Content Release Change Log - Security Questionnaire

Listed below are the notable Content Releases (CR) and the resulting changes made to the CyberGRX Security Questionnaire for each. 

CR #	Change	Date
CR 22	Business Resiliency Questions added to Control Family 2.6	Q1 2019
CR 26	Maturity Questions moved from Control Family level to Control Group level	Q1 2020
CR 27	Section A and B content additions	Q2 2020
CR 28	Privacy Control Group added and GDPR Control Group Removed	Q3 2020
CR 30	Content and syntax refresh Evidence Validation process change: Tier 1 validation occurs only at sub control level and metrics are no longer validated	Jan 25, 2021
CR 31	Content syntax changes	Apr 14, 2021
CR 33	10 additional critical controls were added to Evidence Validation selection (increasing from 50 to 60)	Jun 23, 2021
CR 34	Content syntax changes Static list of critical controls for Evidence Evaluation (applies to Tier 1 & 2) Updated Service Agreement for all existing and new customers	Jul 12, 2021
CR 35	Updated 4.7.3.1 from Human Capital Training to Security Staff Training Pri.1.2.1 spelling mistake in timeliness 3.5.6.1 Coverage and 3.5.6.2 Coverage both had a bug on <25% option where it displayed blank. Updated Vendor Agreement	Oct 12, 2021
CR36	An audit of the last five content releases resulting in many wording updates.	Oct 29, 2021
CR37	Three new sub-controls:    2.3.4.2 - Baseline Performance and Capacity Levels   3.8.2.6 - Environmental Controls   3.8.3.6 - Physical Security Controls Metric answer updates:   PRI.1.2.1 Timeliness - modified answer text   4.1.4.2 Strength - added ‘None’ answer option   4.1.4.2 Timeliness - modified answer text   4.1.4.2 Coverage - added ‘Data Records’ answer option	Nov 11, 2021
CR38	1.1.3.1.Strength: added clarity to answer options 1.1.4.1.Coverage: added clarity to answer options 1.2.1: Removed 'and budget' since budget is covered in 1.2.2 1.3.4.1.Strength: added clarity to an answer option 3.1.2.1.Coverage: Simplified terminology in a few answer options 2.4.2.1.Strength: Aligned answer option wording 2.6.2.1: Aligned wording to be business continuity plan, removed acronym BCP, removed all instances of contingency 2.6.3.1: Aligned wording to be business continuity plan, removed acronym BCP, removed all instances of contingency 2.6.4.1: Aligned wording to be business continuity plan, removed acronym BCP, removed all instances of contingency Replaced preventive with preventative to align with the rest of the questionnaire.	Jan 07, 2022
CR39	Number: 2.5.2.1.Strength Name: Strength: Incident Investigations and Forensics Added answer option: Could snapshots, distributed copies Number: 3.2.1.3.Coverage Name: Security Awareness Training Removed answer option: Secure traveler training Number: 3.2.2.2.Coverage Name: Coverage: Customer Activity Monitoring Added answer option: Data storage location Number: 3.3.3.4.Coverage Name: Coverage: Access De-Provisioning Process Added answer option: Cloud accounts Number: 3.6.1.1.Strength Name: Strength: Desktop and Laptop Protection Added answer option: Configuration for hybrid or cloud only environments Number: 3.6.1.4.Strength Name: Strength: Secure Browsing Added answer option: Configuration for hybrid or cloud only environments Number: 3.6.2.1.Strength Name: Strength: Server Hardening Standard Added answer option: Configuration for hybrid or cloud only environments Number: 3.6.4.2.Strength Name: Strength: Mobile Application Management (MAM) Capabilities Added answer option: Configuration for hybrid or cloud only environments Number: 3.6.4.1.Strength Name: Strength: Mobile Device Management (MDM) Capabilities Added answer option: Configuration for hybrid or cloud only environments Number: 4.1.3.1.Strength Name: Strength: Asset Inventory and Use Added answer option: Cloud buckets Number: 4.1.3.1.Coverage Name: Coverage: Asset Inventory and Use Added answer option: Cloud accounts and buckets Number: 4.2.3.1.Coverage Name: Coverage: Configuration Change Alerting Added answer option: Cloud accounts and buckets	Jun 21, 2022
CR40	2.5.2.1.Strength answer option word misspelling correction: CR39 has Could snapshots, distributed copies and correction is Cloud snapshots, distributed copies 4.7.4.1.Timeliness answer option word change: Changed from How long have most security staff... To How long have most junior security staff... 3.3.2.7.Timeliness answer options word change: No defined period is now No defined period or less than 5 minutes and < 15 minutes is now 5-15 minutes Added new control 2.5.5 around security incident response.	Aug 4, 2022
NA	Business Background Section B: Cyber Security question section removed from Assessment	Aug 30, 2022
CR41	Updated wording in "evidence and technology examples" provided during evidence collection phase of the Validation Workflow. No changes to controls content.	Oct 13, 2022