Recommend addition of "Add More" or "Click Here to Add" alongside the + symbol for Looped Questions.
Currently it's not very clear that the user needs to click on the + symbol and instructions need to be added to the description field.
These instructions can disappear/may not always be visible depending on the amount of information entered by the respondent.
Hailey's evidence validation capability is being extended into the Custom Registers architecture, starting with the Tests and Evidence registers. With richer context available -- test definitions, linked controls, framework mappings, and connected organisational data -- Hailey can validate evidence the way an experienced auditor would, not just check that something was submitted.
The capability is designed around three personas: control owners who define requirements, evidence submitters who respond to tasks, and evaluators who review submissions.
Key Components:
Benefits:
Example use case:
A systems administrator is assigned a task to provide evidence for a quarterly privileged access review. They ask Hailey what to submit and receive specific guidance. They upload a PAM export -- Hailey flags that it covers 47 accounts but the linked asset register shows 112 systems in scope. The administrator uploads a second export to address the gap. Hailey confirms coverage and the task is submitted. The evaluator receives the submission with the full validation history attached and can review with confidence, without performing a manual first-pass quality check.
Introduce a richer, more informative way to view and act on linked data across custom registers. This work replaces the current pill-based display with card-style linked data views and introduces Hailey-assisted mapping recommendations that proactively suggest relevant linkages based on a register item's data and context without requiring users to manually trigger or configure anything.
Key Components:
Benefits:
Example Use Case: A control owner is reviewing a control for MFA configuration. Rather than manually hunting for relevant evidence and deciding which tests it applies to, Hailey analyses the available evidence -- an exported Azure AD report confirming MFA enforcement across all privileged accounts -- and recommends linking it to the relevant test. The control owner reviews the recommendation and confirms the linkage. Related objects are displayed in a clear card-style panel alongside the control, giving immediate context without navigating away from the screen.
Controls are the central object in 6clicks' compliance data model -- everything connects to and from them: evidence, tests, tasks, framework provisions, assets, and systems. This feature rebuilds the Controls module on the same Custom Registers architecture used across the platform, placing controls at the heart of a connected compliance data model and unlocking capabilities that were not possible with the legacy module.
Teams can migrate on their own timeline. The legacy Controls module remains fully functional during the transition, and migration is opt-in and customer-controlled.
Key Components:
Benefits:
Example use case:
A security team at a critical infrastructure operator manages compliance across ISM, Essential Eight, and SOCI simultaneously. After migrating to the new Controls Register, they discover that 40% of their controls map to provisions across more than one framework. Assessments now propagate automatically, eliminating the duplicate effort of re-assessing the same control three times. When a new SOCI obligation is mapped to an existing ISM control, compliance status flows through immediately with no additional assessment work. The control record surfaces a consolidated Hailey validation summary across all linked evidence and tests, giving the compliance manager a single view of what has been validated, what is outstanding, and what was submitted through automated integrations versus manual task workflows.
The review process for QBAs often occurs outside the platform, leading to fragmented communication and limited visibility. This feature enables users to complete the entire QBA review phase within 6clicks.
Users can add question-level comments to provide context or feedback, assign comments to drive accountability, and receive notifications when they are mentioned or assigned. Comments can also be marked as resolved to track progress and maintain a clear audit trail.
This creates a centralized, transparent, and efficient review experience for QBAs, reducing reliance on external tools.
During a Third-Party Risk QBA, a reviewer flags an incomplete response to a data protection question and assigns a comment to the vendor owner. The owner receives a notification, updates the response with clarification, and the reviewer marks the comment as resolved—keeping the entire discussion tracked within the QBA.
The review process for RBAs currently happens outside 6clicks, leading to fragmented communication and limited visibility. This feature enables users to complete the entire RBA review phase within the platform.
Users can add requirement-level comments to provide context or feedback, assign comments to drive accountability, and receive notifications when they are mentioned or assigned. Comments can also be marked as resolved to track progress and maintain a clear audit trail.
This creates a centralized, transparent, and efficient review experience for RBAs, reducing reliance on external tools.
During an ISO 27001 RBA, a reviewer flags a vague response to an access control requirement and adds a comment, assigning it to the IT owner. The IT owner receives a notification, provides clarification, and attaches supporting details. Once reviewed, the comment is marked as resolved, maintaining a clear audit trail within the RBA.
Hello
I’m experiencing an issue with importing controls within a control set in 6clicks. We have custom fields configured, but when I download or view the controls import template, the custom fields are not included (they appear correctly in other modules—for example, the risks import).
Additionally, if I manually add the relevant custom field columns to the import file, 6clicks does not import/populate those fields.
Please find attached the template file I’m trying to import for your review.
Could you please advise how we can import custom fields for controls within a control set, or confirm if there are any limitations/settings required for this functionality?
Description: Introduce a way to download multiple files at once. This would eliminate the need to download individual files and improving efficiency during audits and reviews.
Key Components:
Benefits:
Saves significant time by enabling users to download all evidence in one go
Enhances audit and review efficiency through faster access to supporting documentation
Introduce an out-of-the-box Tasks Register that centralizes all tasks across a Spoke into a single register. This enhancement brings full register capabilities—visibility, configuration, permissions, and linking—to tasks, while preserving existing task IDs and behaviors. Tasks remain generated from other content (e.g., Risks, Controls etc) and are automatically reflected in the Tasks Register for consistent tracking and governance.
Extend the existing Requirement-Based Assessment (RBA) capability beyond frameworks and control sets to custom registers. This enhancement allows users to initiate RBAs directly against one or more items from a selected custom register, collecting structured assessment data while maintaining strong linkage between register items and assessment outcomes.
