Bedrock CMMC Platform

Release notes for the hosted Bedrock CMMC platform — web application and API combined.

Release notes for the hosted platform, newest first. Each entry combines the web application and backend API releases that shipped together. Versions in parentheses are the deployed tags (application / API).

June 10, 2026 — Continuous monitoring accuracy

(app v1.2.8 / API v1.2.7)

Per-requirement monitoring frequencies — continuous-monitoring schedules now honor the frequency set on each individual requirement instead of a single package-wide cadence.
Review-anchored schedules — next-review dates are computed from the last completed review, and the web app and API now use identical date semantics, so day counts match everywhere they're shown.

May 28 – 31, 2026 — Partner administration and invitations

(app v1.2.4 – v1.2.7 / API v1.2.3 – v1.2.6)

Full organization administration for RP partner firms — partner admins can now edit their organization profile, manage team members, transfer ownership, and perform account recovery (password reset, MFA reset, account unlock) without contacting support.
Team-member invitations — RP partners can invite team members by email; invitees get a working activation page and clear status feedback throughout the flow. Fixed an email-encoding bug that could corrupt activation links in some mail clients.
Evidence upload hardening — uploads to evaluation sandboxes are correctly signed for server-side encryption, upload failures now surface the real error instead of a generic message, and long filenames no longer break the upload dialog.

May 11 – 20, 2026 — RP workspace and seamless sandbox conversion

(app v1.2.0 – v1.2.3 / API v1.2.0 – v1.2.2)

Sandbox-to-paid conversion is automatic — when a sandbox evaluator purchases a subscription, their sandbox organization converts in place: dedicated encrypted storage is provisioned, quotas lift to the purchased tier, and existing work carries over. No re-entry, no lost data.
RP owner role — every partner organization now has a designated owner with the ability to transfer ownership; owners can't be removed until ownership is transferred, preventing orphaned organizations.
RP workspace improvements — partner-shaped account settings, an observation dashboard for client engagements, and fixes for MFA status display and notification permissions for partner users.
Reliability — deleting a compliance package that had partner consultant access no longer fails.

April 8, 2026 — v1.1.0: CAP v2.0 assessment lifecycle

The largest release since launch, aligning the platform with the CMMC Assessment Process (CAP) v2.0.

For contractors (OSCs):

Assessment phase visibility — see exactly where your assessment is in the four-phase CAP lifecycle (Pre-Assessment → Assessment → Report → Close-Out), with days-in-phase and appeals/re-evaluation windows.
Readiness checklist — an interactive pre-assessment checklist (level-aware: 8 items for Level 2, 4 for Level 1) you work through with your assessment team.
Assessor messages — read comments your assessor team chooses to share with you, directly in the engagement view.
Certificate card — view your certificate status, dates, and POA&M close-out countdown once issued.
Richer controls table — SPRS point values, objectives-met counts, linked-evidence counts, and last-change dates on every control.
SSP evidence rendering — the System Security Plan view now renders linked policy and procedure evidence inline.

For assessors (C3PAOs):

Portfolio dashboard — KPI rollups across all engagements: at-risk engagements, QA reviews due, certificates expiring, POA&M close-outs due.
Conflict-of-interest register — disclosed conflicts block team assignment on affected engagements automatically.
Independent QA gates — assessments can't advance past pre-assessment until an independent reviewer (enforced: not on the assessment team) approves; final reports carry the same gate.
In-app notifications — phase advances, QA assignments, @mentions, and certificate issuance.

Platform: dependency security patches (including high-severity advisories in XML and utility libraries), Node.js 22 runtime, serialized deployments for safer rollouts.

March 25 – April 2, 2026 — v1.0.x: Initial release

v1.0.0 (March 25) — first production release of the Bedrock CMMC platform: compliance packages, the full CMMC Level 1/Level 2 controls catalog with 321 assessment objectives, evidence management, POA&Ms, asset inventory, SSP generation, and assessment engagements.
v1.0.1 – v1.0.4 — launch hardening: admin session timeout with idle detection, per-organization storage provisioning, evidence upload fixes, and SSP evidence mapping.