Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Version history

What’s new

Complass is continuously developed further. Here you can see the most important new features at a glance; customers find the detailed release notes in the portal.

  1. Version 2.0.4

    • New frameworks: NIST CSF 2.0, GPSR and NIST SSDF: Cybersecurity according to NIST, product safety under the GPSR and secure software development, with catalogue, templates and white paper.
    • Connectors for Qualys, Rapid7, Okta and more (beta): Findings, accounts and devices from Qualys, Rapid7, Okta, Splunk, Sentinel and Intune; nothing changes until you confirm.
    • NIS2 matched to your classification: Complass shows only the duties that apply to your classification, including for operators of critical facilities.

  2. Version 2.0

    • AWS and Azure: Connect AWS and Microsoft Azure with read rights as automatic evidence sources.
    • Dashboard and search: Arrange your dashboard yourself and find any page or action instantly with the new search.
    • Help on every page: Almost every page has its own help; the manual now describes all new functions.

  3. Version 1.92

    • Custom frameworks: Model your own framework with chapters and requirements and work with it like a standard module.
    • See relationships: A graph shows, for each risk, asset, measure or supplier, what it is connected to and where the gaps are.
    • New frameworks: SOC 2, the Swiss data protection act, four ISO standards and NIST are prepared and will be released step by step.

  4. Version 1.91

    • Evidence as a link: Store a link to SharePoint, OneDrive or your intranet instead of a file; it counts like an uploaded piece of evidence.
    • Templates to fill in offline: Every document is available as an empty Word template; the filled-in file is uploaded as the controlled version.
    • GitLab and Greenbone as evidence sources: Pipeline protection and scan status deliver evidence automatically, without Complass calling into your network.

  5. Version 1.90

    • IT-Grundschutz per target object: Modelling and check according to BSI IT-Grundschutz module by module, with implementation plan and reference documents.
    • Own learning blocks in the academy: Write short internal instructions with a quiz and assign them to your employees.
    • Reworked dashboard: Clearer tiles, management duties under § 38 BSIG and status proposals at a glance.

  6. Version 1.89

    • Six more languages (beta): The interface is now also available in French, Spanish, Italian, Dutch, Polish and Portuguese.
    • Register PDF with bookmarks: The document register as a PDF has bookmarks, a linked table of contents and clickable source links.
    • Adopt software from Intune: Programs detected by Intune can be adopted as the software of your devices on request.

  7. Version 1.88

    • ISO 27001 policy templates: Six new templates with fill-in guidance and sample text on assets, network, data protection, threat intelligence, projects and operations.
    • Domain check in the scorecard: The publicly visible configuration of the supplier domain feeds a small share into the overall scorecard value.
    • Withdrawal of product data: If a supplier withdraws an SBOM or VEX release, you receive a notification and see the affected assessments.

  8. Version 1.87

    • Approval of tasks: A second person accepts a finished task and approves it or returns it with a comment for rework.
    • Target risk: Alongside the residual risk, Complass shows the risk after all planned measures, and the risk owner approves it.
    • Internal audit programme: Internal audits are spread over the certification cycle, with audit plan, checklist and an overview of the audited chapters.

  9. Version 1.86

    • Annual programme: Complass shows the recurring duties of the year, suggests activities and ticks them off as soon as the evidence is there.
    • Incident exercises: Your team practises reporting in an emergency with realistic scenarios and timing, without creating a real incident.
    • Completing the management review: Management confirms the management review in person, and the state is filed as unchangeable evidence.

  10. Version 1.85

    • Licence reconciliation: The contract register compares licensed and used licences, including from Microsoft 365, and shows software without a contract.
    • Evidence connectors: Microsoft Entra ID, Microsoft 365 and GitHub deliver settings every day as automatic evidence with a traffic light.
    • Continuity strategies: For each process and scenario you record how operations continue and check the coverage against recovery time and emergency operation.

  11. Version 1.84

    • Objectives with status lights: Measurable objectives for ISO/IEC 27001 and ISO 22301 with target and status light, measured by Complass key figures if you wish.
    • Evidence from operations: Policies and procedures show the backup jobs, tests, emergency plans and assets that support them, also in every release.
    • Document pyramid as a tree: The document register shows the information security policy, policies, procedures and instructions as a tree, with open reconciliations.

  12. Version 1.83

    • Document hierarchy under ISO/IEC 27001: Policy, topic policies, procedures and instructions are linked; after a change above, Complass shows what needs reconciling below.
    • Auditor portal with sampling: Auditors work with one account for all customers, draw traceable samples and confirm the audit conclusion directly in Complass.
    • Slack app with buttons: Take over tasks and confirm acknowledgements directly in Slack, with your own rights and a note in the log.

