Version history
What’s new
Complass is continuously developed further. Here you can see the most important new features at a glance; customers find the detailed release notes in the portal.
-
Version 2.37
- Meles guides you to a decision, in eight languages: Meles takes your choice of plan to the configurator with one click and now answers in eight languages.
- Orders from outside the EU: Companies outside the EU order Complass through the order form, and we check the order before accepting it.
- Become a partner: A dedicated link in the menu leads straight to the partner request.
-
Version 2.36
- Meles, your website assistant: Meles explains Complass, follows you across pages and links straight to the matching answer.
- New pricing page: All plans side by side, with a clear recommendation and the terms in plain words.
-
Version 2.34
- Prices at a glance: The plan prices are now openly shown on the website, with no request and no detour.
- New focus pages: Industry, OT security and product compliance show how Complass helps in these areas.
Earlier improvements by topic
Frameworks and catalogues
- Whistleblower system under the HinSchG, 26 bookable frameworks: The whistleblower protection framework is now bookable and described on the website.
- Eight more frameworks: nDSG, EU GMP Annex 11, 21 CFR Part 11, EnWG, GPSR and three NIST frameworks can now be booked, each with templates.
- Applicability check for Austria, Czechia and Spain: The check assesses NIS2 under the act of your state with classification and deadlines, for Spain under the directive for now.
- New frameworks: NIST CSF 2.0, GPSR and NIST SSDF: Cybersecurity according to NIST, product safety under the GPSR and secure software development, with catalogue, templates and white paper.
- NIS2 matched to your classification: Complass shows only the duties that apply to your classification, including for operators of critical facilities.
- Custom frameworks: Model your own framework with chapters and requirements and work with it like a standard module.
- New frameworks: SOC 2, the Swiss data protection act, four ISO standards and NIST are prepared and will be released step by step.
- Templates to fill in offline: Every document is available as an empty Word template; the filled-in file is uploaded as the controlled version.
- IT-Grundschutz per target object: Modelling and check according to BSI IT-Grundschutz module by module, with implementation plan and reference documents.
- ISO 27001 policy templates: Six new templates with fill-in guidance and sample text on assets, network, data protection, threat intelligence, projects and operations.
- Document pyramid as a tree: The document register shows the information security policy, policies, procedures and instructions as a tree, with open reconciliations.
- Document hierarchy under ISO/IEC 27001: Policy, topic policies, procedures and instructions are linked; after a change above, Complass shows what needs reconciling below.
- Policy library: One policy serves several frameworks at once: one version, one approval, one acknowledgement.
- Implementation guide per requirement: For NIS2, ISO/IEC 27001 and IEC 62443 every requirement shows goal, steps and evidence, and the steps become tasks directly.
- Product file for CE and the Cyber Resilience Act: The file for market surveillance and notified bodies for each product and version, with a completeness check.
- TISAX from ISO 27001: Existing ISO 27001 work can be linked or taken over in the TISAX catalogue instead of recording everything again.
- Whistleblower system: An internal reporting channel under the German Whistleblower Protection Act: employees report anonymously if they wish, Complass reminds of every deadline.
- AI inventory: Record your AI systems in one register, classify them step by step under the AI Act and document AI literacy.
- TISAX bookable: The module for preparing the TISAX assessment, with a self-assessment along the VDA ISA and maturity levels, is now part of the offer.
- 14 new whitepapers: Free guides to DORA, ISO 27001, IEC 62443, the Machinery Regulation, reporting duties, business continuity and more.
- TISAX whitepaper: Labels, assessment levels and the path to the TISAX® label explained clearly.
- Medical technology bundle: Cybersecurity for medical devices under the MDR and IVDR with vulnerabilities, SBOM and risk management in one bundle.
- New framework DORA: For financial entities and their ICT service providers, guided step by step.
- New framework cybersecurity for medical devices: For manufacturers and suppliers in medical technology under the MDR and IVDR.
- Data breaches under the GDPR: Assess, report and document data breaches within the 72-hour deadline, also together with a NIS2 report.
- White paper for suppliers: How to answer many of your customers’ security questionnaires with one set of evidence.
- New framework Radio Equipment Directive: Implement the cybersecurity of connected radio products with guidance, up to the transition to the Cyber Resilience Act.
- New framework Data Act: Implement data access for connected products with guidance.
- New framework KRITIS umbrella act: Physical resilience of critical facilities, from applicability to reporting.
