSV file of your Detailed Compliance Reports.
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • California Consumer Privacy Act Final Text
  • California Consumer Privacy Act Amendment AB713
  • South Africa - Protection of Personal Information Act (POPI Act)
• The following updated Managed Templates are now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • UK Cyber Security Essentials v2.0 to v2.1

• We've made the following changes under the Vendor Risk Management module portion of your platform:
  • The Consensus Assessment Initiative Questionnaire (CAIQ) v3.1 Lite questionnaire template has been added to the questionnaire builder.
  • When creating a questionnaire, you can now format custom questions to use multiple lines. When typing, press the Return or Enter button on your keyboard and your formatting will be saved.
• Under the Risk Management module, you can now format a Risk Description to use multiple lines. When typing, press the Return or Enter button on your keyboard and your formatting will be saved.
• The following updated Managed Templates are now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • SAE18 SOC2 TSC vAT-C 105/205 to v3.2020

• The following updated Managed Templates are now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • NIST 800-53 Rev 4 to Rev 5
• You can now navigate to the list of Managed Templates that we offer directly from your platform. From the top right-hand side of your account, click Support > View Managed Templates.
• You can now navigate to KnowBe4's Community Discussion boards directly from your platform. From the top right-hand side of your account, click Support > Community Board. 
  • KCM GRC offers a Feature Request board and a General Discussion board. The General Discussion board is a great place where you can connect with other KCM customers and discuss aspects of your KCM GRC platform.

September 2019

• Regarding the Questionnaire Templates offered under the Vendor Risk Management (VRM) module, we've resolved an issue where the incorrect answer was considered the 'correct answer' for vendor responses. This change affects any questionnaire that includes the question(s) below. Therefore, this will also update the Vendor Score for all applicable vendors. For more information, please reach out to our Support team.
  • Affected Questionnaire Templates: 2019 SIG Lite, 2019 SIG Full
    • Affected Questions: D.7 Are Constituents able to view client's unencrypted Data?
      • The 'correct answer' has been changed from "Yes" to "No"
• Regarding the Vendor Risk Management (VRM) module, we've fixed an issue in the questionnaire builder where the question text wasn't fully visible if it were longer than a single line. 
  • This issue also impacted "free-form" responses from vendors. The issue has now been resolved.
• Regarding the Vendor Risk Management (VRM) module, we've fixed an issue where questionnaire questions were displayed in an incorrect order for vendor users and for KCM administrators when they were completing or reviewing questionnaires, respectfully. 
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • Connecticut Insurance Data Security Law
  • Lexcel England and Wales for In-house Legal Departments
  • Lexcel England and Wales for Legal Practices
  • Lexcel International
  • Portugal Data Protection Law
  • Sarbanes Oxley Act
  • UK Data Protection Act

August 2019

• If you're using OneLogin or Okta as your SSO/SAML provider, you can configure your single sign-on by adding the "KCM GRC Platform" application to your provider's portal. See this article for more information. 
• The following enhancements have been made to the Vendor Risk Management (VRM) Module:  
  • Regarding evidence due dates when using EDR, you can now override the default Effective Date Range Settings (found under Account Settings) on a per-control basis. See this article for more information. 
  • You can now manually offset the Vendor Score found under each vendor profile. From the Vendor Details page, click the Update button to change the existing Vendor Score.
  • You can now include informational questions in your vendor assessments. These questions are not counted against the questionnaire score.
  • Vendor Users can now edit their questionnaire answers after they have been saved, before the questionnaire has been finalized.
  • You can now permanently delete vendor profiles from the Vendor List area of your VRM module.
  • You can now permanently delete questionnaires from the Questionnaire List area of your VRM module.
  • Fixed an issue in the questionnaire builder where you could save questions without adding answer options and were unable to configure the questionnaire as a result.
• Fixed an issue where auditor users were able to view tasks that had not been approved by an approving manager. Auditor users can only see tasks and task evidence that has been approved. See this article for more information about KCM user role permissions. 
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  
  • Australian Privacy Act
  • Australian Prudential Standard CPS 234
  • BDSG - German Federal Data Protection Act
  • MDSAP - Australia: Therapeutic Goods (Medical Devices) Regulations
  • MDSAP - Brazil: RDC (16, 23, 67)
  • MDSAP - Canada: Medical Devices Regulations
  • MDSAP - Japan: MHLW MO 169
  • MDSAP - USA: Title 21 Food and Drug Regulation
  • New Hampshire Senate Bill 193 v8.2019
  • Privacy Shield Framework - EU-US
  • Privacy Shield Framework - Swiss-US
  • Texas House Bill 4390 - Privacy Protection Act

