We're constantly working to make compliance even easier. This article summarizes 2025 launches by month. For the full marketing changelog, see the Product Updates page. For newer releases, see 2026 Product & Feature Updates.

New features and updates

The new Audits Module brings the entire audit process into Secureframe, allowing teams to manage assessments from start to finish in one place. Admins can create audits, invite auditors, and assign internal stakeholders. Auditors can review requests, accept or reject evidence, ask for more information, and add new requests all within the platform.

A complete audit history is stored for future reference, giving teams a clear, organized view of what was submitted, when, and by whom. This centralized experience helps compliance teams and auditors work more efficiently, move through audits with greater clarity, and stay aligned throughout the process.

Learn more: Audits Module.

Evidence uploads now include an Activity Completion Date to show when the work being documented occurred. This completion date appears alongside the upload date in the evidence detail view.

This enhancement improves clarity for audit scoping by distinguishing when evidence was gathered from when it was submitted. It supports more accurate audit preparation and helps ensure the right evidence is selected when audits are generated in the Audits Module.

Organizations working toward FedRAMP 20x compliance can now generate a machine-readable JSON export that aligns to the program’s Key Security Indicators (KSIs). The export includes system details, control health, test results, and evidence references in a consistent, structured format designed for assessor review.

This export streamlines the submission process and supports a faster, more efficient assessment experience, helping teams save time while aligning with the goals of the new FedRAMP 20x program.

A new Trust Center feature now allows teams to replace an existing resource and notify previously approved users when a new version is available.

This workflow makes it easier to keep customers, vendors, and partners informed when documents like security reports or certifications are updated, ensuring everyone has access to the most current information without needing to check the Trust Center manually.

Learn more: Getting started with Secureframe Trust Center.

Secureframe now offers automated email notifications that alert users to test status changes over a selected time period. Teams can choose to receive these updates daily, weekly, or biweekly, with notifications summarizing tests that changed from passing to at risk, failing, or any other monitored status shift.

Weekly emails are enabled by default for Admins and Super Admins, who will see all test status changes. Other users will receive updates only for tests they own. This feature gives teams visibility into emerging risks and helps maintain a strong compliance posture between audits.

Learn more: .

New features and updates

You can now run Gap Assessments for any framework in Secureframe. This makes it easier to evaluate your organization’s readiness, identify control gaps, and prioritize remediation, whether you’re working toward SOC 2, ISO 27001, NIST 800-171, or other frameworks.

Gap Assessments automatically compare your current posture against framework requirements and provide a clear, actionable view of what’s missing, helping you save time, streamline preparation, and scale compliance across multiple standards.

Learn more: Using the Frameworks Views in Secureframe.

Admins can now mark employees as out of scope and include a rationale, either individually or in bulk. This update is particularly useful for employees who are temporarily out of scope due to leave or reassignment, offering broader flexibility to reflect real-world workforce changes and improve audit transparency.

Learn more: Understanding personnel statuses & scoping.

Secureframe now supports Snowflake, a cloud-based data platform that provides a single service for data warehousing, engineering, science, and applications.

This integration automates testing for key security areas including authentication, high availability, firewall rules, and alerting, allowing teams to maintain continuous compliance without additional configuration.

Learn more: Snowflake.

Extend Secureframe’s automation to any system, even those not covered by native integrations. Custom Integrations let you ingest, map, and test compliance-related resources such as user accounts, devices, training records, and cloud infrastructure.

This release gives organizations flexibility to tailor Secureframe to their tech stack and avoid vendor lock-in by automating evidence collection from non-standard sources.

Learn more: Create Custom Integrations.

Secureframe now integrates with Freshservice, enabling bi-directional syncing similar to our Zendesk integration. Use Freshservice as a task destination and sync tickets to track compliance for incidents, vulnerabilities, nonconformities, system changes, and user access based on SLAs.

This integration eliminates manual evidence uploads and supports organizations using multiple Freshworks products by covering both customer-facing (Freshdesk) and internal ITSM (Freshservice) workflows.

Learn more: Freshservice.

We’ve added support for GovRAMP Core, a streamlined version of the GovRAMP Low and Moderate baselines. This framework simplifies the authorization process and helps organizations demonstrate compliance readiness more efficiently.