- GDPR: Implement data protection verifiably, integrated with the ISMS.
- AI Act: Record and classify AI systems and demonstrate your obligations as deployer or provider.
- IEC 62443 for all roles: For asset owners, integrators and manufacturers.
- Applicability check: Find out in five steps which frameworks apply to you, with a roadmap in one click.
- Management cockpit under Section 38 BSIG: Resolution, oversight and training of the management in one place, with evidence as a PDF.
- Approve and version the SoA: Approve the Statement of Applicability using the four-eyes principle and file it as Word and PDF.
- Introduction per framework: Background, who is affected, the path to conformity and typical pitfalls on one page.
- Frameworks in your language: All frameworks and the official EU texts in eight languages.
- SBOM: Software bills of materials in CycloneDX and SPDX, for example for the Cyber Resilience Act.
- MITRE ATT&CK for IT and OT: See which real attack techniques your measures cover and where gaps remain.
- Document control according to ISO/IEC 27001: Versions, four-eyes approval, review date and acknowledgement directly in the portal.
Connections and imports
- More control tests from connections: Complass checks further controls directly from the data of your connected systems; tasks are created only by you.
- Entra ID sync under control: Conflicts can be ignored deliberately, access of deactivated people is blocked.
- Users from Entra ID: People in your Entra ID groups get access automatically with role and site, and leavers lose it.
- Import from Excel or CSV: Take over control state and policies from a file, with a preview of the errors per row.
- Connectors for Qualys, Rapid7, Okta and more (beta): Findings, accounts and devices from Qualys, Rapid7, Okta, Splunk, Sentinel and Intune; nothing changes until you confirm.
- AWS and Azure: Connect AWS and Microsoft Azure with read rights as automatic evidence sources.
- Evidence as a link: Store a link to SharePoint, OneDrive or your intranet instead of a file; it counts like an uploaded piece of evidence.
- GitLab and Greenbone as evidence sources: Pipeline protection and scan status deliver evidence automatically, without Complass calling into your network.
- Adopt software from Intune: Programs detected by Intune can be adopted as the software of your devices on request.
- Evidence connectors: Microsoft Entra ID, Microsoft 365 and GitHub deliver settings every day as automatic evidence with a traffic light.
- Slack app with buttons: Take over tasks and confirm acknowledgements directly in Slack, with your own rights and a note in the log.
- Asset connectors: Complass takes over your inventory regularly from NetBox, Snipe-IT, Intune, Lansweeper and OT tools, and you confirm new devices yourself.
- ServiceNow and Slack: Measures and incidents become a ServiceNow ticket with one click, and important events appear in your Slack channel.
- Microsoft Teams and Jira: Notifications and approvals directly in Teams, measures as a Jira issue with one click and the status reported back.
- Interfaces for your systems: API and webhooks based on an open standard, with developer documentation directly in the portal.
Security and operations
- Training for IT operations, incident response and procurement: NIS2 role courses with case examples, exercises and model solutions.
- Control audits and exceptions register: Recurring manual audits per control with result and evidence; exceptions with four-eyes approval, second factor and expiry date.
- ISMS context and risk types: Interested parties, issues, obligations and ISMS roles as registers; risk types with threat and vulnerability catalogues to import.
- Domain check in the scorecard: The publicly visible configuration of the supplier domain feeds a small share into the overall scorecard value.
- Withdrawal of product data: If a supplier withdraws an SBOM or VEX release, you receive a notification and see the affected assessments.
- Approval of tasks: A second person accepts a finished task and approves it or returns it with a comment for rework.
- Target risk: Alongside the residual risk, Complass shows the risk after all planned measures, and the risk owner approves it.
- Internal audit programme: Internal audits are spread over the certification cycle, with audit plan, checklist and an overview of the audited chapters.
- Incident exercises: Your team practises reporting in an emergency with realistic scenarios and timing, without creating a real incident.
- Continuity strategies: For each process and scenario you record how operations continue and check the coverage against recovery time and emergency operation.
- Evidence from operations: Policies and procedures show the backup jobs, tests, emergency plans and assets that support them, also in every release.
- Auditor portal with sampling: Auditors work with one account for all customers, draw traceable samples and confirm the audit conclusion directly in Complass.
- Workspace for auditors: Auditors and your team work in one place: request list, evidence for this audit only, questions and a sealed handover package.