July 2019

• The KCM GRC platform now supports single sign-on and SAML 2.0 to allow your users to quickly and easily log in to KCM using your organization's single sign-on, without having to set up or use a password. See this article for more information.
• Under the Policy Management module, we've fixed an issue where "Invalid Date" was incorrectly showing under Policy Management > Campaigns > Campaign Name > Users tab (in Safari browsers). 
• We've updated the Quarterly Product Update video in our Knowledge Base. This video covers new features that have been added to the KnowBe4 product line over the previous quarter.
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • Brazilian Data Protection Law (LGPD)
  • Commonwealth of Virginia Hosted Environment Information Security Standard SEC 525
  • FERPA
  • Financial Conduct Authority Handbook (UK)
  • Interagency Guidelines - Information Security Standards
  • ISO 27002
  • Texas Administrative Code §202 - State Agencies
  • Texas Administrative Code §202 - Institutions of Higher Education
  • UK Public Sector Network Code of Connection
• The following are updated Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • CJIS Security Policy v5.8
  • HIPAA Privacy and Breach Rule
  • HIPAA Security Rule

• The following enhancements have been made to the Vendor Risk Management (VRM) Module:
  • When reviewing vendor questionnaires, you can now filter questions by the following: incorrect answers, answers with attachments, answers with issues, and informational questions.
  • When reviewing vendor questionnaires, incorrect answers are now visually notated by a red line on the left-hand side of the question.
• In response to the significant growth of KCM GRC, the architecture of your platform was upgraded on July 17, 2019. This upgrade improves performance and allows us to better serve you by streamlining platform administration and maintenance.

June 2019

• The following enhancements have been made to the Vendor Risk Management (VRM) Module:
  • When creating questionnaires, you can now upload a CSV file of custom questions. See here for details.
  • When reviewing questionnaires, you can now change the score of vendor responses from the Questionnaire Review and Issue Details pages.
  • When sending (scheduling) a questionnaire, you can set a suggested due date. The questionnaire assessee will see the due date in their email notification, and in their vendor portal.
  • A Scheduled Questionnaires Calendar has been added to the Vendor Management Dashboard. All questionnaires are listed on the day were sent or will be sent. 
  • You can now cancel active questionnaires from the Assigned Questionnaires tab, under the Vendor Details page.
  • You can now cancel questionnaire schedules (questionnaires to be sent) from the Schedules tab, under the Vendor Details page.
  • If your vendor did not receive the email notification for their assigned questionnaire, you can now generate and send their login link from the Assigned Questionnaires tab, under the Vendor Details page.
  • You can now archive questionnaires that have not been sent or scheduled.
  • Vendor Administrator users can now view vendor profiles and questionnaires that have been archived. See this article to learn more about KCM user role privileges. 
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • Gramm-Leach-Bliley Act Privacy Rule
  • Gramm-Leach-Bliley Act Safeguard Rule
  • IRS Publication 1075

May 2019

• You can now follow this article to stay informed of the new and updated Managed Templates available for your account. Our team ensures we have the up-to-date versions of these frameworks available for your use. Contact your Customer Success Manager to have additional templates added to your account.
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • ASD Information Security Manual v3.2019
  • Commonwealth of Virginia ITRM Standard SEC501 v10.1
  • UK Ministry of Defence - Defence Standard Low Profile
  • UK Ministry of Defence - Defence Standard Moderate Profile
  • UK Ministry of Defence - Defence Standard High Profile
• The following are updated Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • CIS Critical Security Controls Group 1 7.1
  • CIS Critical Security Controls Group 2 7.1
  • CIS Critical Security Controls Group 3 7.1

April 2019

• The Vendor Risk Management (VRM) module was released.
  • The VRM module lets you centralize your third-party risk management processes by prequalifying risk, assessing your vendors, and conducting remediation efforts in your KCM GRC platform. See our Introduction Guide to learn more.
• Updates were made to the User Roles available in your account. This includes updates to the User Management and User Profile pages in your account. See more information in our Working with Users article.
• You can now manage evidence submission settings (DocuLinks and documents) at the scope level–in addition to the account-wide settings. See more information in our Managing Account Settings article, here.
• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • NCUA ACET v1.0
  • DFARS NIST 800-171 SA v11.2017
  • HMG Security Policy v1.0
  • Massachusetts Data Privacy Regulation v2009
• The following are updated Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • CIS Critical Security Controls 7.1
  • CCIS Critical Security Controls 7 to 7.1_Changes

March 2019

• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • PCI DSS SAQ A
  • PCI DSS SAQ B
  • PCI DSS SAQ B-IB
  • PCI DSS SAQ C
  • PCI DSS SAQ C-VT
  • PCI DSS SAQ D Merchants
  • PCI DSS SAQ P2PE
  • PCI DSS - SAQ D Service Providers v3.2.1
  • Secure Controls Framework
  • OWASP Level 1 v4.0
    
  • OWASP Level 2 v4.0
  • OWASP Level 3 v4.0

February 2019

• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • Financial Services Sector Coordinating Council (FSSCC) v1.0
  • NIST SP 800-171 Appendix E v2016
  • FedRAMP High Baseline Controls v8.2018
  • FedRAMP Moderate Baseline Controls v8.2018
  • FedRAMP Low Baseline Controls v8.2018
  • FedRAMP LI-SaaS Baseline v8.2018
  • NIST 800-53 High-Impact Baseline rev4
  • NIST 800-53 Moderate-Impact Baseline rev4 
  • NIST 800-53 Low-Impact Baseline rev4
  • International Traffic in Arms Regulations (ITAR) v12.2018
• The following are updated Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • NIST 800-53 rev4