New features and updates

We’ve added full support for the EU Artificial Intelligence Act, the European Union’s landmark regulation for AI governance. The framework introduces a risk-based approach to categorizing and safeguarding AI systems.

As interest in AI accelerates, this framework helps organizations stay ahead of regulatory requirements and implement ethical, rights-aligned AI practices. Read more on our blog.

Secureframe now supports MongoDB Atlas, a cloud-based database service that allows organizations to deploy, scale, and manage MongoDB databases without managing the underlying infrastructure.

This integration enables automated compliance testing for key areas including authentication, backup and availability, encryption, firewall rules, and logging and alerting.on this integration.

Learn more: MongoDB Atlas.

Secureframe also now integrates with Freshdesk, a customer support and ticketing platform. Similar to our Zendesk integration, Freshdesk supports bi-directional syncing and two key use cases:

1. Task Destination: Tasks and notifications from Secureframe can be synced directly into Freshdesk, with updates reflected in both systems. 2. Compliance Testing: Freshdesk tickets can now be used as automated evidence for compliance tests covering incidents, nonconformities, vulnerabilities, system changes, and user access, all aligned to SLAs.

This update eliminates the need to manually upload Freshdesk evidence and improves audit readiness for service-oriented teams.

Learn more: Freshdesk.

New features and updates

We’ve made major improvements to how vendor security reviews are created and managed in Secureframe. Review schedules are now more centralized and easier to configure, with all relevant inputs for frequency, question sets, requested documents, and vendor lists set at the review level instead of per vendor.

You can now specify “requested documents” during a review schedule, which prompts vendors to upload important items like a current SOC 2 report during the review cycle. Reviews now kick off automatically on their start date, and if an external question set or document is requested, a vendor portal will automatically be created and sent to the appropriate contact. These changes streamline vendor review management, reduce manual follow-up, and help ensure reviews happen on time.

Learn more: Vendor Risk Management (VRM) - Full Guide.

Secureframe now supports a wide range of third-party vulnerability scanning tools, allowing customers to strengthen their security posture while aligning with their existing tech stacks. New integrations include Rapid7 InsightVM, Tenable VMS, Qualys, Wiz, and Microsoft Defender, as well as two highly requested additions: Aikido and Snyk.

These integrations automate evidence collection for vulnerability scanning, code dependency testing, and static application security testing (SAST). As organizations mature their vulnerability management programs, many move beyond native solutions like AWS Inspector and adopt these best-in-class tools.

Learn more: Vulnerability Management.

We’ve redesigned the first-time login experience to remove common points of confusion and streamline onboarding for new users. Previously, welcome emails directed new users to a generic sign-up page with login options that may not have been enabled by their company, resulting in errors and password reset loops.

Now, users who enter via a welcome email are taken to a login page that only shows available authentication methods. Super Admins can set up SSO options like Google or Microsoft after logging in for the first time, ensuring proper permissions and reducing login failures.

Secureframe now integrates with Addigy, a leading Apple device management solution that supports remote monitoring and Apple Business Manager features. This integration enables automated compliance testing for hard drive encryption, firewall configuration, screen lock enforcement, and anti-malware on macOS devices.

Addigy has been one of the most requested integrations from customers managing Apple devices, and this update provides more complete endpoint visibility and control.

Find more details in this Helpdesk article.

Learn more: Addigy.

Archiving outdated policies just got easier. You can now use the bulk action bar on the updated Policies table to select and archive multiple policies at once. This is especially helpful for cleaning up legacy content and maintaining a tidy compliance environment..

Several updates across our federal compliance tools help simplify workflows and improve auditor readiness:

Secureframe now supports the C5 Controls Catalog, developed by Germany’s Federal Office for Information Security (BSI). C5 establishes a baseline for secure cloud services, combining internationally recognized standards like ISO 27001, COBIT, and CSA CCM with German regulatory requirements.

This update provides stronger support for organizations operating in the EU or selling to German public sector entities.

We’ve added spam filtering to Trust Center request forms to reduce noise and improve visibility into real requests. Suspicious submissions are now automatically flagged and archived with a “SPAM” label, helping teams focus on legitimate prospects and partner inquiries without manual review.

A new “Completed at” column has been added to the Vendor Review table, making it easier to track when a review was officially completed. This small but impactful addition improves auditability and helps teams monitor the timeliness of third-party risk management workflows.

