When doing a bulk upload of documents (screenshots, workpapers, etc.) via a compressed zip archive using the bulk upload functionality, users should be able to automatically associate documents with requirement statements and PRISMA levels (e.g., policy) using a defined folder structure within the archive.

The folder structure can be something like this:

-- domain
--- requirement statement ID
---- policy
---- process
---- implemented
---- measured
---- managed

Documents present in these folders would be (a) uploaded, (b) associated with the requirement statement, and (c) tagged to the PRISMA levels

When a user belonging to an Assessment's Assessor is assigned a subscriber role, a warning message should be thrown to the user setting the permission that this user will not be allowed to do any validation work if this role is assigned.

MyCSF will automatically delete the draft report files 7 days after the final reports are posted.

QA times should be reservation-based instead of the current first come, first served model.

Currently we cannot identify the control category for a particular control requirement. Subscribers who opt only for 3 month CSF subscription without reporting functionality, we cannot identify the control category. It would be helpful if the control category is included like other details like - Control unique ID, Level and illustrative procedures.

Can we add an enhancement to add the control reference to the requirement statements layout. Like the below. People have a hard time of telling what the requirements are related to without the name. Example is the constant confusion on 09.x and 09.y controls. They are all e-commerce and online transaction but some of them do not have either of those terms within the statement so people think it is just a standalone control.

09.x Electronic Commerce Services
!1579275197061-0.png!

Assign individual users to a milestone and notify of approaching milestone completion date. This would enhance the functionality of the CAP module to include milestone approach date.

Provide assessors the ability to revert entire domains back to clients- even if the feature was only available when the status of the domain is "assessor review pending". This would avoid needing to request HITRUST to revert domains if clients accidentally hit submit too early.

The general documents view should allow the user to sort the documents by date uploaded, by document title, and by document description.

HITRUST should create a feature to allow inheritance by domain/control rather than the whole assessment being returned for a single control/domain inheritance request.

Capability that allows a user to submit a reverted Question to their External Assessor without waiting for the Domain and/or Assessment to be completed.

Ability to handle authentication and user administration leveraging company's LDAP or AD

The system shall allow Internal Inheritance from any CSF Version.

In QA, currently the system only allows you to apply Internal Inheritance on an Assessment Statement if both Assessment's has the same CSF Version. The system should allow you to apply the inheritance if the CSF Version is different- like External Inheritance.

• Name fields on the external assessor timesheet should be drop-downs pre-populated with all of the assessor’s users who have access to that object (with the option to still manually type in a name if not in MyCSF).


• When selected, the CCSFP numbers should auto-populate as well.

When you enter your password Google Chrome gives a dialog to save your password which users may or may not choose to do. In addition the way MyCSF is coded it prompts to save one time two factor codes and it should be disabled as there is no reason to save that code ever.

The document replace functionality should also replace document's name (not just document's contents). Right now it appears to replace the document contents but leaves the old document name.

Add spellcheck functionality.