January 2019

• The following are new Managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • PCI DSS - Self-Assessment Questionnaire A-EP v3.2.1
  • AB-375 Consumer Privacy Act of California v1.0
  • NAIC MDL - Insurance Data Security Law v4th Quarter 2017
  • PIPEDA v12.2018
  • HITECH v2.2009
• The following are updated managed Templates now available for your account (contact your Customer Success Manager to have additional Templates added to your account):
  • HIPAA Privacy and Breach v1.0
  • HIPAA Security Rule v1.0
  • PCI DSS Appendix A v3.2.1
  • CJIS Security Policy v5.7
  • SWIFT CSP v2019

December 2018

• New Managed Template now available (contact your Customer Success Manager to have additional Templates added to your account):
  • SSAE18 SOC2 TSC (AT-C 105/205)
• The ability to create Risk tags was added.
• Added a new tab called Risk Settings to the Account Settings page where you can manage custom categories and risk tags.
• You can now create, edit, delete, and CSV upload custom Risk templates.

November 2018

• New Managed Template now available (contact your Customer Success Manager to have additional Templates added to your account):
  • NIST SP 800-171 A
• Added the user role Risk Administrator.
• Added the ability to map controls to a risk.
• Added the Risk Management report. See here for more information.
• Added the ability to export the Evidence Repository to a CSV file.

October 2018

• The Risk Management Module has been added to KCM GRC.
  • Risk Management simplifies the processes of identifying, assessing, and managing the risks faced by your organization. See here for more information.
• The threat Quick Add screen was added. For more information, see here.
• The View Risk screen was added. See here for more information.
• Added the ability to upload risk templates with a CSV file from the Risk Templates screen.
• Added the ability to import risks to the risk registry with a CSV file.
• Added sample CSV files to download and use as a template when using a CSV file for imports.
• Added colors for the different Risk categories.

September 2018

• The ability to Clone Scopes was added.
• A new Managed Template is now available as a result of revisions to NIST SP 800-171 Rev. 1 (contact your Customer Success Manager to have additional Templates added to your account):
  • NIST SP 800-171 Rev. 1 (updated 06/07/2018)

June 2018

• Executive Reporting features have been added to KCM GRC.
  • Executive Reports give you the ability to send status reports for one or more Scopes at a frequency you choose. See here for more information.
• Two new Managed Templates are now available as a result of revisions to PCI DSS (contact your Customer Success Manager to have additional Templates added to your account):
  
  • PCI DSS v3.2.1:
    • The most current Template for this publication (supersedes PCI DSS v3.2)
  • PCI DSS Changes v3.2.1:
    • Consists only of the changes made to this publication since the previous KCM GRC Template (PCI DSS v3.2)

May 2018

• Multi-Factor Authentication is now available for your KCM GRC platform.
• New versions of Managed Templates are now available (contact your Customer Success Manager to have additional Templates added to your account):
  • CIS Critical Security Controls 7
  • NIST Cybersecurity Framework v1.1
  • NIST SP 800-171 Rev. 1 (Updated 2/20/2018)

April 2018

• New Managed Template now available (contact your Customer Success Manager to have additional Templates added to your account):
  • General Data Protection Regulation (GDPR)
• The Policy Management module was added to KCM GRC.
  • Policy Management allows you to easily track and manage your organization's policy distribution and user acknowledgments. See here for more information.

February 2018

• New Managed Template now available (contact your Customer Success Manager to have additional Templates added to your account):
  • UK Cyber Security Essentials 

January 2018

• Two new Managed Templates are now available as a result of revisions to NIST SP 800-171 (contact your Customer Success Manager to have additional Templates added to your account):
  • NIST SP800-171 2017:
    • The most current Template for this publication (supersedes NIST SP800-171 2015)
  • NIST SP 800-171 Changes 2015-2017:
    • Consists only of the changes made to this publication since the previous KCM GRC Template (NIST SP800-171 2015)

December 2017

• Improved reporting features, such as Gantt charts and additions to the Evidence Repository table

November 2017

• New and improved account settings features:
  • Ability to add a display name and company logo
  • Ability to restrict access to allow only certain IPs
  • Limit control and task documents to DocuLinks and/or uploads
  • Hide your console from KCM GRC support
  • Configure the time needed to prepare evidence for ongoing tasks, when using Effective Date Range (EDR) feature.
• Effective Date Range (EDR) feature release:
  • Allows admins to set start, end, and due date for tasks.
  • End date/Due dates are dependent on Frequency of task. Frequency settings can be manually adjusted in Account Settings.
  • Start, end, and due date can be modified within each Task.
• Set up an advanced, one-time task:
  • Allows admins to set up a one-time task with a start, end, and due date.