Learn more: Vendor Risk Management (VRM) - Full Guide.

We’ve added pagination and navigation controls to the Policy Tests table, aligning it with the main Tests table. This update improves usability, especially for teams managing a large number of test-policy relationships, and brings a more consistent experience across the platform.

New features and updates

We’ve rolled out several updates to Secureframe Federal to make tracking and managing your CMMC compliance easier and more actionable:

Learn more: Understanding Your SPRS Score in Secureframe.

We’ve added support for Microsoft Sentinel, a cloud-native SIEM and SOAR solution built on Microsoft Azure. This integration helps organizations monitor, detect, and respond to security threats across their entire environment and enables evidence automation for key compliance areas such as security incidents, alerting, and threat detection. Microsoft Sentinel is the first integration in our new SIEM category, and an important step forward for customers operating in the federal space.

Learn more: Microsoft Sentinel.

With the release of MFA v2, Super Admins now have the ability to enable or disable multi-factor authentication (MFA) for any access role within the platform. MFA will continue to be enabled by default for Super Admins, Admins, and Auditors (as it was in MFA v1) but this update adds new flexibility to adjust MFA settings based on your organization’s needs.

Learn more: Multi-Factor Authentication (MFA).

We’ve launched a refreshed Data Room experience in early access, rebuilt with Castle components to improve usability and performance. The updated Data Room now supports sorting and filtering across uploaded evidence, making it easier to find what you need.

#### Real-time updates for Entra ID and Okta integrations

We’ve enhanced our Entra ID and Okta integrations to support real-time updates, improving the accuracy and speed of identity-related compliance checks.

For Entra ID users, no action is needed since real-time syncing is enabled automatically. For Okta users, two additional API scopes must be authorized to enable real-time functionality. If you choose not to update permissions, your Okta integration will continue to sync on its existing schedule. For step-by-step setup instructions, visit the Integration Page.

#### Check Point Quantum integration

Secureframe now integrates with Check Point Quantum, a next-generation network security platform designed to protect hybrid environments from Gen V cyber threats. Quantum combines advanced threat prevention (including SandBlast Zero‑Day protection), VPN, SD‑WAN, and centralized management to secure on-prem, cloud, data center, IoT, and remote-user traffic.

This integration supports evidence automation for tests related to firewall configuration and threat detection, helping you stay secure while simplifying compliance. Find more details on this new integration in our Helpdesk article.

#### Map existing tests to policies (early access)

We’ve introduced a faster, more intuitive way to map tests to your policies right from the Policies page. Early access users can now link tests to policies as part of the publish policy workflow, or by editing existing policies directly without navigating back and forth between the Policies and Tests pages. This update streamlines policy management and places test mapping within the context of policy publishing and editing.

Learn more: Data Room Overview.

New features and updates

We’re excited to launch the Secureframe MCP Server in public beta. This read-only Model Context Protocol server enables developer tools and AI assistants like ChatGPT, Claude, and Cursor to access Secureframe compliance data in real time using natural language prompts.

Whether you want to surface failing controls, identify high-risk vendors, or check compliance status across frameworks like SOC 2, ISO 27001, CMMC, or FedRAMP, the MCP Server makes it possible in seconds.

We’ve rolled out a refreshed sidebar experience for all users. Users can now navigate between modules even when the sidebar is collapsed. The new design is cleaner, more consistent, and makes everyday navigation easier and faster.

Secureframe now integrates with HubSpot, the widely used customer relationship management (CRM) platform. This integration allows Secureframe to scan HubSpot users and access data to support compliance-related requirements. It's one of the most requested integrations from our customers and adds another valuable connection to help centralize and automate your compliance program.

Learn more: Hubspot.

We’ve made important accessibility enhancements across key employee onboarding workflows, including policy acceptances and training assignments. These updates improve screen reader compatibility and keyboard navigation, making the platform more usable for all employees, especially those with accessibility needs. This is part of our continued effort to align with accessibility standards and provide an inclusive experience for every user.

Customers can now claim and verify domain ownership, enable single sign-on (SSO), and manage login restrictions , all through a self-service flow directly within the Secureframe platform.

Learn more: .

