On 29th January 2026, we will be making some changes to the standardised control framework within Risk Ledger.
We do this periodically so that the framework stays relevant, useful and practical for all users of the Risk Ledger platform.
All changes will be handled automatically within the platform and marked clearly with a full audit history kept within your activity feed.
This page gives you a summary of the changes that are coming. If you’d like to see the exact changes that will be made ahead of the release date, please send us a message and we can provide this in spreadsheet format.
As a client, what do you need to do?
There is nothing you need to do immediately. You can continue using Risk Ledger in exactly the same way as before. Once the changes are in place, you may wish to do the following:
Engage with your suppliers who haven't yet updated or confirmed their answers to modified control questions or answered the new control question. Suppliers will be required to confirm their answers to modified control questions and answer the new control question during their six-monthly re-assessment. If you’d like them to confirm or update answers before this date, you will need to prompt them by sending a discussion.
What’s changed?
Added three controls from the Data Protection domain to the Small Framework.
Added controls (E13 and E14) to assess a supplier’s ability to demonstrate the provenance of any software they develop.
Added controls (K3 and K4) to assess whether suppliers have guardrails in place to mitigate potential adverse effects stemming from the use of any automated-decision making technologies.
Added a control (F33) to assess whether a supplier receives threat intelligence from the National Cyber Security Centre (NCSC)’s Early Warning programme.
Updated PCI DSS controls to capture the date of the last Attestation of Compliance and to clarify the documentation needed as evidence. Updated the scoping question to better reflect the applicability of PCI DSS for suppliers.
Updated control E5 to capture a supplier’s approach to incorporating threat modelling throughout the software development lifecycle.
Updated several questions and descriptions to align with industry best practices on writing styles.
Updated several questions and descriptions to improve grammar and clarity.
Deprecated control D15 regarding Windows Autorun.