Hi, our vendors have been responding to the assessments we send to them and increasingly are sending me emails to ensure I received their responses as they aren't sure if it submitted. I would like to request that a big sign pops up to say "Your Assessment has been Submitted" once the respondent hits submit. Thanks!
As part of our ongoing efforts to enhance performance and stability across the Analytics module, we are decommissioning the legacy Risk reports and replacing them with new, optimized versions.
These legacy reports have been identified as key contributors to performance bottlenecks, occasionally causing the analytics environment to slow down or temporarily stall. The new reports are optimized for performance and scalability, ensuring a faster and more stable user experience across all tenants.
Key Improvements
Faster load times: New reports load 20–30% faster than before. Improved stability: Reduces the likelihood of slowdowns or timeouts when viewing Risk data. Enhanced data model: Includes linked entities and relationships from Risks to other modules. Better user experience: Streamlined design and improved consistency across dashboards.
Enhance the user experience across registers and assessments by enabling advanced search and filter capabilities based on linked data. This feature allows users to quickly find, segment, and analyze items that are connected to other records
Key Components:
Benefits:
Build a Content Library feature to house pre-built workflow recipe templates, enabling customers to quickly implement common risk workflow automations without building integrations from scratch. This repository provides tested, ready-to-use recipes for standard integration scenarios across Risk, Risk Treatment Plans, and Risk Assessments modules, reducing implementation time and accelerating adoption.
Key Components:
Benefits:
Example Use Case: A compliance manager wants to automatically notify stakeholders when high-severity risks are identified, but lacks technical expertise to build custom recipes from scratch. They access the Content Library, browse available templates, and select the "High-Risk Alert to Slack" recipe. With one click, the recipe imports into their workflow workspace with pre-configured triggers and actions. They simply authenticate their Slack workspace, customize the notification message, and activate the recipe. Within 10 minutes, their automated risk alerting workflow is live—a process that would have taken days of manual configuration and testing.
We need more flexibility in communications to provide relevant details so the end user understands the importance of the email. The current communication is generic and only has a unique URL. Only after clicking on the URL does the user understand their required actions.
Enhance the Hub Administration experience with new capabilities that streamline advisor and user management across the Hub-and-Spoke environment. This feature empowers Hub admins to centrally manage advisors, assign them to Spokes (even if they don’t yet have access), and gain full visibility of users across all Spokes, improving oversight and operational efficiency.
Key Components:
Benefits:
Description: Introduce a modernized evidence management experience with the ability to **view attachments directly in the browser. This enhancement streamlines how users interact with evidence across requirements, assessments, and registers, and improving efficiency during audits and reviews.
Key Components:
Benefits:
Description: Introduce advanced workflow capabilities across registers, enabling structured escalations, exception handling, and approval flows. This feature brings greater automation and governance by defining how items move through stages, who approves changes, and how exceptions or overdue actions are escalated to the right stakeholders.
Key Components:
Benefits:
Description: Expand the Risk Forms capability to provide richer field context and improved communication. This enhancement introduces support for placeholder and description text on form fields, enables matrix field display on forms, and allows submitters to include their email address for acknowledgment or follow-up. Together, these improvements enhance the clarity, usability, and traceability of submitted risks.
Key Components:
Benefits:
Example Use Case: An organization publishes a public risk form for employees to report potential security risks. Each field now includes a short description explaining what to enter, and a risk rating matrix helps the submitter assess impact and likelihood. Before submitting, the user provides their email address to receive a confirmation and to enable follow-up from the risk owner.
Restructure the user permissions architecture to provide granular control over risk review access across multiple platform areas. This enhancement introduces dedicated Risk Review permissions under the My Tasks group, decouples Risk Review module access from the general Risk permissions, and converts obsolete risk review permissions into active, granular controls. The update addresses current inconsistencies where obsolete permissions still control access and the Risk Review module incorrectly uses general Risk permissions instead of dedicated review-specific permissions.
Key Components:
Benefits:
Example Use Case: A compliance officer needs to conduct periodic risk reviews and document findings in My Tasks, but shouldn't have access to view all organizational risks or modify risk data. With the new permission structure, the administrator can grant "Risk Review - View/Edit" permission under My Tasks without providing general Risk module access. The user can see assigned risk reviews in My Tasks, access them through the Type filter, complete their review work, while maintaining appropriate access boundaries. Meanwhile, a risk analyst with full Risk module permissions can still be restricted from deleting completed risk reviews by only granting View/Edit permissions for Risk Reviews.
Issues self-service view enables users to build on-demand reports from the Issues register data inside the 6clicks app. It delivers preconfigured and custom views that power a broad range of reporting needs for the Issues module and provides a dashboard with key metrics for quick insight and monitoring.
A compliance lead filters the Issues register to open high-severity items owned by their team, groups by category, and exports a monthly summary with trend charts from the dashboard to share in the governance meeting.
The ability to manage the risk module fully independent from the Hub.
This should give the ability to not only manage flows, risk assessment labels, risk assessments, risk fields, including disabling fields that have been established at the hub level.
Description: Introduce the ability to consolidate results from multiple assessments into a single aggregated report. Users can select multiple source assessments (QBAs/RBAs), roll up their control requirements into a unified RBA, and generate paginated, pixel-perfect reports that preserve unique fields and references from each source.
Key Components:
Benefits:
Example Use Case: An assessor selects three separate RBAs that cover different operational domains. Using the merge capability, they generate a consolidated report where all control requirements are rolled up and reported together. The resulting Word report is paginated, pixel-perfect, and retains references back to each source assessment, providing a single comprehensive view.
Description: Introduce a structured QA review workflow within RBA assessments, enabling organizations to enforce quality checks before assessments are finalized. This feature provides a formalized review stage where compliance managers or designated reviewers can validate responses, evidence, and overall completeness, ensuring higher confidence in assessment outputs.
Key Components:
Benefits: