Overview:

Population Evidence Requirement

Auditors can no longer accept evidence solely at the population level — evidence accepted on a population request is now required to flow into individual sample requests, ensuring every sample has verifiable, traceable evidence and the three-way reconciliation workflow remains intact
This closes a gap where evidence could be "parked" at the population level for small populations, bypassing sample-level review and creating traceability issues in the final report

Non-Occurrence Attestation Workflow

Clients can now formally attest to a non-occurrence population through a structured attestation modal, replacing informal comments with a legally defensible, auditable submission that flows directly into the auditor's review queue
The attestation requires both a signed checkbox and a written rationale before submission, and locks sample generation only after all assigned services have accepted — preventing split-state populations and ensuring full auditor consensus before closing out the workflow

AI Citations — Iteration 2

A rebuilt citations experience is now available in A-SCEND, improving how AI-generated analysis references specific passages within uploaded evidence files, making it faster for auditors to verify AI findings and trace conclusions back to source material

A-LYX Chatbot Enhancements

A set of targeted improvements to the A-LYX chatbot are included in this release, addressing accuracy, context handling, and overall reliability for auditors using the AI assistant during engagements

Editable Criteria for Custom Controls

Auditors can now add or remove criteria on a custom control after it has been created, directly from the control details sidebar under 'services, criteria' eliminating the need to delete and rebuild a control from scratch when the scope of criteria changes mid-engagement

User Role Included in User List Export

The Role field is now included when exporting the Users list, giving GRC and access review teams the data they need to identify privileged accounts without having to cross-reference the UI manually

Vanta — Real-Time Evidence Ingestion via Webhook

Vanta evidence is now delivered to A-SCEND in near real-time via webhook, replacing the previous hourly cron-based sync — reducing evidence availability delays and eliminating the rate limit issues that could occur during large scheduled pulls
This will also allow evidence to be pulled in from Vanta's new 'IRL Experience' if the requests are linked to controls in Vanta.

MyCSF — Custom Request CVID Support

The MyCSF evidence push now recognizes CVIDs associated with custom requests, not just template requests — resolving an issue where files tied to custom requests appeared as having no CVIDs available and could not be sent to HITRUST
This will also allow for i1 and r2 services using custom IRL's to utilize the feature

Salesforce Engagement Status Sync

A-SCEND now pushes a daily snapshot of request status counts to Mulesoft, flowing through to Salesforce — giving account teams visibility into engagement progress without leaving Salesforce

FedRAMP 20x — New Audit Services

A-SCEND now supports FedRAMP 20x Class A, Class B, and Class C as distinct audit service types

AEC Report Mapping for FedRAMP 20x and rev 5

AEC reports across AWS, Azure, and GCP are now mapped to FedRAMP 20x KSI-based requests and NIST 800-53 rev 5 requests, giving CSPs and auditors immediate visibility into how many requests their connected integrations can satisfy before fieldwork begins

Federal User Data Isolation

PostHog analytics events and Novu/SendGrid notification sends are now suppressed for all users on federal engagements, ensuring no behavioral or notification data flows to third-party services for federal users

Performance & Table Improvements

Data tables across A-SCEND have been updated with AG Grid improvements, including optimized loading — making large engagement datasets faster and easier to work with

v.7.8.26

Related to

July 2026 What's new in A-SCEND