New in fullCircle: December 2025

New frameworks, built on the work you've done

December introduced Framework Deployment, a guided way to add frameworks that reuses the controls and evidence you already have. Service accounts give every integration its own API keys, and new locks keep signed-off risks and tasks from drifting.

This month you can:

01Deploy a new framework on top of your existing program
02Give every integration its own identity
03Lock risks and tasks once they're signed off

+ 5 more improvements

ControlsPlatformRisk

01Controls

Deploy a new framework on top of your existing program

Adding a framework shouldn't mean rebuilding your program. Framework Deployment walks you through it. Pick frameworks and scopes, choose pre-configured controls with recommended descriptions and mappings, and approve every change. You see how much you'll reuse before anything is created.

Guided steps: select, scope, configure, approve controls, approve evidence, deploy

Pre-configured controls and evidence from risk3sixty's library

Coverage before and after, with reused controls, reused evidence and hours saved

Replaced evidence keeps its files, owners, comments and scopes

Explore Compliance Management

Managers and Admins can deploy frameworks.

02Platform

Give every integration its own identity

Settings

Org Users

Create Service Account

User ListModule PermissionsService Accounts

NameStatusLast UsedAPI Keys

Jira syncPushes task status to JiraActive12 min ago1

Evidence exporterNightly evidence export for the data lakeActive3 hours ago2

AI agentMCP access for the security team's agentActiveJust now1

KeyCreatedLast Used

••••••••••••7f3a9cDec 3, 2025Just now

Sends the x-r3s-key header to the API and MCP ServerGenerate Key

Integrations that borrow a person's login break when that person leaves, and nobody can tell which system did what. Admins can now create service accounts with their own module access and API keys. API and MCP automations then run under an identity you control and can audit.

Service accounts with their own name, description and module access

Generate API keys, with created and last-used dates for each

Keys work with the REST API and the MCP Server

Explore the platform

Admins manage service accounts.

03Risk

Lock risks and tasks once they're signed off

NNORTHWIND

Risk Management

Security Risk Register

SearchJRAK fullCircle AICC

DashboardRegisterHeat MapReports

IDRisk StatementInherentResidualAccept.Treatment

R-12Access ControlUnauthorized access via stale accounts2066Mitigate

R-07Third PartyCritical vendor data breach2048Transfer

R-19OperationsRansomware disrupts production1588Mitigate

Linked: IAM-4 · IAM-9 · TPRM-23 tasks · 2 controls

Inherent risk

1207190322ImpactLikelihood

An accepted risk or a finished task shouldn't change without anyone noticing. Managers and Admins can now lock risks and tasks, making them read-only for everyone else. Subtasks follow their parent's lock.

A lock on risk and task side cards

Locked records are read-only for everyone else

Subtasks follow their parent's lock

Managers can still assign owners

Explore Risk Management