ProvePrivacy platform release 10.1 is now live. It brings a substantial upgrade to GRC risk management software capability in preparation for a larger upgrade in the coming months. We have added root cause analysis, residual risk assessments, in-app notifications, enhanced e-learning course management and improved security.
This article explains what has changed, who it affects and what to expect next.
What is new in ProvePrivacy platform 10.1?
Release 10.1 combines adds platform announcements, so you can see in-app when something needs your attention, this will also include broadcast messages from ProvePrivacy to users. The GRC upgrade improves risk history, adds root cause analysis and audit trail, adds FOI redaction, and hardens security across risk, breach and controls areas.
What does the GRC upgrade bring to risk management?
Risk records now keep a proper history of score changes, covering both inherent and residual risk, so past values are preserved rather than overwritten. A new Risk Assessments area on each risk record shows that history and allows a reassessment to be logged with a reason.
An optional external reference field lets a risk be tied to a record in another system, for example your external Group system. Risk matrix labels, such as probability and impact, can now be customised in settings to match how your organisation talks about risk internally, so if you refer to likelihood instead of probability or want to change risk boundaries a customer admin can now change this from within settings
How does root cause analysis work across Breach, FOI and Rights?
Root cause analysis is a shared panel used across Breach, FOI and Rights incidents to record contributing causes, it replaces the old ‘risk’ tab with findings, these can link to actions, controls and risks. If you want record what went wrong either with the event of handling the event you can capture the concerns and of course analyse in the Reporting Center.
A new Taxonomy area in settings lets administrators manage cause categories, with editing rights restricted to protect consistency across the organisation.
What new settings and platform wide features are available?
We have added several settings areas and platform wide foundations:
- Risk settings for the organisation risk matrix and wider GRC configuration.
- Taxonomy settings for RCA cause categories, viewable by the DPO with full editing mainly reserved for the Company Admin.
- Rights settings to manage outcome categories, including renaming, merging and retiring them.
- A notification centre, with a bell icon in the header, an unread count and a list of notifications that can be marked read or dismissed.
- An audit trail that records who did what and when for important GRC changes, including before and after detail.
FOI also gains proper redaction and File Centre support, matching the equivalent functionality already available in Rights.
How does the E-Learning in ProvePrivacy work?
All ProvePrivacy clients can now take advantage of three e-learning courses, data protection, cyber security and AI in the workplace are included n your subscription for all staff. Organisations can now be placed on an E-Learning suite with an expiry date. We have also launched an additional subscription e-learning suite adding a further 43 compliance related courses. You can set mandatory courses for all staff and schedule them to repeat at your pre-determined annual schedule. ProvePrivacy will also automatically add new users to your mandatory schedule making managing e-learning simple.
What security and usability improvements are included?
A body of security hardening work tightens checks. Forms that change data across risk, breach, controls and other GRC routes now carry CSRF protection by default, and a series of fixes closed gaps, which blocked access some users should have had but were blocked from.
Taxonomy settings are now visible to the DPO rather than Department Managers, a broken data sharing assessment link has been removed, and the redaction credit notification no longer points to a missing page. A number of smaller fixes cover header and logo alignment, plus improvements to the quiz and learning dashboard.
What changed on the admin site?
| Area | Before 10.1 | From 10.1 |
|---|---|---|
| Notifications | No way to message users platform wide | Broadcast notifications area to write, send, review and retract announcements |
| E-learning | Manual assignment of Awareness courses per user | Mandatory on join flag, with automatic assignment and backfill |
| E-learning suite | One training course | Three courses as standard, 46 courses available through additional subscription. |
| Question bank | Small question pool | Each course can select from 25 questions |
| Risk | Scores overwritten on change | Full history of inherent and residual score changes |
| Incidents | Separate approaches per area | Shared root cause analysis panel across Breach, FOI and Rights |
What was planned for this release but has not shipped yet?
Some GRC groundwork exists where we are planning to grow ProvePrivacy into a full GRC system this will include a findings inbox, an organisation wide control library, RCSA campaigns, KRI and KCI metric dashboards. None of these have a working product yet, so they are not yet visible in settings, risk screens or menus. They remain in development for a future release.
Frequently asked questions
What is ProvePrivacy platform release 10.1? Release 10.1 is a release which adds platform announcements and mandatory Awareness training on join, and a major GRC upgrade to risk history, root cause analysis, settings, notifications, audit and security.
Who can send a platform announcement? ProvePrivacy staff write and send platform announcements from the admin site. They reach active users in normal organisations, excluding Learning Only accounts, and can be retracted if sent by mistake.
Do mandatory Awareness courses apply to staff who already work at the organisation? Yes. When a course is switched to mandatory on join, existing users in that organisation who do not already have it are backfilled automatically, following the course’s own schedule.
What is root cause analysis in ProvePrivacy platform? Root cause analysis is a shared panel used across Breach, FOI and Rights to record contributing causes, findings, and links to related actions, controls and risks, giving a consistent view of why incidents happen.
When will features such as RCSA campaigns or KRI and KCI dashboards be available? These were part of the wider GRC plan but have not shipped in 9.3. They remain in development, and ProvePrivacy will confirm timing in a future release.