- Linux distributions in vulnerability matching: For Debian, Ubuntu and Alpine backported fixes close findings automatically, AlmaLinux and Rocky Linux are marked for review.
- Logging and detection: Record your log sources and see which critical assets still have no logging.
- Hardening comparison: Import results from common assessment tools and see for each asset how far it meets your hardening baseline.
- Vulnerabilities by urgency: Every finding gets a clear decision with a reason, and actively exploited vulnerabilities get shorter deadlines.
- Handling emergencies: Declare an emergency, alert the crisis team at once, tick off plan steps and file the emergency report as evidence.
- Findings register: All findings from audits, control tests and incidents in one place, with the audit report as a PDF.
- Supply chain exchange: Manufacturers pass SBOM, VEX and security advisories for their products directly into their customers’ Complass.
- Alerting by SMS and call: For reportable incidents Complass reaches your incident team at night too and escalates until someone confirms.
- Certificates at a glance: All certificates with expiry and location, a warning before they expire and notes on outdated algorithms.
- Backup and recovery: See for each asset whether backups meet the target, an offline copy exists and recovery has been tested.
- Test reports and their findings: Record reports from penetration tests and audits, import findings and track them with deadline, owner and retest.
- Customer questionnaires and trust center: Answer your customers' questionnaires from your controls and share evidence in a controlled way through a secret link.
- Auditor access per audit: External auditors read only the projects of their audit, request evidence and lose access on the end date by themselves.
- Management duties record: A sealed PDF with a verification number shows what is documented on resolutions, oversight and training of the management; no release from liability.
- Control tests: Complass checks continuously and automatically whether your controls work and shows the result with its history.
- Reporting security events: All employees report suspicious observations with one click, on the phone too; the team decides whether it becomes an incident.
- Vulnerability report form: A dedicated form accepts vulnerability reports about your products, with an acknowledgement of receipt, as the CRA expects.
- One incident, all reports: Several reporting tracks per incident, such as NIS2 to the BSI and CRA to ENISA, each with its own deadlines and prefilled report drafts.
- AI risk class check in eight languages: The free AI Act check now guides you step by step to the classification of your AI system.
- Supplier Management: Classify suppliers and request and review evidence directly from the supplier.
- Emergency plans and exercises: Create emergency plans from the business impact analysis, evaluate exercises and print the emergency manual.
- Business continuity management (BCM): Business impact analysis per business process with tolerable downtimes and recovery objectives.
- Tamper-proof customer log: Changes in the portal remain completely and immutably traceable.
- Four-eyes principle for risk acceptance: High risks only count as accepted once a second person agrees.
- Audit findings with effectiveness check: Nonconformities only close once their effectiveness is proven.
- Audit package for auditors: All documents for an audit as a ZIP file, exactly according to permissions.
- Sign-in with company account and passkeys: Your team signs in with its usual company account or without any password.
- Risk management: Assess and treat risks qualitatively or in euros, with a heat map.
- Vulnerability management: Automatically detect and prioritise known vulnerabilities in your assets.
- Asset and incident management: Manage assets, evidence and incidents, with the reporting deadlines under NIS2 and the CRA.
Usage and reports
- New home page: The home page now shows step by step how Complass makes your everyday compliance work easier.
- Automation page: A new page shows which work Complass takes off your hands and what stays with you.
- AI in Complass: A new page explains where AI supports you in Complass and where the decision stays with you.
- New packages: Risk management is now included from the Start package up, and what each package includes is clearly separated.
- Rule check in projects: Complass shows gaps such as missing evidence or expired deadlines, without your data leaving the platform.
- Data arrives automatically: Assets, vulnerabilities and evidence arrive automatically from your systems, you decide.
- Threat briefing: Current advisories from authorities and your own feeds, matched against your devices.
- Revised basic courses: Awareness, data protection, AI, OT and software development with handouts and code examples.
- Tiered prices for single seats: The price per training seat now depends on the course and the quantity.
- New look in the portal: Sign-in, forms and portal have a clearer design that matches the website.
- New website design: The website is clearer, tidier and easier to read on every device.
- Revised courses: Case examples, matching exercises and model solutions make the Academy courses more practical.
- Training with proof: Employees learn in short lessons with exercises and check questions, and you prove their participation for audits.
- All integrations in one place: You see your ticket, chat, inventory and identity tools on one page, with their status and a direct way to set them up.
- Notice on sign-in from a new country: When someone signs in from a country not seen before, the person and your administrators automatically receive a notice.
- Conclude the DPA online: You conclude the data processing agreement online when you start the trial or order, without paper or sending e-mails.
- Notifications in Mattermost: Notifications now also reach the channels of your own Mattermost server, just like Slack and Teams.
- Documents as OpenDocument (ODT): Download documents, reports and audit packages in the open ODT format too, for example for LibreOffice.
- Findings close themselves: Hosts on which the scanner no longer finds anything close their old findings automatically (Qualys, Rapid7).
- Uniform time values: API, webhooks and exports deliver instants uniformly in UTC, unambiguous for every analysis and tool.
- Group requirements per site: Head office sets requirements once, every site documents how it implements them, deviations run as exceptions.
- New zone map: Zones and conduits under IEC 62443 at a glance: target security level and gap per zone, conduits with their code, also on the phone.
- Exceptions per site: Assign exceptions to a site: site teams see only what concerns them, and approval stays central.
- Your own time zone: Dates, times, deadlines and "due today" follow your time zone, including reports, exports and reminders.
- NIST Cybersecurity Framework 2.0 (CSF): Profile, target profile, tier and action plan, linked to NIS2, IEC 62443 and ISO 27001.
- Remote maintenance access register: Approve, time-limit and regularly review service provider accesses, with evidence for the audit.
- Own infrastructure in Germany: Since version 2.06 Complass runs on its own infrastructure at Hetzner in Germany, with encrypted data and logs kept separately.
- Dashboard and search: Arrange your dashboard yourself and find any page or action instantly with the new search.
- Help on every page: Almost every page has its own help; the manual now describes all new functions.
- See relationships: A graph shows, for each risk, asset, measure or supplier, what it is connected to and where the gaps are.
- Own learning blocks in the academy: Write short internal instructions with a quiz and assign them to your employees.
- Reworked dashboard: Clearer tiles, management duties under § 38 BSIG and status proposals at a glance.
- Six more languages (beta): The interface is now also available in French, Spanish, Italian, Dutch, Polish and Portuguese.
- Register PDF with bookmarks: The document register as a PDF has bookmarks, a linked table of contents and clickable source links.
- Annual programme: Complass shows the recurring duties of the year, suggests activities and ticks them off as soon as the evidence is there.
- Completing the management review: Management confirms the management review in person, and the state is filed as unchangeable evidence.
- Licence reconciliation: The contract register compares licensed and used licences, including from Microsoft 365, and shows software without a contract.
- Objectives with status lights: Measurable objectives for ISO/IEC 27001 and ISO 22301 with target and status light, measured by Complass key figures if you wish.
- New basic courses: Basic courses on working securely with machines and plants and on secure development bring your team to a common level quickly.
- Reports as PowerPoint: Management report and reports on risks, vulnerabilities, audits and deadlines as ready-made slides for the management.
- Group overview: All sites at a glance with status light, implementation, risks and incidents, plus reporting deadlines per company.
- Package recommendation in the check: The free applicability check now shows your minimum selection and a matching package, each module with its reason.
- New sidebar: Every area with its full name on the left, numbers for what is due and a search that jumps straight to pages and actions.
- Employee access: Employees without a user seat read and acknowledge policies and complete training, signing in with a link sent to their email.
- Step-by-step training: Each module guides you through lessons, exercise and module check, with images and a resume point where you left off.
- Contracts and licences: Licences, cloud subscriptions and maintenance contracts with deadlines, reminders and evidence in asset management.
- Partners in the portal: Your consultant or IT service provider works directly in your portal with your approval, and you can end the access at any time.
- Baseline protection in every plan: GDPR and AI Act are included in every plan and do not count as a framework.
- Free checks: Check CRA reporting deadlines and the AI risk class directly on the website, without signing in.
- Management report at the push of a button: Key figures over time and a PDF for the management.
- All deadlines in one place: Every deadline on one page, optionally as a subscription in your own calendar.
- Reminders: Expiring evidence and recurring tasks remind you in good time.
- Complass in eight languages: Portal, help, website and emails in each person’s language.
- Manuals: User and administrator manual with click paths, online and as a PDF.
- Asset inventory and vendor advisories: Record assets in IT and OT networks and match them automatically against the vendors’ security advisories.
- Work together: Live in the same view with colleagues, auditors or consultants.
- Launch of Complass: Guided implementation of the key frameworks with templates, gap analysis and action plan.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.