On 28th August 2025, we will be making some changes to the standardised control framework within Risk Ledger.
We do this periodically so that the framework stays relevant, useful and practical for all users of the Risk Ledger platform.
All changes will be handled automatically within the platform and marked clearly with a full audit history kept within your activity feed.
This page gives you a summary of the changes that are coming. If you’d like to see the exact changes that will be made ahead of the release date, please send us a message and we can provide this in spreadsheet format.
As a client, what do you need to do?
There is nothing you need to do immediately. You can continue using Risk Ledger in exactly the same way as before. Once the changes are in place, you may wish to do the following:
Engage with your suppliers who haven't yet updated or confirmed their answers to modified control questions or answered the new control question. Suppliers will be required to confirm their answers to modified control questions and answer the new control question during their six-monthly re-assessment. If you’d like them to confirm or update answers before this date, you will need to prompt them by sending a discussion.
What’s changing?
Updating a few small grammatical changes from current questions and descriptions.
Updating descriptions of two certification controls to request specific documentation as evidence:
Statement of Applicability for ISO 270001 (only if appropriate - often this is only provided to the auditor).
For PCI compliance: Attestation of Compliance (AOC), Report on Compliance (ROC), and the Responsibility Matrix.
Updating the MFA control question (D6) to ensure it includes customer-facing applications, especially now that suppliers can list multiple products on their Risk Ledger profile.
Updating D23-27: moving away from specifically targetting laptops to instead covering all endpoints (laptops, mobile phones, tablets, etc.). Breaking this down to organisation-issued devices and BYOD.
Simplifying scoping questions to help suppliers when first completing their profile.
Adding a new control question (K1) about AI Policy, in response to developments in AI risk governance standards.