New features and updates

We’ve launched a powerful new feature to help compliance teams catch evidence issues before audits begin. AI Evidence Validation uses advanced AI to analyze uploaded files and metadata in real time, checking whether the document is correct for the control being tested and whether the timestamp falls within the required testing window.

This proactive approach helps teams avoid common issues like submitting the wrong file, referencing outdated documentation, or uploading incomplete evidence, which often lead to audit delays or findings. With AI Evidence Validation, organizations can improve audit outcomes, reduce exceptions, and accelerate their path to compliance.

Learn more: .

The Secureframe platform now supports the Fedramp 20x KSI framework out of the box. With the key security indicators for the Phase One pilot already mapped to pre-built controls and tests, you know exactly how to meet FedRAMP Low KSI requirements.

Secureframe is also proud to be working alongside Coalfire as part of the FedRAMP 20x pilot program. Developed to streamline compliance for cloud service providers, FedRAMP 20x aims to simplify the path to authorization while maintaining high security standards.

With our new OneSchema-powered experience, admins can now upload device data using a smart template that provides instant validation feedback and highlights any issues in the file before submission. This new system not only improves usability but also includes significant backend performance enhancements, making uploads faster and more reliable.

Learn more: .

Our Spring Design System Release focused on improving the form experience across the platform. We migrated all Checkbox and Radio components to our Castle component library, introduced a new form layout and updated design guidelines, and kicked off accessibility improvements with better focus states and keyboard navigation.

Admins now have access to a centralized Email Log to view all outbound communications from Secureframe to users and vendors, including onboarding invites, task notifications, and role changes. This searchable, filterable log provides visibility into delivery status and open history for messages sent on or after March 17, 2025.

Learn more: Email Logs.

We’ve released the first of several User Access Review (UAR) updates with a completely revamped Access Table. Built with Castle components, the new table is easier to navigate, filter, and search. We also removed the "SSO" column and temporarily removed the "Privileged" column as we refine how customers define privileged access in a meaningful way.

Secureframe now supports both Intune and Entra ID in GCC High environments, expanding our integrations for customers operating in Microsoft’s government cloud. These updates are essential for organizations pursuing FedRAMP or CMMC 2.0 compliance, offering deeper visibility and automation across identity and device management in secure environments.

Learn more: Government clouds (GCC High, GovCloud): what changes, common blockers, and what to collect for Support.

We’ve added two powerful new integrations to support modern development teams: Vercel and Supabase. Secureframe now scans projects in both platforms as cloud resources and automatically surfaces evidence for relevant compliance tests.

Learn more: Vercel and Supabase.

New features and updates

We now support CMMC Level 3, the most advanced and rigorous level of the maturity model framework. Level 3 includes 24 additional requirements beyond Level 2 and is designed for organizations handling the most sensitive controlled information.

This rounds out our support for the full CMMC 2.0 framework, making Secureframe the most comprehensive solution for organizations across the defense industrial base.

We’re proud to be the first platform to offer full support for GovRAMP, formerly known as StateRAMP. Secureframe now includes both GovRAMP Low and Moderate levels.

GovRAMP is built on the foundation of NIST 800-53, with significant overlap with both FedRAMP and TX-RAMP, making it a natural extension of the federal compliance frameworks many organizations are already familiar with. More than 28 states are currently participating in the GovRAMP program, and adoption continues to grow.

Secureframe now supports Azure Government Cloud connections, joining our existing support for AWS GovCloud. This integration allows you to sync resources from Azure Gov environments, helping meet strict CMMC 2.0 and FedRAMP requirements.

Customers in Microsoft 365 Government environments can now sign into Secureframe using Microsoft GCC High credentials. This update supports secure access and identity requirements for CMMC 2.0 and FedRAMP readiness.

Learn more: Government clouds (GCC High, GovCloud): what changes, common blockers, and what to collect for Support.

We’ve upgraded the Vendor Table to make it easier than ever to track vendor reviews. You can now view in-progress and upcoming reviews directly from the table, making it faster to stay on top of what’s next. Each review also displays the current assignee, so responsibilities are always clear. And for teams that prefer to tailor their workflow, the table still supports editing default columns and saving custom views for quick access to the information that matters most.

Learn more: Vendor Risk Management (VRM) - Full Guide.

We’ve overhauled the Personnel Details editing experience for better usability and consistency across the platform.