  13. Version 1.82

    • Workspace for auditors: Auditors and your team work in one place: request list, evidence for this audit only, questions and a sealed handover package.
    • Linux distributions in vulnerability matching: For Debian, Ubuntu and Alpine backported fixes close findings automatically, AlmaLinux and Rocky Linux are marked for review.
    • New basic courses: Basic courses on working securely with machines and plants and on secure development bring your team to a common level quickly.

  14. Version 1.81

    • Asset connectors: Complass takes over your inventory regularly from NetBox, Snipe-IT, Intune, Lansweeper and OT tools, and you confirm new devices yourself.
    • ServiceNow and Slack: Measures and incidents become a ServiceNow ticket with one click, and important events appear in your Slack channel.
    • Policy library: One policy serves several frameworks at once: one version, one approval, one acknowledgement.

  15. Version 1.80

    • Logging and detection: Record your log sources and see which critical assets still have no logging.
    • Hardening comparison: Import results from common assessment tools and see for each asset how far it meets your hardening baseline.
    • Vulnerabilities by urgency: Every finding gets a clear decision with a reason, and actively exploited vulnerabilities get shorter deadlines.

  16. Version 1.79

    • Implementation guide per requirement: For NIS2, ISO/IEC 27001 and IEC 62443 every requirement shows goal, steps and evidence, and the steps become tasks directly.
    • Handling emergencies: Declare an emergency, alert the crisis team at once, tick off plan steps and file the emergency report as evidence.
    • Findings register: All findings from audits, control tests and incidents in one place, with the audit report as a PDF.

  17. Version 1.78

    • Product file for CE and the Cyber Resilience Act: The file for market surveillance and notified bodies for each product and version, with a completeness check.
    • Supply chain exchange: Manufacturers pass SBOM, VEX and security advisories for their products directly into their customers’ Complass.
    • Alerting by SMS and call: For reportable incidents Complass reaches your incident team at night too and escalates until someone confirms.

  18. Version 1.77

    • Certificates at a glance: All certificates with expiry and location, a warning before they expire and notes on outdated algorithms.
    • Backup and recovery: See for each asset whether backups meet the target, an offline copy exists and recovery has been tested.
    • Microsoft Teams and Jira: Notifications and approvals directly in Teams, measures as a Jira issue with one click and the status reported back.

  19. Version 1.76

    • Test reports and their findings: Record reports from penetration tests and audits, import findings and track them with deadline, owner and retest.
    • Reports as PowerPoint: Management report and reports on risks, vulnerabilities, audits and deadlines as ready-made slides for the management.

  20. Version 1.73

    • Customer questionnaires and trust center: Answer your customers' questionnaires from your controls and share evidence in a controlled way through a secret link.
    • Auditor access per audit: External auditors read only the projects of their audit, request evidence and lose access on the end date by themselves.
    • Liability evidence: A sealed PDF with a verification number and QR code documents that the management has met its duties; anyone can check its authenticity.

  21. Version 1.72

    • Group overview: All sites at a glance with status light, implementation, risks and incidents, plus reporting deadlines per company.
    • Control tests: Complass checks continuously and automatically whether your controls work and shows the result with its history.
    • Reporting security events: All employees report suspicious observations with one click, on the phone too; the team decides whether it becomes an incident.

  22. Version 1.69

    • Package recommendation in the check: The free applicability check now shows your minimum selection and a matching package, each module with its reason.
    • Vulnerability report form: A dedicated form accepts vulnerability reports about your products, with an acknowledgement of receipt, as the CRA expects.
    • TISAX from ISO 27001: Existing ISO 27001 work can be linked or taken over in the TISAX catalogue instead of recording everything again.

  23. Version 1.68

    • Whistleblower system: An internal reporting channel under the German Whistleblower Protection Act: employees report anonymously if they wish, Complass reminds of every deadline.
    • AI inventory: Record your AI systems in one register, classify them step by step under the AI Act and document AI literacy.
    • One incident, all reports: Several reporting tracks per incident, such as NIS2 to the BSI and CRA to ENISA, each with its own deadlines and prefilled report drafts.

  24. Version 1.67

    • New sidebar: Every area with its full name on the left, numbers for what is due and a search that jumps straight to pages and actions.
    • Employee access: Employees without a user seat read and acknowledge policies and complete training, signing in with a link sent to their email.
    • Step-by-step training: Each module guides you through lessons, exercise and module check, with images and a resume point where you left off.

  25. Version 1.65

    • TISAX bookable: The module for preparing the TISAX assessment, with a self-assessment along the VDA ISA and maturity levels, is now part of the offer.

  26. Version 1.63

    • 14 new whitepapers: Free guides to DORA, ISO 27001, IEC 62443, the Machinery Regulation, reporting duties, business continuity and more.

  27. Version 1.62

    • Contracts and licences: Licences, cloud subscriptions and maintenance contracts with deadlines, reminders and evidence in asset management.
    • AI risk class check in eight languages: The free AI Act check now guides you step by step to the classification of your AI system.
    • TISAX whitepaper: Labels, assessment levels and the path to the TISAX® label explained clearly.