Learn more in our Help Center.

Learn more: Editing & Merging Personnel Records.

New features and updates

We’re excited to introduce the new Audit Module, built to make managing audits smoother than ever! With this release, you can:

This update helps streamline the entire audit process for both customers and auditors.

Learn more: Audits Module.

We’ve refreshed the Secureframe Dashboard with an updated design and a new Action Items widget that shows expiring evidence, upcoming reviews, task due dates, and more.

Learn more: Homepage: Charts, Action Items and Frameworks.

Our new Zendesk integration allows for bi-directional syncing, similar to our Jira integration. Use Zendesk as a task destination, with task updates flowing between systems. You can also sync Zendesk tickets to Secureframe for incident tracking, nonconformities, vulnerabilities, system changes, and user access, all mapped to your compliance tests.

Learn more: Zendesk.

We’ve replaced the old help menu with a new, streamlined Help Flyout designed to get you the support you need faster. Quickly access Secureframe Academy, the Get Started page, and reach out to our support team directly from the flyout.

Need more help? The "Email us" button now links directly to our Customer Success team.

We’ve added two new columns to the Personnel Table to support CMMC compliance:

These updates help customers meet CMMC's Access Control and Account Management requirements.

Learn more: Managing Personnel.

You can now import .doc and PDF files directly into the Security Questionnaires module, making it easier than ever to streamline the vendor review process.

Learn more: Getting started with Security Questionnaires.

To strengthen account security and meet compliance standards like CMMC, we’ve introduced new authentication and password policies:

Learn more: Integrations that pull Multi-factor Authentication (MFA) and Password Requirements and Security Policy.

Learn more: Integrations that pull Multi-factor Authentication (MFA) and Password Requirements and Security Policy.

We’ve updated our TISAX framework and Statement of Applicability (SOA) export to better align with the latest TISAX assessment requirements.

Two new columns have been added to the Policy Table:

Learn more in the Help Center

New features and updates

We’ve updated CMMC Level 1 & Level 2 frameworks to reflect the DoD’s final ruling. With CMMC compliance becoming mandatory for all DoD contracts in Q2 2025, Secureframe customers get immediate access to the finalized requirements, controls, and tests, ensuring a smooth transition as CMMC goes into effect.

We’ve expanded our DORA framework to include Technical Standards requirements and their associated control/test mappings. With DORA officially enacting these standards, Secureframe ensures your organization remains fully compliant and up to date with the latest financial sector regulations.

Secureframe now integrates with Microsoft Teams, making it easier to coordinate compliance tasks directly from your preferred communication platform. Create, post replies, and close out tasks in Secureframe, with real-time updates sent to the respective Teams channel. This new integration keeps compliance workflows streamlined and ensures your team stays on top of follow-up actions without leaving Microsoft Teams.

To enhance security and prevent spam, we’ve added CAPTCHA validation to all resource requests in the Secureframe Trust Center. CAPTCHA ensures only legitimate requests are submitted to help safeguard against bot-driven spam while maintaining a seamless experience for real users.

All new Secureframe Agent connections and builds for Windows are now digitally signed to enhance security and integrity. This update ensures that every Windows build of the Secureframe Agent is verified and protected, maintaining trust and security for our users.

You can now manually add individual personnel to Secureframe through a new modal without uploading a CSV, providing a faster, more convenient way to add one-off personnel, POCs, or admins without disrupting workflows.

New features and updates

We now support NIST 800-171 Revision 3, ensuring that customers can meet the most up-to-date compliance requirements. Given the significant updates in this revision, organizations may still be attested against the older Rev. 2 requirements, so we’ve made both available to help businesses transition seamlessly. No other compliance automation platforms currently support Rev. 3, giving Secureframe users a first-mover advantage in aligning with the latest federal security standards.

We’ve expanded our endpoint security integrations to automate compliance testing across more security tools:

These integrations reduce manual effort, ensuring devices meet compliance standards automatically. You'll find them under the Endpoint Security category in our Integrations library.

We’ve enhanced our Service Partner console for IT service providers and MSPs to improve transparency and efficiency. Instantly view what’s included in each subscription with clear packaging details and transparent pricing, and enjoy an intuitive, streamlined workflow for faster provisioning.

See the archive on the Product Updates page.