  28. Version 1.59

    • Partners in the portal: Your consultant or IT service provider works directly in your portal with your approval, and you can end the access at any time.
    • Baseline protection in every plan: GDPR and AI Act are included in every plan and do not count as a framework.
    • Medical technology bundle: Cybersecurity for medical devices under the MDR and IVDR with vulnerabilities, SBOM and risk management in one bundle.

  29. Version 1.58

    • Supplier Management: Classify suppliers and request and review evidence directly from the supplier.
    • Emergency plans and exercises: Create emergency plans from the business impact analysis, evaluate exercises and print the emergency manual.
    • Free checks: Check CRA reporting deadlines and the AI risk class directly on the website, without signing in.

  30. Version 1.57

    • New framework DORA: For financial entities and their ICT service providers, guided step by step.
    • New framework cybersecurity for medical devices: For manufacturers and suppliers in medical technology under the MDR and IVDR.

  31. Version 1.56

    • Data breaches under the GDPR: Assess, report and document data breaches within the 72-hour deadline, also together with a NIS2 report.
    • Business continuity management (BCM): Business impact analysis per business process with tolerable downtimes and recovery objectives.

  32. Version 1.55

    • White paper for suppliers: How to answer many of your customers’ security questionnaires with one set of evidence.

  33. Version 1.54

    • New framework Radio Equipment Directive: Implement the cybersecurity of connected radio products with guidance, up to the transition to the Cyber Resilience Act.

  34. Version 1.53

    • New framework Data Act: Implement data access for connected products with guidance.
    • New framework KRITIS umbrella act: Physical resilience of critical facilities, from applicability to reporting.

  35. Version 1.52

    • Interfaces for your systems: API and webhooks based on an open standard, with developer documentation directly in the portal.

  36. Version 1.51

    • GDPR: Implement data protection verifiably, integrated with the ISMS.
    • AI Act: Record and classify AI systems and demonstrate your obligations as deployer or provider.
    • IEC 62443 for all roles: For asset owners, integrators and manufacturers.

  37. Version 1.40

    • Applicability check: Find out in five steps which frameworks apply to you, with a roadmap in one click.

  38. Version 1.36

    • Management cockpit under Section 38 BSIG: Resolution, oversight and training of the management in one place, with evidence as a PDF.

  39. Version 1.33

    • Tamper-proof customer log: Changes in the portal remain completely and immutably traceable.

  40. Version 1.29

    • Management report at the push of a button: Key figures over time and a PDF for the management.

  41. Version 1.28

    • All deadlines in one place: Every deadline on one page, optionally as a subscription in your own calendar.

  42. Version 1.27

    • Reminders: Expiring evidence and recurring tasks remind you in good time.

  43. Version 1.25

    • Four-eyes principle for risk acceptance: High risks only count as accepted once a second person agrees.

  44. Version 1.24

    • Approve and version the SoA: Approve the Statement of Applicability using the four-eyes principle and file it as Word and PDF.

  45. Version 1.23

    • Audit findings with effectiveness check: Nonconformities only close once their effectiveness is proven.

  46. Version 1.17

    • Introduction per framework: Background, who is affected, the path to conformity and typical pitfalls on one page.

  47. Version 1.12

    • Frameworks in your language: All frameworks and the official EU texts in eight languages.

  48. Version 1.9

    • Complass in eight languages: Portal, help, website and emails in each person’s language.

  49. Version 1.7

    • Audit package for auditors: All documents for an audit as a ZIP file, exactly according to permissions.

  50. Version 1.5

    • Manuals: User and administrator manual with click paths, online and as a PDF.

  51. Version 1.4

    • Sign-in with company account and passkeys: Your team signs in with its usual company account or without any password.

  52. Version 1.3

    • Asset inventory and vendor advisories: Record assets in IT and OT networks and match them automatically against the vendors’ security advisories.

  53. Version 1.2

    • SBOM: Software bills of materials in CycloneDX and SPDX, for example for the Cyber Resilience Act.

  54. Version 1.1

    • Work together: Live in the same view with colleagues, auditors or consultants.

  55. Version 1.0

    • MITRE ATT&CK for IT and OT: See which real attack techniques your measures cover and where gaps remain.

  56. Version 0.9

    • Document control according to ISO/IEC 27001: Versions, four-eyes approval, review date and acknowledgement directly in the portal.

  57. Version 0.8

    • Risk management: Assess and treat risks qualitatively or in euros, with a heat map.

  58. Version 0.4

    • Vulnerability management: Automatically detect and prioritise known vulnerabilities in your assets.

  59. Version 0.2

    • Asset and incident management: Manage assets, evidence and incidents, with the reporting deadlines under NIS2 and the CRA.

  60. Version 0.1

    • Launch of Complass: Guided implementation of the key frameworks with templates, gap analysis and action plan.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo